unbound(role): fix unbound prometheus exporter install on debian

- download debian image from github und verify checksum
- setup systemd service unit

roles/unbound/tasks/prometheus-exporter.yml

@@ -1,8 +1,48 @@
 ---
-- name: install unbound prometheus exporter # FIXME: there is no prometheus-unbound-exporter in debian .deb exists in https://github.com/letsencrypt/unbound_exporter/releases/tag/v0.6.0
+- name: install unbound prometheus exporter
   become: true
-  ansible.builtin.package:
-    name: prometheus-unbound-exporter
+  vars:
+    prometheus_unbound_exporter_version: "0.6.0"
+    prometheus_unbound_exporter_filename: "unbound_exporter-v{{ prometheus_unbound_exporter_version }}.x86_64.deb"
+    prometheus_unbound_exporter_github_api_url: "https://api.github.com/repos/letsencrypt/unbound_exporter/releases/tags/v{{ prometheus_unbound_exporter_version }}"
+  block:
+    - name: request github api
+      ansible.builtin.uri:
+        url: "{{ prometheus_unbound_exporter_github_api_url }}"
+        method: GET
+        body_format: json
+        headers:
+          'Accept': 'application/vnd.github+json'
+      register: unbound_exporter_github_api_result
+
+    - name: get prometheus-unbound-exporter download url and digest
+      ansible.builtin.set_fact:
+        unbound_exporter_download_url: "{{ unbound_exporter_github_api_result.json.assets[0].browser_download_url }}"
+        unbound_exporter_download_digest: "{{ unbound_exporter_github_api_result.json.assets[0].digest }}"
+
+    - name: Download prometheus-unbound-exporter deb package with verified checksum
+      ansible.builtin.get_url:
+        url: "{{ unbound_exporter_download_url }}"
+        dest: "/tmp/{{ prometheus_unbound_exporter_filename }}"
+        checksum: "{{ unbound_exporter_download_digest }}"
+        mode: "u=r,g=r,o=r"
+
+    - name: Install prometheus-unbound-exporter deb package
+      become: true
+      ansible.builtin.apt:
+        deb: "/tmp/{{ prometheus_unbound_exporter_filename }}"
+        state: present
+      notify: prometheus-unbound-exporter.restarted
+
+- name: deploy prometheus-unbound-exporter systemd service
+  become: true
+  ansible.builtin.copy:
+    src: "prometheus-unbound-exporter.service"
+    dest: "/etc/systemd/system/prometheus-unbound-exporter.service"
+    owner: root
+    group: root
+    mode: '0644'
+  notify: systemd-daemon-reload
 
 - name: enable unbound prometheus exporter
   become: true
@@ -14,10 +54,10 @@
 - name: configure unbound exporter
   become: true
   ansible.builtin.copy:
-    dest: /etc/conf.d/prometheus-unbound-exporter
+    dest: /etc/prometheus-unbound-exporter.conf
     content: |
-      UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound-control.sock"
+      UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound.ctl"
     owner: root
     group: root
-    mode: '0660'
+    mode: '0644'
   notify: prometheus-unbound-exporter.restarted