unbound(role): fix unbound prometheus exporter install on debian

- download debian image from github und verify checksum
- setup systemd service unit

roles/unbound/files/prometheus-unbound-exporter.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Prometheus exporter for Unbound metrics, written in Go with pluggable metric collectors. The metrics exporter converts Unbound metric names to Prometheus metric names and labels by using a set of regular expressions.
+Documentation=https://github.com/letsencrypt/unbound_exporter
+After=network.target
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/prometheus-unbound-exporter.conf
+ExecStart=/bin/unbound_exporter ${UNBOUND_EXPORTER_ARGS}
+
+[Install]
+WantedBy=multi-user.target

roles/unbound/tasks/main.yml

@@ -31,13 +31,6 @@
         group: unbound
         mode: u=rw,g=r,o=r
 
-    - name: ensure unbound is running and enabled
-      become: true
-      ansible.builtin.systemd:
-        name: unbound.service
-        state: started
-        enabled: true
-
     - name: disable systemd-resolved
       when: unbound_disable_systemd_networkd
       ansible.builtin.include_role:
@@ -47,6 +40,13 @@
         deploy_systemd_resolved_config__dns:
           - 127.0.0.1
 
+    - name: ensure unbound is running and enabled
+      become: true
+      ansible.builtin.systemd:
+        name: unbound.service
+        state: started
+        enabled: true
+
     - name: install and configure prometheus-exporter for unbound
       ansible.builtin.import_tasks: prometheus-exporter.yml
       when: unbound_install_prometheus_exporter

roles/unbound/tasks/prometheus-exporter.yml

@@ -1,8 +1,48 @@
 ---
-- name: install unbound prometheus exporter # FIXME: there is no prometheus-unbound-exporter in debian .deb exists in https://github.com/letsencrypt/unbound_exporter/releases/tag/v0.6.0
+- name: install unbound prometheus exporter
   become: true
-  ansible.builtin.package:
+  vars:
-    name: prometheus-unbound-exporter
+    prometheus_unbound_exporter_version: "0.6.0"
+    prometheus_unbound_exporter_filename: "unbound_exporter-v{{ prometheus_unbound_exporter_version }}.x86_64.deb"
+    prometheus_unbound_exporter_github_api_url: "https://api.github.com/repos/letsencrypt/unbound_exporter/releases/tags/v{{ prometheus_unbound_exporter_version }}"
+  block:
+    - name: request github api
+      ansible.builtin.uri:
+        url: "{{ prometheus_unbound_exporter_github_api_url }}"
+        method: GET
+        body_format: json
+        headers:
+          'Accept': 'application/vnd.github+json'
+      register: unbound_exporter_github_api_result
+
+    - name: get prometheus-unbound-exporter download url and digest
+      ansible.builtin.set_fact:
+        unbound_exporter_download_url: "{{ unbound_exporter_github_api_result.json.assets[0].browser_download_url }}"
+        unbound_exporter_download_digest: "{{ unbound_exporter_github_api_result.json.assets[0].digest }}"
+
+    - name: Download prometheus-unbound-exporter deb package with verified checksum
+      ansible.builtin.get_url:
+        url: "{{ unbound_exporter_download_url }}"
+        dest: "/tmp/{{ prometheus_unbound_exporter_filename }}"
+        checksum: "{{ unbound_exporter_download_digest }}"
+        mode: "u=r,g=r,o=r"
+
+    - name: Install prometheus-unbound-exporter deb package
+      become: true
+      ansible.builtin.apt:
+        deb: "/tmp/{{ prometheus_unbound_exporter_filename }}"
+        state: present
+      notify: prometheus-unbound-exporter.restarted
+
+- name: deploy prometheus-unbound-exporter systemd service
+  become: true
+  ansible.builtin.copy:
+    src: "prometheus-unbound-exporter.service"
+    dest: "/etc/systemd/system/prometheus-unbound-exporter.service"
+    owner: root
+    group: root
+    mode: '0644'
+  notify: systemd-daemon-reload
 
 - name: enable unbound prometheus exporter
   become: true
@@ -14,10 +54,10 @@
 - name: configure unbound exporter
   become: true
   ansible.builtin.copy:
-    dest: /etc/conf.d/prometheus-unbound-exporter
+    dest: /etc/prometheus-unbound-exporter.conf
     content: |
-      UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound-control.sock"
+      UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound.ctl"
     owner: root
     group: root
-    mode: '0660'
+    mode: '0644'
   notify: prometheus-unbound-exporter.restarted