ansible: monitoring with Prometheus, Loki and Grafana

Nothing watched the servers: tonight's asxpio crash loop was found by
hand. On asxpio-ops, Prometheus (30 days), Loki (14 days) and Grafana
at gf.asxp.io (WireGuard only), with blackbox_exporter probing every
service from outside and postgres_exporter. On both hosts node_exporter
and cAdvisor on the VPC address, and Alloy shipping container logs, the
journal and Traefik's access log to Loki over the VPC.

Traefik and Forgejo expose their metrics; restic and the bucket replica
record their last success for node_exporter. Dashboards: an overview as
home, plus hosts, containers, Traefik, probes, Postgres and logs.
Alerts by email to me@asxp.io: host or service down, certificate under
14 days, disk or memory nearly full, a container restart-looping,
Postgres down, backup or replica stale.

Assisted-by: Claude:opus-5-5

ansible/roles/monitoring_agent/tasks/main.yaml

@@ -0,0 +1,22 @@
+---
+# node_exporter, cAdvisor and Alloy on every host. Metrics listen on the
+# host's VPC address only; Alloy ships Docker logs and the journal to Loki
+# on asxpio-ops over the VPC.
+- name: Create the node_exporter textfile directory
+  ansible.builtin.file:
+    path: "{{ monitoring_textfile_dir }}"
+    state: directory
+    mode: "0755"
+
+- name: Deploy the monitoring agents
+  ansible.builtin.include_role:
+    name: docker_service
+  vars:
+    service_name: monitoring-agent
+    service_base_path: "{{ services_base_path }}/monitoring-agent"
+    service_templates:
+      - { src: docker-compose.yml.j2, dest: docker-compose.yml }
+      - { src: config.alloy.j2, dest: config.alloy }
+    health_check_enabled: true
+    health_check_host: "{{ vpc_ip }}"
+    health_check_port: "{{ monitoring_node_exporter_port }}"