#
# Ansible managed
#

[Unit]
Description=Prometheus Node Exporter
After=network-online.target

[Service]
Type=simple
User=node_exporter
Group=node_exporter
ExecStart=/usr/local/bin/node_exporter \
    '--collector.disable-defaults' \
    '--collector.conntrack' \
    '--collector.cpu' \
'--collector.diskstats' \
    '--collector.diskstats.device-exclude=^(nbd|ram|loop|fd)[0-9]*$' \
'--collector.filesystem' \
    '--collector.filesystem.fs-types-exclude=^(tmpfs|nfs4|autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$' \
    '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|run)($|/)' \
    '--collector.loadavg' \
    '--collector.mdadm' \
    '--collector.meminfo' \
    '--collector.netstat' \
'--collector.netdev' \
    '--collector.netdev.device-exclude=^((teql|sit|tun|docker|usb)[0-9]+|(br(-|q)|veth|tap)[0-9a-f-]+|lo).*$' \
    '--collector.os' \
    '--collector.stat' \
'--collector.systemd' \
    '--collector.systemd.unit-include=^(atd|cgrulesengd|cron|rsyslog|ndn-procwatch|redis-accessproxy|logchomper).*' \
    '--collector.hwmon' \
    '--collector.timex' \
    '--collector.zfs' \
    '--web.listen-address=0.0.0.0:9100' \
    '--web.telemetry-path=/metrics'

SyslogIdentifier=node_exporter
Restart=always
RestartSec=1
StartLimitInterval=0

ProtectHome=read-only
NoNewPrivileges=yes

ProtectSystem=strict
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=yes

[Install]
WantedBy=multi-user.target