Variables

All variables use the linux_exporter_* prefix and are translated to the upstream prometheus.prometheus.node_exporter collection role's node_exporter_* names internally — see that collection's own docs for anything not listed here.

General

Variable	Type	Default	Description
`linux_exporter_config_dir`	string	`/etc/node_exporter`	Directory created by the `prepare_filesystem` tag. Passed to the upstream role as `node_exporter_config_dir` (used for `web_config.yml`).
`linux_exporter_system_group`	string	`node-exp`	System group node_exporter runs as.
`linux_exporter_system_user`	string	`{{ linux_exporter_system_group }}`	System user node_exporter runs as.
`linux_exporter_enabled_collectors`	list	`[network_route]`	Extra node_exporter collectors to enable, on top of the upstream role's own defaults.
`linux_exporter_version`	string	`1.12.1`	node_exporter version to install.

TLS

linux_exporter_tls_server_config is passed straight through to the upstream role's node_exporter_tls_server_config — see prometheus.prometheus.node_exporter's own docs for the full shape of that map. This role does not issue certificates; see the Usage Guide for how to get a cert onto the host before installing.

Variable	Type	Default	Description
`linux_exporter_tls_server_config`	map	`{cert_file: /etc/node_exporter/tls.crt, key_file: /etc/node_exporter/tls.priv}`	Passed to node_exporter as-is. Set to `{}` to disable TLS entirely and serve plain HTTP. Add `client_auth_type: RequireAndVerifyClientCert` and `client_ca_file: <path>` yourself to require mTLS — neither is set by default.

Default value:

linux_exporter_tls_server_config:
  cert_file: /etc/node_exporter/tls.crt
  key_file: /etc/node_exporter/tls.priv

HTTP only:

linux_exporter_tls_server_config: {}

Full mTLS:

linux_exporter_tls_server_config:
  cert_file: /etc/node_exporter/tls.crt
  key_file: /etc/node_exporter/tls.priv
  client_auth_type: RequireAndVerifyClientCert
  client_ca_file: /etc/node_exporter/ca.crt

Verification

These control the verify_endpoint tag, which polls node_exporter's metrics endpoint right after install and asserts node_exporter_build_info is present in the response. Under full mTLS (client_auth_type set), the check is skipped entirely — with an explanatory message, not a failure — unless a client cert is provided; HTTP and server-only-TLS installs always run the check.

Variable	Type	Default	Description
`linux_exporter_test_port`	int	`9100`	Port `verify_endpoint` polls. Matches node_exporter's own upstream default (`node_exporter_web_listen_address`) — update both together if you change the listen port.
`linux_exporter_test_path`	string	`/metrics`	Path `verify_endpoint` polls. Matches node_exporter's own upstream default (`node_exporter_web_telemetry_path`).
`linux_exporter_test_client_cert`	string	(unset)	Path to a client certificate for `verify_endpoint` to present. Only relevant when `linux_exporter_tls_server_config` requires mTLS (`client_auth_type` set) — set both this and `linux_exporter_test_client_key` to actually run the check under mTLS instead of skipping it.
`linux_exporter_test_client_key`	string	(unset)	Private key matching `linux_exporter_test_client_cert`.