Move munin-node template from xmpp-server

This was the only config file still dependent on the wider playbook.

There are still multiple variables that are neither defined in the playbook nor
in argument_specs. This would be good to clean up later.

2 files changed, 70 insertions, 1 deletions

diff --git a/munin-node/tasks/main.yml b/munin-node/tasks/main.yml
index 342a3f7..dde9572 100644
--- a/munin-node/tasks/main.yml
+++ b/munin-node/tasks/main.yml
@@ -25,7 +25,7 @@
 
 - name: Ensure munin is configured
   ansible.builtin.template:
-   src: "{{ playbook_dir }}/files/munin-node.conf.j2"
+   src: munin-node.conf.j2
    dest: /etc/munin/munin-node.conf
    owner: root
    group: root
diff --git a/munin-node/templates/munin-node.conf.j2 b/munin-node/templates/munin-node.conf.j2
new file mode 100644
index 0000000..81400a9
--- /dev/null
+++ b/munin-node/templates/munin-node.conf.j2
@@ -0,0 +1,69 @@
+# SPDX-FileCopyrightText: 2026 Matthew Fennell <matthew@fennell.dev>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+#
+# Example config-file for munin-node
+#
+
+log_level 4
+log_file /var/log/munin/munin-node.log
+pid_file /var/run/munin/munin-node.pid
+
+background 1
+setsid 1
+
+user root
+group root
+
+# This is the timeout for the whole transaction.
+# Units are in sec. Default is 15 min
+#
+# global_timeout 900
+
+# This is the timeout for each plugin.
+# Units are in sec. Default is 1 min
+#
+# timeout 60
+
+# Regexps for files to ignore
+ignore_file [\#~]$
+ignore_file DEADJOE$
+ignore_file \.bak$
+ignore_file %$
+ignore_file \.dpkg-(tmp|new|old|dist)$
+ignore_file \.rpm(save|new)$
+ignore_file \.pod$
+
+# Set this if the client doesn't report the correct hostname when
+# telnetting to localhost, port 4949
+#
+#host_name localhost.localdomain
+host_name {{ hostname }}
+
+# A list of addresses that are allowed to connect.  This must be a
+# regular expression, since Net::Server does not understand CIDR-style
+# network notation unless the perl module Net::CIDR is installed.  You
+# may repeat the allow line as many times as you'd like
+
+allow ^127\.0\.0\.1$
+allow ^::1$
+allow ^{{ munin_host }}$
+
+# If you have installed the Net::CIDR perl module, you can use one or more
+# cidr_allow and cidr_deny address/mask patterns.  A connecting client must
+# match any cidr_allow, and not match any cidr_deny.  Note that a netmask
+# *must* be provided, even if it's /32
+#
+# Example:
+#
+# cidr_allow 127.0.0.1/32
+# cidr_allow 192.0.2.0/24
+# cidr_deny  192.0.2.42/32
+
+# Which address to bind to;
+host *
+# host 127.0.0.1
+
+# And which port
+port 4949