some more security

roles/prometheus/tasks/main.yml

@@ -23,8 +23,8 @@
   template:
     src: prometheus.yml
     dest: /etc/prometheus/prometheus.yml
-    owner: root
-    group: root
+    owner: prometheus
+    group: prometheus
     mode: '0640'
   notify: Restart prometheus
   no_log: true

roles/prometheus/templates/prometheus.yml

@@ -30,10 +30,10 @@ scrape_configs:
     # scheme defaults to 'http'.
 
     static_configs:
-      - targets: ['localhost:9090']
+      - targets: ['{{ lan_address }}:9090']
 
   - job_name: node
     # If prometheus-node-exporter is installed, grab stats about the local
     # machine by default.
     static_configs:
-      - targets: ['172.20.1.1:9100']
+      - targets: ['{{ lan_address }}:9100']