r/postgres-exporter: Deploy postgres-exporter

The [postgres-exporter][0] exposes PostgreSQL server statistics to
Prometheus.  It connects to a specified PostgreSQL server (in this
case, a server on the local machine via UNIX socket) and collects data
from the `pg_stat_activity`, et al. views.  It needs the `pg_monitor`
role in order to be allowed to read the relevant metrics.

Since we're setting up the exporter to connect via UNIX socket, it needs
a dedicated OS user to match the PostgreSQL user in order to
authenticate via the _peer_ method.

[0]: https://github.com/prometheus-community/postgres_exporter/

roles/postgres-exporter/templates/postgres-exporter.container.j2

@@ -0,0 +1,19 @@
+[Unit]
+Description=PostgreSQL Exporter for Prometheus
+Wants=network-online.target
+After=network-online.target
+After=postgresql.service
+
+[Container]
+Image=quay.io/prometheuscommunity/postgres-exporter:v0.15.0
+Environment=DATA_SOURCE_URI='postgres-exporter@:5432/template1?host=/run/postgresql'
+Mount=type=bind,source=/run/postgresql,target=/run/postgresql
+# container_t cannot access the PostgreSQL socket postgresql_var_run_t
+SecurityLabelDisable=true
+User=221
+Group=221
+DropCapability=all
+PublishPort=9187:9187
+
+[Install]
+WantedBy=multi-user.target