Expose ntfy metrics like the metrics of other services

The playbook exposes service metrics under a single endpoint
(`https://matrix.example.com/metrics/*`), controlled by
`matrix_metrics_exposure_enabled` and friends. ntfy was not wired into
this at all, so enabling metrics exposure did not expose ntfy's metrics
and enabling Basic Authentication did not protect them.

We have ntfy serve its metrics on a dedicated port, instead of on its
regular HTTP port. Serving them on the regular HTTP port also makes them
reachable at `https://ntfy.example.com/metrics`, where nothing protects
them, as ntfy does not apply its own access-control rules to the metrics
endpoint.

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/5468

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/configuring-playbook-prometheus-grafana.md

@@ -183,6 +183,8 @@ Name | Description
 `prometheus_postgres_exporter_container_labels_metrics_enabled`|Set this to `true` to expose the [Postgres exporter](#enable-metrics-and-graphs-for-postgres-optional) metrics on `https://matrix.example.com/metrics/postgres-exporter`.
 `prometheus_nginxlog_exporter_enabled`|Set this to `true` to enable the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) (locally, on the container network).
 `prometheus_nginxlog_exporter_container_labels_metrics_enabled`|Set this to `true` to expose the [prometheus-nginxlog-exporter](#enable-metrics-and-graphs-for-nginx-logs-optional) metrics on `https://matrix.example.com/metrics/nginxlog`.
+`ntfy_metrics_listen_http_port`|Set this to a port number (e.g. `9090`) to make [ntfy](configuring-playbook-ntfy.md) serve its metrics (locally, on the container network) on that port.
+`ntfy_container_labels_traefik_metrics_enabled`|Set this to `true` to expose the [ntfy](configuring-playbook-ntfy.md) metrics on `https://matrix.example.com/metrics/ntfy`.
 
 ### Expose metrics of other services/roles
 

group_vars/matrix_servers

@@ -4408,6 +4408,21 @@ ntfy_container_labels_traefik_docker_network: "{{ matrix_playbook_reverse_proxya
 ntfy_container_labels_traefik_entrypoints: "{{ traefik_entrypoint_primary }}"
 ntfy_container_labels_traefik_tls_certResolver: "{{ traefik_certResolver_primary }}"
 
+# We have ntfy serve its metrics endpoint on a dedicated port, instead of on the regular HTTP port.
+# Were it served on the regular HTTP port, the endpoint would also become reachable at `https://ntfy.example.com/metrics`.
+# Nothing protects it there, because ntfy does not apply its own access-control rules to the metrics endpoint.
+ntfy_metrics_listen_http_port: "{{ 9090 if matrix_metrics_exposure_enabled else '' }}"
+
+ntfy_container_labels_traefik_metrics_enabled: "{{ matrix_metrics_exposure_enabled }}"
+
+# For consistency with other things hosted at the Matrix FQN, we adjust the metrics endpoint
+# so that metrics would be served at something like `/metrics/SERVICE_NAME`, and not at the default path for the role (`/metrics`).
+ntfy_container_labels_traefik_metrics_hostname: "{{ matrix_server_fqn_matrix }}"
+ntfy_container_labels_traefik_metrics_path_prefix: "{{ matrix_metrics_exposure_path_prefix }}/ntfy"
+
+ntfy_container_labels_traefik_metrics_middleware_basic_auth_enabled: "{{ matrix_metrics_exposure_http_basic_auth_enabled }}"
+ntfy_container_labels_traefik_metrics_middleware_basic_auth_users: "{{ matrix_metrics_exposure_http_basic_auth_users }}"
+
 ntfy_visitor_request_limit_exempt_hosts_hostnames_auto: |
   {{
     [matrix_server_fqn_matrix]