Exporting host metrics with Prometheus node_exporter: collectors, the textfile collector, and firewalling the port

Goal

Expose CPU, memory, disk, network and other host-level metrics from a Linux server in a format Prometheus can scrape, including custom values a local script computes, without exposing the metrics endpoint beyond the monitoring system.

Prerequisites

A Linux host with wget/curl and tar; a Prometheus server (or compatible scraper) that will do the scraping; a way to add a systemd unit and a dedicated system user.

Steps

1. Download the release matching the host's OS and architecture from the project's releases and extract it, e.g. node_exporter-<version>.linux-amd64.tar.gz, as documented in the Prometheus guide to the Node Exporter.
2. Create a dedicated, unprivileged user for the process: useradd --system --no-create-home --shell /usr/sbin/nologin node_exporter, and place the binary at /usr/local/bin/node_exporter owned by root with mode 0755, so the service account cannot replace its own binary.
3. Create a systemd unit /etc/systemd/system/node_exporter.service running the binary as that user with User=node_exporter, ExecStart=/usr/local/bin/node_exporter, Restart=on-failure; no collector flags are required to get the defaults, since the README lists collectors such as cpu, diskstats, filesystem, meminfo and loadavg as enabled by default on Linux.
4. To publish a custom value (a backup's last success timestamp, a certificate's days-to-expiry), point the Textfile Collector at a directory with --collector.textfile.directory=/var/lib/node_exporter/textfile_collector in ExecStart (the collector does nothing until this flag is set) and have a cron job or script write *.prom files there in the Prometheus text exposition format. Write atomically, as the README shows: write to name.prom.$$ in the same directory, then mv it to name.prom, so a scrape never reads a half-written file.
5. Reload and start: systemctl daemon-reload && systemctl enable --now node_exporter.
6. node_exporter listens on HTTP port 9100 by default, per the README, and the endpoint has no built-in authentication unless a --web.config.file is supplied. Restrict inbound access with a host firewall rule allowing only the Prometheus server's address on 9100, e.g. on nftables: nft insert rule inet filter input tcp dport 9100 ip saddr != <prometheus-ip> drop (assumes an inet filter table with an input chain; insert places it before existing accept rules; it matches IPv4 only and is lost at reboot unless added to /etc/nftables.conf).
7. Verify: curl http://localhost:9100/metrics | grep node_ should list metric families prefixed node_, per the guide's own example.

Expected result

The systemd unit is active and enabled; curl against port 9100 returns metrics; the port is unreachable from hosts other than the Prometheus server.

Limits and test basis

Based on the node_exporter README and the Prometheus documentation's Node Exporter guide. To undo, systemctl disable --now node_exporter and remove the unit file and binary. Running the binary as root is unnecessary for the default collectors and widens the impact of any vulnerability in the exporter; keep it under its own system user.