2 files changed, 12 insertions, 4 deletions
diff --git a/roles/monitoring/prometheus/exporter/blackbox/defaults/main.yml b/roles/monitoring/prometheus/exporter/blackbox/defaults/main.yml
index fcf66555..4e7d8d9a 100644
--- a/roles/monitoring/prometheus/exporter/blackbox/defaults/main.yml
+++ b/roles/monitoring/prometheus/exporter/blackbox/defaults/main.yml
@@ -1,10 +1,8 @@
 ---
 prometheus_exporter_blackbox_modules:
-  icmp:
-    prober: icmp
   tcp_connect:
     prober: tcp
-  tcp_tls:
+  tcp_tls_connect:
     prober: tcp
     tcp:
       tls: true
@@ -12,6 +10,12 @@ prometheus_exporter_blackbox_modules:
         insecure_skip_verify: true
   http_2xx:
     prober: http
+  http_tls_2xx:
+    prober: http
+    http:
+      fail_if_not_ssl: true
+      tls_config:
+        insecure_skip_verify: true
   ssh_banner:
     prober: tcp
     tcp:
diff --git a/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2 b/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2
index c9c5712c..a8a91d0b 100644
--- a/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2
+++ b/roles/monitoring/prometheus/exporter/blackbox/templates/service.j2
@@ -8,8 +8,13 @@ ExecStart=/usr/bin/prometheus-blackbox-exporter --web.listen-address="127.0.0.1:
 ExecReload=/bin/kill -HUP $MAINPID
 
 # systemd hardening-options
+{% if prometheus_exporter_blackbox_modules | combine(prometheus_exporter_blackbox_modules_extra) | dict2items | selectattr('value.prober', 'eq', 'icmp') | length > 0 %}
 AmbientCapabilities=CAP_NET_RAW
 CapabilityBoundingSet=CAP_NET_RAW
+{% else %}
+AmbientCapabilities=
+CapabilityBoundingSet=
+{% endif %}
 DeviceAllow=/dev/null rw
 DevicePolicy=strict
 LockPersonality=true
@@ -17,7 +22,6 @@ MemoryDenyWriteExecute=true
 NoNewPrivileges=true
 PrivateDevices=true
 PrivateTmp=true
-PrivateUsers=true
 ProtectControlGroups=true
 ProtectHome=true
 ProtectKernelModules=true