telegraf: disable PrivateMounts in containers (fix LXC 226/NAMESPACE)

The packaged telegraf.service sets PrivateMounts=true, which requires a
mount namespace that unprivileged LXC containers cannot create, so the
service failed to start on the LXC resolver with status 226/NAMESPACE.
Drop in PrivateMounts=false, gated to container guests so VM hosts keep
the unit's hardening.

ansible/roles/telegraf/tasks/main.yml

@@ -45,6 +45,40 @@
     state: enabled
   when: ansible_facts['os_family'] == "RedHat"
 
+# The packaged telegraf.service sets PrivateMounts=true, which needs a mount
+# namespace an unprivileged LXC container can't create (systemd exits
+# 226/NAMESPACE). Disable it only inside containers so VM hosts keep the
+# hardening.
+- name: Detect container runtime
+  ansible.builtin.set_fact:
+    telegraf_in_container: >-
+      {{ ansible_facts['virtualization_role'] == 'guest'
+         and ansible_facts['virtualization_type'] in
+         ['lxc', 'lxc-libvirt', 'systemd-nspawn', 'docker', 'podman', 'openvz'] }}
+
+- name: Create telegraf.service systemd drop-in dir (containers)
+  ansible.builtin.file:
+    path: /etc/systemd/system/telegraf.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: telegraf_in_container | bool
+
+- name: Disable PrivateMounts for telegraf in containers
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/telegraf.service.d/override.conf
+    content: |
+      # Managed by Ansible (roles/telegraf). Unprivileged LXC containers cannot
+      # set up the mount namespace PrivateMounts=true requires (226/NAMESPACE).
+      [Service]
+      PrivateMounts=false
+    owner: root
+    group: root
+    mode: "0644"
+  when: telegraf_in_container | bool
+  notify: Restart telegraf
+
 - name: Enable and start Telegraf
   ansible.builtin.systemd:
     name: telegraf