diff --git a/data.nix b/data.nix
index 2b4172d..497ce46 100644
--- a/data.nix
+++ b/data.nix
@@ -7,6 +7,14 @@ rec {
     updaterbot-deployee = 502;
   };
 
+  ports = {
+    grafana = 3000;
+    prometheus = 9001;
+    exporters = {
+      node = 9002;
+    };
+  };
+
   people_pubkeys = {
     motiejus = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC+qpaaD+FCYPcUU1ONbw/ff5j0xXu5DNvp/4qZH/vOYwG13uDdfI5ISYPs8zNaVcFuEDgNxWorVPwDw4p6+1JwRLlhO4J/5tE1w8Gt6C7y76LRWnp0rCdva5vL3xMozxYIWVOAiN131eyirV2FdOaqTwPy4ouNMmBFbibLQwBna89tbFMG/jwR7Cxt1I6UiYOuCXIocI5YUbXlsXoK9gr5yBRoTjl2OfH2itGYHz9xQCswvatmqrnteubAbkb6IUFYz184rnlVntuZLwzM99ezcG4v8/485gWkotTkOgQIrGNKgOA7UNKpQNbrwdPAMugqfSTo6g8fEvy0Q+6OXdxw5X7en2TJE+BLVaXp4pVMdOAzKF0nnssn64sRhsrUtFIjNGmOWBOR2gGokaJcM6x9R72qxucuG5054pSibs32BkPEg6Qzp+Bh77C3vUmC94YLVg6pazHhLroYSP1xQjfOvXyLxXB1s9rwJcO+s4kqmInft2weyhfaFE0Bjcoc+1/dKuQYfPCPSB//4zvktxTXud80zwWzMy91Q4ucRrHTBz3PrhO8ys74aSGnKOiG3ccD3HbaT0Ff4qmtIwHcAjrnNlINAcH/A2mpi0/2xA7T8WpFnvgtkQbcMF0kEKGnNS5ULZXP/LC8BlLXxwPdqTzvKikkTb661j4PhJhinhVwnQ==";
   };
diff --git a/hosts/vno1-oh2/configuration.nix b/hosts/vno1-oh2/configuration.nix
index 8894431..8627a76 100644
--- a/hosts/vno1-oh2/configuration.nix
+++ b/hosts/vno1-oh2/configuration.nix
@@ -63,6 +63,9 @@
     };
 
     services = {
+      # TODO move to grafana service lib
+      friendlyport.ports = [myData.ports.grafana];
+
       deployerbot = {
         main = {
           enable = true;
@@ -106,11 +109,40 @@
   services = {
     tailscale.enable = true;
 
-    #grafana = {
-    #  enable = true;
-    #  domain = "vno1-oh2.servers.jakst"; # TODO tailscale service?
-    #  addr = myData.hosts."vno1-oh2.servers.jakst".jakstIP;
-    #};
+    grafana = {
+      enable = true;
+      settings = {
+        server = {
+          # TODO tailscale service?
+          domain = "${config.networking.hostName}.${config.networking.domain}";
+          http_addr = myData.hosts."${config.networking.hostName}.${config.networking.domain}".jakstIP;
+          http_port = myData.ports.grafana;
+        };
+      };
+    };
+
+    prometheus = {
+      enable = true;
+      port = myData.ports.prometheus;
+      exporters = {
+        node = {
+          enable = true;
+          enabledCollectors = ["systemd"];
+          port = myData.ports.exporters.node;
+        };
+      };
+
+      scrapeConfigs = [
+        {
+          job_name = "${config.networking.hostName}.${config.networking.domain}";
+          static_configs = [
+            {
+              targets = ["127.0.0.1:${toString config.services.prometheus.exporters.node.port}"];
+            }
+          ];
+        }
+      ];
+    };
 
     nsd = {
       enable = true;
diff --git a/modules/services/friendlyport/default.nix b/modules/services/friendlyport/default.nix
index f7cb51c..9f21893 100644
--- a/modules/services/friendlyport/default.nix
+++ b/modules/services/friendlyport/default.nix
@@ -16,7 +16,9 @@
     hosts = lib.attrVals ["mxp10.motiejus.jakst" "fwmine.motiejus.jakst"] myData.hosts;
     ips = lib.catAttrs "jakstIP" hosts;
     startLines = map (ip: "iptables -A INPUT -p tcp --match multiport --dports ${ports} --source ${ip} -j ACCEPT") ips;
-    stopLines = map (ip: "iptables -D INPUT -p tcp --match multiport --dports ${ports} --source ${ip} -j ACCEPT") ips;
+    # TODO: when stopping the firewall, systemd uses the old ports. So this is a two-phase process.
+    # How to stop the old one and start the new one?
+    stopLines = map (ip: "iptables -D INPUT -p tcp --match multiport --dports ${ports} --source ${ip} -j ACCEPT || :") ips;
   in {
     networking.firewall.extraCommands = lib.concatLines startLines;
     networking.firewall.extraStopCommands = lib.concatLines stopLines;