diff --git a/monitoring/manifests/ingress-grafana.yaml b/monitoring/manifests/ingress-grafana.yaml
new file mode 100644
index 0000000..0cb4613
--- /dev/null
+++ b/monitoring/manifests/ingress-grafana.yaml
@@ -0,0 +1,16 @@
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    ingress.kubernetes.io/ssl-redirect: "true"
+  name: grafana
+  namespace: monitoring
+spec:
+  rules:
+  - host: grafana.knurrli.tbrnt.ch
+    http:
+      paths:
+      - backend:
+          serviceName: grafana
+          servicePort: http
diff --git a/monitoring/manifests/prometheus-prometheus.yaml b/monitoring/manifests/prometheus-prometheus.yaml
index f5cfcd7..54fe910 100644
--- a/monitoring/manifests/prometheus-prometheus.yaml
+++ b/monitoring/manifests/prometheus-prometheus.yaml
@@ -11,6 +11,7 @@ spec:
     - name: alertmanager-main
       namespace: monitoring
       port: web
+  externalUrl: http://prometheus-k8s.monitoring:9090
   image: quay.io/prometheus/prometheus:v2.15.2
   nodeSelector:
     kubernetes.io/os: linux
diff --git a/monitoring/monitoring.jsonnet b/monitoring/monitoring.jsonnet
index c2c48a0..fcd82e4 100644
--- a/monitoring/monitoring.jsonnet
+++ b/monitoring/monitoring.jsonnet
@@ -1,5 +1,8 @@
 local k = import 'ksonnet/ksonnet.beta.4/k.libsonnet';
 local pvc = k.core.v1.persistentVolumeClaim;
+local ingress = k.extensions.v1beta1.ingress;
+local ingressRule = ingress.mixin.spec.rulesType;
+local httpIngressPath = ingressRule.mixin.http.pathsType;
 
 local kp =
   (import 'kube-prometheus/kube-prometheus.libsonnet') +
@@ -25,6 +28,7 @@ local kp =
       prometheus+: {
         spec+: {
           retention: '7d',
+          externalUrl: 'http://prometheus-k8s.monitoring:9090',
           storage: {
             volumeClaimTemplate:
               pvc.new() +
@@ -35,6 +39,25 @@ local kp =
         },
       },
     },
+    ingress+:: {
+      grafana:
+        ingress.new() +
+        ingress.mixin.metadata.withName('grafana') +
+        ingress.mixin.metadata.withNamespace($._config.namespace) +
+        ingress.mixin.metadata.withAnnotations({
+          'cert-manager.io/cluster-issuer': 'letsencrypt-prod',
+          'ingress.kubernetes.io/ssl-redirect': 'true',
+        }) +
+        ingress.mixin.spec.withRules(
+          ingressRule.new() +
+          ingressRule.withHost('grafana.knurrli.tbrnt.ch') +
+          ingressRule.mixin.http.withPaths(
+            httpIngressPath.new() +
+            httpIngressPath.mixin.backend.withServiceName('grafana') +
+            httpIngressPath.mixin.backend.withServicePort('http')
+          ),
+        ),
+    },
   };
 
 { ['setup/0namespace-' + name]: kp.kubePrometheus[name] for name in std.objectFields(kp.kubePrometheus) } +
@@ -50,4 +73,5 @@ local kp =
 { ['prometheus-' + name]: kp.prometheus[name] for name in std.objectFields(kp.prometheus) } +
 { ['prometheus-adapter-' + name]: kp.prometheusAdapter[name] for name in std.objectFields(kp.prometheusAdapter) } +
 { ['grafana-' + name]: kp.grafana[name] for name in std.objectFields(kp.grafana) } +
-{ ['prometheus-pushgateway-' + name]: kp.pushgateway[name] for name in std.objectFields(kp.pushgateway) }
+{ ['prometheus-pushgateway-' + name]: kp.pushgateway[name] for name in std.objectFields(kp.pushgateway) } +
+{ ['ingress-' + name]: kp.ingress[name] for name in std.objectFields(kp.ingress) }