diff --git a/password-store/vms/monitoring01/grafana/admin.gpg b/password-store/vms/monitoring01/grafana/admin.gpg
new file mode 100644
index 0000000..f1fd8e3
Binary files /dev/null and b/password-store/vms/monitoring01/grafana/admin.gpg differ
diff --git a/playbook_provision_monitoring.yml b/playbook_provision_monitoring.yml
new file mode 100644
index 0000000..45f7504
--- /dev/null
+++ b/playbook_provision_monitoring.yml
@@ -0,0 +1,64 @@
+---
+- name: provision monitoring
+  hosts:
+    - monitoring01
+  tasks:
+    - name: install playbook requirements
+      package:
+        name:
+          - gpg
+
+    - name: install prometheus
+      package:
+        name:
+          - prometheus
+          - prometheus-alertmanager
+
+    - name: configure prometheus
+      template:
+        src: templates/prometheus.yml
+        dest: /etc/prometheus/prometheus.yml
+        validate: "/usr/bin/promtool check config %s"
+      notify:
+        - reload prometheus
+
+    - name: add grafana oss repo gpg key
+      apt_key:
+        url: "https://packages.grafana.com/gpg.key"
+        id: "4E40DDF6D76E284A4A6780E48C8C34C524098CB6"
+
+    - name: add grafana oss repo
+      apt_repository:
+        repo: "deb https://packages.grafana.com/oss/deb stable main"
+
+    - name: install grafana oss
+      package:
+        name: grafana
+
+    - name: enable and start grafana
+      service:
+        name: grafana-server
+        state: started
+        enabled: yes
+
+    - name: enable anonymous login in grafana
+      blockinfile:
+        path: /etc/grafana/grafana.ini
+        block: |
+          [auth.anonymous]
+          enabled = true
+          org_role = Viewer
+
+      notify:
+        - restart grafana
+
+  handlers:
+    - name: reload prometheus
+      service:
+        name: prometheus
+        state: reloaded
+
+    - name: restart grafana
+      service:
+        name: grafana-server
+        state: restarted
diff --git a/templates/prometheus.yml b/templates/prometheus.yml
new file mode 100644
index 0000000..777310d
--- /dev/null
+++ b/templates/prometheus.yml
@@ -0,0 +1,30 @@
+global:
+  scrape_interval:     15s # Set the scrape interval to every 15 seconds. Default is every 1 minute.
+  evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.
+  # scrape_timeout is set to the global default (10s).
+
+alerting:
+  alertmanagers:
+  - static_configs:
+    - targets: ['localhost:9093']
+
+rule_files:
+  # - "first_rules.yml"
+
+scrape_configs:
+  - job_name: 'prometheus'
+    scrape_interval: 5s
+    scrape_timeout: 5s
+    static_configs:
+      - targets: ['localhost:9090']
+
+{% for group in groups.keys() | reject('all') | reject('ungrouped') %}
+  - job_name: {{ group }}
+    static_configs:
+{% for host in groups[group] %}
+      - targets: ["{{ hostvars[host]['monitoring_ip'] | default(hostvars[host]['ip']) }}:9100"]
+        labels:
+          instance: "{{ host }}:9100"
+{% endfor %}
+
+{% endfor %}