diff --git a/modules/services/default.nix b/modules/services/default.nix
index 9312f7a..ebf8007 100644
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -6,6 +6,7 @@
     ./blocky
     ./freshrss
     ./gitea
+    ./grafana
     ./hedgedoc
     ./homepage
     ./homer
@@ -29,4 +30,3 @@
     ./tandoor-recipes
   ];
 }
-
diff --git a/modules/services/grafana/default.nix b/modules/services/grafana/default.nix
new file mode 100644
index 0000000..9364ddc
--- /dev/null
+++ b/modules/services/grafana/default.nix
@@ -0,0 +1,81 @@
+# visualize monitoring services
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.my.services.grafana;
+  domain = config.networking.domain;
+in
+{
+  options.my.services.grafana = with lib; {
+    enable = mkEnableOption "Grafana for visualizing";
+
+    port = mkOption {
+      type = types.port;
+      default = 9500;
+      example = 3001;
+      description = "Internal port";
+    };
+
+    username = mkOption {
+      type = types.str;
+      default = "felix";
+      example = "admin";
+      description = "Admin username";
+    };
+
+    passwordFile = mkOption {
+      type = types.str;
+      example = "/var/lib/grafana/password.txt";
+      description = "Admin password stored in a file";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.grafana = {
+      enable = true;
+
+      settings = {
+        server = {
+          domain = "visualization.${domain}";
+          root_url = "https://visualization.${domain}/";
+          http_port = cfg.port;
+          http_addr = "127.0.0.1";
+        };
+
+        security = {
+          admin_user = cfg.username;
+          admin_password = "$__file{${cfg.passwordFile}}";
+        };
+      };
+
+      provision = {
+        enable = true;
+        datasources.settings.datasources = [
+          (lib.optionalAttrs config.services.prometheus.enable {
+            name = "Prometheus";
+            type = "prometheus";
+            url = "http://127.0.0.1:${toString config.services.prometheus.port}";
+            jsonData = {
+              timeInterval = config.services.prometheus.globalConfig.scrape_interval;
+            };
+          })
+        ];
+      };
+    };
+
+    my.services.nginx.virtualHosts = [
+      {
+        subdomain = "visualization";
+        inherit (cfg) port;
+      }
+    ];
+
+    webapps.apps.grafana = {
+      dashboard = {
+        name = "Visualization";
+        category = "infra";
+        icon = "chart-line";
+        link = "https://visualization.${domain}";
+      };
+    };
+  };
+}