diff --git a/inventory/host_vars/monitor.berlin.freifunk.net b/inventory/host_vars/monitor.berlin.freifunk.net
index 5c52f6b..f1ba8f0 100644
--- a/inventory/host_vars/monitor.berlin.freifunk.net
+++ b/inventory/host_vars/monitor.berlin.freifunk.net
@@ -1,2 +1,20 @@
 ---
 caddy_caddyfile: Caddyfile_monitor.j2
+grafana_github_config: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          61633530663261333539666362646165343762366238623236623262353263643938343462626437
+          6232383461626366633038363430353139383866656235390a356434663166306163383964333766
+          36623234363266393436336230643665346438613064633562386138323835316339366135633337
+          6233383566623062650a626330666266666166636639333932393263383064346339323635356237
+          65386133613164636536623763626236393033613934393364623861343463313535346639613163
+          35323431656661356266363366313530616539333136303238336437376165636637646362313632
+          62316134623839383264313630663531396264313864633735396132386636363734363237393034
+          62333733613635326630363432393636656639376433626334373962383935326133303232316664
+          36666539656134656564383033613830373133616561623236613366393363386164363962656266
+          31316663633731333464323839383430306438343566363435336236643636353534663731666634
+          30653561306662666565333561343063653835323162306532633262656364646135356636313833
+          62353439333761633939376663326431313837626639363166643463386634653136653062346331
+          30326431636332653632356535346530376630663930313331363964333032383531346132643564
+          37343838363061356232616364663332633862653561626165333238303065346235353930336332
+          38306562323531626365626234613061636130653864633666303361353430666535396230313962
+          38656562373165346666
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index d98c21b..c2f342f 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -15,7 +15,9 @@
       - mosh
       - nano
       - prometheus-node-exporter
+      - tcpdump
       - tmux
+      - vnstat
       - zsh
     state: present
     update_cache: true
diff --git a/roles/ff_monitor/tasks/main.yml b/roles/ff_monitor/tasks/main.yml
index 1cf7808..72d4bfe 100644
--- a/roles/ff_monitor/tasks/main.yml
+++ b/roles/ff_monitor/tasks/main.yml
@@ -40,14 +40,17 @@
   notify: Restart prometheus
 
 - name: Start prometheus collectd-exporter
-  community.general.docker_container:
+  community.docker.docker_container:
     name: collectd-exporter
     state: started
+    restart_policy: unless-stopped
     image: prom/collectd-exporter
     command: --collectd.listen-address=":25826"
     ports:
       - 9104:9103
       - 127.0.0.1:25827:25826/udp
+  tags:
+    - collectd-exporter
 
 - name: Copy grafana config
   template:
diff --git a/roles/ff_monitor/templates/grafana.ini.j2 b/roles/ff_monitor/templates/grafana.ini.j2
index ea60735..5ca5636 100644
--- a/roles/ff_monitor/templates/grafana.ini.j2
+++ b/roles/ff_monitor/templates/grafana.ini.j2
@@ -6,9 +6,10 @@ domain = monitor.berlin.freifunk.net
 
 enforce_domain = false
 
-root_url = %(protocol)s://%(domain)s:%(http_port)s/grafana/
+#root_url = %(protocol)s://%(domain)s:%(http_port)s/grafana/
+root_url = https://monitor.berlin.freifunk.net/grafana/
 
-serve_from_sub_path = true
+serve_from_sub_path = false
 
 router_logging = false
 
@@ -26,6 +27,9 @@ org_name = freifunk berlin
 org_role = Viewer
 hide_version = true
 
+[auth.github]
+{{ grafana_github_config }}
+
 [log]
 # Either "console", "file", "syslog". Default is console and  file
 # Use space to separate multiple modes, e.g. "console file"
@@ -89,12 +93,12 @@ enabled = false
 enabled = true
 
 [metrics]
-enabled  = false
+enabled  = true
 
 [plugins]
-allow_loading_unsigned_plugins = grafana-map-panel,panodata-map-panel
+allow_loading_unsigned_plugins = panodata-map-panel
 
 [feature_toggles]
 publicDashboards = true
 [unified_alerting]
-enabled = false
+enabled = true
diff --git a/roles/ff_monitor/templates/prometheus.yml.j2 b/roles/ff_monitor/templates/prometheus.yml.j2
index 34d4cbb..e630779 100644
--- a/roles/ff_monitor/templates/prometheus.yml.j2
+++ b/roles/ff_monitor/templates/prometheus.yml.j2
@@ -32,6 +32,10 @@ scrape_configs:
       - targets: ['monitor.berlin.freifunk.net:9104']
     honor_timestamps: true
 
+  - job_name: grafana
+    static_configs:
+      - targets: ['127.0.0.1:8080']
+
   - job_name: servers
     static_configs:
       - targets: