diff --git a/hosts/monitoring/grafana.nix b/hosts/monitoring/grafana.nix
index e3acc5e..5feb5a5 100644
--- a/hosts/monitoring/grafana.nix
+++ b/hosts/monitoring/grafana.nix
@@ -3,6 +3,9 @@
 # Dashboards:
 # - Synapse: https://github.com/element-hq/synapse/tree/master/contrib/grafana
 
+let
+  fqdn = "monitoring.${config.networking.domain}";
+in
 {
   imports = [
     ../../services/nginx.nix
@@ -13,7 +16,13 @@
     grafana = {
       enable = true;
       settings = {
-        server.http_addr = "::1";
+        server = {
+          domain = fqdn;
+          enable_gzip = true;
+          enforce_domain = true;
+          root_url = "https://${fqdn}:443/";
+          protocol = "socket";
+        };
         database = {
           type = "postgres";
           name = "grafana";
@@ -26,6 +35,13 @@
           admin_user = "xengi";
           admin_password = "$__file{${config.age.secrets.grafana_admin_password.path}}";
           admin_email = "cccb-grafana@xengi.de";
+          cookie_samesite = "strict";
+          cookie_secure = true;
+          disable_gravatar = true;
+          #strict_transport_security = true;
+          #strict_transport_security_preload = true;
+          #strict_transport_security_subdomains = true;
+          #x_xss_protection = true;
         };
         analytics = {
           reporting_enabled = false;
@@ -49,32 +65,28 @@
       };
     };
 
-    nginx = {
-      upstreams."grafana".servers."[${config.services.grafana.settings.server.http_addr}]:${toString config.services.grafana.settings.server.http_port}" =
-        { };
-      virtualHosts."monitoring.${config.networking.domain}" = {
-        default = true;
-        quic = true;
-        kTLS = true;
-        forceSSL = true;
-        enableACME = true;
-        #extraConfig = ''
-        #  map $http_upgrade $connection_upgrade {
-        #    default upgrade;
-        #    \'\' close;
-        #  }
-        #'';
-        locations = {
-          "/" = {
-            basicAuthFile = config.age.secrets.grafana_basic_auth.path;
-            proxyPass = "http://grafana";
-            recommendedProxySettings = true;
-          };
-          "/api/live/" = {
-            proxyPass = "http://grafana";
-            recommendedProxySettings = true;
-            proxyWebsockets = true;
-          };
+    nginx.virtualHosts."monitoring.${config.networking.domain}" = {
+      default = true;
+      quic = true;
+      kTLS = true;
+      forceSSL = true;
+      enableACME = true;
+      #extraConfig = ''
+      #  map $http_upgrade $connection_upgrade {
+      #    default upgrade;
+      #    \'\' close;
+      #  }
+      #'';
+      locations = {
+        "/" = {
+          basicAuthFile = config.age.secrets.grafana_basic_auth.path;
+          proxyPass = "http://unix:/run/grafana/grafana.sock";
+          recommendedProxySettings = true;
+        };
+        "/api/live/" = {
+          proxyPass = "http://unix:/run/grafana/grafana.sock";
+          recommendedProxySettings = true;
+          proxyWebsockets = true;
         };
       };
     };