diff --git a/metrics/grafana-deployment.yaml b/metrics/grafana-deployment.yaml
index b35f74d..b2203d7 100644
--- a/metrics/grafana-deployment.yaml
+++ b/metrics/grafana-deployment.yaml
@@ -66,7 +66,7 @@ spec:
               memory: "256Mi"
               cpu: "250m"
           ports:
-            - containerPort: 9000
+            - containerPort: 3000
               protocol: TCP
           volumeMounts:
             - mountPath: /var/lib/grafana
diff --git a/metrics/grafana-service.yaml b/metrics/grafana-service.yaml
index 85c59f2..e5ae826 100644
--- a/metrics/grafana-service.yaml
+++ b/metrics/grafana-service.yaml
@@ -8,21 +8,35 @@ metadata:
     app.kubernetes.io/name: grafana
 spec:
   ports:
-    - name: "9000"
-      port: 9000
-      targetPort: 9000
+    - name: "3000"
+      port: 3000
+      targetPort: 3000
   selector:
     app.kubernetes.io/name: grafana
 ---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: whoami
+  namespace: metrics
+spec:
+  secretName: grafana-tls
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  dnsNames:
+    - "grafana.konfa.ch"
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: grafana-ingress
-  namespace: default
+  namespace: metrics
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.middlewares: default-https-redirect
 spec:
+  tls:
+    - secretName: grafana-tls
   rules:
     - host: grafana.konfa.ch
       http:
@@ -33,4 +47,4 @@ spec:
               service:
                 name: grafana
                 port:
-                  number: 9000
+                  number: 3000