diff --git a/monitoring.yml b/monitoring.yml
new file mode 100644
index 0000000000000000000000000000000000000000..ed2a13ebdaa92fa3fefc179a9bea9ee83b7b2f27
--- /dev/null
+++ b/monitoring.yml
@@ -0,0 +1,8 @@
+# Install and configure Prometheus and Grafana for angel system etc.
+# monitoring
+
+- name: install and configure Prometheus and Grafana
+  hosts: monitoring
+  become: yes
+  roles:
+   - grafana
diff --git a/roles/grafana/defaults/main.yml b/roles/grafana/defaults/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..0274600e399795122def778be61176a67e5f3002
--- /dev/null
+++ b/roles/grafana/defaults/main.yml
@@ -0,0 +1,2 @@
+grafana_listen_address: "127.0.0.1"
+grafana_public_access: true
diff --git a/roles/grafana/handlers/main.yml b/roles/grafana/handlers/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..92e183dff08e068ca0736f7b812788560c99453f
--- /dev/null
+++ b/roles/grafana/handlers/main.yml
@@ -0,0 +1,4 @@
+- name: restart Grafana
+  systemd:
+    name: "grafana-server"
+    state: restarted
diff --git a/roles/grafana/tasks/main.yml b/roles/grafana/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..1a8dbe9061383e05e2761c6de19575882200c528
--- /dev/null
+++ b/roles/grafana/tasks/main.yml
@@ -0,0 +1,29 @@
+- name: add Grafana key
+  apt_key:
+    data: '{{ lookup("file", "grafana.key") }}'
+    state: present
+
+- name: add Grafana repo
+  apt_repository:
+    repo: "deb https://packages.grafana.com/oss/deb stable main"
+    state: present
+    update_cache: yes
+
+- name: install Grafana
+  apt:
+    package: grafana
+    state: present
+
+- name: enable Grafana
+  systemd:
+    name: "grafana-server"
+    enabled: yes
+
+- name: configure Grafana
+  template:
+    src: "grafana.ini.j2"
+    dest: "/etc/grafana/grafana.ini"
+    owner: root
+    group: grafana
+    mode: 0640
+  notify: restart Grafana
diff --git a/roles/grafana/templates/grafana.ini.j2 b/roles/grafana/templates/grafana.ini.j2
new file mode 100644
index 0000000000000000000000000000000000000000..b980e645b1846458ba2aad04654dd6a4b22d930e
--- /dev/null
+++ b/roles/grafana/templates/grafana.ini.j2
@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+
+[server]
+http_addr = {{ grafana_listen_address }}
+
+{% if grafana_public_access %}
+[auth.anonymous]
+enabled = true
+org_name = Heaven
+org_role = Viewer
+{% endif %}