diff --git a/hosts/rico0/services/apps/blocky.nix b/hosts/rico0/services/apps/blocky.nix
index c77d1f2..ace90b5 100644
--- a/hosts/rico0/services/apps/blocky.nix
+++ b/hosts/rico0/services/apps/blocky.nix
@@ -42,6 +42,7 @@ _: {
         filterUnmappedTypes = true;
         mapping = {
           "frp.labs.adtya.xyz" = "10.10.10.10,fd7c:585c:c4ae::10";
+          "prometheus.labs.adtya.xyz" = "10.10.10.10,fd7c:585c:c4ae::10";
           "transmission.labs.adtya.xyz" = "10.10.10.14,fd7c:585c:c4ae::14";
         };
       };
diff --git a/hosts/rico0/services/apps/prometheus.nix b/hosts/rico0/services/apps/prometheus.nix
index d1c6072..bc6cf21 100644
--- a/hosts/rico0/services/apps/prometheus.nix
+++ b/hosts/rico0/services/apps/prometheus.nix
@@ -1,20 +1,31 @@
 _: {
-  services.prometheus = {
-    enable = true;
-    listenAddress = "10.10.10.10";
-    scrapeConfigs = [
-      {
-        job_name = "frp";
-        static_configs = [
-          { targets = [ "10.10.10.1:7500" ]; }
-        ];
-      }
-      {
-        job_name = "blocky";
-        static_configs = [
-          { targets = [ "10.10.10.10:8080" ]; }
-        ];
-      }
-    ];
+  services = {
+    caddy = {
+      virtualHosts."prometheus.labs.adtya.xyz" = {
+        extraConfig = ''
+          reverse_proxy 127.0.0.1:9090
+          tls /persist/secrets/caddy/certs/prometheus.crt /persist/secrets/caddy/certs/prometheus.key
+        '';
+      };
+    };
+    prometheus = {
+      enable = true;
+      listenAddress = "127.0.0.1";
+      scrapeConfigs = [
+        {
+          job_name = "frp";
+          scheme = "https";
+          static_configs = [
+            { targets = [ "frp.labs.adtya.xyz" ]; }
+          ];
+        }
+        {
+          job_name = "blocky";
+          static_configs = [
+            { targets = [ "10.10.10.10:8080" ]; }
+          ];
+        }
+      ];
+    };
   };
 }