diff --git a/hosts/prometheus/default.nix b/hosts/prometheus/default.nix
index 38b4b0bf..c36ef496 100644
--- a/hosts/prometheus/default.nix
+++ b/hosts/prometheus/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ zentralwerk, config, pkgs, lib, ... }:
 
 {
   sops.defaultSopsFile = ./secrets.yaml;
@@ -13,6 +13,7 @@
 
   services.prometheus = {
     enable = true;
+    retentionTime = "7d";
 
     alertmanager = {
       enable = true;
@@ -56,6 +57,34 @@
       web.external-url = "https://prometheus.serv.zentralwerk.org/push/";
     };
 
+    scrapeConfigs = [ {
+      # TODO: authorization?
+      job_name = "node";
+      scrape_interval = "1m";
+      static_configs =
+        let
+          zwNets = zentralwerk.lib.config.site.net;
+          fromNet = net: filter:
+            map (host:
+              "${host}.${net}.zentralwerk.org:9100"
+            ) (builtins.attrNames zwNets.${net}.hosts4);
+        in [ {
+          targets =
+            fromNet "serv" (_: true);
+          labels.__meta_net = "net-serv";
+        } {
+          targets =
+            fromNet "flpk" (host: host != "flpk-gw");
+          labels.__meta_net = "net-flpk";
+        } {
+          targets =
+            fromNet "cluster" (host: builtins.elem host [
+              "server8" "server9" "server10"
+            ]);
+          labels.__meta_net = "net-flpk";
+        } ];
+    } ];
+
     exporters.collectd.enable = true;
     exporters.collectd.openFirewall = true;