diff --git a/morph/grid/testing/config.json b/morph/grid/testing/config.json
index e9b3b96940ab6cc73ef6b6f8dc2ec89a83a463d9..7e8eac29a3ff7455954687582046f11780cbfcd1 100644
--- a/morph/grid/testing/config.json
+++ b/morph/grid/testing/config.json
@@ -1,6 +1,7 @@
 { "publicStoragePort": 8898
 , "ristrettoSigningKeyPath": "../../PrivateStorageSecrets/ristretto.signing-key"
 , "stripeSecretKeyPath": "../../PrivateStorageSecrets/privatestorageio-testing-stripe.secret"
+, "monitoringvpnSecretKeyDir": "../../PrivateStorageSecrets/monitoringvpn"
 , "passValue": 1000000
 , "issuerDomain": "payments.privatestorage-staging.com"
 , "letsEncryptAdminEmail": "jean-paul@privatestorage.io"
diff --git a/morph/grid/testing/grid.nix b/morph/grid/testing/grid.nix
index 760826b8665f149742b6602288e153e209e00488..ed002cbe0a23a60874201c1dbf6bea15a36a1d87 100644
--- a/morph/grid/testing/grid.nix
+++ b/morph/grid/testing/grid.nix
@@ -12,6 +12,16 @@ import ../../lib/make-grid.nix {
       else default
     );
     sshUsers = importDef {} ../../../../PrivateStorageSecrets/staging-users.nix;
+
+    # TBD: derive these automatically:
+    hostsMap = {
+      "172.23.23.1"  = [ "monitoring" "monitoring.monitoringvpn" ];
+      "172.23.23.11" = [ "payments" "payments.monitoringvpn" ];
+      "172.23.23.12" = [ "storage001" "storage001.monitoringvpn" ];
+    };
+    vpnClientIPs = [ "172.23.23.11" "172.23.23.12" ];
+    nodeExporterTargets = [ "monitoring" "payments" "storage001" ];
+
   in {
     "payments" = import ../../lib/make-issuer.nix ({
       publicIPv4 = "18.197.42.120";
@@ -23,10 +33,22 @@ import ../../lib/make-grid.nix {
 
     "storage001" = import ../../lib/make-testing.nix (cfg // {
       publicIPv4 = "3.120.26.190";
-      monitoringvpnIPv4 = "172.23.23.11";
+      monitoringvpnIPv4 = "172.23.23.12";
       inherit sshUsers;
       hardware = ./testing001-hardware.nix;
       stateVersion = "19.03";
     });
+
+    "monitoring" = import ../../lib/make-monitoring.nix ({
+      publicIPv4 = "18.156.171.217";
+      monitoringvpnIPv4 = "172.23.23.1";
+      inherit vpnClientIPs;
+      inherit hostsMap;
+      inherit nodeExporterTargets;
+      nginxExporterTargets = [ ];
+      hardware = ../../lib/issuer-aws.nix;
+      stateVersion = "19.09";
+      inherit sshUsers;
+    } // cfg);
   };
 }