diff --git a/data/common/common.yaml b/data/common/common.yaml
--- a/data/common/common.yaml
+++ b/data/common/common.yaml
@@ -2955,6 +2955,8 @@
 nginx::names_hash_bucket_size: 128
 nginx::names_hash_max_size: 1024
 nginx::worker_processes: "%{::processorcount}"
+nginx::metrics_port: 9081
+nginx::metrics_location: '/metrics'
 
 # prometheus::pve-exporter::password in credential
 prometheus::pve-exporter::user: pve_exporter@pve
@@ -3082,6 +3084,8 @@
 
 prometheus::rabbitmq::exclude_metrics: []
 
+prometheus::nginx::listen_network: "%{lookup('internal_network')}"
+prometheus::nginx::listen_port: 9103
 
 grafana::db::database: grafana
 grafana::db::username: grafana
diff --git a/site-modules/profile/manifests/nginx.pp b/site-modules/profile/manifests/nginx.pp
--- a/site-modules/profile/manifests/nginx.pp
+++ b/site-modules/profile/manifests/nginx.pp
@@ -7,6 +7,9 @@
   $names_hash_bucket_size = lookup('nginx::names_hash_bucket_size')
   $names_hash_max_size = lookup('nginx::names_hash_max_size')
   $worker_processes = lookup('nginx::worker_processes')
+  $metrics_port = lookup('nginx::metrics_port')
+  $metrics_location = lookup('nginx::metrics_location')
+
   if $worker_processes != 'auto' {
     $actual_worker_processes = $worker_processes + 0
   } else {
@@ -31,4 +34,17 @@
       '404'    => '0',
     }
   }
+
+  # metrics vhosts
+  ::nginx::resource::server {'nginx-metrics':
+    ensure         => present,
+    listen_ip      => '127.0.0.1',
+    listen_port    => $metrics_port,
+    listen_options => 'deferred',
+    server_name    => [ '127.0.0.1', 'localhost' ],
+    format_log     => 'combined',
+    locations      => { $metrics_location => { 'stub_status' => true }},
+  }
+
+  include profile::prometheus::nginx
 }
diff --git a/site-modules/profile/manifests/prometheus/nginx.pp b/site-modules/profile/manifests/prometheus/nginx.pp
new file mode 100644
--- /dev/null
+++ b/site-modules/profile/manifests/prometheus/nginx.pp
@@ -0,0 +1,42 @@
+# Prometheus configuration for statsd exporter
+class profile::prometheus::nginx {
+  include profile::prometheus::base
+
+  $defaults_file = '/etc/default/prometheus-nginx-exporter'
+  $nginx_metrics_port = lookup('nginx::metrics_port')
+  $nginx_metrics_location = lookup('nginx::metrics_location')
+  $scrape_uri = "http://127.0.0.1:${nginx_metrics_port}${nginx_metrics_location}"
+  $listen_network = lookup('prometheus::nginx::listen_network')
+  $listen_address = pick($listen_address, ip_for_network($listen_network))
+  $listen_port = lookup('prometheus::nginx::listen_port')
+  $target = "${listen_address}:${listen_port}"
+
+  package {'prometheus-nginx-exporter':
+    ensure => present,
+    notify => Service['prometheus-nginx-exporter'],
+  }
+
+  service {'prometheus-nginx-exporter':
+    ensure  => 'running',
+    enable  => true,
+    require => [
+      Package['prometheus-nginx-exporter'],
+      File[$defaults_file],
+    ]
+  }
+
+  # Uses $target and $scrape_uri
+  file {$defaults_file:
+    ensure  => 'present',
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('profile/prometheus/nginx/prometheus-nginx-exporter.defaults.erb'),
+    require => Package['prometheus-nginx-exporter'],
+    notify  => Service['prometheus-nginx-exporter'],
+  }
+
+  profile::prometheus::export_scrape_config {'nginx':
+    target => $target,
+  }
+}
diff --git a/site-modules/profile/templates/prometheus/nginx/prometheus-nginx-exporter.defaults.erb b/site-modules/profile/templates/prometheus/nginx/prometheus-nginx-exporter.defaults.erb
new file mode 100644
--- /dev/null
+++ b/site-modules/profile/templates/prometheus/nginx/prometheus-nginx-exporter.defaults.erb
@@ -0,0 +1,16 @@
+# Managed by Puppet (class profile::prometheus::nginx), changes will be lost.
+
+ARGS="--nginx.scrape-uri <%= @scrape_uri %> --web.listen-address <%= @target %>"
+
+# Prometheus-nginx-exporter supports the following options:
+#  -nginx.plus
+#        Start the exporter for NGINX Plus. By default, the exporter is started
+#        for NGINX.
+#  -nginx.scrape-uri string
+#        A URI for scraping NGINX or NGINX Plus metrics.
+#        For NGINX, the stub_status page must be available through the URI.
+#        For NGINX Plus -- the API. (default "http://127.0.0.1:8080/stub_status")
+#  -web.listen-address string
+#        An address to listen on for web interface and telemetry. (default ":9113")
+#  -web.telemetry-path string
+#        A path under which to expose metrics. (default "/metrics"