diff --git a/data/common/common.yaml b/data/common/common.yaml
--- a/data/common/common.yaml
+++ b/data/common/common.yaml
@@ -3087,6 +3087,9 @@
 prometheus::nginx::listen_network: "%{lookup('internal_network')}"
 prometheus::nginx::listen_port: 9103
 
+prometheus::varnish::listen_network: "%{lookup('internal_network')}"
+prometheus::varnish::listen_port: 9104
+
 grafana::db::database: grafana
 grafana::db::username: grafana
 # grafana::db::password in private-data
diff --git a/site-modules/profile/manifests/prometheus/nginx.pp b/site-modules/profile/manifests/prometheus/nginx.pp
--- a/site-modules/profile/manifests/prometheus/nginx.pp
+++ b/site-modules/profile/manifests/prometheus/nginx.pp
@@ -1,4 +1,4 @@
-# Prometheus configuration for statsd exporter
+# Prometheus configuration for nginx exporter
 class profile::prometheus::nginx {
   include profile::prometheus::base
 
diff --git a/site-modules/profile/manifests/prometheus/varnish.pp b/site-modules/profile/manifests/prometheus/varnish.pp
new file mode 100644
--- /dev/null
+++ b/site-modules/profile/manifests/prometheus/varnish.pp
@@ -0,0 +1,53 @@
+# Prometheus configuration for varnish exporter
+class profile::prometheus::varnish {
+  include profile::prometheus::base
+
+  $defaults_file = '/etc/default/prometheus-varnish-exporter'
+  $varnish_user = 'varnish'
+  $listen_network = lookup('prometheus::varnish::listen_network')
+  $listen_address = pick($listen_address, ip_for_network($listen_network))
+  $listen_port = lookup('prometheus::varnish::listen_port')
+  $exporter_url = "${listen_address}:${listen_port}"
+
+  package {'prometheus-varnish-exporter':
+    ensure => present,
+    notify => Service['prometheus-varnish-exporter'],
+  }
+
+  service {'prometheus-varnish-exporter':
+    ensure  => 'running',
+    enable  => true,
+    require => [
+      Package['prometheus-varnish-exporter'],
+      File[$defaults_file],
+    ]
+  }
+
+  ::systemd::dropin_file {'prometheus-varnish-exporter/config.conf':
+    ensure   => present,
+    unit     => 'prometheus-varnish-exporter.service',
+    filename => 'user.conf',
+    content  => "[Service]\nUser=${varnish_user}\n",
+  }
+  ::systemd::dropin_file {'prometheus-varnish-exporter/restart.conf':
+    ensure   => present,
+    unit     => 'prometheus-varnish-exporter.service',
+    filename => 'restart.conf',
+    content  => "[Service]\nRestart=always\nRestartSec=5\n",
+  }
+
+  # Uses $exporter_url
+  file {$defaults_file:
+    ensure  => 'present',
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('profile/prometheus/varnish/prometheus-varnish-exporter.defaults.erb'),
+    require => Package['prometheus-varnish-exporter'],
+    notify  => Service['prometheus-varnish-exporter'],
+  }
+
+  profile::prometheus::export_scrape_config {'varnish':
+    target => $exporter_url,
+  }
+}
diff --git a/site-modules/profile/manifests/varnish.pp b/site-modules/profile/manifests/varnish.pp
--- a/site-modules/profile/manifests/varnish.pp
+++ b/site-modules/profile/manifests/varnish.pp
@@ -94,4 +94,6 @@
     content => file('profile/varnish/unknown_vhost_then_forbidden_access.vcl'),
   }
 
+  include profile::prometheus::varnish
+
 }
diff --git a/site-modules/profile/templates/prometheus/varnish/prometheus-varnish-exporter.defaults.erb b/site-modules/profile/templates/prometheus/varnish/prometheus-varnish-exporter.defaults.erb
new file mode 100644
--- /dev/null
+++ b/site-modules/profile/templates/prometheus/varnish/prometheus-varnish-exporter.defaults.erb
@@ -0,0 +1,21 @@
+# Managed by Puppet (class profile::prometheus::varnish), changes will be lost.
+
+ARGS="-raw -web.listen-address <%= @exporter_url %>"
+
+# Usage of prometheus-varnish-exporter:
+#   -N string
+#       varnishstat -N value.
+#   -n string
+#       varnishstat -n value.
+#   -raw
+#       Raw stdout logging without timestamps.
+#   -test
+#       Test varnishstat availability, prints available metrics and exits.
+#   -verbose
+#       Verbose logging.
+#   -version
+#       Print version and exit
+#   -web.listen-address string
+#       Address on which to expose metrics and web interface. (default ":9131")
+#   -web.telemetry-path string
+#       Path under which to expose metrics. (default "/metrics")