diff --git a/data/subnets/vagrant.yaml b/data/subnets/vagrant.yaml
--- a/data/subnets/vagrant.yaml
+++ b/data/subnets/vagrant.yaml
@@ -125,6 +125,8 @@
     host: beaubourg.internal.softwareheritage.org
   10.168.100.34:
     host: hypervisor3.internal.softwareheritage.org
+  10.168.100.51:
+    host: granet.internal.softwareheritage.org
   10.168.100.61:
     host: esnode1.internal.softwareheritage.org
   10.168.100.62:
diff --git a/site-modules/profile/manifests/swh/deploy/graph.pp b/site-modules/profile/manifests/swh/deploy/graph.pp
--- a/site-modules/profile/manifests/swh/deploy/graph.pp
+++ b/site-modules/profile/manifests/swh/deploy/graph.pp
@@ -16,6 +16,8 @@
   $sentry_environment = lookup("swh::deploy::graph::sentry_environment", Optional[String], 'first', undef)
   $sentry_swh_package = lookup("swh::deploy::graph::sentry_swh_package", Optional[String], 'first', undef)
 
+  $java_api_port = 50091 # hardcoded in swh-graph
+
   # install services from templates
   $services = [ {  # this matches the current status
     'name' => 'swh-graph-shm-mount',
@@ -59,8 +61,8 @@
 
   # swh-graph.service exposes the main graph server.
   # Ensure the port is working ok through icinga checks
-  @@::icinga2::object::service {"swh-graph api (local on ${::fqdn})":
-    service_name     => "swh-graph api (localhost)",
+  @@::icinga2::object::service {"swh-graph grpc api (local on ${::fqdn})":
+    service_name     => 'swh-graph grpc api (localhost)',
     import           => ['generic-service'],
     host_name        => $::fqdn,
     check_command    => 'http',
@@ -77,9 +79,24 @@
     tag              => 'icinga2::exported',
   }
 
+  @@::icinga2::object::service {"swh-graph java api (local on ${::fqdn})":
+    service_name     => 'swh-graph java api (localhost)',
+    import           => ['generic-service'],
+    host_name        => $::fqdn,
+    check_command    => 'tcp',
+    command_endpoint => $::fqdn,
+    vars             => {
+      tcp_port    => $java_api_port,
+      tcp_address => $local_check_address,
+    },
+    target           => $icinga_checks_file,
+    tag              => 'icinga2::exported',
+  }
+
+
   if $backend_listen_host != '127.0.0.1' {
     @@::icinga2::object::service {"swh-graph api (remote on ${::fqdn})":
-      service_name  => "swh-graph api (remote)",
+      service_name  => 'swh-graph grpc api (remote)',
       import        => ['generic-service'],
       host_name     => $::fqdn,
       check_command => 'http',