diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/grafana.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/grafana.yaml
new file mode 100644
index 0000000..f965123
--- /dev/null
+++ b/apps/base/bind-internal/authoritative/unkin-net/a/grafana.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: DNSRecord
+metadata:
+  name: grafana-dns-internal
+  namespace: bind-internal
+spec:
+  zoneRef: unkin-net
+  name: grafana
+  type: A
+  ttl: 600
+  values:
+    # traefik-EXTERNAL (DMZ) gateway VIP; the grafana-external Gateway serves
+    # grafana.unkin.net there.
+    - 198.18.199.0
diff --git a/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml b/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml
index b0e9d9f..c10613a 100644
--- a/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml
+++ b/apps/base/bind-internal/authoritative/unkin-net/a/kustomization.yaml
@@ -9,6 +9,7 @@ resources:
   # record itself.
   # - git.yaml
   - ghp.yaml
+  - grafana.yaml
   - identity.yaml
   - lb1.yaml
   - logviewer.yaml
diff --git a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
index 6349a3e..a28c2cf 100644
--- a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
+++ b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml
@@ -14,9 +14,9 @@ spec:
   secretTemplate:
     annotations:
       reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs,grafana"
       reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner,haproxy,vlogs,grafana"
   privateKey:
     size: 4096
   dnsNames:
diff --git a/apps/base/grafana/gateway.yaml b/apps/base/grafana/gateway.yaml
index eee305d..e64cc87 100644
--- a/apps/base/grafana/gateway.yaml
+++ b/apps/base/grafana/gateway.yaml
@@ -37,3 +37,36 @@ spec:
           - group: ""
             kind: Secret
             name: grafana-tls
+---
+# Public grafana.unkin.net via the external Traefik; TLS uses the reflected
+# Let's Encrypt *.unkin.net wildcard, DNS lives in the bind-operator zone.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: external
+  name: grafana-external
+  namespace: grafana
+spec:
+  gatewayClassName: traefik-external
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: grafana.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: grafana.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: wildcard-unkin-net-tls
+        mode: Terminate
diff --git a/apps/base/grafana/grafana.yaml b/apps/base/grafana/grafana.yaml
index 3cacd55..1a1c323 100644
--- a/apps/base/grafana/grafana.yaml
+++ b/apps/base/grafana/grafana.yaml
@@ -43,7 +43,7 @@ spec:
                   memory: 4Gi
   config:
     server:
-      root_url: "https://grafana.k8s.syd1.au.unkin.net"
+      root_url: "https://grafana.unkin.net"
     database:
       type: "postgres"
       host: "postgres-pooler-rw.grafana.svc.cluster.local:5432"
diff --git a/apps/base/grafana/httproute.yaml b/apps/base/grafana/httproute.yaml
index 254e199..20b316c 100644
--- a/apps/base/grafana/httproute.yaml
+++ b/apps/base/grafana/httproute.yaml
@@ -53,3 +53,58 @@ spec:
         - path:
             type: PathPrefix
             value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana-external-http-redirect
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: grafana
+    app.kubernetes.io/instance: grafana
+spec:
+  hostnames:
+    - grafana.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: grafana-external
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana-external
+  namespace: grafana
+  labels:
+    app.kubernetes.io/name: grafana
+    app.kubernetes.io/instance: grafana
+spec:
+  hostnames:
+    - grafana.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: grafana-external
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: grafana-service
+          port: 3000
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
diff --git a/apps/base/haproxy/configmap.yaml b/apps/base/haproxy/configmap.yaml
index 9a79587..4bd62cb 100644
--- a/apps/base/haproxy/configmap.yaml
+++ b/apps/base/haproxy/configmap.yaml
@@ -21,7 +21,6 @@ data:
     jellyfin.main.unkin.net be_jellyfin
     fafflix.unkin.net be_jellyfin
     git.unkin.net be_gitea
-    grafana.unkin.net be_grafana
     dashboard.ceph.unkin.net be_ceph_dashboard
     auth.unkin.net be_k8s_kanidm
 
@@ -124,23 +123,6 @@ data:
       server ausyd1nxvm2081 198.18.27.117:443 check cookie ausyd1nxvm2081 fall 2 inter 2s rise 3 ssl verify none
       server ausyd1nxvm2082 198.18.28.71:443 check cookie ausyd1nxvm2082 fall 2 inter 2s rise 3 ssl verify none
 
-    backend be_grafana
-      description Backend for grafana nodes
-      balance roundrobin
-      cookie SRVNAME insert indirect nocache
-      http-request set-header X-Forwarded-Port %[dst_port]
-      http-request add-header X-Forwarded-Proto https if { dst_port 443 }
-      http-reuse always
-      option httpchk GET /
-      option forwardfor
-      option http-keep-alive
-      option prefer-last-server
-      redirect scheme https if !{ ssl_fc }
-      stick on src
-      stick-table type ip size 200k expire 30m
-      server ausyd1nxvm2015 198.18.27.2:443 check cookie ausyd1nxvm2015 fall 2 inter 2s rise 3 ssl verify none
-      server ausyd1nxvm2016 198.18.28.189:443 check cookie ausyd1nxvm2016 fall 2 inter 2s rise 3 ssl verify none
-
     backend be_jellyfin
       description Backend for au-syd1 jellyfin
       balance roundrobin
diff --git a/apps/base/haproxy/httproute.yaml b/apps/base/haproxy/httproute.yaml
index 6778452..9ca1411 100644
--- a/apps/base/haproxy/httproute.yaml
+++ b/apps/base/haproxy/httproute.yaml
@@ -17,7 +17,6 @@ spec:
     - jellyfin.main.unkin.net
     - fafflix.unkin.net
     - git.unkin.net
-    - grafana.unkin.net
     - dashboard.ceph.unkin.net
     - auth.unkin.net
   parentRefs:
diff --git a/apps/base/haproxy/tlsroute.yaml b/apps/base/haproxy/tlsroute.yaml
index 530c9d3..1a2c37c 100644
--- a/apps/base/haproxy/tlsroute.yaml
+++ b/apps/base/haproxy/tlsroute.yaml
@@ -17,7 +17,6 @@ spec:
     - jellyfin.main.unkin.net
     - fafflix.unkin.net
     - git.unkin.net
-    - grafana.unkin.net
     - dashboard.ceph.unkin.net
     - auth.unkin.net
   parentRefs: