diff --git a/services/portainer.md b/services/portainer.md
index c2d03fe..5c6275c 100644
--- a/services/portainer.md
+++ b/services/portainer.md
@@ -119,6 +119,26 @@ docker logs portainer -f
 python3 /usr/local/sbin/portainer-backup.py
 ```
 
+## Observability
+
+Portainer metrics scraped by Prometheus on CT 109 at `/api/metrics`.
+
+- **Auth**: `X-API-Key: ptr_tJhUVPuut6wreG6yTkuRZcfM0Rlu8Jehbx7+LHG4unc=` (prometheus-scrape API token, user fkrebs)
+- **Prometheus job**: `portainer` in `/opt/stacks/monitoring/prometheus/prometheus.yml`
+- **Grafana dashboard**: `http://192.168.1.8:3000/d/portainer-be/portainer-be`
+  - Environment count, health status table, CPU/memory per environment, auth attempt rate
+- **Alert rules**: `/opt/stacks/monitoring/prometheus/rules/portainer.yml`
+  - `PortainerEnvironmentUnhealthy` — env status == 2 for >2m → warning
+  - `PortainerDown` — scrape target unreachable for >1m → critical
+
+Key metrics:
+| Metric | Description |
+|---|---|
+| `portainer_environment_count` | Total environments by type (docker/k8s/swarm) |
+| `portainer_environment_status` | 1=healthy, 2=unhealthy per environment |
+| `portainer_environment_resource_usage` | CPU/memory % per environment |
+| `portainer_authentication_total_status` | Auth success/fail counters |
+
 ## Arcane decommission (2026-05-26)
 
 Arcane was replaced by Portainer on 2026-05-26: