diff --git a/.env.sample b/.env.sample
index 9acb3be..f8215d3 100644
--- a/.env.sample
+++ b/.env.sample
@@ -17,6 +17,10 @@ ENABLE_BACKUPS=true
 ## Prometheus
 # COMPOSE_FILE="$COMPOSE_FILE:compose.prometheus.yml"
 # PROMETHEUS_RETENTION_TIME=1y
+#
+## Prometheus Pushgateway
+# COMPOSE_FILE="$COMPOSE_FILE:compose.pushgateway.yml"
+#
 ## Loki
 # Loki Server
 #
diff --git a/README.md b/README.md
index 7e29ad2..3ce78de 100644
--- a/README.md
+++ b/README.md
@@ -101,8 +101,17 @@ $ echo '{
 $ systemctl restart docker.service
 ```
 
+## Setup Push Gateway
 
+1. Enable in the env fiöle by uncommenting the following lines:
+```
+## Prometheus Pushgateway
+# COMPOSE_FILE="$COMPOSE_FILE:compose.pushgateway.yml"
+```
+2. `abra app deploy monitoring.example.org`
 
+This will expose the pushgateway at `https://pushgateway.${DOMAIN}`.
+It is secured behind the same basic auth as the other services.
 
 ## Post-setup guide
 
diff --git a/compose.pushgateway.yml b/compose.pushgateway.yml
new file mode 100644
index 0000000..75a826a
--- /dev/null
+++ b/compose.pushgateway.yml
@@ -0,0 +1,25 @@
+version: '3.8'
+
+services:
+  pushgateway:
+    image: prom/pushgateway:v1.10.0
+    command:
+      - '--web.listen-address=:9191'
+      - '--push.disable-consistency-check'
+      - '--persistence.interval=5m'
+    ports:
+      - 9191:9191
+    networks:
+      - internal
+      - proxy
+    deploy:
+      restart_policy:
+        condition: on-failure
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.services.${STACK_NAME}-pushgateway.loadbalancer.server.port=9191"
+        - "traefik.http.routers.${STACK_NAME}-pushgateway.rule=Host(`pushgateway.${DOMAIN}`)"
+        - "traefik.http.routers.${STACK_NAME}-pushgateway.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}-pushgateway.tls=true"
+        - "traefik.http.routers.${STACK_NAME}-pushgateway.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.http.routers.${STACK_NAME}-pushgateway.middlewares=basicauth@file"