diff --git a/README.md b/README.md
index ffd66083..586c1f9b 100644
--- a/README.md
+++ b/README.md
@@ -406,7 +406,7 @@ Note: Logstash integration is missing in [#31](https://github.com/Icinga/icinga-
   ------------------|-----------------------------------|----------------
   Icinga Web 2      | http://192.168.33.7/icingaweb2    | icingaadmin/icinga
   Icinga 2 API      | https://192.168.33.7:5665/v1      | root/icinga
-  Kibana            | http://192.168.33.7:5601          | -
+  Kibana            | https://192.168.33.7:5601         | icinga/icinga
   Elasticsearch/Nginx | https://192.168.33.7:9200	| icinga/icinga
 
 ### <a id="icinga2x-graylog"></a>Icinga 2 and Graylog
diff --git a/icinga2x-elastic/manifests/default.pp b/icinga2x-elastic/manifests/default.pp
index 1f03916e..7aa1d157 100644
--- a/icinga2x-elastic/manifests/default.pp
+++ b/icinga2x-elastic/manifests/default.pp
@@ -267,7 +267,7 @@
   ensure => "$kibanaVersion-1",
   config => {
     'server.port'                  => 5601,
-    'server.host'                  => '0.0.0.0',
+    'server.host'                  => '127.0.0.1',
     'kibana.index'                 => '.kibana',
     'kibana.defaultAppId'          => "$kibanaDefaultAppId",
     'logging.silent'               => false,
@@ -298,6 +298,20 @@
   auth_basic_user_file => "$elasticsearchBasicAuthFile",
   require     => File['/etc/icinga2']
 }->
+nginx::resource::server { 'kibana.vagrant-demo.icinga.com':
+  listen_ip   => '192.168.33.7',
+  listen_port => 5601,
+  ssl         => true,
+  ssl_port    => 5601,
+  ssl_cert    => '/etc/icinga2/pki/icinga2-elastic.crt',
+  ssl_key     => '/etc/icinga2/pki/icinga2-elastic.key',
+  ssl_trusted_cert => '/etc/icinga2/pki/ca.crt',
+  ipv6_listen_port => 5601,
+  proxy       => 'http://localhost:5601',
+  auth_basic  => 'Kibana auth',
+  auth_basic_user_file => "$elasticsearchBasicAuthFile",
+  require     => File['/etc/icinga2']
+}->
 class { 'filebeat':
   outputs => {
     'elasticsearch' => {