diff --git a/flake.nix b/flake.nix
index 77e8f92..a658cd6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -51,6 +51,7 @@
           ./machines/auth.domain.com/configuration.nix
           ./machines/auth.domain.com/hardware-configuration.nix
           ./modules/keycloak.nix
+          ./modules/gatus_service.nix
         ] ++ sharedModules;
       };
 
@@ -64,4 +65,4 @@
       };
     };
   };
-}
\ No newline at end of file
+}
diff --git a/machines/auth.domain.com/configuration.nix b/machines/auth.domain.com/configuration.nix
index 6948bd8..5e79527 100644
--- a/machines/auth.domain.com/configuration.nix
+++ b/machines/auth.domain.com/configuration.nix
@@ -39,6 +39,23 @@
     };
   };
 
+  infra.gatus = {
+    enable = true;
+    hostname = "status.domain.com";
+    title = "Status";
+    endpoints = [
+      {
+        name = "Keycloak";
+        url = "https://auth.domain.com/health";
+        interval = "1m";
+        conditions = [
+          "[STATUS] == 200"
+          "[RESPONSE_TIME] < 500"
+        ];
+      }
+    ];
+  };
+
   infra.autoUpdate = {
     enable = true;
     # selects the nixosConfigurations.auth.domain.com output from the flake
diff --git a/modules/gatus_service.nix b/modules/gatus_service.nix
new file mode 100644
index 0000000..d981181
--- /dev/null
+++ b/modules/gatus_service.nix
@@ -0,0 +1,70 @@
+{ config, lib, pkgs, domain, ... }:
+
+with lib;
+
+let
+  cfg = config.infra.gatus;
+in {
+  options.infra.gatus = {
+    enable = mkEnableOption "Gatus status page behind nginx";
+
+    hostname = mkOption {
+      type = types.str;
+      default = "status.${domain}";
+      description = "Virtual host name serving the Gatus status page";
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 8081;
+      description = "Port Gatus listens on locally";
+    };
+
+    title = mkOption {
+      type = types.str;
+      default = "Status";
+      description = "Title shown in the Gatus UI";
+    };
+
+    endpoints = mkOption {
+      type = types.listOf types.attrs;
+      default = [ ];
+      description = ''
+        Gatus endpoint definitions.
+        See https://gatus.io/docs/configure-endpoints
+      '';
+    };
+
+    extraSettings = mkOption {
+      type = types.attrs;
+      default = { };
+      description = "Extra settings merged into services.gatus.settings";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.gatus = {
+      enable = true;
+      settings = mkMerge [
+        {
+          web.port = cfg.port;
+          storage = {
+            type = "sqlite";
+            path = "/var/lib/gatus/data.db";
+          };
+          ui.title = cfg.title;
+          endpoints = cfg.endpoints;
+        }
+        cfg.extraSettings
+      ];
+    };
+
+    services.nginx = {
+      enable = true;
+      virtualHosts.${cfg.hostname}.locations."/".proxyPass =
+        "http://127.0.0.1:${toString cfg.port}";
+    };
+
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+  };
+}
\ No newline at end of file