diff --git a/modules/hosts/arcturus/config.nix b/modules/hosts/arcturus/config.nix
index 4026d91..b737c59 100644
--- a/modules/hosts/arcturus/config.nix
+++ b/modules/hosts/arcturus/config.nix
@@ -57,6 +57,7 @@
           vaultwarden = {
             enable = true;
             domain = "bw.lab.tux.rs";
+            configurePangolin = true;
           };
         };
 
diff --git a/modules/nixos/services/aiostreams.nix b/modules/nixos/services/aiostreams.nix
index 9c60f87..64b60df 100644
--- a/modules/nixos/services/aiostreams.nix
+++ b/modules/nixos/services/aiostreams.nix
@@ -39,6 +39,12 @@
           description = "Whether to configure Nginx as a reverse proxy for AIOStreams";
         };
 
+        configurePangolin = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to configure Pangolin as a reverse proxy for AIOStreams";
+        };
+
         image = mkOption {
           type = types.str;
           default = "ghcr.io/viren070/aiostreams:latest";
@@ -81,12 +87,39 @@
           ];
         };
 
-        services.nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
-          forceSSL = acmeHost != "";
-          useACMEHost = mkIf (acmeHost != "") acmeHost;
-          locations."/" = {
-            proxyPass = "http://${cfg.host}:${port}";
-            proxyWebsockets = true;
+        services = {
+          nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
+            forceSSL = acmeHost != "";
+            useACMEHost = mkIf (acmeHost != "") acmeHost;
+            locations."/" = {
+              proxyPass = "http://${cfg.host}:${port}";
+              proxyWebsockets = true;
+            };
+          };
+
+          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
+            aiostreams = {
+              auth = {
+                sso-enabled = false;
+              };
+              full-domain = cfg.domain;
+              name = "aiostreams";
+              protocol = "http";
+              targets = [
+                {
+                  hostname = "localhost";
+                  method = "http";
+                  port = cfg.port;
+                  healthcheck = {
+                    hostname = "localhost";
+                    port = cfg.port;
+                    scheme = "http";
+                    method = "GET";
+                    path = "/";
+                  };
+                }
+              ];
+            };
           };
         };
       };
diff --git a/modules/nixos/services/mediaflow-proxy.nix b/modules/nixos/services/mediaflow-proxy.nix
index 61dda03..ba5cac3 100644
--- a/modules/nixos/services/mediaflow-proxy.nix
+++ b/modules/nixos/services/mediaflow-proxy.nix
@@ -39,6 +39,12 @@
           description = "Whether to configure Nginx as a reverse proxy for MediaFlow Proxy";
         };
 
+        configurePangolin = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to configure Pangolin as a reverse proxy for MediaFlow Proxy";
+        };
+
         image = mkOption {
           type = types.str;
           default = "ghcr.io/mhdzumair/mediaflow-proxy-light:latest";
@@ -56,7 +62,11 @@
         assertions = [
           {
             assertion = !cfg.configureNginx || cfg.domain != "";
-            message = "tnix.services.mediaflow-proxy.domain must be set when configureNginx is enabled.";
+            message = "tnix.services.mediaflow-proxy.domain must be set when tnix.services.mediaflow-proxy.configureNginx is enabled.";
+          }
+          {
+            assertion = !cfg.configurePangolin || cfg.domain != "";
+            message = "tnix.services.mediaflow-proxy.domain must be set when tnix.services.mediaflow-proxy.configurePangolin is enabled.";
           }
         ];
 
@@ -72,12 +82,39 @@
           environmentFiles = optional (cfg.environmentFile != null) cfg.environmentFile;
         };
 
-        services.nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
-          forceSSL = acmeHost != "";
-          useACMEHost = mkIf (acmeHost != "") acmeHost;
-          locations."/" = {
-            proxyPass = "http://${cfg.host}:${port}";
-            proxyWebsockets = true;
+        services = {
+          nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
+            forceSSL = acmeHost != "";
+            useACMEHost = mkIf (acmeHost != "") acmeHost;
+            locations."/" = {
+              proxyPass = "http://${cfg.host}:${port}";
+              proxyWebsockets = true;
+            };
+          };
+
+          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
+            mediaflow-proxy = {
+              auth = {
+                sso-enabled = false;
+              };
+              full-domain = cfg.domain;
+              name = "mediaflow-proxy";
+              protocol = "http";
+              targets = [
+                {
+                  hostname = "localhost";
+                  method = "http";
+                  port = cfg.port;
+                  healthcheck = {
+                    hostname = "localhost";
+                    port = cfg.port;
+                    scheme = "http";
+                    method = "GET";
+                    path = "/";
+                  };
+                }
+              ];
+            };
           };
         };
       };
diff --git a/modules/nixos/services/uptime-kuma.nix b/modules/nixos/services/uptime-kuma.nix
index 218a5f5..52fc8c3 100644
--- a/modules/nixos/services/uptime-kuma.nix
+++ b/modules/nixos/services/uptime-kuma.nix
@@ -38,6 +38,12 @@
           default = false;
           description = "Whether to configure Nginx as a reverse proxy for Uptime Kuma";
         };
+
+        configurePangolin = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to configure Pangolin as a reverse proxy for Uptime Kuma";
+        };
       };
 
       config = mkIf cfg.enable {
@@ -65,6 +71,31 @@
               proxyWebsockets = true;
             };
           };
+
+          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
+            uptime-kuma = {
+              auth = {
+                sso-enabled = false;
+              };
+              full-domain = cfg.domain;
+              name = "uptime-kuma";
+              protocol = "http";
+              targets = [
+                {
+                  hostname = "localhost";
+                  method = "http";
+                  port = cfg.port;
+                  healthcheck = {
+                    hostname = "localhost";
+                    port = cfg.port;
+                    scheme = "http";
+                    method = "GET";
+                    path = "/";
+                  };
+                }
+              ];
+            };
+          };
         };
       };
     };
diff --git a/modules/nixos/services/vaultwarden.nix b/modules/nixos/services/vaultwarden.nix
index d4f1eda..e2ac87b 100644
--- a/modules/nixos/services/vaultwarden.nix
+++ b/modules/nixos/services/vaultwarden.nix
@@ -38,6 +38,12 @@
           default = false;
           description = "Whether to configure Nginx as a reverse proxy for Vaultwarden";
         };
+
+        configurePangolin = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to configure Pangolin as a reverse proxy for Vaultwarden";
+        };
       };
 
       config = mkIf cfg.enable {
@@ -73,6 +79,31 @@
             };
           };
 
+          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
+            vaultwarden = {
+              auth = {
+                sso-enabled = false;
+              };
+              full-domain = cfg.domain;
+              name = "vaultwarden";
+              protocol = "http";
+              targets = [
+                {
+                  hostname = "localhost";
+                  method = "http";
+                  port = cfg.port;
+                  healthcheck = {
+                    hostname = "localhost";
+                    port = cfg.port;
+                    scheme = "http";
+                    method = "GET";
+                    path = "/";
+                  };
+                }
+              ];
+            };
+          };
+
           postgresql = {
             enable = true;
             ensureDatabases = [ "vaultwarden" ];