diff --git a/flake.nix b/flake.nix
index 999d920..c055f4d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -339,6 +339,7 @@
               ./modules/nixos/torrentbox.nix
               ./modules/nixos/minio_server.nix
               ./modules/nixos/nextcloud.nix
+              ./modules/nixos/immich.nix
               # ./modules/nixos/garage.nix
               # ./modules/nixos/ntfy.nix
               # S3 cache read
diff --git a/instances/baldur/configuration.nix b/instances/baldur/configuration.nix
index 08ca896..54aff49 100644
--- a/instances/baldur/configuration.nix
+++ b/instances/baldur/configuration.nix
@@ -114,6 +114,20 @@
             '';
           };
 
+          "immich.bertof.net" = ssl // {
+            locations."/" = {
+              proxyPass = "http://heimdall.tsn:2283";
+              proxyWebsockets = true;
+              recommendedProxySettings = true;
+              extraConfig = ''
+                client_max_body_size 50000M;
+                proxy_read_timeout   600s;
+                proxy_send_timeout   600s;
+                send_timeout         600s;
+              '';
+            };
+          };
+
           # "ntfy.bertof.net" = ssl // {
           #   locations."/" = {
           #     proxyPass = "http://heimdall.tsn:7080/";
diff --git a/instances/heimdall/configuration.nix b/instances/heimdall/configuration.nix
index 1a25528..70bfc74 100644
--- a/instances/heimdall/configuration.nix
+++ b/instances/heimdall/configuration.nix
@@ -109,6 +109,9 @@ in
         };
       };
     };
+
+    immich.mediaLocation = "/mnt/raid/immich";
+
     music-assistant = {
       enable = true;
       providers = [ "chromecast" "dlna" "filesystem_local" "hass" "hass_players" "jellyfin" "player_group" "radiobrowser" "soundcloud" "tidal" ];
diff --git a/modules/nixos/immich.nix b/modules/nixos/immich.nix
new file mode 100644
index 0000000..c66746f
--- /dev/null
+++ b/modules/nixos/immich.nix
@@ -0,0 +1,13 @@
+{
+  services = {
+    immich = {
+      enable = true;
+      accelerationDevices = [ "/dev/dri/renderD128" ];
+      redis.enable = true;
+      openFirewall = true;
+      host = "::";
+    };
+    # immich-public-proxy = { enable = true; openFirewall = true; immichUrl = "http://localhost:2283"; };
+  };
+  users.users.immich.extraGroups = [ "video" "render" ];
+}