{ config, lib, ... }:
{
  services = {
    # Immich setup
    immich = {
      enable = true;
      openFirewall = false;

      host = "127.0.0.1";
      port = 3010;
    };

    nginx = {
      virtualHosts."photos.internal" = {
        locations."/" = {
          proxyPass = "http://127.0.0.1:3010";
          proxyWebsockets = true;
        };
      };
    };
  };

  hardware.graphics.enable = lib.mkForce true;

  users.users.immich = {
    extraGroups = [ "video" "render" ];
  };
}