diff --git a/systems/etna/immich.nix b/systems/etna/immich.nix
index 7063a31..ececb10 100644
--- a/systems/etna/immich.nix
+++ b/systems/etna/immich.nix
@@ -1,6 +1,9 @@
-{ config, ... }:
+{ config, _utils, ... }:
+let
+  frp = _utils.mkFrpPassthrough "immich" config.services.immich.port;
+in
 {
-  cfTunnels."im.uku.moe" = "http://localhost:${builtins.toString config.services.immich.port}";
+  imports = [ frp ];
 
   services.immich = {
     enable = true;
diff --git a/systems/vesuvio/default.nix b/systems/vesuvio/default.nix
index 7c06490..3ebeff1 100644
--- a/systems/vesuvio/default.nix
+++ b/systems/vesuvio/default.nix
@@ -4,6 +4,7 @@
     ./certificates.nix
     ./frp.nix
     ./hetzner.nix
+    ./nginx.nix
   ];
 
   environment.systemPackages = with pkgs; [
diff --git a/systems/vesuvio/nginx.nix b/systems/vesuvio/nginx.nix
new file mode 100644
index 0000000..8b0f506
--- /dev/null
+++ b/systems/vesuvio/nginx.nix
@@ -0,0 +1,20 @@
+{
+  services.nginx.virtualHosts = {
+    # immich
+    "im.uku.moe" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:2283";
+        proxyWebsockets = true;
+      };
+
+      extraConfig = ''
+        client_max_body_size 5000M;
+        proxy_read_timeout 600s;
+        proxy_send_timeout 600s;
+        send_timeout 600s;
+      '';
+    };
+  };
+}