diff --git a/hosts/dalinar/default.nix b/hosts/dalinar/default.nix
index 3041f76..057dd5e 100644
--- a/hosts/dalinar/default.nix
+++ b/hosts/dalinar/default.nix
@@ -217,10 +217,8 @@
 
   services.immich = {
     enable = true;
-    host = "0.0.0.0";
-    openFirewall = true;
     machine-learning.enable = false;
-    # TODO set data dir
+    mediaLocation = "/storage/encrypted/photos/";
   };
 
   services.prometheus = {
@@ -308,6 +306,11 @@
           reverse_proxy localhost:8096
         '';
       };
+      "https://immich.dalinar.home.johannes-rothe.de" = {
+        extraConfig = ''
+          reverse_proxy localhost:${toString config.services.immich.port}
+        '';
+      };
     };
   };