diff --git a/home-server.nix b/home-server.nix
index 93cb1cb..4ae0398 100644
--- a/home-server.nix
+++ b/home-server.nix
@@ -24,6 +24,7 @@ in with builtins; {
     ./services/mosquitto.nix
     ./services/home-assistant.nix
     ./services/owntracks.nix
+    ./services/immich.nix
     ./services/miniflux.nix
     ./services/paperless.nix
     ./services/nextcloud.nix
@@ -82,6 +83,7 @@ in with builtins; {
       "cloud.felschr.com"
       "office.felschr.com"
       "media.felschr.com"
+      "photos.felschr.com"
       "books.felschr.com"
       "news.felschr.com"
       "mqtt.felschr.com"
diff --git a/secrets/immich/.env.age b/secrets/immich/.env.age
new file mode 100644
index 0000000..25aa5b1
Binary files /dev/null and b/secrets/immich/.env.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 2d054df..dc6a33d 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -4,7 +4,7 @@ let
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGbQpMo1JOGk59Rzl6pVoOcMHOoqezph+aIlEXZP4rBu";
   users = [ felschr ];
 
-  # `ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key`
+  # `ssh-keygen -t ed25519 -N "" -f /etc/secrets/initrd/ssh_host_ed25519_key`
   home-pc =
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBFTQvIcSdhEKl/Kq+pcS/cPCyyZ1ygj+djfuaXzaRMx";
   home-server =
@@ -27,6 +27,7 @@ in {
   "miniflux.age".publicKeys = [ felschr home-pc home-server ];
   "paperless.age".publicKeys = [ felschr home-pc home-server ];
   "nextcloud/admin.age".publicKeys = [ felschr home-pc home-server ];
+  "immich/.env.age".publicKeys = [ felschr home-pc home-server ];
 
   # home-server
   "home-server/hostKey.age".publicKeys = [ felschr home-server ];
diff --git a/services/immich.nix b/services/immich.nix
new file mode 100644
index 0000000..692335a
--- /dev/null
+++ b/services/immich.nix
@@ -0,0 +1,123 @@
+{ config, lib, pkgs, ... }:
+
+let
+  uploadDir = "/var/lib/immich/upload";
+  dbuser = "immich";
+  dbname = "immich";
+  ociBackend = config.virtualisation.oci-containers.backend;
+  containersHost = if ociBackend == "podman" then
+    "host.containers.internal"
+  else
+    "host.docker.internal";
+  domain = "photos.felschr.com";
+
+  immichEnv = {
+    environment = {
+      NODE_ENV = "production";
+      DB_HOSTNAME = containersHost;
+      DB_PORT = toString config.services.postgresql.port;
+      DB_USERNAME = dbuser;
+      DB_DATABASE_NAME = dbname;
+      REDIS_HOSTNAME = containersHost;
+      REDIS_PORT = toString config.services.redis.servers.immich.port;
+      VITE_SERVER_ENDPOINT = "https://${domain}/api";
+
+      # immich requires this value, even though we don't have password auth
+      DB_PASSWORD = "x";
+    };
+    # only secrets need to be included, e.g. JWT_SECRET, MAPBOX_KEY
+    environmentFiles = [ config.age.secrets.immich-env.path ];
+  };
+in {
+  age.secrets.immich-env.file = ../secrets/immich/.env.age;
+
+  services.postgresql = {
+    enable = true;
+    ensureDatabases = [ dbname ];
+    ensureUsers = [{
+      name = dbuser;
+      ensurePermissions."DATABASE ${dbname}" = "ALL PRIVILEGES";
+    }];
+  };
+
+  services.redis.servers.immich.enable = true;
+
+  systemd.services.prepare-immich = {
+    enable = true;
+    wantedBy = [ "multi-user.target" ];
+    script = ''
+      mkdir -p ${uploadDir}
+    '';
+    before = [
+      "${ociBackend}-immich-server.service"
+      "${ociBackend}-immich-microservices.service"
+      "${ociBackend}-immich-machine-learning.service"
+      "${ociBackend}-immich-web.service"
+      "${ociBackend}-immich-proxy.service"
+    ];
+  };
+
+  virtualisation.oci-containers.containers = {
+    immich-server = immichEnv // {
+      image = "altran1502/immich-server:release";
+      entrypoint = "/bin/sh";
+      cmd = [ "./start-server.sh" ];
+      volumes = [ "${uploadDir}:/usr/src/app/upload" ];
+    };
+
+    immich-microservices = immichEnv // {
+      image = "altran1502/immich-server:release";
+      entrypoint = "/bin/sh";
+      cmd = [ "./start-microservices.sh" ];
+      volumes = [ "${uploadDir}:/usr/src/app/upload" ];
+    };
+
+    immich-machine-learning = immichEnv // {
+      image = "altran1502/immich-machine-learning:release";
+      entrypoint = "/bin/sh";
+      cmd = [ "./entrypoint.sh" ];
+      volumes = [ "${uploadDir}:/usr/src/app/upload" ];
+    };
+
+    immich-web = immichEnv // {
+      image = "altran1502/immich-web:release";
+      entrypoint = "/bin/sh";
+      cmd = [ "./entrypoint.sh" ];
+    };
+  };
+
+  systemd.services = {
+    "${ociBackend}-immich-server" = {
+      requires = [ "postgresql.service" "redis-immich.service" ];
+      after = [ "postgresql.service" "redis-immich.service" ];
+    };
+
+    "${ociBackend}-immich-microservices" = {
+      requires = [ "postgresql.service" "redis-immich.service" ];
+      after = [ "postgresql.service" "redis-immich.service" ];
+    };
+
+    "${ociBackend}-immich-machine-learning" = {
+      requires = [ "postgresql.service" ];
+      after = [ "postgresql.service" ];
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/api" = {
+      proxyPass = "http://localhost:3001";
+      extraConfig = ''
+        rewrite /api/(.*) /$1 break;
+        client_max_body_size 50000M;
+      '';
+    };
+    locations."/" = {
+      proxyPass = "http://localhost:3000";
+      extraConfig = ''
+        client_max_body_size 50000M;
+      '';
+    };
+  };
+}