diff --git a/configuration.nix b/configuration.nix
index 62b9096..7effb4f 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -49,5 +49,13 @@
     linkConfig.RequiredForOnline = "routable";
   };
 
-  system.stateVersion = "23.11";
+  # NOTE: for now, we use internal ports
+  # TODO: switch to unixsockets if supported
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+  };
+
+
+  system.stateVersion = "24.05";
 }
diff --git a/flake.nix b/flake.nix
index 168425f..0bdbf18 100644
--- a/flake.nix
+++ b/flake.nix
@@ -44,7 +44,7 @@
       let pkgs = nixpkgs.legacyPackages.${system};
       in {
         devShell = pkgs.mkShell {
-          buildInputs = with pkgs; [ colmena.packages.${system}.colmena ];
+          buildInputs = [ colmena.packages.${system}.colmena ];
         };
       });
 }
diff --git a/immich.nix b/immich.nix
index d00dbdf..ef590a9 100644
--- a/immich.nix
+++ b/immich.nix
@@ -7,4 +7,11 @@
     machine-learning.enable = true;
     host = "localhost";
   };
+
+  services.nginx.virtualHosts."immich.rz01.infra.dgnum.eu" = {
+    enableACME = true;
+    forceSSL = true;
+    serverAliases = [];
+    locations."/".proxyPass = "http://localhost:3001/";
+  };
 }
diff --git a/photoprism.nix b/photoprism.nix
index 478d06e..5d5ce00 100644
--- a/photoprism.nix
+++ b/photoprism.nix
@@ -17,4 +17,11 @@
 
     passwordFile = "/passwords/photoprism";
   };
+
+  services.nginx.virtualHosts."photoprism.rz01.infra.dgnum.eu" = {
+    enableACME = true;
+    forceSSL = true;
+    serverAliases = [];
+    locations."/".proxyPass = "http://localhost:2342/";
+  };
 }