diff --git a/hosts/linode/default.nix b/hosts/linode/default.nix
index 5ede3a1..09c5114 100644
--- a/hosts/linode/default.nix
+++ b/hosts/linode/default.nix
@@ -16,12 +16,36 @@
     ./postgres.nix
   ];
 
+  age.secrets.runner-deployer = {
+    file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
+    owner = "gitlab-runner";
+  };
+
+  environment.systemPackages = with pkgs; [
+    bind
+    graphviz
+    nix-du
+    pgloader
+  ];
+
   greg = {
     home = false;
     linode.enable = true;
+    proxies."immich.thehellings.com" = {
+      genAliases = false;
+      target = "http://localhost:${builtins.toString config.services.immich-public-proxy.port}";
+      ssl = true;
+    };
     tailscale.enable = true;
   };
 
+  networking = {
+    networkmanager.enable = lib.mkForce false;
+    hostName = "linode";
+    domain = "thehellings.com";
+    nameservers = [ "100.88.91.27" ];
+  };
+
   programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
     "Host chronicles.shire-zebra.ts.net"
     "    User backup"
@@ -30,32 +54,21 @@
     "    UserKnownHostsFile /dev/null"
   ];
 
-  networking = {
-    networkmanager.enable = lib.mkForce false;
-    hostName = "linode";
-    domain = "thehellings.com";
-    nameservers = [ "100.88.91.27" ];
-  };
+  services = {
+    gitlab-runner = {
+      enable = true;
+      services.deployer = {
+        executor = "shell";
+        authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
+      };
+    };
 
-  age.secrets.runner-deployer = {
-    file = ../../secrets/gitlab/linode-deployer-runner-reg.age;
-    owner = "gitlab-runner";
-  };
-
-  services.gitlab-runner = {
-    enable = true;
-    services.deployer = {
-      executor = "shell";
-      authenticationTokenConfigFile = config.age.secrets.runner-deployer.path;
+    immich-public-proxy = {
+      enable = true;
+      immichUrl = "https://immich.shire-zebra.ts.net";
     };
   };
 
-  users.users.gitlab-runner = {
-    isSystemUser = true;
-    group = "gitlab-runner";
-  };
-  users.groups.gitlab-runner = { };
-
   systemd.services."gitlab-runner".serviceConfig = {
     DynamicUser = lib.mkForce false;
     User = "gitlab-runner";
@@ -77,10 +90,11 @@
     }
   ];
 
-  environment.systemPackages = with pkgs; [
-    bind
-    graphviz
-    nix-du
-    pgloader
-  ];
+  users = {
+    groups.gitlab-runner = { };
+    users.gitlab-runner = {
+      isSystemUser = true;
+      group = "gitlab-runner";
+    };
+  };
 }