{
  self,
  config,
  lib,
  ...
}:
let
  d = self.lib.data.services.immich;
  inherit (self.lib.secrets) mkServiceSecrets;
in
{
  services = {
    immich = {
      inherit (d) port;
      enable = true;
      host = "0.0.0.0";
      redis.enable = true;
      mediaLocation = "/var/media/photos/";
      accelerationDevices = [ "/dev/dri/renderD128" ];
      settings = lib.recursiveUpdate (builtins.fromJSON (builtins.readFile ./immich-config.json)) {
        oauth.clientSecret._secret = config.age.secrets.immich-oauth-secret.path;
        notifications.smtp.transport.password._secret = config.age.secrets.immich-mail-pw.path;
        server.externalDomain = "https://${d.extUrl}";
      };
    };
    immich-public-proxy = {
      enable = true;
      port = d.pubProxy;
      immichUrl = "http://localhost:${toString d.port}";
      settings.ipp = {
        downloadedFilename = 1;
        allowSlugLinks = true;
        showHomePage = false;
      };
    };
  };
  systemd.services.immich-public-proxy.environment.PUBLIC_BASE_URL = "https://${d.extUrl}";
  users.users.immich.extraGroups = [
    "video"
    "render"
  ];
  age.secrets = mkServiceSecrets "immich" ./secrets [
    "oauth-secret"
    "mail-pw"
  ];
}