diff --git a/boxes/copernicus/services/photoprism.nix b/boxes/copernicus/services/photoprism.nix
index cbd5db1..dfd88ff 100644
--- a/boxes/copernicus/services/photoprism.nix
+++ b/boxes/copernicus/services/photoprism.nix
@@ -4,10 +4,12 @@
   services.photoprism = {
     enable = true;
     originalsPath = "/var/lib/photoprism/originals";
+    passwordFile = "/home/usr/wg-keys/photoprism-password";
     settings = {
       PHOTOPRISM_ADMIN_USER = "usr";
-      PHOTOPRISM_ADMIN_PASSWORD = "usr";
       PHOTOPRISM_SITE_TITLE = "photos.beepboop.systems";
+      PHOTOPRISM_SITE_URL = "https://photos.beepboop.systems";
+      PHOTOPRISM_DEFAULT_LOCALE = "en";
     };
   };
 }
diff --git a/boxes/netbox/default.nix b/boxes/netbox/default.nix
index 720c563..67e67e5 100644
--- a/boxes/netbox/default.nix
+++ b/boxes/netbox/default.nix
@@ -17,6 +17,7 @@
       ./nginx.nix
       ./franklincce.nix
       ./wireguard.nix
+      ./photoprism-bridge.nix
     ];
 
   nix = {
diff --git a/boxes/netbox/photoprism-bridge.nix b/boxes/netbox/photoprism-bridge.nix
new file mode 100644
index 0000000..e2e6e49
--- /dev/null
+++ b/boxes/netbox/photoprism-bridge.nix
@@ -0,0 +1,17 @@
+{ lib, config, pkgs, ... }:
+{
+  services.nginx.virtualHosts."photos.beepboop.systems" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://10.100.0.2:2342";
+      proxyWebsockets = true;
+      extraConfig = ''
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $host;
+        proxy_buffering off;
+        proxy_http_version 1.1;
+      '';
+    };
+  };
+}