diff --git a/hosts/magnesium/services/tandoor.nix b/hosts/magnesium/services/tandoor.nix
index 6577626..e573639 100644
--- a/hosts/magnesium/services/tandoor.nix
+++ b/hosts/magnesium/services/tandoor.nix
@@ -3,6 +3,7 @@
 let
   domain = "tandoor.jalr.de";
   cfg = config.services.tandoor-recipes;
+  #recipesDirectory = "/var/lib/private/tandoor-recipes/recipes";
   inherit (config.networking) ports;
 in
 {
@@ -13,6 +14,9 @@ in
   services.tandoor-recipes = {
     enable = true;
     port = ports.tandoor.tcp;
+    extraConfig = {
+      GUNICORN_MEDIA = "1";
+    };
   };
 
   systemd.services.tandoor-recipes = {
@@ -26,12 +30,22 @@ in
     };
   };
 
+  #users.groups.tandoor-recipes.members = [ "nginx" ];
+  # https://tandoor.jalr.de/media/recipes/c071286f-60b3-45e9-9ac5-f4bb99703c17_11.jpg
+
+  #systemd.services.nginx.serviceConfig.BindReadOnlyPaths = [ recipesDirectory ];
+  #users.groups.tandoor-recipes.members = [ "nginx" ];
+
   services.nginx.virtualHosts."${domain}" = {
     enableACME = true;
     forceSSL = true;
 
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${toString cfg.port}";
+    locations = {
+      "/" = {
+        proxyPass = "http://127.0.0.1:${toString cfg.port}";
+        proxyWebsockets = true;
+      };
+      #"/media/recipes/".alias = recipesDirectory;
     };
   };
 }