diff --git a/flake.lock b/flake.lock
index ab5b11d..ed2f6d2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1709309926,
-        "narHash": "sha256-VZFBtXGVD9LWTecGi6eXrE0hJ/mVB3zGUlHImUs2Qak=",
+        "lastModified": 1713013257,
+        "narHash": "sha256-ZEfGB3YCBVggvk0BQIqVY7J8XF/9jxQ68fCca6nib+8=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "79baff8812a0d68e24a836df0a364c678089e2c7",
+        "rev": "90055d5e616bd943795d38808c94dbf0dd35abe8",
         "type": "github"
       },
       "original": {
@@ -41,11 +41,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1709237383,
-        "narHash": "sha256-cy6ArO4k5qTx+l5o+0mL9f5fa86tYUX3ozE1S+Txlds=",
+        "lastModified": 1712963716,
+        "narHash": "sha256-WKm9CvgCldeIVvRz87iOMi8CFVB1apJlkUT4GGvA0iM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1536926ef5621b09bba54035ae2bb6d806d72ac8",
+        "rev": "cfd6b5fc90b15709b780a5a1619695a88505a176",
         "type": "github"
       },
       "original": {
diff --git a/misskey-service.nix b/misskey-service.nix
index c064486..c764787 100644
--- a/misskey-service.nix
+++ b/misskey-service.nix
@@ -84,11 +84,19 @@ in {
   in {
     enable = true;
     recommendedProxySettings = true;
+    package = pkgs.openresty;
 
     upstreams."misskey".extraConfig = ''
       server unix:/var/run/misskey/misskey.sock;
     '';
 
+    proxyCachePath."egirls_media_cache" = {
+      enable = true;
+      maxSize = "1g";
+      inactive = "10m";
+      keysZoneName = "egirls_media_cache";
+    };
+
     virtualHosts."media.egirls.gay" = {
       inherit listen;
 
@@ -97,35 +105,42 @@ in {
 
       extraConfig = ''
         client_max_body_size 1m;
+        proxy_cache media_cache;
+        proxy_cache_valid 200 10m;
+        proxy_cache_lock on;
+
+        proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
+        proxy_hide_header X-Amz-ID-2;
+        proxy_hide_header X-Amz-Request-ID;
+        proxy_hide_header X-Wasabi-CM-Reference-ID;
+
+        proxy_hide_header      Set-Cookie;
+        proxy_ignore_headers   Set-Cookie;
       '';
 
       locations."/".extraConfig = ''
-        # set $bucket rub-um5oh2ac4yi9c2mf.misskey.egirls.gay;
-        # set $region us-east-1;
-        # set $url linodeobjects.com;
-        set $bucket egirls-gay-misskey;
-        set $region us-west-1;
-        set $url wasabisys.com;
-        set $path /egirls-gay-misskey/;
-
-        #proxy_pass https://storage.us-east-1.linodeobjects.com;
-        #proxy_set_header Host $bucket.us-east-1.linodeobjects.com;
-        proxy_pass https://$bucket.$region.$url$path;
-        proxy_set_header Host $bucket.$region.$url$path;
-        proxy_http_version 1.1;
-        proxy_redirect off;
-        proxy_intercept_errors on;
-        error_page 400 401 403 404 406 409 410 /404;
-
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto https;
-
-        proxy_cache off;
+        return 404;
       '';
 
-      locations."/404".extraConfig = ''
-        return 404 "not found";
+      locations."/misskey/".extraConfig = ''
+        proxy_http_version 1.1;
+
+        include /etc/nixos-secrets/s3-access-nginx.conf;
+
+        set $s3_bucket 'egirls-gay-misskey';
+        set $path_full '/$s3_bucket$request_uri';
+
+        set_by_lua $now "return ngx.http_time(ngx.time())";
+        set $signature_string "GET\n\n\n\nx-amz-date:''${now}\n$path_full";
+        set_hmac_sha1 $s3_signature $s3_secret $signature_string;
+        set_encode_base64 $s3_signature_b64 $s3_signature;
+
+        proxy_set_header x-amz-date $now;
+        proxy_set_header Authorization "AWS $s3_access:$s3_signature_b64";
+
+        proxy_ssl_session_reuse on;
+        rewrite .* $path_full break;
+        proxy_pass https://s3.us-west-1.wasabisys.com;
       '';
     };