diff --git a/.gitignore b/.gitignore
index 7f93e02..bd62fff 100755
--- a/.gitignore
+++ b/.gitignore
@@ -148,3 +148,5 @@ cython_debug/
 
 *.db
 *.rdb
+
+/result
diff --git a/default.nix b/default.nix
new file mode 100644
index 0000000..98f37b3
--- /dev/null
+++ b/default.nix
@@ -0,0 +1,34 @@
+{ pythonPackages }:
+
+pythonPackages.buildPythonApplication rec {
+  pname = "selfprivacy-graphql-api";
+  version = "local";
+  src = builtins.filterSource (p: t: p != ".git" && t != "symlink") ./.;
+  propagatedBuildInputs = with pythonPackages; [
+    fastapi
+    gevent
+    huey
+    mnemonic
+    portalocker
+    psutil
+    pydantic
+    pytest
+    pytest-datadir
+    pytest-mock
+    pytz
+    redis
+    setuptools
+    strawberry-graphql
+    typing-extensions
+    uvicorn
+  ];
+  meta = {
+    description = ''
+      SelfPrivacy Server Management API
+    '';
+  };
+  passthru = {
+    # TODO explain what's the purpose of this?
+    pythonPath = pythonPackages.makePythonPath propagatedBuildInputs;
+  };
+}
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..73363ef
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,92 @@
+{
+  "nodes": {
+    "hardware-configuration-nix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1692731346,
+        "narHash": "sha256-rQIpYKwowqbbVVurEl5qNpuPfoRyEUMefoZXrUoO6p8=",
+        "path": "hardware-configuration.nix",
+        "type": "path"
+      },
+      "original": {
+        "id": "hardware-configuration-nix",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1686476475,
+        "narHash": "sha256-W9yUePvCSDghn+YUXewuodyPxt+kJl/a7zdY4Q6r4MU=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "eef86b8a942913a828b9ef13722835f359deef29",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": [
+          "selfprivacy-nixos-config",
+          "nixpkgs"
+        ],
+        "selfprivacy-nixos-config": "selfprivacy-nixos-config"
+      }
+    },
+    "selfprivacy-nixos-config": {
+      "inputs": {
+        "hardware-configuration-nix": "hardware-configuration-nix",
+        "nixpkgs": "nixpkgs",
+        "selfprivacy-overlay-path": "selfprivacy-overlay-path",
+        "userdata-json": "userdata-json"
+      },
+      "locked": {
+        "lastModified": 1692741993,
+        "narHash": "sha256-p1hrRJeMgj0o9VQpLTQ+PLVUwh++oZyUKNCfUFooenw=",
+        "ref": "flake-to-override",
+        "rev": "50c554e6e72b45f350af65c12e7fb19a46fc537f",
+        "revCount": 122,
+        "type": "git",
+        "url": "https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-config.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-config.git"
+      }
+    },
+    "selfprivacy-overlay-path": {
+      "locked": {
+        "lastModified": 1689554432,
+        "narHash": "sha256-hegMIgxBHUuRFbCecQpbjFfTHpduV3VZWr8OINtQO6k=",
+        "ref": "flakes",
+        "rev": "53ed9b3f5f70a7f2843ecbef7775307e23a2c1f4",
+        "revCount": 31,
+        "type": "git",
+        "url": "https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nix-repo.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nix-repo.git"
+      }
+    },
+    "userdata-json": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1689259484,
+        "narHash": "sha256-Co3QGsxCjDspP5Nzzu1zICkee5CEq+ORlxSF3bFqbCY=",
+        "path": "userdata/userdata.json",
+        "type": "path"
+      },
+      "original": {
+        "id": "userdata-json",
+        "type": "indirect"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..1f2e089
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,45 @@
+{
+  description = "SelfPrivacy API application flake";
+
+  inputs = {
+    selfprivacy-nixos-config.url =
+      "git+https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-config.git";
+
+    # nixpkgs is inherited from selfprivacy-nixos-config
+    # but can be overridden with `--override-input` option for nix build/flake
+    nixpkgs.follows = "selfprivacy-nixos-config/nixpkgs";
+  };
+
+  outputs = { nixpkgs, ... }:
+  let
+    system = "x86_64-linux";
+    pkgs = nixpkgs.legacyPackages.${system};
+    selfprivacy-graphql-api = pkgs.callPackage ./default.nix {
+      pythonPackages = pkgs.python310Packages;
+    };
+  in
+  {
+    packages.${system}.default = selfprivacy-graphql-api;
+    devShells.${system}.default = pkgs.mkShell {
+      inputsFrom = [ selfprivacy-graphql-api ];
+      packages = with pkgs; [
+        black
+        rclone
+        redis
+        restic
+      ];
+      # FIXME is it still needed inside shellHook?
+      # PYTHONPATH=${sp-python}/${sp-python.sitePackages}
+      shellHook = ''
+        # envs set with export and as attributes are treated differently.
+        # for example. printenv <Name> will not fetch the value of an attribute.
+        export USE_REDIS_PORT=6379
+        pkill redis-server
+        sleep 2
+        setsid redis-server --bind 127.0.0.1 --port $USE_REDIS_PORT >/dev/null 2>/dev/null &
+        # maybe set more env-vars
+      '';
+    };
+  };
+  nixConfig.bash-prompt-suffix = "[SP devshell] ";
+}
diff --git a/shell.nix b/shell.nix
deleted file mode 100644
index bce16bd..0000000
--- a/shell.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ pkgs ? import <nixos-22.11> { } }:
-let
-  sp-python = pkgs.python310.withPackages (p: with p; [
-    setuptools
-    portalocker
-    pytz
-    pytest
-    pytest-mock
-    pytest-datadir
-    huey
-    gevent
-    mnemonic
-    coverage
-    pylint
-    rope
-    mypy
-    pylsp-mypy
-    pydantic
-    typing-extensions
-    psutil
-    black
-    fastapi
-    uvicorn
-    redis
-    strawberry-graphql
-    flake8-bugbear
-    flake8
-  ]);
-in
-pkgs.mkShell {
-  buildInputs = [
-    sp-python
-    pkgs.black
-    pkgs.redis
-    pkgs.restic
-    pkgs.rclone
-  ];
-  shellHook = ''
-    PYTHONPATH=${sp-python}/${sp-python.sitePackages}
-    # envs set with export and as attributes are treated differently.
-    # for example. printenv <Name> will not fetch the value of an attribute.
-    export USE_REDIS_PORT=6379
-    pkill redis-server
-    sleep 2
-    setsid redis-server --bind 127.0.0.1 --port $USE_REDIS_PORT >/dev/null 2>/dev/null &
-    # maybe set more env-vars
-  '';
-}