diff --git a/.envrc b/.envrc
new file mode 100644
index 0000000..3550a30
--- /dev/null
+++ b/.envrc
@@ -0,0 +1 @@
+use flake
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..519585e
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,42 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1647297614,
+        "narHash": "sha256-ulGq3W5XsrBMU/u5k9d4oPy65pQTkunR4HKKtTq0RwY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "73ad5f9e147c0d2a2061f1d4bd91e05078dc0b58",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-unstable",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "utils": "utils"
+      }
+    },
+    "utils": {
+      "locked": {
+        "lastModified": 1644229661,
+        "narHash": "sha256-1YdnJAsNy69bpcjuoKdOYQX0YxZBiCYZo4Twxerqv7k=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "3cecb5b042f7f209c56ffd8371b2711a290ec797",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..ea89290
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,47 @@
+{
+  description = "A basic Go web server setup";
+
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-unstable";
+    utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, utils }:
+    utils.lib.eachSystem [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ] (system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+        version = builtins.substring 0 8 self.lastModifiedDate;
+      in {
+        defaultPackage = pkgs.buildGoModule {
+          pname = "grafanauth";
+          inherit version;
+          src = ./.;
+
+          # This hash locks the dependencies of this package. It is
+          # necessary because of how Go requires network access to resolve
+          # VCS.  See https://www.tweag.io/blog/2021-03-04-gomod2nix/ for
+          # details. Normally one can build with a fake sha256 and rely on native Go
+          # mechanisms to tell you what the hash should be or determine what
+          # it should be "out-of-band" with other tooling (eg. gomod2nix).
+          # To begin with it is recommended to set this, but one must
+          # remeber to bump this hash when your dependencies change.
+          vendorSha256 = pkgs.lib.fakeSha256;
+          #vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+        };
+
+        packages = { };
+
+        defaultApp = utils.lib.mkApp {
+          drv = self.defaultPackage.${system};
+        };
+
+        devShell = pkgs.mkShell {
+          buildInputs = with pkgs; [ go gopls go-tools gotools ];
+        };
+      });
+}