diff --git a/.gitignore b/.gitignore
index 4978251..326f870 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /backend/target
 mi.db
+result*
diff --git a/backend/default.nix b/backend/default.nix
new file mode 100644
index 0000000..6ab7c73
--- /dev/null
+++ b/backend/default.nix
@@ -0,0 +1,20 @@
+{ sources ? import ../nix/sources.nix, pkgs ? import sources.nixpkgs { } }:
+with pkgs;
+let
+  rust = import ../nix/rust.nix { inherit sources; };
+  naersk = pkgs.callPackage sources.naersk {
+    rustc = rust;
+    cargo = rust;
+  };
+  src = builtins.filterSource
+    (path: type: type != "directory" || builtins.baseNameOf path != "target")
+    ./.;
+in {
+  backend = naersk.buildPackage {
+    name = "mi_backend";
+    inherit src;
+    buildInputs = with pkgs; [ openssl pkg-config sqlite libsodium ];
+    SODIUM_USE_PKG_CONFIG = "1";
+    SODIUM_SHARED = "1";
+  };
+}
diff --git a/nix/sources.json b/nix/sources.json
index 24244cc..c449da1 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -1,4 +1,16 @@
 {
+    "naersk": {
+        "branch": "master",
+        "description": "Build rust crates in Nix. No configuration, no code generation, no IFD. Sandbox friendly.",
+        "homepage": "",
+        "owner": "nmattia",
+        "repo": "naersk",
+        "rev": "d645515b7159c75087b3d51f23a68047c2c09699",
+        "sha256": "16hjyf1nkvwhb5nw989qhm3gdlim5wfw515bnvxpix5ff8jfbh9x",
+        "type": "tarball",
+        "url": "https://github.com/nmattia/naersk/archive/d645515b7159c75087b3d51f23a68047c2c09699.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
     "niv": {
         "branch": "master",
         "description": "Easy dependency management for Nix projects",
diff --git a/shell.nix b/shell.nix
index 8d392ab..18f1a26 100644
--- a/shell.nix
+++ b/shell.nix
@@ -11,9 +11,9 @@ in pkgs.mkShell rec {
     openssl
     cmake
     zlib
-    libgit2
     diesel-cli
     sqlite
+    libsodium
     cargo-watch
 
     # elm
@@ -29,4 +29,8 @@ in pkgs.mkShell rec {
   DATABASE_URL = "./mi.db";
   ROCKET_DATABASES = ''{ main_data = { url = "${DATABASE_URL}" } }'';
   RUST_LOG = "info";
+
+  # libsodium-sys
+  SODIUM_USE_PKG_CONFIG = "1";
+  SODIUM_SHARED = "1";
 }