diff --git a/config/client_session_key b/config/client_session_key
new file mode 100644
index 0000000..bada1b0
--- /dev/null
+++ b/config/client_session_key
@@ -0,0 +1 @@
+þxdHB>èû“,ñ‚rM‘íE®vóªÆ’úä`’¤ŽeØ<?ìŒÊqÎP§¶p€$Æ¢dßÊR»ñ×©àÕ´sRœMk~¥ auÈz|‚è¤>“\híuQÑë¯R4­ýQ
\ No newline at end of file
diff --git a/config/settings.yml b/config/settings.yml
index dce5c99..f02a46e 100644
--- a/config/settings.yml
+++ b/config/settings.yml
@@ -2,6 +2,7 @@
 # See https://github.com/yesodweb/yesod/wiki/Configuration#overriding-configuration-values-with-environment-variables
 
 static-dir:     "_env:YESOD_STATIC_DIR:static"
+session-key:     "_env:YESOD_SESSION_KEY:config/client_session_key"
 host:           "_env:YESOD_HOST:*4" # any IPv4 host
 port:           "_env:YESOD_PORT:3000" # NB: The port `yesod devel` uses is distinct from this value. Set the `yesod devel` port from the command line.
 # For `keter` user, enable the follwing line, and comment out previous one.
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..273b351
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,94 @@
+{
+  description = "A flake to install sTodo";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+  };
+
+  outputs = {
+    self,
+    nixpkgs,
+  }: {
+    packages.x86_64-linux.sTodo = with nixpkgs.legacyPackages.x86_64-linux;
+      stdenv.mkDerivation {
+        pname = "sTodo";
+        version = "1.0.0";
+
+        src = fetchTarball {
+          url = "https://git.stuce.ch/stuce/sTodo/releases/download/Release1/release1.tar.gz";
+          sha256 = "10jyldwmcs5zyz1k8lp3jscn7nhlvn56g0709l5jp91qimw7xiqz";
+        };
+        buildInputs = [zlib gmp libffi openssl];
+        installPhase = ''
+          mkdir -p $out/bin
+          cp $src/sTodo $out/bin
+        '';
+        mainProgram = "sTodo";
+      };
+    nixosModules.sTodo = {
+      config,
+      lib,
+      ...
+    }: let
+      cfg = config.services.sTodo;
+    in {
+      options.services.sTodo = {
+        # options.programs.sTodo = {
+        enable = lib.mkEnableOption "sTodo";
+        package = lib.mkOption {
+          type = lib.types.package;
+          default = self.packages.x86_64-linux.sTodo;
+        };
+        appRoot = lib.mkOption {
+          type = lib.types.str;
+          default = "http://localhost:6901";
+          description = "Link used to access the webapp";
+        };
+
+        staticRoot = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/sTodo/static";
+          description = "Location of the static folder";
+        };
+
+        databaseFolder = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/sTodo/sTodo.sqlite3";
+          description = "Location of the database folder";
+        };
+
+        clientSessionKey = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/sTodo/client_session_key.aes";
+          description = "Location of the client session key";
+        };
+
+        port = lib.mkOption {
+          type = lib.types.int;
+          default = 6901;
+          description = "Default port of the app";
+        };
+      };
+
+      # Systemd Service
+      config = lib.mkIf cfg.enable {
+        systemd.services.sTodo = {
+          description = "Launch a sTodo app to have a online todolist";
+          after = ["network.target"];
+          wantedBy = ["multi-user.target"];
+          serviceConfig = {
+            ExecStart = "${cfg.package}/bin/sTodo";
+            Restart = "always";
+          };
+          environment = {
+            YESOD_PORT = "${toString cfg.port}";
+            YESOD_APPROOT = "${cfg.appRoot}";
+            YESOD_SQLITE_DATABASE = "${cfg.databaseFolder}";
+            YESOD_STATIC_DIR = "${cfg.staticRoot}";
+            YESOD_SESSION_KEY = "${cfg.clientSessionKey}";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/shell.nix b/shell.nix
new file mode 100644
index 0000000..e036ca9
--- /dev/null
+++ b/shell.nix
@@ -0,0 +1,11 @@
+{pkgs ? import <nixpkgs> {}}:
+pkgs.mkShell {
+  buildInputs = [
+    pkgs.haskellPackages.ghc
+    pkgs.haskellPackages.stack
+    pkgs.haskellPackages.yesod
+    pkgs.haskellPackages.yesod-bin
+    pkgs.haskellPackages.haskell-language-server
+    pkgs.zlib
+  ];
+}
diff --git a/src/Foundation.hs b/src/Foundation.hs
index 241e246..2c365fe 100644
--- a/src/Foundation.hs
+++ b/src/Foundation.hs
@@ -80,9 +80,9 @@ instance Yesod App where
     -- Store session data on the client in encrypted cookies,
     -- default session idle timeout is 120 minutes
     makeSessionBackend :: App -> IO (Maybe SessionBackend)
-    makeSessionBackend _ = Just <$> defaultClientSessionBackend
+    makeSessionBackend app = Just <$> defaultClientSessionBackend
         120    -- timeout in minutes
-        "config/client_session_key.aes"
+        (appSessionKey $ appSettings app)
 
     -- Yesod Middleware allows you to run code before and after each handler function.
     -- The defaultYesodMiddleware adds the response header "Vary: Accept, Accept-Language" and performs authorization checks.
diff --git a/src/Settings.hs b/src/Settings.hs
index 5da2963..c66c174 100644
--- a/src/Settings.hs
+++ b/src/Settings.hs
@@ -33,7 +33,8 @@ data AppSettings = AppSettings
     -- ^ Configuration settings for accessing the database.
     , appRoot                   :: Maybe Text
     -- ^ Base for all generated URLs. If @Nothing@, determined
-    -- from the request headers.
+    , appSessionKey                :: [Char]
+    -- ^ Where to get the client session key
     , appHost                   :: HostPreference
     -- ^ Host/interface the server should bind to.
     , appPort                   :: Int
@@ -74,6 +75,7 @@ instance FromJSON AppSettings where
         appStaticDir              <- o .: "static-dir"
         appDatabaseConf           <- o .: "database"
         appRoot                   <- o .:? "approot"
+        appSessionKey                <- o .: "session-key"
         appHost                   <- fromString <$> o .: "host"
         appPort                   <- o .: "port"
         appIpFromHeader           <- o .: "ip-from-header"
