diff --git a/nix-cache/.envrc b/nix-cache/.envrc
new file mode 100644
index 0000000..1d953f4
--- /dev/null
+++ b/nix-cache/.envrc
@@ -0,0 +1 @@
+use nix
diff --git a/nix-cache/.gitignore b/nix-cache/.gitignore
new file mode 100644
index 0000000..29963da
--- /dev/null
+++ b/nix-cache/.gitignore
@@ -0,0 +1 @@
+/.direnv/
diff --git a/nix-cache/Dockerfile b/nix-cache/Dockerfile
new file mode 100644
index 0000000..6fdf7db
--- /dev/null
+++ b/nix-cache/Dockerfile
@@ -0,0 +1,5 @@
+FROM ghcr.io/zhaofengli/attic:latest
+COPY ./entrypoint.sh /entrypoint.sh
+COPY ./server.toml /attic/server.toml.tmpl
+EXPOSE 8080
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/nix-cache/entrypoint.sh b/nix-cache/entrypoint.sh
new file mode 100755
index 0000000..4d42ee8
--- /dev/null
+++ b/nix-cache/entrypoint.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+set -e
+
+sed \
+    -e "s/!!POSTGRES_PASSWORD!!/${POSTGRES_PASSWORD}/g" \
+    /attic/server.toml.tmpl \
+    > /run/server.toml
+
+exec /bin/atticd \
+    -f /run/server.toml \
+    --mode monolithic
diff --git a/nix-cache/fly.toml b/nix-cache/fly.toml
new file mode 100644
index 0000000..0d92357
--- /dev/null
+++ b/nix-cache/fly.toml
@@ -0,0 +1,22 @@
+# fly.toml app configuration file generated for jalr-attic on 2025-09-03T19:29:39+02:00
+#
+# See https://fly.io/docs/reference/configuration/ for information about how to use this file.
+#
+
+app = 'jalr-attic'
+primary_region = 'fra'
+swap_size_mb = 256
+
+[build]
+
+[http_service]
+  internal_port = 8080
+  force_https = true
+  auto_stop_machines = 'stop'
+  auto_start_machines = true
+  min_machines_running = 0
+  processes = ['app']
+
+[[vm]]
+  size = 'shared-cpu-1x'
+  memory = '512mb'
diff --git a/nix-cache/server.toml b/nix-cache/server.toml
new file mode 100644
index 0000000..3f520d7
--- /dev/null
+++ b/nix-cache/server.toml
@@ -0,0 +1,29 @@
+listen = "[::]:8080"
+
+[database]
+url = "postgresql://neondb_owner:!!POSTGRES_PASSWORD!!@ep-raspy-snow-aggvse7u-pooler.c-2.eu-central-1.aws.neon.tech/neondb?sslmode=require&channel_binding=require"
+
+[storage]
+bucket = "jalr-attic"
+type = "s3"
+region = "auto"
+endpoint = "https://1b34998519526958a742d40d38834033.eu.r2.cloudflarestorage.com"
+
+#[storage.credentials]
+#access_key_id = "" # AWS_ACCESS_KEY_ID
+#secret_access_key = "" # AWS_SECRET_ACCESS_KEY
+
+[chunking]
+nar-size-threshold = 65536
+min-size = 16384
+avg-size = 65536
+max-size = 262144
+
+[compression]
+type = "zstd"
+
+[garbage-collection]
+interval = "12 hours"
+
+#[jwt.signing]
+#token-hs256-secret-base64 = "" # ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64
diff --git a/nix-cache/shell.nix b/nix-cache/shell.nix
new file mode 100644
index 0000000..92b44a1
--- /dev/null
+++ b/nix-cache/shell.nix
@@ -0,0 +1,10 @@
+with import <nixpkgs> { };
+
+mkShellNoCC {
+  buildInputs = [
+    flyctl
+  ];
+  shellHook = ''
+    export FLY_ACCESS_TOKEN=$(pass show private/services/fly.io/app-jalr-attic)
+  '';
+}