diff --git a/.envrc b/.envrc
new file mode 100644
index 00000000..b85b26d1
--- /dev/null
+++ b/.envrc
@@ -0,0 +1 @@
+has nix && use flake
diff --git a/.gitignore b/.gitignore
index e69113fb..720f911a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,7 +17,9 @@
 *.xz
 *~
 .*.sw*
+/.direnv
 clean
 config/*.old
 crossgcc
 typescript*
+result
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 00000000..491e53f7
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1711703276,
+        "narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "d8fe5e6c92d0d190646fb9f1056741a229980089",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 00000000..8796f929
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,126 @@
+{
+  description = "heads flake, mostly for devshell for now";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = {
+    self,
+    flake-utils,
+    nixpkgs,
+    ...
+  }:
+    flake-utils.lib.eachDefaultSystem (system: let
+      pkgs = nixpkgs.legacyPackages.${system};
+      lib = pkgs.lib;
+      deps = with pkgs;
+        [
+          autoconf
+          automake
+          bashInteractive
+          coreutils
+          bc
+          bison # Generate flashmap descriptor parser
+          bzip2
+          cacert
+          ccache
+          cmake
+          cpio
+          curl
+          diffutils
+          dtc
+          e2fsprogs
+          elfutils
+          findutils
+          flex
+          gawk
+          git
+          gnat
+          gnugrep
+          gnumake
+          gnused
+          gnutar
+          gzip
+          imagemagick
+          innoextract
+          libtool
+          m4
+          ncurses5 # make menuconfig and slang
+          parted
+          patch
+          perl
+          pkg-config
+          python3
+          rsync
+          sharutils
+          texinfo
+          unzip
+          wget
+          which
+          xz
+          zip
+          zlib
+          zlib.dev
+        ]
+        ++ [
+          # blobs/xx30/vbios_[tw]530.sh
+          bundler
+          p7zip
+          ruby
+          sudo # ( °-° )
+          upx
+        ]
+        ++ [
+          # debugging/fixing/testing
+          qemu
+          vim
+        ];
+    in {
+      devShell = pkgs.mkShellNoCC {
+        buildInputs = deps;
+      };
+      packages.myDevShell =
+        pkgs.runCommand "my-dev-shell" {}
+        #bash
+        ''
+          grep \
+            -e CMAKE_PREFIX_PATH \
+            -e NIX_CC_WRAPPER_TARGET_TARGET \
+            -e NIX_CFLAGS_COMPILE_FOR_TARGET \
+            -e NIX_LDFLAGS_FOR_TARGET \
+            -e PKG_CONFIG_PATH_FOR_TARGET \
+            ${self.devShell.${system}} >$out
+        '';
+      packages.dockerImage = pkgs.dockerTools.buildLayeredImage {
+        name = "linuxboot/heads";
+        tag = "dev-env";
+        config.Entrypoint = ["bash" "-c" ''source /devenv.sh; if (( $# == 0 )); then exec bash; else exec "$0" "$@"; fi''];
+        contents =
+          deps
+          ++ [
+            pkgs.dockerTools.binSh
+            pkgs.dockerTools.caCertificates
+            pkgs.dockerTools.usrBinEnv
+          ];
+        enableFakechroot = true;
+        fakeRootCommands =
+          #bash
+          ''
+            set -e
+
+            grep \
+              -e NIX_CC_WRAPPER_TARGET_TARGET \
+              -e NIX_CFLAGS_COMPILE_FOR_TARGET \
+              -e NIX_LDFLAGS_FOR_TARGET \
+              -e NIX_PKG_CONFIG_WRAPPER_TARGET \
+              -e PKG_CONFIG_PATH_FOR_TARGET \
+              ${self.devShell.${system}} >/devenv.sh
+
+            printf '[safe]\n\tdirectory = *\n' >/.gitconfig
+            mkdir /tmp;
+          '';
+      };
+    });
+}