diff --git a/flake.nix b/flake.nix
index f20c1a1..b208608 100644
--- a/flake.nix
+++ b/flake.nix
@@ -26,6 +26,9 @@
         labmon = self.packages.${prev.system}.default;
       };
 
+      nixosModules.labmon = import ./nix/module.nix;
+      nixosModules.default = self.nixosModules.labmon;
+
       packages = forAllSystems (
         { pkgs }:
         {
diff --git a/main.go b/main.go
index df88289..0b37d91 100644
--- a/main.go
+++ b/main.go
@@ -18,7 +18,11 @@ import (
 const Version = "0.1.0"
 
 func LoadConfig() (*config.Config, error) {
-	config, err := config.FromFile("labmon.toml")
+	path := "labmon.toml"
+	if len(os.Args) > 1 {
+		path = os.Args[1]
+	}
+	config, err := config.FromFile(path)
 	if err != nil {
 		return nil, err
 	}
diff --git a/nix/module.nix b/nix/module.nix
new file mode 100644
index 0000000..ed4ce0e
--- /dev/null
+++ b/nix/module.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  settingsFormat = pkgs.format.toml { };
+
+  settingsFile = settingsFormat.generate "labmon.toml" config.labmon.settings;
+in
+{
+  options.labmon = {
+    enable = lib.mkEnableOption "Enable labmon";
+
+    settings = lib.mkOption {
+      type = lib.types.attrs;
+      description = ''
+        Settings for labmon.
+      '';
+    };
+  };
+
+  systemd.services.labmon = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+
+    serviceConfig = {
+      ExecStart = "${pkgs.labmon}/bin/labmon ${settingsFile}";
+      DynamicUser = true;
+      Restart = "always";
+
+      # Hardening
+      DevicePolicy = "strict";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "full";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+    };
+  };
+}