diff --git a/fetch_data.sh b/fetch_data.sh
index a111173..2585868 100755
--- a/fetch_data.sh
+++ b/fetch_data.sh
@@ -1,7 +1,9 @@
 #!/usr/bin/env sh
 
+set -e
+
 overpass() {
-    curl -X POST -d "data=[out:json];$1" http://overpass-api.de/api/interpreter
+    curl -X POST -d "data=[out:json];$1" -o $2 http://overpass-api.de/api/interpreter
 }
 
 bbox="50.8,13,51.3,14.5"
@@ -10,6 +12,14 @@ for level in 7 8 9 10 11 ; do
     Q=$Q'way["admin_level"="'$level'"]('$bbox'); relation["admin_level"="'$level'"]('$bbox');'
 done
 
-overpass "($Q); out body; >; out skel;" > locations.json
+if [ ! -e locations.json ]; then
+    F=$(mktemp)
+    overpass "($Q); out body; >; out skel;" $F
+    mv $F locations.json
+fi
 
-wget https://opensky-network.org/datasets/metadata/aircraftDatabase.csv
+if [ ! -e aircraftDatabase.csv ]; then
+    F=$(mktemp)
+    curl https://opensky-network.org/datasets/metadata/aircraftDatabase.csv -o $F
+    mv $F aircraftDatabase.csv
+fi
diff --git a/flake.nix b/flake.nix
index 803932e..9855651 100644
--- a/flake.nix
+++ b/flake.nix
@@ -48,5 +48,65 @@
         nativeBuildInputs = with defaultPackage;
           nativeBuildInputs ++ buildInputs;
       };
-    });
+    }) // {
+      nixosModule = { config, lib, pkgs, ... }: {
+        options.services.heliwatch = with lib; {
+          enable = mkEnableOption "Enable Heliwatch MUC bot";
+          jid = mkOption {
+            type = types.str;
+          };
+          password = mkOption {
+            type = types.str;
+          };
+          muc = mkOption {
+            type = types.str;
+            description = "Full Jabber-Id in the form of room@service/nickname";
+          };
+          user = mkOption {
+            type = types.str;
+            default = "heliwatch";
+          };
+          group = mkOption {
+            type = types.str;
+            default = "heliwatch";
+          };
+        };
+
+        config =
+          let
+            cfg = config.services.heliwatch;
+          in
+            lib.mkIf cfg.enable {
+              users = {
+                users.${cfg.user} = {
+                  isSystemUser = true;
+                  home = "/home/heliwatch";
+                  createHome = true;
+                  group = cfg.group;
+                };
+                groups.${cfg.group} = {};
+              };
+
+              systemd.services.heliwatch = {
+                wantedBy = [ "multi-user.target" ];
+                after = [ "network.target" ];
+                path = with pkgs; [ bash curl ];
+                script = ''
+                  ${./fetch_data.sh}
+                  exec ${self.packages.${pkgs.system}.heliwatch}/bin/heliwatch ${lib.escapeShellArgs (with cfg; [ jid password muc ])}
+                '';
+                serviceConfig = {
+                  Type = "simple";
+                  User = cfg.user;
+                  Group = cfg.group;
+                  WorkingDirectory = config.users.users.${cfg.user}.home;
+                  ReadWritePaths = config.users.users.${cfg.user}.home;
+                  ProtectSystem = "full";
+                  Restart = "always";
+                  RestartSec = "60s";
+                };
+              };
+            };
+      };
+    };
 }