diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..7cbb245
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,4 @@
+[submodule "nixos-infect"]
+	path = misc/nixos-infect
+	url = ../nixos-infect
+	branch = sammy
diff --git a/files/cloud-init.yml b/files/cloud-init.yml
new file mode 100644
index 0000000..3e0d3fa
--- /dev/null
+++ b/files/cloud-init.yml
@@ -0,0 +1,4 @@
+#cloud-config
+
+runcmd:
+  - curl https://git.cherrykitten.dev/sammy/nixos-infect/raw/branch/sammy/nixos-infect | PROVIDER=hetznercloud NIX_CHANNEL=nixos-23.05 bash 2>&1 | tee /tmp/infect.log
diff --git a/flake.nix b/flake.nix
index 02e3ead..495ac97 100644
--- a/flake.nix
+++ b/flake.nix
@@ -26,11 +26,22 @@
       formatter = forAllSystems (system: nixpkgs.legacyPackages.${system}.nixpkgs-fmt);
 
       devShells = forAllSystems (system:
-        let pkgs = import nixpkgs { system = system; }; in {
+        let
+          pkgs = import nixpkgs { system = system; };
+          packages = [ pkgs.nix pkgs.colmena pkgs.just pkgs.git pkgs.home-manager pkgs.pass pkgs.nixos-rebuild ];
+        in
+        {
           default = pkgs.mkShell {
-            nativeBuildInputs = [ pkgs.nix pkgs.colmena pkgs.just pkgs.git pkgs.home-manager pkgs.nixos-rebuild ];
+            nativeBuildInputs = packages;
             shellHook = "exec $SHELL";
           };
+          hcloud = pkgs.mkShell {
+            nativeBuildInputs = packages ++ [ pkgs.hcloud ];
+            shellHook = ''
+              export HCLOUD_TOKEN=$(pass services/hcloud/api_token)
+              exec $SHELL
+            '';
+          };
         });
 
       colmena =
diff --git a/misc/nixos-infect b/misc/nixos-infect
new file mode 160000
index 0000000..ed6a87b
--- /dev/null
+++ b/misc/nixos-infect
@@ -0,0 +1 @@
+Subproject commit ed6a87bc3a5e5c44cff4b30e5900b436b92ad9a1