diff --git a/env.nix b/env.nix
new file mode 100644
index 0000000..e757612
--- /dev/null
+++ b/env.nix
@@ -0,0 +1,20 @@
+let
+  # Pin nixpkgs
+  nixpkgs = builtins.fetchGit {
+    url = "https://github.com/nixos/nixpkgs-channels";
+    ref = "nixos-18.09";
+    rev = "0396345b79436f54920f7eb651ab42acf2eb7973";
+  };
+in
+with import nixpkgs { };
+
+stdenv.mkDerivation rec {
+  name = "nix-bitcoin-environment";
+
+  buildInputs = [ pkgs.nixops pkgs.figlet pkgs.apg ];
+
+  shellHook = ''
+    figlet "nix-bitcoin"
+    ./secrets/generate_secrets.sh
+  '';
+}
diff --git a/generate_secrets.sh b/secrets/generate_secrets.sh
similarity index 88%
rename from generate_secrets.sh
rename to secrets/generate_secrets.sh
index 4059957..b25d47b 100755
--- a/generate_secrets.sh
+++ b/secrets/generate_secrets.sh
@@ -1,15 +1,13 @@
 #!/bin/bash
 
 SECRETSFILE=secrets/secrets.nix
-mkdir -p secrets
 
 if [ -e "$SECRETSFILE" ]; then
-    echo $SECRETSFILE already exists
+    echo $SECRETSFILE already exists. No new secrets were generated.
     exit 1
 fi
 
 echo Installing apg through nix-env
-nix-env -i apg
 echo Write secrets to $SECRETSFILE
 {
     echo \{