diff --git a/.gitignore b/.gitignore
index f069e42..f4199de 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 result
 .gcroots
 config.tf.json
-.direnv
\ No newline at end of file
+.direnv
+.terraform
diff --git a/flake.nix b/flake.nix
index a821aed..87a2475 100644
--- a/flake.nix
+++ b/flake.nix
@@ -31,7 +31,12 @@
     terraform = pkgs.opentofu;
     terraformCfg = terranix.lib.terranixConfiguration {
       inherit system;
-      modules = [ ];
+      modules = [ 
+        ./terraform
+        {
+          bagel.hydra.enable = true;
+        }
+      ];
     };
   in
   {
@@ -46,6 +51,16 @@
             ${lib.getExe terraform} apply
           '');
         };
+      plan = {
+        type = "app";
+        program = toString (pkgs.writers.writeBash "plan" ''
+            set -eo pipefail
+            rm -f config.tf.json
+            cp ${terraformCfg} config.tf.json
+            ${lib.getExe terraform} init
+            ${lib.getExe terraform} plan
+          '');
+        };
         # nix run ".#destroy"
         destroy = {
           type = "app";
@@ -60,9 +75,11 @@
     apps.${system}.default = self.apps.${system}.apply;
 
     devShells.${system}.default = pkgs.mkShell {
-      packages = [ 
+      packages = [
         inputs.agenix.packages.${system}.agenix
         inputs.colmena.packages.${system}.colmena
+
+        pkgs.opentofu
       ];
     };
 
diff --git a/terraform/default.nix b/terraform/default.nix
new file mode 100644
index 0000000..61f5866
--- /dev/null
+++ b/terraform/default.nix
@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./hydra.nix
+  ];
+}
diff --git a/terraform/hydra.nix b/terraform/hydra.nix
new file mode 100644
index 0000000..e980715
--- /dev/null
+++ b/terraform/hydra.nix
@@ -0,0 +1,72 @@
+{ lib, config, ... }:
+let
+  inherit (lib) mkEnableOption mkIf types mkOption;
+  cfg = config.bagel.hydra;
+in
+{
+  options.bagel.hydra = {
+    enable = mkEnableOption "the Hydra jobsets";
+  };
+
+  config = mkIf cfg.enable {
+    terraform.required_providers.hydra = {
+      version = "~> 0.1";
+      source = "DeterminateSystems/hydra";
+    };
+
+    provider.hydra = {
+      host = "https://hydra.bagel.delroth.net";
+      # username/password are provided via HYDRA_USERNAME/HYDRA_PASSWORD
+    };
+
+    resource.hydra_project.forkos = {
+      name = "forkos";
+      display_name = "ForkOS";
+      description = "ForkOS packages collection";
+      homepage = "https://cl.forkos.org";
+      owner = "raito";
+      enabled = true;
+      visible = true;
+    };
+
+    resource.hydra_jobset.raito-nixos-rolling-small = {
+      project = config.resource.hydra_project.forkos.name;
+      state = "enabled";
+      visible = true;
+      name = "raito-nixos-rolling-small";
+      type = "legacy";
+      description = "master branch for raito-nixos";
+
+      nix_expression = {
+        file = "pkgs/top-level/release.nix";
+        input = "nixpkgs";
+      };
+
+      check_interval = 0;
+      scheduling_shares = 3000;
+      keep_evaluations = 3;
+
+      email_notifications = false;
+
+      input = [
+        {
+          name = "nixpkgs";
+          type = "git";
+          value = "https://cl.forkos.org/nixpkgs";
+          notify_committers = false;
+        }
+        {
+          name = "officialRelease";
+          type = "boolean";
+          value = "false";
+          notify_committers = false;
+        }
+        {
+          name = "supportedSystems";
+          type = "nix";
+          value = ''[ "x86_64-linux" ]'';
+        }
+      ];
+    };
+  };
+}