Install via nix package. Also configure with custom module, inspired by nix os module. Bind hard to localhost, do not listen to outer world.