diff --git a/firmware/app.nix b/firmware/app.nix
index fccee82..05f89c5 100644
--- a/firmware/app.nix
+++ b/firmware/app.nix
@@ -10,18 +10,39 @@ let
     systemd = config.systemd.package;
     iwd = config.networking.wireless.iwd.package;
   };
+
+  app = pkgs.substituteAll {
+    src = ./app.py;
+    isExecutable = true;
+
+    python = pkgs.python3.withPackages (ps: with ps; [ pyyaml aiohttp ]);
+  };
 in
 {
   config = {
     systemd = {
       services = {
         qclk-configurer = {
-          description = "qclk dynamic configurer";
+          description = "qCLK dynamic configurer";
           after = [ "network.target" ];
 
           serviceConfig = {
             Type = "notify-reload";
             ExecStart = "${configurer} serve";
+            Restart = "on-failure";
+          };
+
+          wantedBy = [ "multi-user.target" ];
+        };
+
+        qclk-app = {
+          description = "qCLK app";
+          after = [ "qclk-configurer.service" ];
+
+          serviceConfig = {
+            Type = "simple";
+            ExecStart = "${app}";
+            Restart = "on-failure";
           };
 
           wantedBy = [ "multi-user.target" ];
diff --git a/firmware/app.py b/firmware/app.py
new file mode 100755
index 0000000..fb06d40
--- /dev/null
+++ b/firmware/app.py
@@ -0,0 +1,29 @@
+#! @python@/bin/python -B
+import os
+
+from aiohttp import web
+import yaml
+
+CONF_FILE = os.getenv('CONFIG', '/etc/qclk/config.yaml')
+conf_k = web.AppKey('config', dict)
+
+def log(m):
+  print(m, file=sys.stderr)
+
+routes = web.RouteTableDef()
+
+@routes.get('/')
+async def index(req):
+  return web.Response(text='Hello, world!')
+
+def main():
+  app = web.Application()
+
+  with open(CONF_FILE) as f:
+    app[conf_k] = yaml.safe_load(f)
+  app.add_routes(routes)
+
+  web.run_app(app, port=8080)
+
+if __name__ == '__main__':
+  main()
diff --git a/firmware/configurer.py b/firmware/configurer.py
index 76eaacb..120b7d0 100755
--- a/firmware/configurer.py
+++ b/firmware/configurer.py
@@ -63,7 +63,7 @@ class Configurer:
       self.config = yaml.safe_load(f)
 
   def write_config(self):
-    log(f'Updaing config')
+    log(f'Updating config')
     tmp = os.path.join(self.tmpdir, 'new-config.yaml')
     with open(tmp, 'w') as f:
       yaml.dump(self.config, f)
diff --git a/firmware/default.nix b/firmware/default.nix
index d684ba5..c65a430 100644
--- a/firmware/default.nix
+++ b/firmware/default.nix
@@ -40,6 +40,8 @@ in
   perSystem = { lib, libMy, pkgs, ... }:
   let
     inherit (lib) concatMapStringsSep;
+
+    devPython = pkgs.python3.withPackages (ps: with ps; [ pyyaml aiohttp ]);
   in
   {
     devenv.shells.firmware = libMy.withRootdir {
@@ -47,6 +49,7 @@ in
         nixos-rebuild
         nixVersions.latest
         wireguard-tools
+        devPython
       ];
 
       scripts =
diff --git a/firmware/network.nix b/firmware/network.nix
index f6e3983..a605cee 100644
--- a/firmware/network.nix
+++ b/firmware/network.nix
@@ -9,6 +9,11 @@
     hostName = config.system.name;
     useDHCP = false;
     useNetworkd = true;
+
+    firewall = {
+      interfaces.management.allowedTCPPorts = [ 8080 ];
+    };
+
     wireless.iwd = {
       enable = true;
       settings = {