diff --git a/flake.nix b/flake.nix
index e215e71a7d6d36bb29aa990199d030b6aa702819..a9bcc39ad82f9e2b0e143bb40643c077714b544b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -31,11 +31,16 @@
 
         horizon-platform-prev = get-flake horizon-platform;
 
-        horizon-gen-nix = writeBashBin "horizon-gen-nix" ''
-          ${horizon-platform-prev.legacyPackages.${system}.horizon-gen-nix}/bin/horizon-gen-nix;
-          ${pkgs.nixpkgs-fmt}/bin/nixpkgs-fmt pkgs/*
-          ${pkgs.nixpkgs-fmt}/bin/nixpkgs-fmt initial-packages.nix
-        '';
+        horizon-gen-nix = pkgs.writeShellApplication {
+          name = "horizon-gen-nix";
+          runtimeInputs = with pkgs; [ ghc cabal-install ];
+          text = ''
+            cabal update
+            ${horizon-platform-prev.legacyPackages.${system}.horizon-gen-nix}/bin/horizon-gen-nix;
+            ${pkgs.nixpkgs-fmt}/bin/nixpkgs-fmt pkgs/*
+            ${pkgs.nixpkgs-fmt}/bin/nixpkgs-fmt initial-packages.nix
+          '';
+        };
 
         haskellLib = pkgs.haskell.lib.compose;
 
diff --git a/horizon.dhall b/horizon.dhall
index c4e8ec071c49c44ec2bafdffe524aafff6dcbeda..90567c9428f139d6d75eb70be87be74721ec570b 100644
--- a/horizon.dhall
+++ b/horizon.dhall
@@ -112,6 +112,7 @@ let packages =
       , attoparsec-binary = H.callHackage "attoparsec-binary" "0.2"
       , attoparsec-iso8601 = H.callHackage "attoparsec-iso8601" "1.1.0.0"
       , attoparsec = H.callHackage "attoparsec" "0.14.4"
+      , authenticate-oauth = H.callHackage "authenticate-oauth" "1.7"
       , auto-update = H.callHackage "auto-update" "0.1.6"
       , autodocodec = H.callHackage "autodocodec" "0.2.0.1"
       , autodocodec-schema = H.callHackage "autodocodec-schema" "0.1.0.2"
@@ -203,6 +204,7 @@ let packages =
       , composite-lens-extra = H.callHackage "composite-lens-extra" "0.1.0.0"
       , composite-tuple = H.callHackage "composite-tuple" "0.1.2.0"
       , composition-prelude = H.callHackage "composition-prelude" "3.0.0.2"
+      , concise = H.callHackage "concise" "0.1.0.1"
       , concurrent-extra = H.callHackage "concurrent-extra" "0.7.0.12"
       , concurrent-output = H.callHackage "concurrent-output" "1.10.16"
       , conduit-combinators = H.callHackage "conduit-combinators" "1.3.0"
@@ -236,6 +238,7 @@ let packages =
       , cryptohash = H.callHackage "cryptohash" "0.11.9"
       , crypto-api-tests = H.callHackage "crypto-api-tests" "0.3"
       , crypto-api = H.callHackage "crypto-api" "0.13.3"
+      , crypto-pubkey-types = H.callHackage "crypto-pubkey-types" "0.4.3"
       , daemons = H.callHackage "daemons" "0.3.0"
       , data-binary-ieee754 = H.callHackage "data-binary-ieee754" "0.4.4"
       , data-clist = H.callHackage "data-clist" "0.2"
@@ -551,6 +554,7 @@ let packages =
       , iso8601-time = H.callHackage "iso8601-time" "0.1.5"
       , iwlib = H.callHackage "iwlib" "0.1.2"
       , jira-wiki-markup = H.callHackage "jira-wiki-markup" "1.4.0"
+      , jose = H.callHackage "jose" "0.9"
       , js-chart = H.callHackage "js-chart" "2.9.4.1"
       , js-dgtable = H.callHackage "js-dgtable" "0.5.2"
       , js-flot = H.callHackage "js-flot" "0.8.3"
@@ -820,6 +824,7 @@ let packages =
       , retry = H.callHackage "retry" "0.9.3.0"
       , rope-utf16-splay = H.callHackage "rope-utf16-splay" "0.4.0.0"
       , row-types = H.callHackage "row-types" "1.0.1.2"
+      , RSA = H.callHackage "RSA" "2.4.1"
       , safe-coloured-text-layout =
           H.callHackage "safe-coloured-text-layout" "0.0.0.0"
       , safe-coloured-text-terminfo =
@@ -845,6 +850,8 @@ let packages =
       , semver = H.callHackage "semver" "0.4.0.1"
       , serialise = H.callHackage "serialise" "0.2.6.0"
       , servant = callGitServant "servant"
+      , servant-auth = H.callHackage "servant-auth" "0.4.1.0"
+      , servant-auth-server = H.callHackage "servant-auth-server" "0.4.7.0"
       , servant-blaze = H.callHackage "servant-blaze" "0.9.1"
       , servant-client-core = callGitServant "servant-client-core"
       , servant-client = callGitServant "servant-client"
@@ -1112,6 +1119,7 @@ let packages =
       , word-compat = H.callHackage "word-compat" "0.0.6"
       , word-wrap = H.callHackage "word-wrap" "0.5"
       , word8 = H.callHackage "word8" "0.1.3"
+      , wreq = H.callHackage "wreq" "0.5.3.3"
       , wuss = H.callHackage "wuss" "2.0.0.2"
       , x509-store = H.callHackage "x509-store" "1.6.9"
       , x509-system = H.callHackage "x509-system" "1.6.7"
diff --git a/initial-packages.nix b/initial-packages.nix
index 1f4ac6f91dac08a8a44f45e09edf72ee0fb4e20e..46967c1cea8dbaa256c760e62814469734c49c00 100644
--- a/initial-packages.nix
+++ b/initial-packages.nix
@@ -53,6 +53,8 @@ self: with pkgs.haskell.lib; {
 
   QuickCheck = self.callPackage (./pkgs/QuickCheck.nix) { };
 
+  RSA = self.callPackage (./pkgs/RSA.nix) { };
+
   SHA = self.callPackage (./pkgs/SHA.nix) { };
 
   StateVar = self.callPackage (./pkgs/StateVar.nix) { };
@@ -121,6 +123,8 @@ self: with pkgs.haskell.lib; {
 
   attoparsec-iso8601 = self.callPackage (./pkgs/attoparsec-iso8601.nix) { };
 
+  authenticate-oauth = self.callPackage (./pkgs/authenticate-oauth.nix) { };
+
   auto-update = self.callPackage (./pkgs/auto-update.nix) { };
 
   autodocodec = self.callPackage (./pkgs/autodocodec.nix) { };
@@ -285,6 +289,8 @@ self: with pkgs.haskell.lib; {
 
   composition-prelude = self.callPackage (./pkgs/composition-prelude.nix) { };
 
+  concise = self.callPackage (./pkgs/concise.nix) { };
+
   concurrent-extra = self.callPackage (./pkgs/concurrent-extra.nix) { };
 
   concurrent-output = self.callPackage (./pkgs/concurrent-output.nix) { };
@@ -319,6 +325,8 @@ self: with pkgs.haskell.lib; {
 
   crypto-api-tests = self.callPackage (./pkgs/crypto-api-tests.nix) { };
 
+  crypto-pubkey-types = self.callPackage (./pkgs/crypto-pubkey-types.nix) { };
+
   cryptohash = self.callPackage (./pkgs/cryptohash.nix) { };
 
   cryptohash-md5 = self.callPackage (./pkgs/cryptohash-md5.nix) { };
@@ -865,6 +873,8 @@ self: with pkgs.haskell.lib; {
 
   jira-wiki-markup = self.callPackage (./pkgs/jira-wiki-markup.nix) { };
 
+  jose = self.callPackage (./pkgs/jose.nix) { };
+
   js-chart = self.callPackage (./pkgs/js-chart.nix) { };
 
   js-dgtable = self.callPackage (./pkgs/js-dgtable.nix) { };
@@ -1389,6 +1399,10 @@ self: with pkgs.haskell.lib; {
 
   servant = self.callPackage (./pkgs/servant.nix) { };
 
+  servant-auth = self.callPackage (./pkgs/servant-auth.nix) { };
+
+  servant-auth-server = self.callPackage (./pkgs/servant-auth-server.nix) { };
+
   servant-blaze = self.callPackage (./pkgs/servant-blaze.nix) { };
 
   servant-client = self.callPackage (./pkgs/servant-client.nix) { };
@@ -1843,6 +1857,8 @@ self: with pkgs.haskell.lib; {
 
   word8 = self.callPackage (./pkgs/word8.nix) { };
 
+  wreq = self.callPackage (./pkgs/wreq.nix) { };
+
   wuss = self.callPackage (./pkgs/wuss.nix) { };
 
   x509 = self.callPackage (./pkgs/x509.nix) { };
diff --git a/pkgs/RSA.nix b/pkgs/RSA.nix
new file mode 100644
index 0000000000000000000000000000000000000000..0a91233e81eaaaa33a4475d2576e91775b7bffbc
--- /dev/null
+++ b/pkgs/RSA.nix
@@ -0,0 +1,51 @@
+{ mkDerivation
+, QuickCheck
+, SHA
+, base
+, binary
+, bytestring
+, crypto-api
+, crypto-pubkey-types
+, lib
+, tagged
+, test-framework
+, test-framework-quickcheck2
+}:
+mkDerivation {
+  pname = "RSA";
+  version = "2.4.1";
+  sha256 = "72c5d8c45ef1013e0e8aff763bb8894df0f022f28e698e33ae87bbdb33d69041";
+  isLibrary = true;
+  isExecutable = false;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [
+    base
+    binary
+    bytestring
+    crypto-api
+    crypto-pubkey-types
+    SHA
+  ];
+  testHaskellDepends = [
+    base
+    binary
+    bytestring
+    crypto-api
+    crypto-pubkey-types
+    QuickCheck
+    SHA
+    tagged
+    test-framework
+    test-framework-quickcheck2
+  ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = false;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  description = "Implementation of RSA, using the padding schemes of PKCS#1 v2.1.";
+  license = lib.licenses.bsd3;
+  broken = false;
+}
diff --git a/pkgs/authenticate-oauth.nix b/pkgs/authenticate-oauth.nix
new file mode 100644
index 0000000000000000000000000000000000000000..8575a50d44b538221e988619b0cf024a4c6685c8
--- /dev/null
+++ b/pkgs/authenticate-oauth.nix
@@ -0,0 +1,54 @@
+{ mkDerivation
+, RSA
+, SHA
+, base
+, base64-bytestring
+, blaze-builder
+, bytestring
+, crypto-pubkey-types
+, data-default
+, http-client
+, http-types
+, lib
+, random
+, time
+, transformers
+, transformers-compat
+}:
+mkDerivation {
+  pname = "authenticate-oauth";
+  version = "1.7";
+  sha256 = "746ff695fec1bd7c7b90f1952847ce3453fadf0f18a31db206753360b3219b78";
+  revision = "1";
+  editedCabalFile = "198xm2qdaqwg2m9kgrkw5gdk2bh19mmj6c4d5fsbpcjnhxlh6axg";
+  isLibrary = true;
+  isExecutable = false;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [
+    base
+    base64-bytestring
+    blaze-builder
+    bytestring
+    crypto-pubkey-types
+    data-default
+    http-client
+    http-types
+    random
+    RSA
+    SHA
+    time
+    transformers
+    transformers-compat
+  ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = false;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "http://github.com/yesodweb/authenticate";
+  description = "Library to authenticate with OAuth for Haskell web applications";
+  license = lib.licenses.bsd3;
+  broken = false;
+}
diff --git a/pkgs/concise.nix b/pkgs/concise.nix
new file mode 100644
index 0000000000000000000000000000000000000000..f76d0a8a4212c9d43ae9b63dc27be816835898c5
--- /dev/null
+++ b/pkgs/concise.nix
@@ -0,0 +1,41 @@
+{ mkDerivation
+, QuickCheck
+, base
+, bytestring
+, lens
+, lib
+, quickcheck-instances
+, tasty
+, tasty-quickcheck
+, text
+}:
+mkDerivation {
+  pname = "concise";
+  version = "0.1.0.1";
+  sha256 = "5c27df5a3e1fe820548e90abc4a0e326b6d0fb286218619aa22d3af90c7b9925";
+  isLibrary = true;
+  isExecutable = false;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [ base bytestring lens text ];
+  testHaskellDepends = [
+    base
+    bytestring
+    lens
+    QuickCheck
+    quickcheck-instances
+    tasty
+    tasty-quickcheck
+    text
+  ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = false;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "https://github.com/frasertweedale/hs-concise";
+  description = "Utilities for Control.Lens.Cons";
+  license = lib.licenses.bsd3;
+  broken = false;
+}
diff --git a/pkgs/crypto-pubkey-types.nix b/pkgs/crypto-pubkey-types.nix
new file mode 100644
index 0000000000000000000000000000000000000000..87d94e81fe1633345b499ca1ecdd82340ac7c5e1
--- /dev/null
+++ b/pkgs/crypto-pubkey-types.nix
@@ -0,0 +1,21 @@
+{ mkDerivation, asn1-encoding, asn1-types, base, lib }:
+mkDerivation {
+  pname = "crypto-pubkey-types";
+  version = "0.4.3";
+  sha256 = "7ed9f52281ec4e34021a91818fe45288e33d65bff937f60334a3f45be5a71c60";
+  isLibrary = true;
+  isExecutable = false;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [ asn1-encoding asn1-types base ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = false;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "http://github.com/vincenthz/hs-crypto-pubkey-types";
+  description = "Generic cryptography Public keys algorithm types";
+  license = lib.licenses.bsd3;
+  broken = false;
+}
diff --git a/pkgs/jose.nix b/pkgs/jose.nix
new file mode 100644
index 0000000000000000000000000000000000000000..948813586f34ced2b11ba1d7332f700e31112125
--- /dev/null
+++ b/pkgs/jose.nix
@@ -0,0 +1,87 @@
+{ mkDerivation
+, QuickCheck
+, aeson
+, base
+, base64-bytestring
+, bytestring
+, concise
+, containers
+, cryptonite
+, hspec
+, lens
+, lib
+, memory
+, monad-time
+, mtl
+, network-uri
+, pem
+, quickcheck-instances
+, tasty
+, tasty-hspec
+, tasty-quickcheck
+, template-haskell
+, text
+, time
+, x509
+}:
+mkDerivation {
+  pname = "jose";
+  version = "0.9";
+  sha256 = "92f919239d02c9f3369d885ba9a3a9fdf14f352e2dc281c3f50a5993df00314e";
+  isLibrary = true;
+  isExecutable = true;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [
+    aeson
+    base
+    base64-bytestring
+    bytestring
+    concise
+    containers
+    cryptonite
+    lens
+    memory
+    monad-time
+    mtl
+    network-uri
+    QuickCheck
+    quickcheck-instances
+    template-haskell
+    text
+    time
+    x509
+  ];
+  testHaskellDepends = [
+    aeson
+    base
+    base64-bytestring
+    bytestring
+    concise
+    containers
+    cryptonite
+    hspec
+    lens
+    mtl
+    network-uri
+    pem
+    QuickCheck
+    quickcheck-instances
+    tasty
+    tasty-hspec
+    tasty-quickcheck
+    text
+    time
+    x509
+  ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = false;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "https://github.com/frasertweedale/hs-jose";
+  description = "JSON Object Signing and Encryption (JOSE) and JSON Web Token (JWT) library";
+  license = lib.licenses.asl20;
+  broken = false;
+}
diff --git a/pkgs/servant-auth-server.nix b/pkgs/servant-auth-server.nix
new file mode 100644
index 0000000000000000000000000000000000000000..582dddfd79eec490bcc5efc0fc0856a11a77c168
--- /dev/null
+++ b/pkgs/servant-auth-server.nix
@@ -0,0 +1,104 @@
+{ mkDerivation
+, QuickCheck
+, aeson
+, base
+, base64-bytestring
+, blaze-builder
+, bytestring
+, case-insensitive
+, cookie
+, data-default-class
+, entropy
+, hspec
+, hspec-discover
+, http-client
+, http-types
+, jose
+, lens
+, lens-aeson
+, lib
+, markdown-unlit
+, memory
+, monad-time
+, mtl
+, servant
+, servant-auth
+, servant-server
+, tagged
+, text
+, time
+, transformers
+, unordered-containers
+, wai
+, warp
+, wreq
+}:
+mkDerivation {
+  pname = "servant-auth-server";
+  version = "0.4.7.0";
+  sha256 = "42da496b14f250495131d92280e007634dbed580cea7bc423cbe87877b2f24d4";
+  revision = "4";
+  editedCabalFile = "1qcgm2pqi5qjqk27632h69j8ishls6cby8gghvww73wi63fqii9n";
+  isLibrary = true;
+  isExecutable = false;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [
+    aeson
+    base
+    base64-bytestring
+    blaze-builder
+    bytestring
+    case-insensitive
+    cookie
+    data-default-class
+    entropy
+    http-types
+    jose
+    lens
+    memory
+    monad-time
+    mtl
+    servant
+    servant-auth
+    servant-server
+    tagged
+    text
+    time
+    unordered-containers
+    wai
+  ];
+  testHaskellDepends = [
+    aeson
+    base
+    bytestring
+    case-insensitive
+    hspec
+    http-client
+    http-types
+    jose
+    lens
+    lens-aeson
+    mtl
+    QuickCheck
+    servant
+    servant-auth
+    servant-server
+    time
+    transformers
+    wai
+    warp
+    wreq
+  ];
+  testToolDepends = [ hspec-discover markdown-unlit ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = false;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "http://github.com/haskell-servant/servant/servant-auth#readme";
+  description = "servant-server/servant-auth compatibility";
+  license = lib.licenses.bsd3;
+  broken = false;
+}
diff --git a/pkgs/servant-auth.nix b/pkgs/servant-auth.nix
new file mode 100644
index 0000000000000000000000000000000000000000..bf2f35530789d0898a2c51d459a6aedf9a7754ca
--- /dev/null
+++ b/pkgs/servant-auth.nix
@@ -0,0 +1,42 @@
+{ mkDerivation
+, aeson
+, base
+, containers
+, jose
+, lens
+, lib
+, servant
+, text
+, unordered-containers
+}:
+mkDerivation {
+  pname = "servant-auth";
+  version = "0.4.1.0";
+  sha256 = "add973fe8bcc1b68eaaf90a1ec8fd6933d11eabf3854f91371b77d6827b5ef21";
+  revision = "4";
+  editedCabalFile = "0qgaq8if56fh1ydx8crb24p5cb5axx3n1lnx8klvvkamwrbr870a";
+  isLibrary = true;
+  isExecutable = false;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [
+    aeson
+    base
+    containers
+    jose
+    lens
+    servant
+    text
+    unordered-containers
+  ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = false;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "http://github.com/haskell-servant/servant/servant-auth#readme";
+  description = "Authentication combinators for servant";
+  license = lib.licenses.bsd3;
+  broken = false;
+}
diff --git a/pkgs/wreq.nix b/pkgs/wreq.nix
new file mode 100644
index 0000000000000000000000000000000000000000..6a610c27ac022810816f86163ed0d58b53a14521
--- /dev/null
+++ b/pkgs/wreq.nix
@@ -0,0 +1,128 @@
+{ mkDerivation
+, Cabal
+, HUnit
+, QuickCheck
+, aeson
+, aeson-pretty
+, attoparsec
+, authenticate-oauth
+, base
+, base16-bytestring
+, base64-bytestring
+, bytestring
+, cabal-doctest
+, case-insensitive
+, containers
+, cryptonite
+, directory
+, doctest
+, exceptions
+, filepath
+, ghc-prim
+, hashable
+, http-client
+, http-client-tls
+, http-types
+, lens
+, lens-aeson
+, lib
+, memory
+, mime-types
+, network-info
+, psqueues
+, snap-core
+, snap-server
+, template-haskell
+, temporary
+, test-framework
+, test-framework-hunit
+, test-framework-quickcheck2
+, text
+, time
+, time-locale-compat
+, transformers
+, unix-compat
+, unordered-containers
+, uuid
+, vector
+}:
+mkDerivation {
+  pname = "wreq";
+  version = "0.5.3.3";
+  sha256 = "bcf31dd31f7c8d023ec36170f1bb4bd187906dd277d05a15dc27838b0808657f";
+  isLibrary = true;
+  isExecutable = true;
+  enableSeparateDataOutput = false;
+  setupHaskellDepends = [ base Cabal cabal-doctest ];
+  libraryHaskellDepends = [
+    aeson
+    attoparsec
+    authenticate-oauth
+    base
+    base16-bytestring
+    bytestring
+    case-insensitive
+    containers
+    cryptonite
+    exceptions
+    ghc-prim
+    hashable
+    http-client
+    http-client-tls
+    http-types
+    lens
+    lens-aeson
+    memory
+    mime-types
+    psqueues
+    template-haskell
+    text
+    time
+    time-locale-compat
+    unordered-containers
+  ];
+  testHaskellDepends = [
+    aeson
+    aeson-pretty
+    base
+    base64-bytestring
+    bytestring
+    case-insensitive
+    containers
+    directory
+    doctest
+    filepath
+    hashable
+    http-client
+    http-types
+    HUnit
+    lens
+    lens-aeson
+    network-info
+    QuickCheck
+    snap-core
+    snap-server
+    temporary
+    test-framework
+    test-framework-hunit
+    test-framework-quickcheck2
+    text
+    time
+    transformers
+    unix-compat
+    unordered-containers
+    uuid
+    vector
+  ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = false;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "http://www.serpentine.com/wreq";
+  description = "An easy-to-use HTTP client library";
+  license = lib.licenses.bsd3;
+  broken = false;
+}