diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index 2676a85029cb..ac0806bdb917 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -47,6 +47,7 @@
   andir = "Andreas Rammhold <andreas@rammhold.de>";
   andres = "Andres Loeh <ksnixos@andres-loeh.de>";
   andrestylianos = "Andre S. Ramos <andre.stylianos@gmail.com>";
+  andrew-d = "Andrew Dunham <andrew@du.nham.ca>";
   andrewrk = "Andrew Kelley <superjoe30@gmail.com>";
   andsild = "Anders Sildnes <andsild@gmail.com>";
   aneeshusa = "Aneesh Agrawal <aneeshusa@gmail.com>";
diff --git a/pkgs/tools/admin/lego/default.nix b/pkgs/tools/admin/lego/default.nix
new file mode 100644
index 000000000000..fe165b1e66e3
--- /dev/null
+++ b/pkgs/tools/admin/lego/default.nix
@@ -0,0 +1,24 @@
+{ lib, fetchFromGitHub, buildGoPackage }:
+
+buildGoPackage rec {
+  name = "lego-unstable-${version}";
+  version = "2018-02-02";
+  rev = "06a8e7c475c03ef8d4773284ac63357d2810601b";
+
+  src = fetchFromGitHub {
+    inherit rev;
+    owner = "xenolf";
+    repo = "lego";
+    sha256 = "11a9gcgi3317z4lb1apkf6dnbjhf7xni0670nric3fbf5diqfwh2";
+  };
+
+  goPackagePath = "github.com/xenolf/lego";
+  goDeps = ./deps.nix;
+
+  meta = with lib; {
+    description = "Let's Encrypt client and ACME library written in Go";
+    license = licenses.mit;
+    homepage = https://github.com/xenolf/lego;
+    maintainers = with maintainers; [ andrew-d ];
+  };
+}
diff --git a/pkgs/tools/admin/lego/deps.nix b/pkgs/tools/admin/lego/deps.nix
new file mode 100644
index 000000000000..6d842c5f3f51
--- /dev/null
+++ b/pkgs/tools/admin/lego/deps.nix
@@ -0,0 +1,219 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
+[
+  {
+    goPackagePath = "cloud.google.com/go";
+    fetch = {
+      type = "git";
+      url = "https://code.googlesource.com/gocloud";
+      rev = "fd7767e8876b52efa597af4d0ec944e9b2574120";
+      sha256 = "1m7yd2vwbgypi9izgyif4k8rifgfmgsh747s1z467qlr5k17cjy5";
+    };
+  }
+  {
+    goPackagePath = "github.com/Azure/azure-sdk-for-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Azure/azure-sdk-for-go";
+      rev = "f111fc2fa3861c5fdced76cae4c9c71821969577";
+      sha256 = "1xfm3phjwb222nkhzi16qslj0r374rgvjw99c9wrzzlzkq2qkb38";
+    };
+  }
+  {
+    goPackagePath = "github.com/Azure/go-autorest";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Azure/go-autorest";
+      rev = "5a06e9ddbe3c22262059b8e061777b9934f982bd";
+      sha256 = "0dy80x5gxsq6vf8lpihpgv8cb8mnsk76q4ywxx3cxzfglqdjlwz6";
+    };
+  }
+  {
+    goPackagePath = "github.com/JamesClonk/vultr";
+    fetch = {
+      type = "git";
+      url = "https://github.com/JamesClonk/vultr";
+      rev = "fa1c0367800db75e4d10d0ec90c49a8731670224";
+      sha256 = "1bx2x17aa6wfn4qy9lxk8sh7shs3x5ppz2z49s0xm8qq0rs1qi92";
+    };
+  }
+  {
+    goPackagePath = "github.com/aws/aws-sdk-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/aws/aws-sdk-go";
+      rev = "fb9d53b0db7e801eb0d4fa021f5860794d845da3";
+      sha256 = "0md4bvrr4y5604l3bif7xx1bvhn6cc81v578s6w15mp63k9yjlpn";
+    };
+  }
+  {
+    goPackagePath = "github.com/decker502/dnspod-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/decker502/dnspod-go";
+      rev = "f33a2c6040fc2550a631de7b3a53bddccdcd73fb";
+      sha256 = "0c5v7y465k8mi5vxhln53pjn3z4h022sh14mngnx71h6szakzykg";
+    };
+  }
+  {
+    goPackagePath = "github.com/dgrijalva/jwt-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dgrijalva/jwt-go";
+      rev = "dbeaa9332f19a944acb5736b4456cfcc02140e29";
+      sha256 = "0zk6l6kzsjdijfn7c4h0aywdjx5j2hjwi67vy1k6wr46hc8ks2hs";
+    };
+  }
+  {
+    goPackagePath = "github.com/dnsimple/dnsimple-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dnsimple/dnsimple-go";
+      rev = "e43ab24dc4818cd584429752f69885fbc8a74baa";
+      sha256 = "0cq1xjv27nssarmflnh0w4i0l8v74129va4inhi5m2wxrz2247z7";
+    };
+  }
+  {
+    goPackagePath = "github.com/edeckers/auroradnsclient";
+    fetch = {
+      type = "git";
+      url = "https://github.com/edeckers/auroradnsclient";
+      rev = "1563e622aaca0a8bb895a448f31d4a430ab97586";
+      sha256 = "0d1izyqnlqasp56mldrpfnyhzmih2k955jn78ibzhay22dmn8ndr";
+    };
+  }
+  {
+    goPackagePath = "github.com/exoscale/egoscale";
+    fetch = {
+      type = "git";
+      url = "https://github.com/exoscale/egoscale";
+      rev = "7c8b1e7975be2af74d6e462dbea467e9061f9619";
+      sha256 = "00bqam37lkwls4rr209pcrld1rb025nm935h004lgfd8i2xjv5g4";
+    };
+  }
+  {
+    goPackagePath = "github.com/google/go-querystring";
+    fetch = {
+      type = "git";
+      url = "https://github.com/google/go-querystring";
+      rev = "53e6ce116135b80d037921a7fdd5138cf32d7a8a";
+      sha256 = "0lkbm067nhmxk66pyjx59d77dbjjzwyi43gdvzyx2f8m1942rq7f";
+    };
+  }
+  {
+    goPackagePath = "github.com/miekg/dns";
+    fetch = {
+      type = "git";
+      url = "https://github.com/miekg/dns";
+      rev = "5364553f1ee9cddc7ac8b62dce148309c386695b";
+      sha256 = "1r56ws5ayza5xk6xlkjvv7wcj6misbm5cyixvyf3pnz8wgja31wp";
+    };
+  }
+  {
+    goPackagePath = "github.com/ovh/go-ovh";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ovh/go-ovh";
+      rev = "df6beeb652924ef66aa95690b392f62864ad8842";
+      sha256 = "1nxgsrbqhznqivjxh67pn8laf4pysja5xyc40bdjvprl9nc40z6q";
+    };
+  }
+  {
+    goPackagePath = "github.com/rainycape/memcache";
+    fetch = {
+      type = "git";
+      url = "https://github.com/rainycape/memcache";
+      rev = "1031fa0ce2f20c1c0e1e1b51951d8ea02c84fa05";
+      sha256 = "02cbhy192vi0d1kwh57mdrg1mkr027ndkvd1y0cx0kn0h6pszggn";
+    };
+  }
+  {
+    goPackagePath = "github.com/stretchr/testify";
+    fetch = {
+      type = "git";
+      url = "https://github.com/stretchr/testify";
+      rev = "be8372ae8ec5c6daaed3cc28ebf73c54b737c240";
+      sha256 = "1ljfacbhd180yr0lc9myvxxdka0iji2ihsx0fcczja4ik5f2mb5p";
+    };
+  }
+  {
+    goPackagePath = "github.com/timewasted/linode";
+    fetch = {
+      type = "git";
+      url = "https://github.com/timewasted/linode";
+      rev = "37e84520dcf74488f67654f9c775b9752c232dc1";
+      sha256 = "08gpys1c5xkh7f92fq31wb24vjksfnpbhfwini73dlvyi2w25a3c";
+    };
+  }
+  {
+    goPackagePath = "github.com/urfave/cli";
+    fetch = {
+      type = "git";
+      url = "https://github.com/urfave/cli";
+      rev = "a1c7408de3f632d86eee604a3bb755f1ffb68226";
+      sha256 = "1fq0amfgpccf35nll7xw0k6smwrb7h0wy62n70kfd9kvh64n8hbn";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/crypto";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/crypto";
+      rev = "5119cf507ed5294cc409c092980c7497ee5d6fd2";
+      sha256 = "0r8ffhagvzpjrkm25rrlby4h6bsqqlq6kcm01g54iqm7b2yrjy1p";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev = "f5dfe339be1d06f81b22525fe34671ee7d2c8904";
+      sha256 = "01y9j7pjnnld4ipmzjvs0hls0hh698f2sga8cxaw5y6r5j7igaah";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/oauth2";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/oauth2";
+      rev = "543e37812f10c46c622c9575afd7ad22f22a12ba";
+      sha256 = "0kc816fq1zj5wdw4mfa7w2q26rnh273157w8n0d30xpzl8ba2isr";
+    };
+  }
+  {
+    goPackagePath = "google.golang.org/api";
+    fetch = {
+      type = "git";
+      url = "https://code.googlesource.com/google-api-go-client";
+      rev = "068431dcab1a5817548dd244d9795788a98329f4";
+      sha256 = "1yn5qfmmmqbm6k5h8qj5n6ra3xv9aispvjv9kqarxwvv7q5xql83";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/ini.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/ini.v1";
+      rev = "32e4c1e6bc4e7d0d8451aa6b75200d19e37a536a";
+      sha256 = "0mhgxw5q6b0pryhikx3k4wby7g32rwjjljzihi47lwn34kw5y1qn";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/ns1/ns1-go.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/ns1/ns1-go.v2";
+      rev = "1f132c4ac59d2c7022353a8824002a15deb66f1e";
+      sha256 = "0fx646hzhi6w58hiwc76hfjxn0dj9vxbrdqkb64lqxymzxzsrfnb";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/square/go-jose.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/square/go-jose.v1";
+      rev = "aa2e30fdd1fe9dd3394119af66451ae790d50e0d";
+      sha256 = "0drajyadd6c4m5qv0jxcv748qczg8sgxz28nva1jn39f234m02is";
+    };
+  }
+]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 80edb45e9c45..3fa74e9f7350 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3066,6 +3066,8 @@ with pkgs;
 
   lbreakout2 = callPackage ../games/lbreakout2 { };
 
+  lego = callPackage ../tools/admin/lego { };
+
   leocad = callPackage ../applications/graphics/leocad { };
 
   less = callPackage ../tools/misc/less { };