Mark flake.lock as binary for merge conflicts

This makes git preserve the local version, but still mark the file as
conflicted, so it is not mangled with conflict regions.

.gitattributes

@@ -0,0 +1 @@
+/flake.lock merge=binary

flake.nix

@@ -222,6 +222,7 @@
 
           packages = {
             incus-ui = pkgs.callPackage ./pkgs/incus-ui { };
+            openfga = pkgs.callPackage ./pkgs/openfga { };
           };
 
           devShells.default = with pkgs; mkShell {

pkgs/openfga/default.nix

@@ -0,0 +1,40 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "openfga";
+  version = "1.4.2";
+
+  src = fetchFromGitHub {
+    owner = "openfga";
+    repo = "openfga";
+    rev = "v${version}";
+    hash = "sha256-fWSsTmb/vwoZ5CTsOOITZC/ZOEoAtWI42KSbTDKNdDY=";
+  };
+
+  vendorHash = "sha256-/110Ocvcj/WRpqth6RFQQ0xj2WAkW/psDQcFZO2parI=";
+
+  subPackages = [
+    "cmd/openfga"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/openfga/openfga/internal/build.Version=v${version}"
+    "-X=github.com/openfga/openfga/internal/build.Commit=${src.rev}"
+    "-X=github.com/openfga/openfga/internal/build.Date=1970-01-01T00:00:00Z"
+    "-X=github.com/openfga/openfga/internal/build.ProjectName=${pname}"
+  ];
+
+  meta = with lib; {
+    description = "A high performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar";
+    homepage = "https://github.com/openfga/openfga";
+    changelog = "https://github.com/openfga/openfga/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ];
+    mainProgram = "openfga";
+  };
+}