diff --git a/.dockerignore b/.dockerignore
index 0da60a2..393624e 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,2 +1,5 @@
 **/.git
 **/.gitignore
+/.webhook_bridge
+/result
+**/Dockerfile
diff --git a/.gitignore b/.gitignore
index ea1472e..2f1e03b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 output/
+/result
diff --git a/.webhook_bridge/pipeline-build-homepage-staging.yaml b/.webhook_bridge/pipeline-build-homepage-staging.yaml
index 9772473..657f2e1 100644
--- a/.webhook_bridge/pipeline-build-homepage-staging.yaml
+++ b/.webhook_bridge/pipeline-build-homepage-staging.yaml
@@ -44,31 +44,6 @@ spec:
                 #!/usr/bin/env sh
                 set -euo pipefail
                 echo -n "$(date +%s)" | tee $(results.unix-time.path)
-      - name: get-git-commit-time
-        taskSpec:
-          metadata: {}
-          stepTemplate:
-            image: alpine:3.20
-            computeResources:
-              requests:
-                cpu: 10m
-                memory: 600Mi
-            workingDir: "$(workspaces.repo.path)"
-          results:
-            - name: unix-time
-              description: The time of the git commit in unix timestamp format.
-          steps:
-            - image: alpine/git:v2.34.2
-              name: detect-tag-step
-              script: |
-                #!/usr/bin/env sh
-                set -euo pipefail
-                echo -n "$(git log -1 --pretty=%ct)" | tee $(results.unix-time.path)
-        workspaces:
-          - name: repo
-            workspace: git-source
-        runAfter:
-          - fetch-repository
       - name: report-pending
         taskRef:
           resolver: git
@@ -79,8 +54,6 @@ spec:
               value: f914437a46978b95f325f68d791dcf1a35738f60
             - name: pathInRepo
               value: task/gitea-set-status/0.1/gitea-set-status.yaml
-        runAfter:
-          - fetch-repository
         params:
           - name: CONTEXT
             value: "$(params.JOB_NAME)"
@@ -116,6 +89,31 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+      - name: get-git-commit-time
+        taskSpec:
+          metadata: {}
+          stepTemplate:
+            image: alpine:3.20
+            computeResources:
+              requests:
+                cpu: 10m
+                memory: 600Mi
+            workingDir: "$(workspaces.repo.path)"
+          results:
+            - name: unix-time
+              description: The time of the git commit in unix timestamp format.
+          steps:
+            - image: alpine/git:v2.34.2
+              name: detect-tag-step
+              script: |
+                #!/usr/bin/env sh
+                set -euo pipefail
+                echo -n "$(git log -1 --pretty=%ct)" | tee $(results.unix-time.path)
+        workspaces:
+          - name: repo
+            workspace: git-source
+        runAfter:
+          - fetch-repository
       - name: build-image
         taskRef:
           resolver: git
@@ -123,7 +121,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: af22c87d0db59dece97d03e6b6a796d84010158f
+              value: 7d4b33528fef5f2e662d32d093566ce56eb4acd0
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/.webhook_bridge/pipeline-build-homepage.yaml b/.webhook_bridge/pipeline-build-homepage.yaml
index 70300da..b74d781 100644
--- a/.webhook_bridge/pipeline-build-homepage.yaml
+++ b/.webhook_bridge/pipeline-build-homepage.yaml
@@ -135,7 +135,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: af22c87d0db59dece97d03e6b6a796d84010158f
+              value: 7d4b33528fef5f2e662d32d093566ce56eb4acd0
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/docker/server/Dockerfile b/docker/server/Dockerfile
index 0be90da..49f6160 100644
--- a/docker/server/Dockerfile
+++ b/docker/server/Dockerfile
@@ -1,69 +1,52 @@
 # syntax=docker/dockerfile:1
-ARG ALPINE_VERSION="3.20"
+#
+# Builder
+#
+
+FROM nixos/nix:2.31.3 AS builder
+
+RUN tee -a /etc/nix/nix.conf <<EOF
+extra-experimental-features = nix-command flakes
+filter-syscalls = false
+substituters = http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org
+download-attempts = 1
+connect-timeout = 3
+EOF
+
+RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
+
+COPY . /tmp/build
+WORKDIR /tmp/build
+
+RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
+
+# Export the built closure to a folder
+RUN mkdir /tmp/nix-store-closure
+RUN cp -R $(nix-store -qR result/) /tmp/nix-store-closure
+RUN ln -s $(readlink -f /tmp/build/result/bin/sh) /tmp/sh
 
 
 
-FROM scratch AS private
-ADD git@code.fizz.buzz:talexander/homepage_private.git /homepage_private
+#
+# Runner
+#
 
+FROM scratch
 
+WORKDIR /app
 
-FROM scratch AS explorer
-ADD https://code.fizz.buzz/talexander/organic_ast_explorer.git /organic_ast_explorer
+ENV PATH="$PATH:/app/bin"
 
+ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+ENV NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
+COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
 
+COPY --from=builder /tmp/nix-store-closure /nix/store
+COPY --from=builder /tmp/build/result /app
+COPY --from=builder /tmp/sh /bin/sh
 
-FROM scratch AS organic
-ADD git@code.fizz.buzz:talexander/organic.git /organic
-
-
-
-FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS organic-build
-RUN apk add --no-cache musl-dev make bash
-RUN rustup target add wasm32-unknown-unknown
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked cargo install wasm-bindgen-cli
-COPY --link --from=organic /organic /organic
-WORKDIR /organic
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked make wasm
-
-
-
-FROM node:lts-alpine$ALPINE_VERSION AS explorer-build
-COPY --link --from=explorer /organic_ast_explorer /organic_ast_explorer
-COPY --link --from=organic-build /organic /organic
-WORKDIR /organic_ast_explorer
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/npmcache,sharing=locked npm set cache /npmcache && npm install
-RUN npm run release
-
-
-
-
-FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS natter-build
-RUN apk add --no-cache musl-dev
-ADD git@code.fizz.buzz:talexander/natter.git /natter
-WORKDIR /natter
-RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked CARGO_TARGET_DIR=/target cargo build --profile release-lto
-
-
-
-FROM alpine:$ALPINE_VERSION AS natter
-COPY --link --from=natter-build /target/release-lto/natter /usr/bin/
-COPY --link . /source
-COPY --link --from=private /homepage_private/static /source/static/
-COPY --link --from=explorer-build /organic_ast_explorer/dist /source/static/organic/ast_explorer/
-RUN --network=none --mount=type=tmpfs,target=/tmp natter build --config /source/natter.toml
-
-
-
-
-FROM alpine:$ALPINE_VERSION AS server
-
-RUN apk add --no-cache bash nginx
-RUN addgroup web && adduser -D -G web web && install -d -D -o web -g web -m 700 /srv/http/public
-RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log
-
-COPY --chown=web:web docker/server/nginx.conf /srv/http
-COPY --chown=web:web docker/server/headers.include /srv/http
-COPY --from=natter --chown=web:web /source/output/ /srv/http/public/
-
-ENTRYPOINT ["/usr/sbin/nginx", "-c", "/srv/http/nginx.conf", "-e", "stderr", "-g", "daemon off;"]
+EXPOSE 8080
+#RUN addgroup web && adduser -D -G web web
+#&& install -d -D -o web -g web -m 700 /srv/http/public
+# RUN ln -sf /dev/stdout /var/log/nginx/access.log && ln -sf /dev/stderr /var/log/nginx/error.log
+CMD ["/app/bin/launch_nginx"]
diff --git a/docker/server/nginx.conf b/docker/server/nginx.conf
index 229bb4a..276a99d 100644
--- a/docker/server/nginx.conf
+++ b/docker/server/nginx.conf
@@ -1,4 +1,4 @@
-user web;
+# user web;
 worker_processes 4;
 
 # Speed up regular expressions.
@@ -12,7 +12,7 @@ events {
 }
 
 http {
-    include /etc/nginx/mime.types;
+    include @mime_types@;
     default_type application/octet-stream;
 
     types {
@@ -24,11 +24,11 @@ http {
     sendfile on;
     tcp_nopush on;
 
-    include headers.include;
+    include @headers_include@;
 
     server {
         listen 8080;
-        root /srv/http/public;
+        root @web_root@;
 
         location / {
             try_files $uri $uri/ =404;
@@ -47,24 +47,24 @@ http {
         }
 
         location /.well-known/ {
-            alias /srv/http/public/well-known/;
+            alias @web_root@/well-known/;
             default_type text/plain;
         }
 
         location /.well-known/openpgpkey/hu/ {
-            alias /srv/http/public/well-known/openpgpkey/fizz.buzz/hu/;
+            alias @web_root@/well-known/openpgpkey/fizz.buzz/hu/;
             default_type        "application/octet-stream";
             add_header          Access-Control-Allow-Origin * always;
         }
 
         location /.well-known/openpgpkey/policy {
-            alias /srv/http/public/well-known/openpgpkey/fizz.buzz/policy;
+            alias @web_root@/well-known/openpgpkey/fizz.buzz/policy;
             default_type        "application/octet-stream";
             add_header          Access-Control-Allow-Origin * always;
         }
 
         location ~ /\.well-known/(?<path>openpgpkey/[^/]+/hu/.*) {
-            alias /srv/http/public/well-known/$path;
+            alias @web_root@/well-known/$path;
             default_type        "application/octet-stream";
             add_header          Access-Control-Allow-Origin * always;
         }
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..8568bef
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,136 @@
+{
+  "nodes": {
+    "natter": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1783808400,
+        "narHash": "sha256-izeK0soRWiep4mkZ1duD1hf3fqXYrZXsHUwnBzTbTpA=",
+        "ref": "refs/heads/main",
+        "rev": "05c7ecde829f3e3843e89000e9959b8016124b2e",
+        "revCount": 326,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/natter.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/natter.git"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "organic": {
+      "inputs": {
+        "nixpkgs": [
+          "organic_ast_explorer",
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay_2"
+      },
+      "locked": {
+        "lastModified": 1783734912,
+        "narHash": "sha256-tXPapMwegdfP0jcr3BPQXxv1Aauo6yZwS4q2sIKOF9o=",
+        "ref": "refs/heads/main",
+        "rev": "842a77fb2bc684a545fb102e16790fa902aec11c",
+        "revCount": 2008,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic.git"
+      }
+    },
+    "organic_ast_explorer": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "organic": "organic"
+      },
+      "locked": {
+        "lastModified": 1783737126,
+        "narHash": "sha256-BM6lYBegCV8EkVGqd6wIW9YN4EQL8cnoe4T5TuV7Q2I=",
+        "ref": "refs/heads/main",
+        "rev": "de11bc7c5e08610dc006ac7b31454abc6e1f46e7",
+        "revCount": 74,
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://code.fizz.buzz/talexander/organic_ast_explorer.git"
+      }
+    },
+    "root": {
+      "inputs": {
+        "natter": "natter",
+        "nixpkgs": "nixpkgs",
+        "organic_ast_explorer": "organic_ast_explorer"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "natter",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781407245,
+        "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "d5f483210eb016d66102eef22baa128b3b3233fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "rust-overlay_2": {
+      "inputs": {
+        "nixpkgs": [
+          "organic_ast_explorer",
+          "organic",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781407245,
+        "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "d5f483210eb016d66102eef22baa128b3b3233fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..fe0df22
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,115 @@
+{
+  description = "Fizz.buzz homepage";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    natter = {
+      url = "git+https://code.fizz.buzz/talexander/natter.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    organic_ast_explorer = {
+      url = "git+https://code.fizz.buzz/talexander/organic_ast_explorer.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      natter,
+      organic_ast_explorer,
+    }:
+    let
+      forAllSystems =
+        func:
+        builtins.listToAttrs (
+          map (system: {
+            name = system;
+            value = func system;
+          }) nixpkgs.lib.systems.flakeExposed
+        );
+    in
+    {
+      devShells = forAllSystems (
+        system:
+        let
+          overlays = [
+            natter.overlays.default
+            organic_ast_explorer.overlays.default
+          ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+        in
+        {
+          default = pkgs.mkShell {
+            nativeBuildInputs = [
+            ];
+            buildInputs = with pkgs; [
+              pkgs.natter.release
+            ];
+          };
+        }
+      );
+      packages = forAllSystems (
+        system:
+        let
+          overlays = [
+            natter.overlays.default
+            organic_ast_explorer.overlays.default
+          ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+          appliedOverlay = self.overlays.default pkgs pkgs;
+        in
+        rec {
+          default = release;
+          inherit (appliedOverlay.homepage)
+            release
+            ;
+          docker_env = pkgs.buildEnv {
+            name = "homepage";
+            paths = with pkgs; [
+              appliedOverlay.homepage.launch_nginx
+              bash
+              uutils-coreutils-noprefix
+              # toybox # Smaller than uutils-coreutils?
+            ];
+          };
+        }
+      );
+      overlays.default = final: prev: {
+        homepage = final.lib.makeScope final.newScope (
+          homepageScope:
+          let
+            homepage_private = fetchGit {
+              url = "git@code.fizz.buzz:talexander/homepage_private.git";
+              ref = "main";
+              rev = "89ba9628bf3e596345bc83f59cef5a2943584894";
+            };
+            natter' = (natter.overlays.default final final).natter.release;
+            organic_ast_explorer' =
+              (organic_ast_explorer.overlays.default final final).organic_ast_explorer.release;
+            release = homepageScope.callPackage ./nix/package.nix {
+              natter = natter';
+              organic_ast_explorer = organic_ast_explorer';
+              inherit homepage_private;
+            };
+            nginx_conf = final.replaceVars "${./docker/server/nginx.conf}" {
+              web_root = release;
+              mime_types = "${final.nginx}/conf/mime.types";
+              headers_include = "${./docker/server/headers.include}";
+            };
+            launch_nginx = final.writeShellScriptBin "launch_nginx" ''
+              ${final.nginx}/bin/nginx -c ${nginx_conf} -e stderr -g "daemon off;"
+            '';
+          in
+          {
+            inherit release launch_nginx;
+          }
+        );
+      };
+    };
+}
diff --git a/nix/package.nix b/nix/package.nix
new file mode 100644
index 0000000..a147247
--- /dev/null
+++ b/nix/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  pkgs,
+  natter,
+  organic_ast_explorer,
+  homepage_private,
+}:
+let
+
+in
+pkgs.stdenv.mkDerivation rec {
+  pname = "homepage";
+  version = "0.0.0";
+
+  src = lib.cleanSource ../.;
+
+  configurePhase = "";
+
+  buildPhase = ''
+    mkdir -p static/organic/ast_explorer
+    cp ${organic_ast_explorer}/* static/organic/ast_explorer/
+    cp -r ${homepage_private}/static/* static/
+
+    ${natter}/bin/natter build --config natter.toml
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    mv output/* $out/
+  '';
+}