diff --git a/infra/default.nix b/infra/default.nix
index 482c0b8e6..b3f39a446 100644
--- a/infra/default.nix
+++ b/infra/default.nix
@@ -1,7 +1,11 @@
-with { pkgs = import ./nix {}; };
+let
+  pkgs = import ./nix {};
+  napalm = import pkgs.sources.napalm { inherit pkgs;} ;
+in
 
 rec
-{ function = # TODO: rename to handler
+{
+  function = # TODO: rename to handler
     pkgs.runCommand "build-lambda" {}
       ''
         cp ${./main.js} main.js
@@ -59,9 +63,10 @@ rec
         ${pkgs.zip}/bin/zip -r $out/function.zip main.js main_hs
       '';
 
+
+  deckdeckgo-starter-dist-foo = napalm.buildPackage pkgs.sources.deckdeckgo-starter {};
+
   deckdeckgo-starter-dist =
-    with
-      { napalm = import pkgs.sources.napalm { inherit pkgs;} ; };
     pkgs.runCommand "deckdeckgo-starter" { buildInputs = [ pkgs.nodejs pkgs.zip ]; }
       ''
         cp -r ${napalm.buildPackage pkgs.sources.deckdeckgo-starter {}}/* .
@@ -75,9 +80,9 @@ rec
         popd
       '';
 
-  devshell = if ! pkgs.lib.inNixShell then null else
-    with
-      { pkg = pkgs.haskellPackages.developPackage { root = ./handler; } ; };
+
+  devshell =
+    let pkg = handler.env; in
     pkg.overrideAttrs(attr: {
       buildInputs = with pkgs;
         [ terraform awscli postgresql moreutils minio ];
@@ -166,11 +171,12 @@ rec
         '';
      });
 
-  handler = pkgs.haskellPackages.deckdeckgo-handler;
+  handler = pkgs.staticHaskellPackages.deckdeckgo-handler;
+  firebase-login = pkgs.staticHaskellPackages.firebase-login;
 
-  unsplashProxy = pkgs.haskellPackages.unsplash-proxy;
+  unsplashProxy = pkgs.staticHaskellPackages.unsplash-proxy;
 
-  googleKeyUpdater = pkgs.haskellPackages.google-key-updater;
+  googleKeyUpdater = pkgs.staticHaskellPackages.google-key-updater;
 
   publicKey = builtins.readFile ./public.cer;
 
diff --git a/infra/firebase-login/default.nix b/infra/firebase-login/default.nix
index 98886d29f..c70058c8a 100644
--- a/infra/firebase-login/default.nix
+++ b/infra/firebase-login/default.nix
@@ -1,5 +1,18 @@
-# TODO: port tests
-# TODO: fix sources
-# TODO: drop nix/packages
-with { pkgs = import ./nix {}; };
-pkgs.callPackage ./nix/packages.nix {}
+{ mkDerivation, aeson, base, bytestring, hpack, http-client
+, http-client-tls, http-conduit, jose, lens, mtl, network-uri, pem
+, servant, servant-client-core, servant-server, servant-swagger
+, stdenv, text, unordered-containers, wai, word8, x509
+}:
+mkDerivation {
+  pname = "firebase-login";
+  version = "0.0.0";
+  src = ./.;
+  libraryHaskellDepends = [
+    aeson base bytestring http-client http-client-tls http-conduit jose
+    lens mtl network-uri pem servant servant-client-core servant-server
+    servant-swagger text unordered-containers wai word8 x509
+  ];
+  libraryToolDepends = [ hpack ];
+  prePatch = "hpack";
+  license = stdenv.lib.licenses.mit;
+}
diff --git a/infra/firebase-login/nix/default.nix b/infra/firebase-login/nix/default.nix
index 9e5aa9365..925f6264d 100644
--- a/infra/firebase-login/nix/default.nix
+++ b/infra/firebase-login/nix/default.nix
@@ -2,10 +2,6 @@
 with
   { overlay = _: pkgs: rec
       { inherit (import sources.niv {}) niv;
-        haskellPackages = pkgs.haskellPackages.override
-          { overrides = _: super:
-              { jose = super.callCabal2nix "jose" sources.hs-jose {}; };
-          };
 
         packages = import ./packages.nix
           { inherit (pkgs) haskell lib ;
diff --git a/infra/firebase-login/nix/packages.nix b/infra/firebase-login/nix/packages.nix
index 90a21ea56..696108e51 100644
--- a/infra/firebase-login/nix/packages.nix
+++ b/infra/firebase-login/nix/packages.nix
@@ -7,7 +7,7 @@
 }:
 rec
 { firebase-login-sdist = haskell.lib.sdistTarball firebase-login;
-  firebase-login = haskellPackages.callCabal2nix "firebase-login" firebase-login-source {};
+  firebase-login = haskellPackages.callPackage ../../firebase-login {};
   firebase-login-source = lib.sourceByRegex ../.
     [ "^package.yaml$"
       "^src.*"
diff --git a/infra/firebase-login/shell.nix b/infra/firebase-login/shell.nix
index a9f1b11cc..fb14b09cf 100644
--- a/infra/firebase-login/shell.nix
+++ b/infra/firebase-login/shell.nix
@@ -1,5 +1,5 @@
-with { pkgs = import ./nix {}; };
-pkgs.haskellPackages.developPackage
-  { root = ./.;
-    modifier = drv: drv // { buildInputs = drv.buildInputs ++ [ pkgs.cabal-install ]; } ;
-  }
+with { pkgs = import ../nix {}; };
+
+pkgs.haskellPackages.firebase-login.env.overrideAttrs(oldAttrs: {
+  nativeBuildInputs = oldAttrs.nativeBuildInputs or [] ++ [ pkgs.cabal-install ];
+})
diff --git a/infra/firebase-login/src/Servant/Auth/Firebase.hs b/infra/firebase-login/src/Servant/Auth/Firebase.hs
index 28fc1c8fa..75a5e29f6 100644
--- a/infra/firebase-login/src/Servant/Auth/Firebase.hs
+++ b/infra/firebase-login/src/Servant/Auth/Firebase.hs
@@ -35,7 +35,7 @@ import qualified Network.Wai as Wai
 import qualified Servant as Servant
 import qualified Servant.Client.Core as Servant
 import qualified Servant.Client.Core as Servant.Client
-import qualified Servant.Server.Internal.RoutingApplication as Servant
+import qualified Servant.Server.Internal as Servant
 
 data Protected
 
diff --git a/infra/google-key-updater/default.nix b/infra/google-key-updater/default.nix
new file mode 100644
index 000000000..006ac49c4
--- /dev/null
+++ b/infra/google-key-updater/default.nix
@@ -0,0 +1,27 @@
+{ mkDerivation, aeson, amazonka, amazonka-core, amazonka-s3, base
+, bytestring, hpack, http-client, http-client-tls, http-conduit
+, http-types, servant, servant-client, servant-server, stdenv, text
+, unliftio, wai, wai-cors, wai-lambda, warp, pkgsMusl
+}:
+mkDerivation {
+  pname = "google-key-updater";
+  version = "0.0.0";
+  src = ./.;
+  isLibrary = false;
+  isExecutable = true;
+  libraryToolDepends = [ hpack ];
+  executableHaskellDepends = [
+    aeson amazonka amazonka-core amazonka-s3 base bytestring
+    http-client http-client-tls http-conduit http-types servant
+    servant-client servant-server text unliftio wai wai-cors wai-lambda
+    warp
+  ];
+  prePatch = "hpack";
+  license = stdenv.lib.licenses.agpl3;
+  configureFlags = [
+          "--ghc-option=-optl=-static"
+          "--extra-lib-dirs=${pkgsMusl.gmp6.override { withStatic = true; }}/lib"
+          "--extra-lib-dirs=${pkgsMusl.zlib.static}/lib"
+          "--extra-lib-dirs=${pkgsMusl.libffi.overrideAttrs (old: { dontDisableStatic = true; })}/lib"
+    ];
+}
diff --git a/infra/handler/app/Test.hs b/infra/handler/app/Test.hs
index 66fc1bf97..7784e348a 100644
--- a/infra/handler/app/Test.hs
+++ b/infra/handler/app/Test.hs
@@ -328,7 +328,7 @@ testServer = withServer $ \port -> do
 
   runClientM (usersPost' b someUserInfo) clientEnv >>= \case
     -- TODO: test that user is returned here, even on 409
-    Left (FailureResponse resp) ->
+    Left (FailureResponse _ resp) ->
       if HTTP.statusCode (responseStatusCode resp) == 409 then pure () else
         error $ "Got unexpected response: " <> show resp
     Left e -> error $ "Expected 409, got error: " <> show e
diff --git a/infra/handler/default.nix b/infra/handler/default.nix
new file mode 100644
index 000000000..9386b289d
--- /dev/null
+++ b/infra/handler/default.nix
@@ -0,0 +1,50 @@
+{ mkDerivation, aeson, amazonka, amazonka-cloudfront, amazonka-core
+, amazonka-s3, amazonka-sqs, base, bytestring, cases, conduit
+, conduit-extra, contravariant, cryptonite, directory, filepath
+, firebase-login, hasql, hpack, http-client, http-client-tls
+, http-types, lens, memory, mime-types, mtl, port-utils, pureMD5
+, random, resourcet, servant, servant-client, servant-server
+, servant-swagger, servant-swagger-ui, stdenv, swagger2, tagsoup
+, tasty, tasty-hunit, temporary, text, time, unliftio
+, unordered-containers, wai, wai-cors, wai-lambda, warp
+, zip-archive, pkgsMusl
+}:
+mkDerivation {
+  pname = "deckdeckgo-handler";
+  version = "0.0.0";
+  src = ./.;
+  isLibrary = true;
+  isExecutable = true;
+  enableLibraryProfiling = false;
+  enableExecutableProfiling = false;
+  enableSharedExecutables = false;
+  enableSharedLibraries = false;
+  libraryHaskellDepends = [
+    aeson amazonka amazonka-cloudfront amazonka-core amazonka-s3
+    amazonka-sqs base bytestring cases conduit conduit-extra
+    contravariant cryptonite directory filepath firebase-login hasql
+    http-client http-types lens memory mime-types mtl pureMD5 random
+    resourcet servant servant-server servant-swagger servant-swagger-ui
+    swagger2 tagsoup temporary text time unliftio unordered-containers
+    wai wai-cors wai-lambda zip-archive
+  ];
+  libraryToolDepends = [ hpack ];
+  executableHaskellDepends = [
+    aeson amazonka amazonka-cloudfront amazonka-core amazonka-s3
+    amazonka-sqs base bytestring cases conduit conduit-extra
+    contravariant cryptonite directory filepath firebase-login hasql
+    http-client http-client-tls http-types lens memory mime-types mtl
+    port-utils pureMD5 random resourcet servant servant-client
+    servant-server servant-swagger servant-swagger-ui swagger2 tagsoup
+    tasty tasty-hunit temporary text time unliftio unordered-containers
+    wai wai-cors wai-lambda warp zip-archive
+  ];
+  prePatch = "hpack";
+  license = stdenv.lib.licenses.agpl3;
+  configureFlags = [
+          "--ghc-option=-optl=-static"
+          "--extra-lib-dirs=${pkgsMusl.gmp6.override { withStatic = true; }}/lib"
+          "--extra-lib-dirs=${pkgsMusl.zlib.static}/lib"
+          "--extra-lib-dirs=${pkgsMusl.libffi.overrideAttrs (old: { dontDisableStatic = true; })}/lib"
+    ];
+}
diff --git a/infra/handler/package.yaml b/infra/handler/package.yaml
index 03c2427a2..0507bb6c3 100644
--- a/infra/handler/package.yaml
+++ b/infra/handler/package.yaml
@@ -48,6 +48,10 @@ dependencies:
 
 ghc-options:
     - -Wall
+    - -optl
+    - -Wl,--start-group
+    - -lssl
+    - -lcrypto
 
 library:
     source-dirs: src
diff --git a/infra/handler/src/DeckGo/Handler.hs b/infra/handler/src/DeckGo/Handler.hs
index dd8539f40..1dc5cbbcb 100644
--- a/infra/handler/src/DeckGo/Handler.hs
+++ b/infra/handler/src/DeckGo/Handler.hs
@@ -540,13 +540,16 @@ usersGetStatement = Statement sql encoder decoder True
       [ "SELECT account.id, account.firebase_id, account.username"
       ,   "FROM account"
       ]
-    encoder = HE.unit
-    decoder = HD.rowList $
+    encoder = mempty
+    decoder :: HD.Result [Item UserId User]
+    decoder = HD.rowList row
+    row :: HD.Row (Item UserId User)
+    row =
       Item <$>
-        ((UserId . FirebaseId) <$> HD.column HD.text) <*>
-        ( User <$>
-          (FirebaseId <$> HD.column HD.text) <*>
-          HD.nullableColumn (Username <$> HD.text)
+        ((UserId . FirebaseId) <$> (HD.column (HD.nonNullable HD.text))) <*>
+        (User <$>
+            (FirebaseId <$> (HD.column (HD.nonNullable HD.text))) <*>
+            (HD.column (HD.nullable (Username <$> HD.text)))
         )
 
 usersGetUserId :: HC.Connection -> UserId -> Servant.Handler (Item UserId User)
@@ -570,13 +573,13 @@ usersGetUserIdStatement = Statement sql encoder decoder True
       ]
     encoder = contramap
         (unFirebaseId . unUserId)
-        (HE.param HE.text)
+        (HE.param (HE.nonNullable HE.text))
     decoder = HD.rowMaybe $
       Item <$>
-        ((UserId . FirebaseId) <$> HD.column HD.text) <*>
+        ((UserId . FirebaseId) <$> HD.column (HD.nonNullable HD.text)) <*>
         ( User <$>
-          (FirebaseId <$> HD.column HD.text) <*>
-          HD.nullableColumn (Username <$> HD.text)
+          (FirebaseId <$> HD.column (HD.nonNullable HD.text)) <*>
+          (HD.column (HD.nullable (Username <$> HD.text)))
         )
 
 usersPost
@@ -669,8 +672,8 @@ usersPostStatement = Statement sql encoder decoder True
     encoder =
       contramap
         (unFirebaseId . unUserId . view _1)
-        (HE.param HE.text) <>
-      contramap (unFirebaseId . userFirebaseId . view _2) (HE.param HE.text)
+        (HE.param (HE.nonNullable HE.text)) <>
+      contramap (unFirebaseId . userFirebaseId . view _2) (HE.param (HE.nonNullable HE.text))
     decoder = HD.rowsAffected
 
 usersPostStatement' :: Statement (Username, UserId) Int64
@@ -681,10 +684,10 @@ usersPostStatement' = Statement sql encoder decoder True
     encoder =
       contramap
         (unUsername . view _1)
-        (HE.param HE.text) <>
+        (HE.param (HE.nonNullable HE.text)) <>
       contramap
         (unFirebaseId . unUserId . view _2)
-        (HE.param HE.text)
+        (HE.param (HE.nonNullable HE.text))
     decoder = HD.rowsAffected
 
 usersPostStatement'' :: Statement Username () -- TODO: check was deleted?
@@ -696,8 +699,8 @@ usersPostStatement'' = Statement sql encoder decoder True
     encoder =
       contramap
         (unUsername)
-        (HE.param HE.text)
-    decoder = HD.unit
+        (HE.param (HE.nonNullable HE.text))
+    decoder = HD.noResult
 
 usersPut
   :: HC.Connection
@@ -783,8 +786,8 @@ usersDeleteStatement = Statement sql encoder decoder True
     encoder =
       contramap
         (unFirebaseId . unUserId)
-        (HE.param HE.text)
-    decoder = HD.unit -- TODO: affected rows
+        (HE.param (HE.nonNullable HE.text))
+    decoder = HD.noResult -- TODO: affected rows
 
 -- PRESENTATIONS
 
@@ -803,13 +806,13 @@ presentationsPostStatement = Statement sql encoder decoder True
       ,   "VALUES ($1, $2, $3, $4)"
       ]
     encoder =
-      contramap (unPresentationId . view _1) (HE.param HE.text) <>
-      contramap (unPresShortname . view _2) (HE.param HE.text) <>
-      contramap (view _3) (HE.param HE.text) <>
+      contramap (unPresentationId . view _1) (HE.param (HE.nonNullable HE.text)) <>
+      contramap (unPresShortname . view _2) (HE.param (HE.nonNullable HE.text)) <>
+      contramap (view _3) (HE.param (HE.nonNullable HE.text)) <>
       contramap
         (unFirebaseId . unUserId . view _4)
-        (HE.param HE.text)
-    decoder = HD.unit
+        (HE.param (HE.nonNullable HE.text))
+    decoder = HD.noResult
 
 presentationsGetByIdSession :: PresentationId -> HS.Session (Maybe (PresShortname, T.Text))
 presentationsGetByIdSession pid = do
@@ -823,10 +826,10 @@ presentationsGetByIdStatement = Statement sql encoder decoder True
       [ "SELECT name, url, owner FROM presentation"
       ,   "WHERE id = $1"
       ]
-    encoder = contramap unPresentationId (HE.param HE.text)
+    encoder = contramap unPresentationId (HE.param (HE.nonNullable HE.text))
     decoder = HD.rowMaybe $ (,) <$>
-      (PresShortname <$> HD.column HD.text) <*>
-      HD.column HD.text -- <*>
+      (PresShortname <$> HD.column (HD.nonNullable HD.text)) <*>
+      HD.column (HD.nonNullable HD.text)
       -- TODO: return user ID
 
 data PresResponse = PresResponse T.Text
@@ -878,7 +881,7 @@ migrateFrom = \frm -> do
           [ "INSERT INTO db_meta (key, value) VALUES ('version', $1)"
           , "ON CONFLICT (key) DO UPDATE SET value = $1"
           ]
-        ) (HE.param HE.text) HD.unit True
+        ) (HE.param (HE.nonNullable HE.text)) HD.noResult True
     HS.sql "COMMIT"
   where
     -- | Migrates from (ver -1) to ver
@@ -893,13 +896,13 @@ migrateFrom = \frm -> do
             ,   "anonymous BOOLEAN"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
       DbVersion1 -> do
         HS.statement () $ Statement
           (BS8.unwords
             [ "DROP TABLE IF EXISTS account CASCADE"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         HS.statement () $ Statement
           (BS8.unwords
             [ "CREATE TABLE account ("
@@ -907,7 +910,7 @@ migrateFrom = \frm -> do
             ,   "firebase_id TEXT UNIQUE NOT NULL"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         HS.statement () $ Statement
           (BS8.unwords
             [ "CREATE TABLE username ("
@@ -915,7 +918,7 @@ migrateFrom = \frm -> do
             ,   "account TEXT REFERENCES account (id) ON DELETE CASCADE UNIQUE NOT NULL"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
       DbVersion2 -> do
         HS.statement () $ Statement
           (BS8.unwords
@@ -926,7 +929,7 @@ migrateFrom = \frm -> do
             ,   "attributes JSON"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
       DbVersion3 -> do
         HS.sql "DROP TABLE IF EXISTS username"
         HS.sql "DROP TABLE IF EXISTS account CASCADE"
@@ -939,7 +942,7 @@ migrateFrom = \frm -> do
             ,   "username TEXT UNIQUE NULL"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         HS.statement () $ Statement
           (BS8.unwords
             [ "CREATE TABLE deck ("
@@ -950,7 +953,7 @@ migrateFrom = \frm -> do
             ,   "attributes JSON"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         HS.statement () $ Statement
           (BS8.unwords
             [ "CREATE TABLE slide ("
@@ -962,7 +965,7 @@ migrateFrom = \frm -> do
             ,   "attributes JSON"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
       DbVersion4 -> do
         HS.sql "DROP TABLE IF EXISTS username"
         HS.sql "DROP TABLE IF EXISTS account CASCADE"
@@ -976,7 +979,7 @@ migrateFrom = \frm -> do
             ,   "username TEXT UNIQUE NULL"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         HS.statement () $ Statement
           (BS8.unwords
             [ "CREATE TABLE deck ("
@@ -987,7 +990,7 @@ migrateFrom = \frm -> do
             ,   "attributes JSON"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         HS.statement () $ Statement
           (BS8.unwords
             [ "CREATE TABLE slide ("
@@ -999,7 +1002,7 @@ migrateFrom = \frm -> do
             ,   "attributes JSON"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
       DbVersion5 -> do
         HS.sql "DROP TABLE IF EXISTS username"
         HS.sql "DROP TABLE IF EXISTS account CASCADE"
@@ -1013,7 +1016,7 @@ migrateFrom = \frm -> do
             ,   "username TEXT UNIQUE NULL"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         HS.statement () $ Statement
           (BS8.unwords
             [ "CREATE TABLE deck ("
@@ -1024,7 +1027,7 @@ migrateFrom = \frm -> do
             ,   "attributes JSON"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         HS.statement () $ Statement
           (BS8.unwords
             [ "CREATE TABLE slide ("
@@ -1036,7 +1039,7 @@ migrateFrom = \frm -> do
             ,   "attributes JSON"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
       DbVersion6 -> do
         HS.sql "DROP TABLE IF EXISTS username"
         HS.sql "DROP TABLE IF EXISTS account CASCADE"
@@ -1050,7 +1053,7 @@ migrateFrom = \frm -> do
             ,   "username TEXT UNIQUE NULL"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         HS.statement () $ Statement
           (BS8.unwords
             [ "CREATE TABLE deck ("
@@ -1061,7 +1064,7 @@ migrateFrom = \frm -> do
             ,   "attributes JSON"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         HS.statement () $ Statement
           (BS8.unwords
             [ "CREATE TABLE slide ("
@@ -1073,7 +1076,7 @@ migrateFrom = \frm -> do
             ,   "attributes JSON"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
       -- TODO: unique on (owner, name)
       -- TODO: drop deck, slide tables
       DbVersion7 -> do
@@ -1086,7 +1089,7 @@ migrateFrom = \frm -> do
             ,   "owner TEXT NOT NULL REFERENCES account (id) ON DELETE CASCADE"
             , ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
 
 readDbVersion :: HS.Session (Either String (Maybe DbVersion))
 readDbVersion = do
@@ -1099,12 +1102,12 @@ readDbVersion = do
         ,   "AND    table_name = 'db_meta'"
         ,   ");"
         ]
-      ) HE.unit (HD.singleRow (HD.column HD.bool)) True
+      ) mempty (HD.singleRow (HD.column (HD.nonNullable HD.bool))) True
     case res of
       True -> do
         mtver <- HS.statement () $ Statement
           "SELECT value FROM db_meta WHERE key = 'version'"
-          HE.unit (HD.rowMaybe (HD.column HD.text)) True
+          mempty (HD.rowMaybe (HD.column (HD.nonNullable HD.text))) True
         case mtver of
           Nothing -> pure (Right Nothing)
           Just tver -> case dbVersionFromText tver of
@@ -1118,7 +1121,7 @@ readDbVersion = do
             ,   "value TEXT NOT NULL"
             ,   ");"
             ]
-          ) HE.unit HD.unit True
+          ) mempty HD.noResult True
         pure $ Right Nothing
 
 dbVersionToText :: DbVersion -> T.Text
diff --git a/infra/nix/default.nix b/infra/nix/default.nix
index 59607de39..5204e0107 100644
--- a/infra/nix/default.nix
+++ b/infra/nix/default.nix
@@ -1,101 +1,77 @@
 {}:
-with rec
-{ sources = import ./sources.nix;
-  pkgs_ = import sources.nixpkgs {};
-  mkPackage = pkgs: hsuper: name: path:
-    with
-    { addStaticLinkerFlagsWithPkgconfig =
-        haskellDrv:
-        pkgConfigNixPackages:
-        pkgconfigFlagsString:
-        pkgs.haskell.lib.overrideCabal
-          (pkgs.haskell.lib.appendConfigureFlag haskellDrv
+let
+  sources = import ./sources.nix;
+  pkgs = import sources.nixpkgs {
+    overlays = [
+      (
+        self: super:
+          super.lib.optionalAttrs super.stdenv.hostPlatform.isMusl
+            {
+
+
+              postgresql = (super.postgresql.overrideAttrs (old: { dontDisableStatic = true; })).override {
+                # We need libpq, which does not need systemd,
+                # and systemd doesn't currently build with musl.
+                enableSystemd = false;
+              };
+              lzma = super.lzma.overrideAttrs (old: { dontDisableStatic = true; });
+
+              openssl = super.openssl.override { static = true; };
+            }
+      )
+    ];
+  };
+  staticPkgs = pkgs.pkgsMusl;
+  compiler = "ghc865";
+
+  addStaticLinkerFlagsWithPkgconfig =
+    haskellDrv:
+    pkgConfigNixPackages:
+    pkgconfigFlagsString:
+      pkgs.haskell.lib.overrideCabal
+        (
+          pkgs.haskell.lib.appendConfigureFlag haskellDrv
             [ "--ld-option=-Wl,--start-group" ]
-          )
-          (old:
-            { preConfigure =
+        )
+        (
+          old:
+            {
+              preConfigure =
                 builtins.concatStringsSep "\n"
-                  [ (old.preConfigure or "")
+                  [
+                    (old.preConfigure or "")
                     ''
                       set -e
                       configureFlags+=$(for flag in $(pkg-config --static ${pkgconfigFlagsString}); do echo -n " --ld-option=$flag"; done)
                     ''
                   ];
               libraryPkgconfigDepends =
-                (old.libraryPkgconfigDepends or []) ++
-                pkgConfigNixPackages;
+                (old.libraryPkgconfigDepends or []) ++ pkgConfigNixPackages;
             }
-          );
-    };
-    { ${name} =
-        with { drv = hsuper.callCabal2nix name (pkgs.lib.cleanSource path) {}; };
-        with pkgs.haskell.lib;
-        failOnAllWarnings (
-        disableLibraryProfiling (
-        disableExecutableProfiling (
-          with { openssl_static = pkgs.openssl.override { static = true; }; };
-          addStaticLinkerFlagsWithPkgconfig drv [ openssl_static ]
-            "--libs openssl"
-        )));
-    };
+        );
 
-  pkgs = import sources.nixpkgs
-    { overlays =
-        [ (_: pkgs: pkgs.lib.recursiveUpdate pkgs
-            { haskell = pkgs.lib.recursiveUpdate pkgs.haskell
-              { packages = pkgs.lib.recursiveUpdate pkgs.haskell.packages
-                { ghc864 = pkgs.haskell.packages.ghc864.override
-                  (old:
-                    { overrides =
-                        pkgs.lib.composeExtensions
-                        (old.overrides or (_: _: {}))
-                        (hself: hsuper:
-                          mkPackage pkgs hsuper "deckdeckgo-handler"
-                            ../handler //
-                          mkPackage pkgs hsuper "firebase-login"
-                            ../firebase-login //
-                          mkPackage pkgs hsuper "unsplash-proxy"
-                            ../unsplash-proxy //
-                          mkPackage pkgs hsuper "wai-lambda"
-                            wai-lambda.wai-lambda-source //
-                          mkPackage pkgs hsuper "google-key-updater"
-                            ../google-key-updater
-                        );
-                    }
-                  );
-                };
-              };
 
-              # for cabal2nix
-              nix = pkgs_.nix;
-              git = pkgs_.git;
-              subversion = pkgs_.subversion;
-            }
-          )
+  opensslStatic = staticPkgs.openssl.dev;
 
-          (_: pkgs:
-            {
-              # Fails during tests
-              go_1_12 = pkgs.go_1_12.overrideAttrs (_:
-                { doCheck = false; }
-                );
+  foo = self: drv:
+    addStaticLinkerFlagsWithPkgconfig drv [ opensslStatic staticPkgs.postgresql ]
+      "--libs openssl --libs libpq";
 
-              # for napalm
-              nodejs = pkgs.nodejs-12_x;
-            }
-          )
-        ];
-    };
+  final = staticPkgs;
 
-  wai-lambda = pkgs.callPackage "${sources.wai-lambda}/nix/packages.nix" {};
+  staticHaskellPackages = with pkgs.haskell.lib; staticPkgs.haskell.packages.${compiler}.override {
+    overrides = self: super: {
+      google-key-updater = foo self (self.callPackage ../google-key-updater {});
+      deckdeckgo-handler = foo self (self.callPackage ../handler {});
+      unsplash-proxy = foo self (self.callPackage ../unsplash-proxy {});
+      firebase-login = foo self (self.callPackage ../firebase-login {});
 
-  survey = import "${sources.static-haskell-nix}/survey"
-    { normalPkgs = pkgs; };
+      postgresql-libpq = foo self super.postgresql-libpq;
+      postgresql-binary = foo self super.postgresql-binary;
+      hasql = foo self super.hasql;
+    };
+  };
 
-  haskellPackages =
-    survey.pkgsWithStaticHaskellBinaries.haskellPackages;
-};
+in
 
-pkgs //
-{ inherit haskellPackages sources wai-lambda; } //
-{ terraform = pkgs.terraform_0_12 ; }
+pkgs // { inherit staticHaskellPackages sources; } // { terraform = pkgs.terraform_0_12; }
diff --git a/infra/nix/sources.json b/infra/nix/sources.json
index 75301159f..57fcde38f 100644
--- a/infra/nix/sources.json
+++ b/infra/nix/sources.json
@@ -17,18 +17,6 @@
         "url": "https://s3-eu-west-1.amazonaws.com/softwaremill-public/elasticmq-server-0.14.6.jar",
         "url_template": "https://s3-eu-west-1.amazonaws.com/softwaremill-public/elasticmq-server-0.14.6.jar"
     },
-    "hs-jose": {
-        "branch": "master",
-        "description": "Haskell JOSE and JWT library",
-        "homepage": "http://hackage.haskell.org/package/jose",
-        "owner": "frasertweedale",
-        "repo": "hs-jose",
-        "rev": "71274bf64c0600c1d877152173a08a5bff7adf4d",
-        "sha256": "0ah189vika1s0jk8f17mn77gilkw24vbs6xlggxw1qj926i6c4pk",
-        "type": "tarball",
-        "url": "https://github.com/frasertweedale/hs-jose/archive/71274bf64c0600c1d877152173a08a5bff7adf4d.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
     "napalm": {
         "branch": "master",
         "description": "Support for building npm packages in Nix and lightweight npm registry",
@@ -41,28 +29,16 @@
         "url": "https://github.com/nmattia/napalm/archive/4db4f253c78cfa8d8e8defb45dfe25e04409142a.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
-    "niv": {
-        "branch": "master",
-        "description": "Easy dependency management for Nix projects",
-        "homepage": "https://github.com/nmattia/niv",
-        "owner": "nmattia",
-        "repo": "niv",
-        "rev": "c2698b0780b783880e0b1a520723948fe3b5c26a",
-        "sha256": "0v68x0h9si6kjqg5fcjrgsbsf4x18m32a786yvjmrdkrki9qwmcq",
-        "type": "tarball",
-        "url": "https://github.com/nmattia/niv/archive/c2698b0780b783880e0b1a520723948fe3b5c26a.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
     "nixpkgs": {
-        "branch": "master",
+        "branch": "release-20.03",
         "description": "Nixpkgs/NixOS branches that track the Nixpkgs/NixOS channels",
         "homepage": null,
-        "owner": "nh2",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a2d7e9b875e8ba7fd15b989cf2d80be4e183dc72",
-        "sha256": "1hnmp637r99qd6g0sbx4w3za564gbzwl5c4z0x7fvn7kfi2jp1hx",
+        "rev": "504f993df9a5ca63317fe9c859df19daad30aa14",
+        "sha256": "19innk4v45xq62q6n5h0alhfbb3v7yxpdd1r7sglgjn8sr3ylwmn",
         "type": "tarball",
-        "url": "https://github.com/nh2/nixpkgs/archive/a2d7e9b875e8ba7fd15b989cf2d80be4e183dc72.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/504f993df9a5ca63317fe9c859df19daad30aa14.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "port-utils": {
@@ -70,28 +46,5 @@
         "type": "tarball",
         "url": "http://hackage.haskell.org/package/port-utils-0.2.1.0/port-utils-0.2.1.0.tar.gz",
         "url_template": "http://hackage.haskell.org/package/port-utils-0.2.1.0/port-utils-0.2.1.0.tar.gz"
-    },
-    "static-haskell-nix": {
-        "branch": "master",
-        "description": "easily build most Haskell programs into fully static Linux executables",
-        "homepage": "",
-        "owner": "nh2",
-        "repo": "static-haskell-nix",
-        "rev": "8d004d7ced9da947c785b93b4011f39367442339",
-        "sha256": "0nw4g23c5rs0cvaar2phpr60zim9r0qycznpifi8d8k85y4r3bdd",
-        "type": "tarball",
-        "url": "https://github.com/nh2/static-haskell-nix/archive/8d004d7ced9da947c785b93b4011f39367442339.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "wai-lambda": {
-        "branch": "master",
-        "description": "Haskell Webapps on AWS Lambda",
-        "owner": "deckgo",
-        "repo": "wai-lambda",
-        "rev": "7f139047addff89e9d30e55b7eebb07c0e846456",
-        "sha256": "0qqi6wlg8v35dkh6gh9mrj0kb9kpzrz2pc7k0dykk2ahcj6m22k6",
-        "type": "tarball",
-        "url": "https://github.com/deckgo/wai-lambda/archive/7f139047addff89e9d30e55b7eebb07c0e846456.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     }
 }
diff --git a/infra/unsplash-proxy/Main.hs b/infra/unsplash-proxy/Main.hs
index 14112469e..6c77bf4cb 100644
--- a/infra/unsplash-proxy/Main.hs
+++ b/infra/unsplash-proxy/Main.hs
@@ -54,7 +54,7 @@ type ClientAPI =
 runClient
   :: MonadIO io
   => Client.ClientM a
-  -> io (Either Client.ServantError a)
+  -> io (Either Client.ClientError a)
 runClient act = liftIO $ do
     mgr <- HTTP.newManager HTTP.tlsManagerSettings
     Client.runClientM act (clientEnv mgr)
diff --git a/infra/unsplash-proxy/default.nix b/infra/unsplash-proxy/default.nix
new file mode 100644
index 000000000..211aa050d
--- /dev/null
+++ b/infra/unsplash-proxy/default.nix
@@ -0,0 +1,26 @@
+{ mkDerivation, aeson, base, bytestring, hpack, http-client
+, http-client-tls, http-conduit, http-types, servant
+, servant-client, servant-server, stdenv, text, wai, wai-cors
+, wai-lambda, warp, pkgsMusl
+}:
+mkDerivation {
+  pname = "unsplash-proxy";
+  version = "0.0.0";
+  src = ./.;
+  isLibrary = false;
+  isExecutable = true;
+  libraryToolDepends = [ hpack ];
+  executableHaskellDepends = [
+    aeson base bytestring http-client http-client-tls http-conduit
+    http-types servant servant-client servant-server text wai wai-cors
+    wai-lambda warp
+  ];
+  prePatch = "hpack";
+  license = stdenv.lib.licenses.agpl3;
+  configureFlags = [
+          "--ghc-option=-optl=-static"
+          "--extra-lib-dirs=${pkgsMusl.gmp6.override { withStatic = true; }}/lib"
+          "--extra-lib-dirs=${pkgsMusl.zlib.static}/lib"
+          "--extra-lib-dirs=${pkgsMusl.libffi.overrideAttrs (old: { dontDisableStatic = true; })}/lib"
+    ];
+}