diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 28f92fa..bc3bdcf 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -9,24 +9,15 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - name: Set up Python 3.9
-        uses: actions/setup-python@v2
+      - uses: actions/checkout@v3
+      - uses: cachix/install-nix-action@v18
+      - uses: cachix/cachix-action@v12
         with:
-          python-version: 3.9
-      - name: Install dependencies
+          name: networkinventory
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+      - name: Test
         run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements/local.txt
-      - name: Lint with flake8
-        run: |
-          # stop the build if there are Python syntax errors or undefined names
-          flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-          # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-          flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-      - name: Test with pytest
-        run: |
-          pytest -nauto --ds=network_inventory.settings.ram_test --nomigrations
+          nix flake check -L -j auto
 
   publish:
     # Ensure test job passes before pushing image.
@@ -36,13 +27,16 @@ jobs:
     if: github.event_name == 'push'
 
     steps:
-      - uses: actions/checkout@v2
-
-      - name: "Remove any .pyc files"
-        run: find . \( -name __pycache__ -o -name "*.pyc" \) -delete
-
-      - name: Build image
-        run: docker build . --file Dockerfile --tag $IMAGE_NAME
+      - uses: actions/checkout@v3
+      - uses: cachix/install-nix-action@v18
+      - uses: cachix/cachix-action@v12
+        with:
+          name: networkinventory
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+      - name: Buid container
+        run: |
+          nix build .#container
+          docker load < result
 
       - name: Log into registry
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
diff --git a/flake.nix b/flake.nix
index ffd33e2..3e73cb3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,6 +28,44 @@
           inherit system;
           overlays = [ self.overlays.default ];
         };
+        src = with pkgs.lib;
+          cleanSource (cleanSourceWith {
+            filter = name: type:
+              let
+                baseName = baseNameOf (toString name);
+              in
+                !(builtins.elem baseName [
+                  ".coverage"
+                  ".coveragerc"
+                  ".dir-locals.el"
+                  ".direnv"
+                  ".git"
+                  ".github"
+                  ".env"
+                  ".envrc"
+                  ".flake8"
+                  ".gitignore"
+                  ".gitlab-ci.yml"
+                  "docker-compose.yaml"
+                  "flake.lock"
+                  "flake.nix"
+                  "Makefile"
+                  "poetry.lock"
+                  "poetry.toml"
+                  "pyproject.toml"
+                  "pytest.ini"
+                ]);
+            src = ./.;
+          });
+        inventory = pkgs.stdenv.mkDerivation {
+          inherit src;
+          version = "latest";
+          pname = "network-inventory";
+          installPhase = ''
+            mkdir -p $out
+            cp -r ./src $out/code
+          '';
+        };
       in
       {
         devShells.default = pkgs.mkShell {
@@ -75,9 +113,63 @@
             '';
           };
         };
-        packages.venv = pkgs.inventoryEnv;
-        packages.inventory = pkgs.inventoryPackage;
-        packages.default = pkgs.inventoryPackage;
+        packages = {
+          venv = pkgs.inventoryEnv;
+          container = pkgs.dockerTools.buildImage {
+            name = "network-inventory";
+            tag = "latest";
+            created = "now";
+            copyToRoot = pkgs.buildEnv {
+              name = "image-root";
+              paths = [
+                pkgs.bashInteractive
+                pkgs.coreutils
+                pkgs.inventoryEnv
+                inventory
+                (pkgs.writeShellScriptBin "start-inventory" ''
+                  cd /code
+                  if [ -f .second_run ]; then
+                      sleep 2
+                      ${pkgs.python3}/bin/python manage.py collectstatic --noinput
+                      ${pkgs.python3}/bin/python manage.py makemigrations
+                      ${pkgs.python3}/bin/python manage.py migrate
+                  else
+                      ${pkgs.python3}/bin/python manage.py collectstatic --noinput
+                      ${pkgs.python3}/bin/python manage.py makemigrations backups
+                      ${pkgs.python3}/bin/python manage.py makemigrations computers
+                      ${pkgs.python3}/bin/python manage.py makemigrations core
+                      ${pkgs.python3}/bin/python manage.py makemigrations customers
+                      ${pkgs.python3}/bin/python manage.py makemigrations devices
+                      ${pkgs.python3}/bin/python manage.py makemigrations licenses
+                      ${pkgs.python3}/bin/python manage.py makemigrations nets
+                      ${pkgs.python3}/bin/python manage.py makemigrations softwares
+                      ${pkgs.python3}/bin/python manage.py makemigrations users
+                      ${pkgs.python3}/bin/python manage.py makemigrations
+                      ${pkgs.python3}/bin/python manage.py migrate
+                      ${pkgs.python3}/bin/python manage.py loaddata backups
+                      ${pkgs.python3}/bin/python manage.py loaddata computers
+                      ${pkgs.python3}/bin/python manage.py loaddata core
+                      ${pkgs.python3}/bin/python manage.py loaddata devices
+                      ${pkgs.python3}/bin/python manage.py loaddata nets
+                      ${pkgs.python3}/bin/python manage.py loaddata softwares
+                      ${pkgs.python3}/bin/python manage.py shell -c "from django.contrib.auth import get_user_model; User = get_user_model(); User.objects.create_superuser('admin', 'admin@example.com', 'password')"
+                      touch .second_run
+                  fi
+                  ${pkgs.python310Packages.gunicorn}/bin/gunicorn network_inventory.wsgi:application --reload --bind 0.0.0.0:8000 --workers 3
+                '')
+              ];
+            };
+            config = {
+              Cmd = [ "start-inventory" ];
+              Env = [
+                "POSTGRES_DB=network_inventory"
+                "DJANGO_SETTINGS_MODULE=network_inventory.settings.production"
+                "PYTHONPATH=/lib/python3.10:/lib/python3.10/site-packages"
+              ];
+            };
+          };
+          default = self.packages.container;
+        };
       }));
 }