What we do at Channable is build our packages with Nix, push them to Cachix, and record the Nix store path. (CI does that automatically for release builds.) The

What we do at Channable is build our packages with Nix, push them to Cachix, and record the Nix store path. (CI does that automatically for release builds.) Then we use Ansible to declare that that is the store path that we want to realize on the appropriate servers. Our packages contain an "activate" script that updates symlinks in /usr/bin, or systemd units. Ansible calls this script after realizing the store paths. We have some functions written in Nix to help writing these activation scripts, and Nix makes it easy to import them from a Git repository, so we have it in one place and import it in all of our repos. We are now moving towards CD by automatically running Ansible in some cases.