diff --git a/Cargo.lock b/Cargo.lock
index 0136f3f..f37c9f0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3139,7 +3139,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d649a3145108d7d3fbcde896a468d1bd636791823c9921135218ad89be08307"
 
 [[package]]
-name = "wasmcloud"
+name = "wasmcloud_api"
 version = "0.1.0"
 dependencies = [
  "blake3",
@@ -3165,29 +3165,8 @@ dependencies = [
  "tracing-log",
  "tracing-subscriber",
  "ureq",
- "uuid",
-]
-
-[[package]]
-name = "wasmcloud_executor"
-version = "0.1.0"
-dependencies = [
- "color-eyre",
- "diesel",
- "jwt",
- "lazy_static",
- "rocket",
- "rocket_contrib",
- "serde",
- "serde_json",
- "thiserror",
- "tracing",
- "tracing-log",
- "tracing-subscriber",
- "ureq",
  "url 2.1.1",
  "uuid",
- "wasmcloud",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index e0cc07b..ca0e417 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
-name = "wasmcloud"
+name = "wasmcloud_api"
 version = "0.1.0"
 authors = ["Christine Dodrill <me@christine.website>"]
 edition = "2018"
@@ -27,6 +27,7 @@ tracing-log = "0.1"
 tracing-subscriber = "0.2"
 ureq = { version = "1", features = ["json", "charset"] }
 uuid = { version = "0.7", features = ["serde", "v4"] }
+url = "2"
 
 rocket_upload = { path = "./lib/rocket_upload" }
 
@@ -46,6 +47,5 @@ features = [ "blocking" ]
 
 [workspace]
 members = [
-  "./executor",
-  "./lib/rocket_upload"
+  "./lib/rocket_upload",
 ]
diff --git a/default.nix b/default.nix
new file mode 100644
index 0000000..4ad81d0
--- /dev/null
+++ b/default.nix
@@ -0,0 +1,18 @@
+{ sources ? import ./nix/sources.nix, pkgs ? import sources.nixpkgs { } }:
+with pkgs;
+let
+  rust = import ./nix/rust.nix { inherit sources; };
+  naersk = pkgs.callPackage sources.naersk {
+    rustc = rust;
+    cargo = rust;
+  };
+  src = builtins.filterSource
+    (path: type: type != "directory" || builtins.baseNameOf path != "target")
+    ./.;
+in {
+  backend = naersk.buildPackage {
+    name = "wasmcloud_backend";
+    inherit src;
+    buildInputs = with pkgs; [ openssl pkg-config ];
+  };
+}
diff --git a/executor/Cargo.toml b/executor/Cargo.toml
deleted file mode 100644
index 76f5f22..0000000
--- a/executor/Cargo.toml
+++ /dev/null
@@ -1,33 +0,0 @@
-[package]
-name = "wasmcloud_executor"
-version = "0.1.0"
-authors = ["Christine Dodrill <me@christine.website>"]
-edition = "2018"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-color-eyre = "0.5"
-rocket = "0.4"
-jwt = "0.11"
-lazy_static = "1.4"
-serde_json = "^1"
-serde = { version = "^1", features = ["derive"] }
-thiserror = "1"
-tracing = "0.1"
-tracing-log = "0.1"
-tracing-subscriber = "0.2"
-ureq = { version = "1", features = ["json", "charset"] }
-url = "2"
-uuid = { version = "0.7", features = ["serde", "v4"] }
-
-wasmcloud = { path = ".." }
-
-[dependencies.diesel]
-version = "1"
-features = ["postgres", "r2d2", "uuidv07", "chrono"]
-
-[dependencies.rocket_contrib]
-version = "0.4"
-default-features = false
-features = ["diesel_postgres_pool", "uuid"]
diff --git a/executor/src/execute.rs b/executor/src/execute.rs
deleted file mode 100644
index 8b13789..0000000
--- a/executor/src/execute.rs
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix
new file mode 100644
index 0000000..5b0ce4f
--- /dev/null
+++ b/nix/nixpkgs.nix
@@ -0,0 +1,26 @@
+let
+  # Manage this with https://github.com/nmattia/niv
+  # or define { nixpkgs = ...; nixpkgs-mozilla = ...; }
+  # yourself.
+  sources = import ./sources.nix;
+
+  rustChannelsOverlay = import "${sources.nixpkgs-mozilla}/rust-overlay.nix";
+  # Useful if you also want to provide that in a nix-shell since some rust tools depend
+  # on that.
+  rustChannelsSrcOverlay = import "${sources.nixpkgs-mozilla}/rust-src-overlay.nix";
+
+in import sources.nixpkgs {
+    overlays = [
+      rustChannelsOverlay
+      rustChannelsSrcOverlay
+      (self: super: {
+        # Replace "latest.rustChannels.stable" with the version of the rust tools that
+        # you would like. Look at the documentation of nixpkgs-mozilla for examples.
+        #
+        # NOTE: "rust" instead of "rustc" is not a typo: It will include more than needed
+        # but also the much needed "rust-std".
+        rustc = super.latest.rustChannels.nightly.rust;
+        inherit (super.latest.rustChannels.nightly) cargo rust rust-fmt rust-std clippy;
+      })
+    ];
+  }
diff --git a/nix/sources.json b/nix/sources.json
index 95345c8..bea4d18 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -1,4 +1,16 @@
 {
+    "naersk": {
+        "branch": "master",
+        "description": "Build rust crates in Nix. No configuration, no code generation, no IFD. Sandbox friendly.",
+        "homepage": "",
+        "owner": "nmattia",
+        "repo": "naersk",
+        "rev": "d645515b7159c75087b3d51f23a68047c2c09699",
+        "sha256": "16hjyf1nkvwhb5nw989qhm3gdlim5wfw515bnvxpix5ff8jfbh9x",
+        "type": "tarball",
+        "url": "https://github.com/nmattia/naersk/archive/d645515b7159c75087b3d51f23a68047c2c09699.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
     "niv": {
         "branch": "master",
         "description": "Easy dependency management for Nix projects",
diff --git a/nix/sources.nix b/nix/sources.nix
index 8a725cb..b64b8f8 100644
--- a/nix/sources.nix
+++ b/nix/sources.nix
@@ -12,36 +12,29 @@ let
     else
       pkgs.fetchurl { inherit (spec) url sha256; };
 
-  fetch_tarball = pkgs: spec:
-    if spec.builtin or true then
-      builtins_fetchTarball { inherit (spec) url sha256; }
-    else
-      pkgs.fetchzip { inherit (spec) url sha256; };
+  fetch_tarball = pkgs: name: spec:
+    let
+      ok = str: ! builtins.isNull (builtins.match "[a-zA-Z0-9+-._?=]" str);
+      # sanitize the name, though nix will still fail if name starts with period
+      name' = stringAsChars (x: if ! ok x then "-" else x) "${name}-src";
+    in
+      if spec.builtin or true then
+        builtins_fetchTarball { name = name'; inherit (spec) url sha256; }
+      else
+        pkgs.fetchzip { name = name'; inherit (spec) url sha256; };
 
   fetch_git = spec:
     builtins.fetchGit { url = spec.repo; inherit (spec) rev ref; };
 
-  fetch_builtin-tarball = spec:
-    builtins.trace
-      ''
-        WARNING:
-          The niv type "builtin-tarball" will soon be deprecated. You should
-          instead use `builtin = true`.
+  fetch_local = spec: spec.path;
 
-          $ niv modify <package> -a type=tarball -a builtin=true
-      ''
-      builtins_fetchTarball { inherit (spec) url sha256; };
+  fetch_builtin-tarball = name: throw
+    ''[${name}] The niv type "builtin-tarball" is deprecated. You should instead use `builtin = true`.
+        $ niv modify ${name} -a type=tarball -a builtin=true'';
 
-  fetch_builtin-url = spec:
-    builtins.trace
-      ''
-        WARNING:
-          The niv type "builtin-url" will soon be deprecated. You should
-          instead use `builtin = true`.
-
-          $ niv modify <package> -a type=file -a builtin=true
-      ''
-      (builtins_fetchurl { inherit (spec) url sha256; });
+  fetch_builtin-url = name: throw
+    ''[${name}] The niv type "builtin-url" will soon be deprecated. You should instead use `builtin = true`.
+        $ niv modify ${name} -a type=file -a builtin=true'';
 
   #
   # Various helpers
@@ -72,13 +65,23 @@ let
     if ! builtins.hasAttr "type" spec then
       abort "ERROR: niv spec ${name} does not have a 'type' attribute"
     else if spec.type == "file" then fetch_file pkgs spec
-    else if spec.type == "tarball" then fetch_tarball pkgs spec
+    else if spec.type == "tarball" then fetch_tarball pkgs name spec
     else if spec.type == "git" then fetch_git spec
-    else if spec.type == "builtin-tarball" then fetch_builtin-tarball spec
-    else if spec.type == "builtin-url" then fetch_builtin-url spec
+    else if spec.type == "local" then fetch_local spec
+    else if spec.type == "builtin-tarball" then fetch_builtin-tarball name
+    else if spec.type == "builtin-url" then fetch_builtin-url name
     else
       abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}";
 
+  # If the environment variable NIV_OVERRIDE_${name} is set, then use
+  # the path directly as opposed to the fetched source.
+  replace = name: drv:
+    let
+      saneName = stringAsChars (c: if isNull (builtins.match "[a-zA-Z0-9]" c) then "_" else c) name;
+      ersatz = builtins.getEnv "NIV_OVERRIDE_${saneName}";
+    in
+      if ersatz == "" then drv else ersatz;
+
   # Ports of functions for older nix versions
 
   # a Nix version of mapAttrs if the built-in doesn't exist
@@ -87,13 +90,23 @@ let
     listToAttrs (map (attr: { name = attr; value = f attr set.${attr}; }) (attrNames set))
   );
 
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
+  range = first: last: if first > last then [] else builtins.genList (n: first + n) (last - first + 1);
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257
+  stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1));
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
+  stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
+  concatStrings = builtins.concatStringsSep "";
+
   # fetchTarball version that is compatible between all the versions of Nix
-  builtins_fetchTarball = { url, sha256 }@attrs:
+  builtins_fetchTarball = { url, name, sha256 }@attrs:
     let
       inherit (builtins) lessThan nixVersion fetchTarball;
     in
       if lessThan nixVersion "1.12" then
-        fetchTarball { inherit url; }
+        fetchTarball { inherit name url; }
       else
         fetchTarball attrs;
 
@@ -115,13 +128,13 @@ let
         then abort
           "The values in sources.json should not have an 'outPath' attribute"
         else
-          spec // { outPath = fetch config.pkgs name spec; }
+          spec // { outPath = replace name (fetch config.pkgs name spec); }
     ) config.sources;
 
   # The "config" used by the fetchers
   mkConfig =
-    { sourcesFile ? ./sources.json
-    , sources ? builtins.fromJSON (builtins.readFile sourcesFile)
+    { sourcesFile ? if builtins.pathExists ./sources.json then ./sources.json else null
+    , sources ? if isNull sourcesFile then {} else builtins.fromJSON (builtins.readFile sourcesFile)
     , pkgs ? mkPkgs sources
     }: rec {
       # The sources, i.e. the attribute set of spec name to spec
@@ -130,5 +143,6 @@ let
       # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers
       inherit pkgs;
     };
+
 in
 mkSources (mkConfig {}) // { __functor = _: settings: mkSources (mkConfig settings); }
diff --git a/src/api/handler.rs b/src/api/handler.rs
index 5ee82e0..a220072 100644
--- a/src/api/handler.rs
+++ b/src/api/handler.rs
@@ -13,8 +13,8 @@ pub struct New {
     pub async_impl: bool,
 }
 
-#[instrument(skip(conn), err)]
 #[post("/handler", format = "json", data = "<input>")]
+#[instrument(skip(conn), err)]
 pub fn create(
     user: models::User,
     input: Json<New>,
@@ -41,8 +41,8 @@ pub fn create(
     Ok(Json(hdl))
 }
 
-#[instrument(skip(conn), err)]
 #[get("/handler")]
+#[instrument(skip(conn), err)]
 pub fn list(user: models::User, conn: MainDatabase) -> Result<Json<Vec<models::Handler>>> {
     Ok(Json(
         handlers
@@ -52,8 +52,8 @@ pub fn list(user: models::User, conn: MainDatabase) -> Result<Json<Vec<models::H
     ))
 }
 
-#[instrument(skip(conn), err)]
 #[get("/handler/<hdl_id>")]
+#[instrument(skip(conn), err)]
 pub fn get(user: models::User, hdl_id: Uuid, conn: MainDatabase) -> Result<Json<models::Handler>> {
     let uuid = hdl_id.into_inner();
     let handler = handlers
@@ -68,8 +68,8 @@ pub fn get(user: models::User, hdl_id: Uuid, conn: MainDatabase) -> Result<Json<
     }
 }
 
-#[instrument(skip(conn), err)]
 #[delete("/handler/<hdl_id>")]
+#[instrument(skip(conn), err)]
 pub fn delete(user: models::User, hdl_id: Uuid, conn: MainDatabase) -> Result {
     let uuid = hdl_id.into_inner();
 
@@ -89,8 +89,8 @@ pub fn delete(user: models::User, hdl_id: Uuid, conn: MainDatabase) -> Result {
     Ok(())
 }
 
-#[instrument(skip(conn), err)]
 #[get("/handler/<handler_id_str>/config")]
+#[instrument(skip(conn), err)]
 pub fn get_config(
     user: models::User,
     handler_id_str: Uuid,
@@ -124,8 +124,8 @@ pub struct Cfg {
     pub value: String,
 }
 
-#[instrument(skip(conn, cfg), err)]
 #[post("/handler/<hdl_id>/config", format = "json", data = "<cfg>")]
+#[instrument(skip(conn, cfg), err)]
 pub fn create_config(
     user: models::User,
     hdl_id: Uuid,
@@ -166,8 +166,8 @@ pub fn create_config(
     Ok(())
 }
 
-#[instrument(skip(conn, data), err)]
 #[post("/handler/<hdl_id>/upload", data = "<data>")]
+#[instrument(skip(conn, data), err)]
 pub fn upload_version(
     user: models::User,
     hdl_id: Uuid,
diff --git a/src/api/token.rs b/src/api/token.rs
index 83e4ac6..9efb30b 100644
--- a/src/api/token.rs
+++ b/src/api/token.rs
@@ -4,8 +4,8 @@ use chrono::prelude::*;
 use diesel::prelude::*;
 use rocket_contrib::{json::Json, uuid::Uuid};
 
-#[instrument(skip(conn), err)]
 #[get("/token")]
+#[instrument(skip(conn), err)]
 pub fn list(user: models::User, conn: MainDatabase) -> Result<Json<Vec<models::Token>>> {
     use schema::tokens::dsl::*;
 
@@ -17,8 +17,8 @@ pub fn list(user: models::User, conn: MainDatabase) -> Result<Json<Vec<models::T
     ))
 }
 
-#[instrument(skip(conn), err)]
 #[delete("/token/<uuid>")]
+#[instrument(skip(conn), err)]
 pub fn delete(user: models::User, conn: MainDatabase, uuid: Uuid) -> Result {
     use schema::tokens::dsl::*;
     let uuid = uuid.into_inner();
@@ -39,8 +39,8 @@ pub fn delete(user: models::User, conn: MainDatabase, uuid: Uuid) -> Result {
     Ok(())
 }
 
-#[instrument(skip(conn), err)]
 #[post("/token")]
+#[instrument(skip(conn), err)]
 pub fn create(user: models::User, conn: MainDatabase) -> Result<String> {
     use schema::tokens;
 
diff --git a/src/api/user.rs b/src/api/user.rs
index ac03a6d..997b803 100644
--- a/src/api/user.rs
+++ b/src/api/user.rs
@@ -2,8 +2,8 @@ use super::{Error, Result};
 use crate::models;
 use rocket_contrib::{json::Json, uuid::Uuid};
 
-#[instrument(err)]
 #[get("/user/<uuid>")]
+#[instrument(err)]
 pub fn get(user: models::User, uuid: Uuid) -> Result<Json<models::User>> {
     if uuid != user.id {
         return Err(Error::LackPermissions);
@@ -12,8 +12,8 @@ pub fn get(user: models::User, uuid: Uuid) -> Result<Json<models::User>> {
     Ok(Json(user))
 }
 
-#[instrument]
 #[get("/whoami")]
+#[instrument]
 pub fn whoami(user: models::User) -> Json<models::User> {
     Json(user)
 }
diff --git a/src/main.rs b/src/bin/api.rs
similarity index 95%
rename from src/main.rs
rename to src/bin/api.rs
index 8943787..b50e19b 100644
--- a/src/main.rs
+++ b/src/bin/api.rs
@@ -7,7 +7,7 @@ use color_eyre::eyre::Result;
 use rocket_contrib::helmet::SpaceHelmet;
 use rocket_oauth2::OAuth2;
 
-use ::wasmcloud::{api, b2, gitea, jwt, Gitea, MainDatabase};
+use ::wasmcloud_api::{api, b2, gitea, jwt, Gitea, MainDatabase};
 
 fn main() -> Result<()> {
     color_eyre::install()?;
diff --git a/executor/src/main.rs b/src/bin/executor.rs
similarity index 96%
rename from executor/src/main.rs
rename to src/bin/executor.rs
index ea5da63..94eb2d5 100644
--- a/executor/src/main.rs
+++ b/src/bin/executor.rs
@@ -1,9 +1,5 @@
 #![feature(proc_macro_hygiene, decl_macro)]
 
-#[macro_use]
-extern crate diesel;
-#[macro_use]
-extern crate lazy_static;
 #[macro_use]
 extern crate rocket;
 #[macro_use]
@@ -17,8 +13,8 @@ use std::{
     time,
 };
 use uuid::Uuid;
-use wasmcloud::api::Error::InternalServerError;
-use wasmcloud::{
+use wasmcloud_api::api::Error::InternalServerError;
+use wasmcloud_api::{
     api::{
         Error::{Database, Impossible, Subcommand},
         Result,
@@ -65,8 +61,8 @@ fn execute(
     Ok((output, duration))
 }
 
-#[instrument(skip(conn), err)]
 #[get("/run/<handler_name>")]
+#[instrument(skip(conn), err)]
 fn schedule(handler_name: String, conn: MainDatabase) -> Result {
     fs::create_dir_all(TEMP_FOLDER)?;
     let hdl = {
diff --git a/src/gitea.rs b/src/gitea.rs
index c1e88e4..77bb007 100644
--- a/src/gitea.rs
+++ b/src/gitea.rs
@@ -38,14 +38,14 @@ fn user(token: String) -> std::io::Result<User> {
     Ok(user)
 }
 
-#[instrument(skip(oauth2, cookies))]
 #[get("/")]
+#[instrument(skip(oauth2, cookies))]
 pub fn login(oauth2: OAuth2<Gitea>, mut cookies: Cookies<'_>) -> Redirect {
     oauth2.get_redirect(&mut cookies, &[""]).unwrap()
 }
 
-#[instrument(skip(conn, token, cookies), err)]
 #[get("/callback")]
+#[instrument(skip(conn, token, cookies), err)]
 pub fn callback(
     conn: MainDatabase,
     token: TokenResponse<Gitea>,