diff --git a/default.nix b/default.nix
index 9fd97789a6..636bb420ab 100644
--- a/default.nix
+++ b/default.nix
@@ -1,3 +1,4 @@
-{ system ? builtins.currentSystem, src ? ./.
-, pkgs ? (import ./nix { inherit system src; }).pkgs }:
-pkgs.mantis
+let
+  flake = builtins.getFlake (toString ./.);
+in
+  flake.pkgs.${builtins.currentSystem}.mantis
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000000..f5f04a2a0a
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,212 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "locked": {
+        "lastModified": 1614513358,
+        "narHash": "sha256-LakhOx3S1dRjnh0b5Dg3mbZyH0ToC9I8Y2wKSkBaTzU=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5466c5bbece17adaab2d82fae80b46e807611bf3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "locked": {
+        "lastModified": 1601282935,
+        "narHash": "sha256-WQAFV6sGGQxrRs3a+/Yj9xUYvhTpukQJIcMbIi7LCJ4=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "588973065fce51f4763287f0fda87a174d78bf48",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_3": {
+      "locked": {
+        "lastModified": 1605370193,
+        "narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5021eac20303a61fafe17224c087f5519baed54d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "mantis-explorer": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1614341279,
+        "narHash": "sha256-MsktksQES7SAZabF/emZTnIG8lVDZ2bw455WOCmcZcU=",
+        "owner": "input-output-hk",
+        "repo": "mantis-explorer",
+        "rev": "d72aa0d5d182b6700bb31cfea3f28284f0619430",
+        "type": "github"
+      },
+      "original": {
+        "owner": "input-output-hk",
+        "repo": "mantis-explorer",
+        "type": "github"
+      }
+    },
+    "mantis-faucet-web": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1614341313,
+        "narHash": "sha256-xu2wOsgQLedyyR/E0zn81SIe5t188D08/q+6LTMYG3k=",
+        "owner": "input-output-hk",
+        "repo": "mantis-faucet-web",
+        "rev": "9da14f10408254597d6a709723b21d5f52f42de2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "input-output-hk",
+        "repo": "mantis-faucet-web",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1603802751,
+        "narHash": "sha256-K3CeF3CYy7LCu0J1NnSdo77oVIkcwf0cXDAA/HFjP58=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "8a1fdce8d3482b60ac13678a8eab838777b51549",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs-kevm": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1606507280,
+        "narHash": "sha256-NvYGnD+gdDPVZlzB+t6GS+IC72dmN1sPwiAMrr3I8YQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "df25e214c8e662d693ef89e45ce56bbf58d6c59e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "df25e214c8e662d693ef89e45ce56bbf58d6c59e",
+        "type": "github"
+      }
+    },
+    "nixpkgs-sbt": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1591564272,
+        "narHash": "sha256-Z+4hmPx21+vYx9jp19+3jaT/Whl8IzmH1G/fGyFv7FY=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e2bb73ce5f786b83e984b80199112f86b8a6cc9d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "e2bb73ce5f786b83e984b80199112f86b8a6cc9d",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1616670887,
+        "narHash": "sha256-wn+l9qJfR5sj5Gq4DheJHAcBDfOs9K2p9seW2f35xzs=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "c0e881852006b132236cbf0301bd1939bb50867e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1606940130,
+        "narHash": "sha256-feZRQOfUWLfTuYUTEUxGadrS0QksS+TLHOx7kz8vgIY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "1176af94d32008050a447dd1c1a2c8c459aa9dcb",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1610118011,
+        "narHash": "sha256-a17vwGBOqmAsy/Wkvf10ygDyfgjJpvlPyNnf7SAk+Ac=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "a98302aa9b9628915878a6ea9776c40a0bb02950",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "a98302aa9b9628915878a6ea9776c40a0bb02950",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "mantis-explorer": "mantis-explorer",
+        "mantis-faucet-web": "mantis-faucet-web",
+        "nixpkgs": "nixpkgs_3",
+        "nixpkgs-kevm": "nixpkgs-kevm",
+        "nixpkgs-sbt": "nixpkgs-sbt",
+        "nixpkgs-unstable": "nixpkgs-unstable",
+        "sbtix": "sbtix"
+      }
+    },
+    "sbtix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1563807309,
+        "narHash": "sha256-L8EW6s/21q3R2VmjNngfkl80sOas4BWHTxssM2o+76Y=",
+        "owner": "input-output-hk",
+        "repo": "Sbtix",
+        "rev": "7b969a5641fce10500ca51cbe88af4ea160d7064",
+        "type": "github"
+      },
+      "original": {
+        "owner": "input-output-hk",
+        "repo": "Sbtix",
+        "rev": "7b969a5641fce10500ca51cbe88af4ea160d7064",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000000..beb6ea6f1a
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,80 @@
+{
+  description = "Mantis flake";
+
+  inputs = {
+    flake-utils.url = "github:numtide/flake-utils";
+    nixpkgs.url =
+      "github:nixos/nixpkgs?rev=a98302aa9b9628915878a6ea9776c40a0bb02950";
+    nixpkgs-sbt = {
+      url = "github:nixos/nixpkgs?rev=e2bb73ce5f786b83e984b80199112f86b8a6cc9d";
+      flake = false;
+    };
+    nixpkgs-kevm = {
+      url = "github:nixos/nixpkgs?rev=df25e214c8e662d693ef89e45ce56bbf58d6c59e";
+      flake = false;
+    };
+    sbtix = {
+      url =
+        "github:input-output-hk/Sbtix?rev=7b969a5641fce10500ca51cbe88af4ea160d7064";
+      flake = false;
+    };
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    mantis-faucet-web.url = "github:input-output-hk/mantis-faucet-web";
+    mantis-explorer.url = "github:input-output-hk/mantis-explorer";
+  };
+
+  outputs = { self, nixpkgs, flake-utils, ... }@inputs:
+    let
+      overlay = import ./nix/overlay.nix inputs;
+
+      pkgsForSystem = system:
+        (import nixpkgs) {
+          inherit system;
+          overlays = [ overlay ];
+        };
+
+      mkHydraUtils = mkPkgs:
+        let
+          # nothing in lib should really depend on the system
+          libPkgs = mkPkgs "x86_64-linux";
+          # [attrset] -> attrset
+          recursiveMerge = libPkgs.lib.foldr libPkgs.lib.recursiveUpdate { };
+          mkHydraJobsForSystem = attrs: system:
+            recursiveMerge
+            (map (n: { "${n}"."${system}" = (mkPkgs system)."${n}"; }) attrs);
+        in {
+          collectHydraSets = jobSets: { hydraJobs = recursiveMerge jobSets; };
+          mkHydraSet = attrs: systems:
+            recursiveMerge (map (mkHydraJobsForSystem attrs) systems);
+        };
+
+      hydraUtils = mkHydraUtils pkgsForSystem;
+      inherit (hydraUtils) collectHydraSets mkHydraSet;
+
+    in flake-utils.lib.eachDefaultSystem (system: rec {
+      pkgs = pkgsForSystem system;
+      legacyPackages = pkgs;
+
+      defaultPackage = pkgs.mantis;
+      devShell = pkgs.mkShell { nativeBuildInputs = with pkgs; [ solc sbt ]; };
+      apps.mantis = flake-utils.lib.mkApp { drv = pkgs.mantis; };
+      defaultApp = apps.mantis;
+    }) // (collectHydraSets [
+      (mkHydraSet [
+        "mantis"
+        "kevm"
+        "iele"
+
+        "mantis-entrypoint"
+        "mantis-faucet-entrypoint"
+
+        "mantis-explorer-evm"
+        "mantis-explorer-iele"
+        "mantis-explorer-kevm"
+
+        "mantis-faucet-web-evm"
+        "mantis-faucet-web-iele"
+        "mantis-faucet-web-kevm"
+      ] [ "x86_64-linux" ])
+    ]);
+}
diff --git a/nix/default.nix b/nix/default.nix
deleted file mode 100644
index c8c53cef9f..0000000000
--- a/nix/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ system ? builtins.currentSystem, sources ? import ./sources.nix, src ? ../. }:
-
-let
-  overlay = final: prev: {
-    inherit sources;
-    inherit (import sources.gitignore { inherit (prev) lib; }) gitignoreSource;
-
-    sbtix = prev.callPackage ../sbtix.nix {
-      jdk = prev.openjdk8_headless;
-      jre = prev.openjdk8_headless.jre;
-    };
-
-    mantisPkgs = final.callPackage ./pkgs/mantis {
-      inherit (prev.openjdk8_headless) jre;
-      inherit src;
-    };
-
-    inherit (final.mantisPkgs) mantis;
-
-    mkSrc = import sources.nix-mksrc { inherit (final) lib; };
-  };
-in import sources.nixpkgs {
-  inherit system;
-  overlays = [ overlay ];
-}
diff --git a/nix/entrypoint.nix b/nix/entrypoint.nix
new file mode 100644
index 0000000000..27139cbec4
--- /dev/null
+++ b/nix/entrypoint.nix
@@ -0,0 +1,11 @@
+{ lib, writeBashBinChecked, awscli, mantis, coreutils, gnugrep, gnused, kevm
+, iele }:
+writeBashBinChecked "mantis-entrypoint" ''
+  set -exuo pipefail
+
+  export PATH="${
+    lib.makeBinPath [ coreutils mantis awscli gnugrep gnused kevm iele ]
+  }"
+
+  ${builtins.readFile ./entrypoint.sh}
+''
diff --git a/nix/entrypoint.sh b/nix/entrypoint.sh
new file mode 100644
index 0000000000..c31b782647
--- /dev/null
+++ b/nix/entrypoint.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -exuo pipefail
+
+mkdir -p /tmp "$NOMAD_TASK_DIR/mantis"
+cd "$NOMAD_TASK_DIR"
+
+if [ -n "${DAG_NAME:-}" ]; then
+    if [ -f "ethash/$DAG_NAME" ]; then
+        echo "found existing DAG"
+        sha256sum "ethash/$DAG_NAME"
+    else
+        mkdir -p ethash
+        aws \
+            --endpoint-url "$MONITORING_ADDR" \
+            s3 cp \
+            "s3://mantis-kevm-dag/$DAG_NAME" \
+            "ethash/$DAG_NAME" \
+            || echo "Unable to download DAG, skipping."
+    fi
+fi
+
+set +x
+echo "Waiting for $REQUIRED_PEER_COUNT peers to show up in the config"
+until [ "$(grep -c enode mantis.conf)" -ge "$REQUIRED_PEER_COUNT" ]; do
+    sleep 1
+done
+set -x
+
+if [ -n "${COINBASE:-}" ]; then
+  mkdir -p "$NOMAD_SECRETS_DIR/keystore"
+  cp "$NOMAD_SECRETS_DIR/account" "$NOMAD_SECRETS_DIR/keystore/UTC--2020-10-16T14-48-29.47Z-$COINBASE"
+fi
+
+ulimit -c unlimited
+ulimit -n 2048
+cp mantis.conf running.conf
+
+exec mantis "-Duser.home=$NOMAD_TASK_DIR" "$@"
diff --git a/nix/overlay.nix b/nix/overlay.nix
new file mode 100644
index 0000000000..2aa1e608fe
--- /dev/null
+++ b/nix/overlay.nix
@@ -0,0 +1,107 @@
+inputs: final: prev: {
+  # Little convenience function helping us to containing the bash
+  # madness: forcing our bash scripts to be shellChecked.
+  writeBashChecked = final.writers.makeScriptWriter {
+    interpreter = "${final.bash}/bin/bash";
+    check = final.writers.writeBash "shellcheck-check" ''
+      ${final.shellcheck}/bin/shellcheck -x "$1"
+    '';
+  };
+  writeBashBinChecked = name: final.writeBashChecked "/bin/${name}";
+
+  mantis-faucet-source = builtins.fetchGit {
+    url = "https://github.com/input-output-hk/mantis";
+    rev = "07e617cdd1bfc76ad1a8472305f0e5e60e2801e1";
+    ref = "develop";
+    submodules = true;
+  };
+
+  # Last change to this was in 2018, so to avoid submodules we just clone
+  # ourselves instead.
+  mantis-extvm-pb = builtins.fetchGit {
+    url = "https://github.com/input-output-hk/mantis-extvm-pb";
+    rev = "6b3039be92882df6ef6c15887c8d0b5f10c86d6f";
+  };
+
+  mantisPkgs = final.callPackage ./pkgs/mantis { src = ../.; };
+
+  inherit (final.mantisPkgs) mantis;
+
+  nixpkgs-kevm = import inputs.nixpkgs-kevm { inherit (final) system; };
+
+  mantis-faucet = import final.mantis-faucet-source { inherit (final) system; };
+  mantis-faucet-entrypoint =
+    final.callPackage ./entrypoint.nix { mantis = final.mantis-faucet; };
+
+  inherit (import inputs.nixpkgs-sbt { inherit (final) system; }) sbt;
+
+  sbtix = final.callPackage ../sbtix.nix { };
+
+  jdk = prev.openjdk8_headless;
+  jre = prev.openjdk8_headless.jre;
+  kevm = final.nixpkgs-kevm.callPackage ./pkgs/kevm.nix { };
+  iele = final.callPackage ./pkgs/iele.nix { };
+  mantis-entrypoint = final.callPackage ./entrypoint.nix { };
+
+  makeFaucet = name:
+    (final.callPackage ./pkgs/nginx.nix {
+      package =
+        inputs.mantis-faucet-web.defaultPackage.${final.system}.overrideAttrs
+        (old: {
+          MANTIS_VM = prev.lib.toUpper name;
+          FAUCET_NODE_URL =
+            "https://faucet-${prev.lib.toLower name}.portal.dev.cardano.org";
+        });
+      target = "/mantis-faucet";
+    });
+
+  makeExplorer = MANTIS_VM:
+    (prev.callPackage ./pkgs/nginx.nix {
+      package =
+        inputs.mantis-explorer.defaultPackage.${final.system}.overrideAttrs
+        (old: { inherit MANTIS_VM; });
+      target = "/mantis-explorer";
+    });
+
+  mantis-explorer-evm = final.makeExplorer "EVM";
+  mantis-explorer-iele = final.makeExplorer "IELE";
+  mantis-explorer-kevm = final.makeExplorer "KEVM";
+
+  mantis-faucet-web-evm = final.makeFaucet "EVM";
+  mantis-faucet-web-iele = final.makeFaucet "IELE";
+  mantis-faucet-web-kevm = final.makeFaucet "KEVM";
+
+  mantis-image =
+    inputs.nixpkgs-unstable.legacyPackages.${final.system}.dockerTools.buildLayeredImage {
+      name = "inputoutput/mantis";
+      tag = "2021";
+
+      contents = with final; [
+        iele
+        kevm
+        mantis
+
+        bashInteractive
+        coreutils
+        curl
+        diffutils
+        dnsutils
+        fd
+        gawk
+        gnugrep
+        gnused
+        iproute
+        jq
+        less
+        lsof
+        netcat
+        nettools
+        procps
+        ripgrep
+        tree
+        vim
+      ];
+
+      config.Entrypoint = [ "${final.bashInteractive}/bin/bash" ];
+    };
+}
diff --git a/nix/pkgs/default.nix b/nix/pkgs/default.nix
deleted file mode 100644
index 9f402da515..0000000000
--- a/nix/pkgs/default.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ pkgs, lib, newScope, sources, src, impure ? false }:
-
-lib.makeScope newScope (self:
-  with self;
-  let callPackages = lib.callPackagesWith (pkgs // self);
-  in {
-    inherit sources src impure;
-    jdk = prev.openjdk8_headless;
-  })
diff --git a/nix/pkgs/iele.nix b/nix/pkgs/iele.nix
new file mode 100644
index 0000000000..e31f6b887a
--- /dev/null
+++ b/nix/pkgs/iele.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, dockerTools, secp256k1, gmp5, mpfr, zlib }:
+let libPath = lib.makeLibraryPath [ secp256k1 gmp5 mpfr zlib ];
+in stdenv.mkDerivation {
+  name = "iele";
+
+  src = dockerTools.pullImage {
+    imageName = "inputoutput/mantis";
+    imageDigest =
+      "sha256:594ed009f1bc1f12b86e11136441602107c3d580476002d9bae58b258a74ac1b";
+    sha256 = "sha256-JT+FarGQlgYoO392Ne1ofdqmishZLfH+OwV2CXTYwdA=";
+  };
+
+  installPhase = ''
+    mkdir -p tmp $out/bin
+    tar --delay-directory-restore -C tmp -xf layer.tar || true
+
+    cp tmp/bin/iele-vm $out/bin
+    chmod 0755 $out/bin/iele-vm
+
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${libPath}" \
+      "$out/bin/iele-vm"
+  '';
+}
diff --git a/nix/pkgs/kevm.nix b/nix/pkgs/kevm.nix
new file mode 100644
index 0000000000..546ea2e957
--- /dev/null
+++ b/nix/pkgs/kevm.nix
@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchFromGitHub, dockerTools, autoreconfHook, gmp5, mpfr, zlib, secp256k1 }:
+let
+  libPath = lib.makeLibraryPath [ secp256k1 gmp5 mpfr zlib ];
+in stdenv.mkDerivation {
+  name = "kevm";
+
+  src = dockerTools.pullImage {
+    imageName = "inputoutput/mantis";
+    imageDigest =
+      "sha256:594ed009f1bc1f12b86e11136441602107c3d580476002d9bae58b258a74ac1b";
+    sha256 = "sha256-JT+FarGQlgYoO392Ne1ofdqmishZLfH+OwV2CXTYwdA=";
+  };
+
+  installPhase = ''
+    mkdir -p tmp $out/bin
+    tar --delay-directory-restore -C tmp -xf layer.tar || true
+
+    cp tmp/bin/kevm-vm $out/bin
+    chmod 0755 $out/bin/kevm-vm
+
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${libPath}" \
+      "$out/bin/kevm-vm"
+  '';
+}
diff --git a/nix/pkgs/mantis/default.nix b/nix/pkgs/mantis/default.nix
index 6ff24989e7..ffd6c83856 100644
--- a/nix/pkgs/mantis/default.nix
+++ b/nix/pkgs/mantis/default.nix
@@ -1,8 +1,6 @@
-{ src, mkSrc, lib, gitignoreSource, callPackage, jre }: rec {
+{ src, lib, callPackage, jre }: rec {
 
-  mantis-source = mkSrc src;
-
-  mantis-unwrapped = callPackage ./unwrapped.nix { src = mantis-source; };
+  mantis-unwrapped = callPackage ./unwrapped.nix { inherit src; };
 
   mantis = callPackage ./wrapped.nix {
     mantis = mantis-unwrapped;
diff --git a/nix/pkgs/mantis/unwrapped.nix b/nix/pkgs/mantis/unwrapped.nix
index 1c054f5eb7..edbb6a59a5 100644
--- a/nix/pkgs/mantis/unwrapped.nix
+++ b/nix/pkgs/mantis/unwrapped.nix
@@ -1,6 +1,6 @@
 # this file originates from SBTix
 { src, stdenv, writeShellScriptBin, bash, protobuf, sbtix
-, jdk, impure ? false }:
+, jdk, mantis-extvm-pb, runCommand, impure ? false }:
 
 let
   inherit (stdenv.lib) optionalString makeLibraryPath;
@@ -19,14 +19,22 @@ let
     set -e
 
     for f in "$@"; do
-      echo ''${f##*=}
+      echo "''${f##*=}"
     done | grep protocbridge | xargs sed -i "1s|.*|#!${bash}/bin/bash|"
 
     exec ${protobuf}/bin/protoc "$@"
   '';
 
+  extSrc = runCommand "mantis-src-ext" {} ''
+    cp -r ${src} $out
+    chmod -R u+w $out
+    mkdir -p $out/src/main/protobuf/extvm
+    cp ${mantis-extvm-pb}/msg.proto $out/src/main/protobuf/extvm/msg.proto
+    cp ${mantis-extvm-pb}/VERSION $out/src/main/protobuf/extvm/VERSION
+  '';
+
 in sbtix.buildSbtProject {
-  inherit src;
+  src = extSrc;
 
   name = "mantis";
   sbtOptions = "-Dnix=true";
diff --git a/nix/pkgs/mantis/wrapped.nix b/nix/pkgs/mantis/wrapped.nix
index 135da02d1f..edc7e3fe88 100644
--- a/nix/pkgs/mantis/wrapped.nix
+++ b/nix/pkgs/mantis/wrapped.nix
@@ -1,9 +1,9 @@
-{ lib, stdenv, mantis, makeWrapper, jre, gawk }:
+{ lib, stdenv, mantis, makeWrapper, jre, gawk, gnused, kevm, iele, coreutils }:
 let
   inherit (stdenv.lib) optionalString makeLibraryPath;
   inherit (stdenv) cc isDarwin;
   LD_LIBRARY_PATH = makeLibraryPath [ cc.cc.lib ];
-  PATH = lib.makeBinPath [ jre gawk ];
+  PATH = lib.makeBinPath [ jre gawk gnused kevm iele coreutils ];
 in stdenv.mkDerivation {
   pname = "mantis";
   version = let
@@ -23,11 +23,14 @@ in stdenv.mkDerivation {
 
     for p in $(find $out/bin/* -executable); do
       wrapProgram "$p" \
-        --prefix PATH : ${PATH} \
+        --set PATH ${PATH} \
         ${
           optionalString (!isDarwin)
           "--prefix LD_LIBRARY_PATH : ${LD_LIBRARY_PATH}"
         }
     done
+
+    ln -s ${kevm}/bin/kevm-vm $out/bin
+    ln -s ${iele}/bin/iele-vm $out/bin
   '';
 }
diff --git a/nix/pkgs/nginx.nix b/nix/pkgs/nginx.nix
new file mode 100644
index 0000000000..b63bf49ab9
--- /dev/null
+++ b/nix/pkgs/nginx.nix
@@ -0,0 +1,14 @@
+{ lib, writeBashBinChecked, nginx, coreutils, package, target }:
+writeBashBinChecked "entrypoint" ''
+  export PATH="${lib.makeBinPath [ nginx coreutils ]}"
+  mkdir -p /var/cache/nginx
+  ln -fs ${package} ${target}
+
+  config="$1"
+  echo "waiting for valid nginx config..."
+  until nginx -t -c "$config"; do
+    sleep 1
+  done
+
+  exec nginx -g 'error_log stderr;' -c "$@"
+''
diff --git a/nix/sources.json b/nix/sources.json
deleted file mode 100644
index ea990796c7..0000000000
--- a/nix/sources.json
+++ /dev/null
@@ -1,74 +0,0 @@
-{
-    "Sbtix": {
-        "branch": "master",
-        "description": "Generates Nix definitions for your SBT builds",
-        "homepage": null,
-        "owner": "input-output-hk",
-        "repo": "Sbtix",
-        "rev": "7b969a5641fce10500ca51cbe88af4ea160d7064",
-        "sha256": "19pg7rm36b0v9y3ibq5cwsq38pwj3xw3d8srv78svmpnrzm1dh9g",
-        "type": "tarball",
-        "url": "https://github.com/input-output-hk/Sbtix/archive/7b969a5641fce10500ca51cbe88af4ea160d7064.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "gitignore": {
-        "branch": "master",
-        "description": "Nix function for filtering local git sources",
-        "homepage": "",
-        "owner": "hercules-ci",
-        "repo": "gitignore",
-        "rev": "ec5dd0536a5e4c3a99c797b86180f7261197c124",
-        "sha256": "0k2r8y21rn4kr5dmddd3906x0733fs3bb8hzfpabkdav3wcy3klv",
-        "type": "tarball",
-        "url": "https://github.com/hercules-ci/gitignore/archive/ec5dd0536a5e4c3a99c797b86180f7261197c124.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "niv": {
-        "branch": "master",
-        "description": "Easy dependency management for Nix projects",
-        "homepage": "https://github.com/nmattia/niv",
-        "owner": "nmattia",
-        "repo": "niv",
-        "rev": "f73bf8d584148677b01859677a63191c31911eae",
-        "sha256": "0jlmrx633jvqrqlyhlzpvdrnim128gc81q5psz2lpp2af8p8q9qs",
-        "type": "tarball",
-        "url": "https://github.com/nmattia/niv/archive/f73bf8d584148677b01859677a63191c31911eae.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "nix-mksrc": {
-        "branch": "master",
-        "description": null,
-        "homepage": "",
-        "owner": "input-output-hk",
-        "repo": "nix-mksrc",
-        "rev": "c446c2da50209f06d75df9f06f9faa738939b54d",
-        "sha256": "1mnp88fvg9rkl211zsg1mjkx0kk63l9q4fdy3a4avbq8z9bjb1gf",
-        "type": "tarball",
-        "url": "https://github.com/input-output-hk/nix-mksrc/archive/c446c2da50209f06d75df9f06f9faa738939b54d.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "nixkite": {
-        "branch": "master",
-        "description": "Nixkite is a Buildkite pipeline generation tool using the NixOS module system",
-        "homepage": null,
-        "owner": "input-output-hk",
-        "repo": "nixkite",
-        "rev": "11c40d1591e294a2da275aaeb9e21a45319a4673",
-        "sha256": "1cfiqv4n54g9xkm5zvypxfrr8ajpbggvpjn6dp1l9kfc2aknpgiz",
-        "type": "tarball",
-        "url": "https://github.com/input-output-hk/nixkite/archive/11c40d1591e294a2da275aaeb9e21a45319a4673.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "nixpkgs": {
-        "branch": "nixos-20.03",
-        "description": "Nixpkgs/NixOS branches that track the Nixpkgs/NixOS channels",
-        "homepage": null,
-        "owner": "NixOS",
-        "repo": "nixpkgs-channels",
-        "rev": "e2bb73ce5f786b83e984b80199112f86b8a6cc9d",
-        "sha256": "0mpcdwhippvgsj3kj8vw35dgz94dnzgxgsfqqzcfpmvnzjc23vk7",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs-channels/archive/e2bb73ce5f786b83e984b80199112f86b8a6cc9d.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    }
-}
diff --git a/nix/sources.nix b/nix/sources.nix
deleted file mode 100644
index 718ea6fe26..0000000000
--- a/nix/sources.nix
+++ /dev/null
@@ -1,136 +0,0 @@
-# This file has been generated by Niv.
-
-let
-
-  #
-  # The fetchers. fetch_<type> fetches specs of type <type>.
-  #
-
-  fetch_file = pkgs: spec:
-    if spec.builtin or true then
-      builtins_fetchurl { inherit (spec) url sha256; }
-    else
-      pkgs.fetchurl { inherit (spec) url sha256; };
-
-  fetch_tarball = pkgs: spec:
-    if spec.builtin or true then
-      builtins_fetchTarball { inherit (spec) url sha256; }
-    else
-      pkgs.fetchzip { inherit (spec) url sha256; };
-
-  fetch_git = spec:
-      builtins.fetchGit { url = spec.repo; inherit (spec) rev ref; };
-
-  fetch_builtin-tarball = spec:
-    builtins.trace
-      ''
-        WARNING:
-          The niv type "builtin-tarball" will soon be deprecated. You should
-          instead use `builtin = true`.
-
-          $ niv modify <package> -a type=tarball -a builtin=true
-      ''
-      builtins_fetchTarball { inherit (spec) url sha256; };
-
-  fetch_builtin-url = spec:
-    builtins.trace
-      ''
-        WARNING:
-          The niv type "builtin-url" will soon be deprecated. You should
-          instead use `builtin = true`.
-
-          $ niv modify <package> -a type=file -a builtin=true
-      ''
-      (builtins_fetchurl { inherit (spec) url sha256; });
-
-  #
-  # Various helpers
-  #
-
-  # The set of packages used when specs are fetched using non-builtins.
-  mkPkgs = sources:
-    if hasNixpkgsPath
-    then
-      if hasThisAsNixpkgsPath
-      then import (builtins_fetchTarball { inherit (mkNixpkgs sources) url sha256; }) {}
-      else import <nixpkgs> {}
-    else
-      import (builtins_fetchTarball { inherit (mkNixpkgs sources) url sha256; }) {};
-
-  mkNixpkgs = sources:
-    if builtins.hasAttr "nixpkgs" sources
-    then sources.nixpkgs
-    else abort
-      ''
-        Please specify either <nixpkgs> (through -I or NIX_PATH=nixpkgs=...) or
-        add a package called "nixpkgs" to your sources.json.
-      '';
-
-  hasNixpkgsPath = (builtins.tryEval <nixpkgs>).success;
-  hasThisAsNixpkgsPath =
-    (builtins.tryEval <nixpkgs>).success && <nixpkgs> == ./.;
-
-  # The actual fetching function.
-  fetch = pkgs: name: spec:
-
-    if ! builtins.hasAttr "type" spec then
-      abort "ERROR: niv spec ${name} does not have a 'type' attribute"
-    else if spec.type == "file" then fetch_file pkgs spec
-    else if spec.type == "tarball" then fetch_tarball pkgs spec
-    else if spec.type == "git" then fetch_git spec
-    else if spec.type == "builtin-tarball" then fetch_builtin-tarball spec
-    else if spec.type == "builtin-url" then fetch_builtin-url spec
-    else
-      abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}";
-
-  # Ports of functions for older nix versions
-
-  # a Nix version of mapAttrs if the built-in doesn't exist
-  mapAttrs = builtins.mapAttrs or (
-    f: set: with builtins;
-    listToAttrs (map (attr: { name = attr; value = f attr set.${attr}; }) (attrNames set))
-  );
-
-  # fetchTarball version that is compatible between all the versions of Nix
-  builtins_fetchTarball = { url, sha256 }@attrs:
-    let
-      inherit (builtins) lessThan nixVersion fetchTarball;
-    in
-      if lessThan nixVersion "1.12" then
-        fetchTarball { inherit url; }
-      else
-        fetchTarball attrs;
-
-  # fetchurl version that is compatible between all the versions of Nix
-  builtins_fetchurl = { url, sha256 }@attrs:
-    let
-      inherit (builtins) lessThan nixVersion fetchurl;
-    in
-      if lessThan nixVersion "1.12" then
-        fetchurl { inherit url; }
-      else
-        fetchurl attrs;
-
-  # Create the final "sources" from the config
-  mkSources = config:
-    mapAttrs (
-      name: spec:
-        if builtins.hasAttr "outPath" spec
-        then abort
-          "The values in sources.json should not have an 'outPath' attribute"
-        else
-          spec // { outPath = fetch config.pkgs name spec; }
-    ) config.sources;
-
-  # The "config" used by the fetchers
-  mkConfig =
-    { sourcesFile ? ./sources.json
-    }: rec {
-      # The sources, i.e. the attribute set of spec name to spec
-      sources = builtins.fromJSON (builtins.readFile sourcesFile);
-      # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers
-      pkgs = mkPkgs sources;
-    };
-in
-mkSources (mkConfig {}) //
-  { __functor = _: settings: mkSources (mkConfig settings); }
diff --git a/src/main/protobuf/extvm b/src/main/protobuf/extvm
index 53eb31f3c5..6b3039be92 160000
--- a/src/main/protobuf/extvm
+++ b/src/main/protobuf/extvm
@@ -1 +1 @@
-Subproject commit 53eb31f3c59f7200994915b834e626bd292df7ed
+Subproject commit 6b3039be92882df6ef6c15887c8d0b5f10c86d6f
diff --git a/src/main/scala/io/iohk/ethereum/consensus/blocks/BlockGeneratorSkeleton.scala b/src/main/scala/io/iohk/ethereum/consensus/blocks/BlockGeneratorSkeleton.scala
index 894dc58924..281589cf94 100644
--- a/src/main/scala/io/iohk/ethereum/consensus/blocks/BlockGeneratorSkeleton.scala
+++ b/src/main/scala/io/iohk/ethereum/consensus/blocks/BlockGeneratorSkeleton.scala
@@ -163,13 +163,13 @@ abstract class BlockGeneratorSkeleton(
     transactionsForBlock
   }
 
-  //returns maximal limit to be able to include as many transactions as possible
-  protected def calculateGasLimit(parentGas: BigInt): BigInt = {
-    val GasLimitBoundDivisor: Int = 1024
+  /*
+    Returns the same gas limit as the parent block
 
-    val gasLimitDifference = parentGas / GasLimitBoundDivisor
-    parentGas + gasLimitDifference - 1
-  }
+    In Mantis only testnets (and without this changed), this means that all blocks will have the same gasLimit as
+    the genesis block
+   */
+  protected def calculateGasLimit(parentGas: BigInt): BigInt = parentGas
 
   protected def buildMpt[K](entities: Seq[K], vSerializable: ByteArraySerializable[K]): ByteString = {
     val stateStorage = StateStorage.getReadOnlyStorage(EphemDataSource())
diff --git a/src/test/scala/io/iohk/ethereum/consensus/BlockGeneratorSpec.scala b/src/test/scala/io/iohk/ethereum/consensus/BlockGeneratorSpec.scala
index 273dadfe10..1d4cc69827 100644
--- a/src/test/scala/io/iohk/ethereum/consensus/BlockGeneratorSpec.scala
+++ b/src/test/scala/io/iohk/ethereum/consensus/BlockGeneratorSpec.scala
@@ -39,7 +39,12 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
     val miningTimestamp = 1508751768
 
     val fullBlock = pendingBlock.block.copy(header =
-      pendingBlock.block.header.copy(nonce = minedNonce, mixHash = minedMixHash, unixTimestamp = miningTimestamp)
+      pendingBlock.block.header.copy(
+        nonce = minedNonce,
+        mixHash = minedMixHash,
+        unixTimestamp = miningTimestamp,
+        gasLimit = generatedBlockGasLimit
+      )
     )
     validators.blockHeaderValidator.validate(
       fullBlock.header,
@@ -61,7 +66,12 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
     val miningTimestamp = 1508752265
 
     val fullBlock = pendingBlock.block.copy(header =
-      pendingBlock.block.header.copy(nonce = minedNonce, mixHash = minedMixHash, unixTimestamp = miningTimestamp)
+      pendingBlock.block.header.copy(
+        nonce = minedNonce,
+        mixHash = minedMixHash,
+        unixTimestamp = miningTimestamp,
+        gasLimit = generatedBlockGasLimit
+      )
     )
     validators.blockHeaderValidator.validate(
       fullBlock.header,
@@ -83,7 +93,12 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
     val miningTimestamp = 1508752265
 
     val fullBlock = pendingBlock.block.copy(header =
-      pendingBlock.block.header.copy(nonce = minedNonce, mixHash = minedMixHash, unixTimestamp = miningTimestamp)
+      pendingBlock.block.header.copy(
+        nonce = minedNonce,
+        mixHash = minedMixHash,
+        unixTimestamp = miningTimestamp,
+        gasLimit = generatedBlockGasLimit
+      )
     )
 
     // Import Block, to create some existing state
@@ -132,7 +147,12 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
     val miningTimestamp = 1508752389
 
     val fullBlock = pendingBlock.block.copy(header =
-      pendingBlock.block.header.copy(nonce = minedNonce, mixHash = minedMixHash, unixTimestamp = miningTimestamp)
+      pendingBlock.block.header.copy(
+        nonce = minedNonce,
+        mixHash = minedMixHash,
+        unixTimestamp = miningTimestamp,
+        gasLimit = generatedBlockGasLimit
+      )
     )
     validators.blockHeaderValidator.validate(
       fullBlock.header,
@@ -165,7 +185,12 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
     val miningTimestamp = 1508752492
 
     val fullBlock = pendingBlock.block.copy(header =
-      pendingBlock.block.header.copy(nonce = minedNonce, mixHash = minedMixHash, unixTimestamp = miningTimestamp)
+      pendingBlock.block.header.copy(
+        nonce = minedNonce,
+        mixHash = minedMixHash,
+        unixTimestamp = miningTimestamp,
+        gasLimit = generatedBlockGasLimit
+      )
     )
 
     validators.blockHeaderValidator.validate(
@@ -233,7 +258,12 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
 
     val fullBlock =
       pendingBlock.block.copy(header =
-        pendingBlock.block.header.copy(nonce = minedNonce, mixHash = minedMixHash, unixTimestamp = miningTimestamp)
+        pendingBlock.block.header.copy(
+          nonce = minedNonce,
+          mixHash = minedMixHash,
+          unixTimestamp = miningTimestamp,
+          gasLimit = generatedBlockGasLimit
+        )
       )
     validators.blockHeaderValidator.validate(
       fullBlock.header,
@@ -323,7 +353,12 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
 
     val fullBlock =
       pendingBlock.block.copy(header =
-        pendingBlock.block.header.copy(nonce = minedNonce, mixHash = minedMixHash, unixTimestamp = miningTimestamp)
+        pendingBlock.block.header.copy(
+          nonce = minedNonce,
+          mixHash = minedMixHash,
+          unixTimestamp = miningTimestamp,
+          gasLimit = generatedBlockGasLimit
+        )
       )
     validators.blockHeaderValidator.validate(fullBlock.header, blockchain.getBlockHeaderByHash) shouldBe Right(
       BlockHeaderValid
@@ -355,7 +390,12 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
 
     val fullBlock =
       pendingBlock.block.copy(header =
-        pendingBlock.block.header.copy(nonce = minedNonce, mixHash = minedMixHash, unixTimestamp = miningTimestamp)
+        pendingBlock.block.header.copy(
+          nonce = minedNonce,
+          mixHash = minedMixHash,
+          unixTimestamp = miningTimestamp,
+          gasLimit = generatedBlockGasLimit
+        )
       )
     validators.blockHeaderValidator.validate(fullBlock.header, blockchain.getBlockHeaderByHash) shouldBe Right(
       BlockHeaderValid
@@ -400,7 +440,12 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
     val miningTimestamp = 1499721182
 
     val fullBlock = pendingBlock.block.copy(header =
-      pendingBlock.block.header.copy(nonce = minedNonce, mixHash = minedMixHash, unixTimestamp = miningTimestamp)
+      pendingBlock.block.header.copy(
+        nonce = minedNonce,
+        mixHash = minedMixHash,
+        unixTimestamp = miningTimestamp,
+        gasLimit = generatedBlockGasLimit
+      )
     )
     validators.blockHeaderValidator.validate(fullBlock.header, blockchain.getBlockHeaderByHash) shouldBe Right(
       BlockHeaderValid
@@ -432,7 +477,12 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
     val miningTimestamp = 1508752698
 
     val fullBlock = pendingBlock.block.copy(header =
-      pendingBlock.block.header.copy(nonce = minedNonce, mixHash = minedMixHash, unixTimestamp = miningTimestamp)
+      pendingBlock.block.header.copy(
+        nonce = minedNonce,
+        mixHash = minedMixHash,
+        unixTimestamp = miningTimestamp,
+        gasLimit = generatedBlockGasLimit
+      )
     )
     validators.blockHeaderValidator.validate(fullBlock.header, blockchain.getBlockHeaderByHash) shouldBe Right(
       BlockHeaderValid
@@ -562,6 +612,10 @@ class BlockGeneratorSpec extends AnyFlatSpec with Matchers with ScalaCheckProper
     lazy val blockExecution =
       new BlockExecution(blockchain, blockchainConfig, consensus.blockPreparator, blockValidation)
 
+    // FIXME: the change in gas limit voting strategy caused the hardcoded nonce and mixHash in this file to be invalid
+    //        The gas limit of all the generated blocks has to be set to the old strategy of increasing as much as possible
+    //        the gas limit, if not PoW validations will fail
+    val generatedBlockGasLimit = 16733003
   }
 }