I think Gabriel's blogpost http://www.haskellforall.com/2018/08/nixos-in-production.html he explains how to work around nixos-rebuild's inflexibilities. However, I think everything that is being suggested is actually possible in nixos-rebuild already
They blog is still a good exercise to understanding what nixos-rebuild does behind the scenes though.
Deploy to a target machine, from a build machine, with pinned nixpkgs, and a specific nixos config:
nixos-rebuild switch \
--build-host=build@build.service.consul \