[vq]

I maintain a couple of Debian servers and this is how I do it too.

Reverse proxy, DB, etc from Debian. The application server is built and deployed with nix. The Python version (and all the dependencies) that runs the application server is the tagged one in my nix flake which is the same used in the development environment.

I make sure that PostgreSQL is never upgraded past what is available in the latest Debian stable on any on the dev machines.