nix: expose overlay and NixOS module for infrastructure deployment

- Fix default.nix to build from workspace (imphnen-backend/Cargo.toml)
- Add overlays.default adding pkgs.imphnen-backend
- Add nixosModules.backend via nixos-module.nix
- NixOS module defines systemd service on port 8081 with environmentFile

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

default.nix

@@ -1,15 +1,16 @@
-{pkgs ? import <nixpkgs> {}}: let
-  manifest = (pkgs.lib.importTOML ./Cargo.toml).package;
-  rustDeps = pkgs.callPackage ./Cargo.nix {};
-  packageEntry = rustDeps.workspaceMembers.${manifest.name};
-  deps = packageEntry.build.cargoDeps or null;
-in
-  pkgs.rustPlatform.buildRustPackage {
-    pname = manifest.name;
-    version = manifest.version;
-    cargoDeps = deps;
-    src = pkgs.lib.cleanSource ./.;
-    cargoLock.lockFile = ./Cargo.lock;
-    nativeBuildInputs = [pkgs.openssl pkgs.pkg-config];
-    buildInputs = [pkgs.openssl];
-  }
+{ pkgs ? import <nixpkgs> { } }:
+pkgs.rustPlatform.buildRustPackage {
+  pname = "imphnen-backend";
+  version = (pkgs.lib.importTOML ./imphnen-backend/Cargo.toml).package.version;
+  src = pkgs.lib.cleanSource ./.;
+  cargoLock.lockFile = ./Cargo.lock;
+  cargoBuildFlags = [
+    "--package"
+    "imphnen-backend"
+    "--bin"
+    "api"
+  ];
+  nativeBuildInputs = [ pkgs.pkg-config ];
+  buildInputs = [ pkgs.openssl ];
+  doCheck = false;
+}

flake.nix

@@ -1,41 +1,47 @@
-{
-  description = "IMPHNEN Backend Service Nix Flake";
-
-  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-  };
-
-  outputs =
-    {
-      self,
-      nixpkgs,
-    }:
-    let
-      supportedSystems = [
-        "x86_64-linux"
-        "x86_64-darwin"
-        "aarch64-darwin"
-        "aarch64-linux"
-      ];
-      pkgsFor =
-        system:
-        import nixpkgs {
-          inherit system;
-          config = {
-            allowUnfree = true;
-          };
-        };
-      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
-    in
-    {
-      packages = forAllSystems (system: {
-        default = (pkgsFor system).callPackage ./default.nix { };
-      });
-      devShells = forAllSystems (system: {
-        default = (pkgsFor system).callPackage ./shell.nix { };
-      });
-      dockerImages = forAllSystems (system: {
-        tryOutApi = (pkgsFor system).callPackage ./docker.nix { };
-      });
-    };
-}
+{
+  description = "IMPHNEN Backend Service Nix Flake";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+    }:
+    let
+      supportedSystems = [
+        "x86_64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+        "aarch64-linux"
+      ];
+      pkgsFor =
+        system:
+        import nixpkgs {
+          inherit system;
+          config.allowUnfree = true;
+        };
+      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
+    in
+    {
+      packages = forAllSystems (system: {
+        default = (pkgsFor system).callPackage ./default.nix { };
+      });
+
+      overlays.default = final: _prev: {
+        imphnen-backend = final.callPackage ./default.nix { };
+      };
+
+      nixosModules.backend = ./nixos-module.nix;
+
+      devShells = forAllSystems (system: {
+        default = (pkgsFor system).callPackage ./shell.nix { };
+      });
+
+      dockerImages = forAllSystems (system: {
+        tryOutApi = (pkgsFor system).callPackage ./docker.nix { };
+      });
+    };
+}

nixos-module.nix

@@ -0,0 +1,48 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.imphnen-backend;
+in
+{
+  options.services.imphnen-backend = {
+    enable = lib.mkEnableOption "IMPHNEN backend service";
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8081;
+      description = "Port the backend HTTP server listens on.";
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to environment file with secrets (DATABASE_URL, JWT keys, etc).";
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.imphnen-backend = {
+      description = "IMPHNEN Backend Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+        "postgresql.service"
+      ];
+      serviceConfig = {
+        ExecStart = "${pkgs.imphnen-backend}/bin/api";
+        EnvironmentFile = cfg.environmentFile;
+        Environment = [ "PORT=${toString cfg.port}" ];
+        DynamicUser = true;
+        Restart = "on-failure";
+        RestartSec = "5s";
+        StandardOutput = "journal";
+        StandardError = "journal";
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+  };
+}