fix: rust overlay in nix package

container/flake.nix

@@ -2,9 +2,8 @@
   inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
   # inputs.trictrac.url = "github:mmai/trictrac";
   inputs.trictrac.url = "..";
-  inputs.rust-overlay.url = "github:oxalica/rust-overlay";
 
-  outputs = { self, nixpkgs, trictrac, rust-overlay }:
+  outputs = { self, nixpkgs, trictrac }:
     {
       nixosConfigurations = {
 
@@ -30,8 +29,8 @@
                 networking.firewall.allowedTCPPorts = [ 80 ];
                 networking.hostName = hostname;
 
-                # rust-overlay must be applied first so trictrac.overlay can use rust-bin
-                nixpkgs.overlays = [ rust-overlay.overlays.default trictrac.overlay ];
+                # trictrac.overlay already includes rust-overlay
+                nixpkgs.overlays = [ trictrac.overlay ];
 
                 services.trictrac = {
                   enable = true;

flake.nix

@@ -8,13 +8,16 @@
 
   outputs = { self, nixpkgs, rust-overlay }:
     let
+      rustPkgs = import nixpkgs {
+        inherit (final) system;
+        overlays = [ rust-overlay.overlays.default ];
+      };
       systems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
       forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);
-      # rust-overlay must be applied before self.overlay so that rust-bin is available
       nixpkgsFor = forAllSystems (system:
         import nixpkgs {
           inherit system;
-          overlays = [ rust-overlay.overlays.default self.overlay ];
+          overlays = [ self.overlay ];
         }
       );
     in
@@ -24,7 +27,7 @@
         trictrac-front =
           let
             # WASM build needs wasm32-unknown-unknown target in the Rust toolchain
-            rustToolchain = final.rust-bin.stable.latest.default.override {
+            rustToolchain = rustPkgs.rust-bin.stable.latest.default.override {
               targets = [ "wasm32-unknown-unknown" ];
             };
             rustPlatform = final.makeRustPlatform {

module.nix

@@ -41,6 +41,39 @@ in
         description = "Port the relay server listens on.";
       };
 
+      smtp = {
+        host = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = "SMTP server hostname.";
+        };
+        port = mkOption {
+          type = types.port;
+          default = 1025;
+          description = "SMTP server port.";
+        };
+        from = mkOption {
+          type = types.str;
+          default = "noreply@trictrac.local";
+          description = "Sender address for outgoing mail.";
+        };
+        user = mkOption {
+          type = types.str;
+          default = "";
+          description = "SMTP username (leave empty to skip authentication).";
+        };
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/secrets/trictrac-smtp-password";
+          description = ''
+            Path to a file containing a single line: SMTP_PASSWORD=<secret>.
+            Loaded as a systemd EnvironmentFile so the secret never appears in
+            the Nix store or process environment of other units.
+          '';
+        };
+      };
+
       createDatabaseLocally = mkOption {
         type = types.bool;
         default = true;
@@ -136,8 +169,13 @@ in
         wantedBy = [ "multi-user.target" ];
 
         environment = {
-          # Use TCP + trust auth (matches NixOS postgresql.authentication above)
           DATABASE_URL = "postgresql://${cfg.user}@127.0.0.1/${cfg.user}";
+          APP_URL = "${cfg.protocol}://${cfg.hostname}";
+          SMTP_HOST = cfg.smtp.host;
+          SMTP_PORT = toString cfg.smtp.port;
+          SMTP_FROM = cfg.smtp.from;
+        } // optionalAttrs (cfg.smtp.user != "") {
+          SMTP_USER = cfg.smtp.user;
         };
 
         serviceConfig = {
@@ -149,6 +187,7 @@ in
           WorkingDirectory = "/var/lib/trictrac";
           ExecStartPre = "${setupScript}";
           ExecStart = "${pkgs.trictrac}/bin/relay-server";
+          EnvironmentFile = mkIf (cfg.smtp.passwordFile != null) cfg.smtp.passwordFile;
           Restart = "on-failure";
           RestartSec = "5s";
         };