Package both services and expose configurable NixOS modules. Keep runtime credentials outside the Nix store. Add a native development launcher with persistent private state. Use prek for commit checks, with Go vet and race tests run manually.