From 306fea37fd7c75a6cee03cca7372c3c1f65e22a1 Mon Sep 17 00:00:00 2001
From: didier amyot <didier.amyot@all-dressed-programming.com>
Date: Sun, 31 May 2026 15:50:41 -0400
Subject: [PATCH] add inline openaiApiKey and token options

---
 flake.nix | 44 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 33 insertions(+), 11 deletions(-)

diff --git a/flake.nix b/flake.nix
index 140797d..0ad364c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -64,10 +64,17 @@
             };
 
             openaiApiKeyFile = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.nullOr lib.types.path;
+              default = null;
               description = "Path to a file containing the API key (OpenAI or DeepSeek).";
             };
 
+            openaiApiKey = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "API key directly. Prefer openaiApiKeyFile for secrets.";
+            };
+
             embeddingBaseUrl = lib.mkOption {
               type = lib.types.str;
               default = "https://api.openai.com/v1";
@@ -81,9 +88,16 @@
             };
 
             tokenFile = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.nullOr lib.types.path;
+              default = null;
               description = "Path to a file containing the MCP Bearer token.";
             };
+
+            token = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "MCP Bearer token directly. Prefer tokenFile for secrets.";
+            };
           };
 
           config = lib.mkIf cfg.enable {
@@ -106,18 +120,26 @@
                 Restart = "always";
                 WorkingDirectory = "/var/lib/st-pierre";
                 ExecStart = "${st-pierre-pkg}/bin/st-pierre";
-                EnvironmentFile = [ cfg.openaiApiKeyFile cfg.tokenFile ]
+                EnvironmentFile = lib.optional (cfg.openaiApiKeyFile != null) cfg.openaiApiKeyFile
+                  ++ lib.optional (cfg.tokenFile != null) cfg.tokenFile
                   ++ lib.optional (cfg.qdrantApiKeyFile != null) cfg.qdrantApiKeyFile;
               };
 
-              environment = {
-                PORT = builtins.toString cfg.port;
-                QDRANT_URL = cfg.qdrantUrl;
-                QDRANT_PORT = builtins.toString cfg.qdrantPort;
-                QDRANT_TLS = if cfg.qdrantTls then "true" else "false";
-                EMBEDDING_BASE_URL = cfg.embeddingBaseUrl;
-                EMBEDDING_MODEL = cfg.embeddingModel;
-              };
+              environment =
+                {
+                  PORT = builtins.toString cfg.port;
+                  QDRANT_URL = cfg.qdrantUrl;
+                  QDRANT_PORT = builtins.toString cfg.qdrantPort;
+                  QDRANT_TLS = if cfg.qdrantTls then "true" else "false";
+                  EMBEDDING_BASE_URL = cfg.embeddingBaseUrl;
+                  EMBEDDING_MODEL = cfg.embeddingModel;
+                }
+                // lib.optionalAttrs (cfg.openaiApiKey != null) {
+                  OPENAI_API_KEY = cfg.openaiApiKey;
+                }
+                // lib.optionalAttrs (cfg.token != null) {
+                  MCP_TOKEN = cfg.token;
+                };
             };
           };
         };