add inline openaiApiKey and token options

flake.nix

@@ -64,10 +64,17 @@
             };
 
             openaiApiKeyFile = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.nullOr lib.types.path;
+              default = null;
               description = "Path to a file containing the API key (OpenAI or DeepSeek).";
             };
 
+            openaiApiKey = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "API key directly. Prefer openaiApiKeyFile for secrets.";
+            };
+
             embeddingBaseUrl = lib.mkOption {
               type = lib.types.str;
               default = "https://api.openai.com/v1";
@@ -81,9 +88,16 @@
             };
 
             tokenFile = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.nullOr lib.types.path;
+              default = null;
               description = "Path to a file containing the MCP Bearer token.";
             };
+
+            token = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+              description = "MCP Bearer token directly. Prefer tokenFile for secrets.";
+            };
           };
 
           config = lib.mkIf cfg.enable {
@@ -106,17 +120,25 @@
                 Restart = "always";
                 WorkingDirectory = "/var/lib/st-pierre";
                 ExecStart = "${st-pierre-pkg}/bin/st-pierre";
-                EnvironmentFile = [ cfg.openaiApiKeyFile cfg.tokenFile ]
+                EnvironmentFile = lib.optional (cfg.openaiApiKeyFile != null) cfg.openaiApiKeyFile
+                  ++ lib.optional (cfg.tokenFile != null) cfg.tokenFile
                   ++ lib.optional (cfg.qdrantApiKeyFile != null) cfg.qdrantApiKeyFile;
               };
 
-              environment = {
+              environment =
+                {
                   PORT = builtins.toString cfg.port;
                   QDRANT_URL = cfg.qdrantUrl;
                   QDRANT_PORT = builtins.toString cfg.qdrantPort;
                   QDRANT_TLS = if cfg.qdrantTls then "true" else "false";
                   EMBEDDING_BASE_URL = cfg.embeddingBaseUrl;
                   EMBEDDING_MODEL = cfg.embeddingModel;
+                }
+                // lib.optionalAttrs (cfg.openaiApiKey != null) {
+                  OPENAI_API_KEY = cfg.openaiApiKey;
+                }
+                // lib.optionalAttrs (cfg.token != null) {
+                  MCP_TOKEN = cfg.token;
                 };
             };
           };