feat: deepseek is insanly good

flake.nix

@@ -124,6 +124,12 @@
               default = "/var/lib/st-pierre/st-pierre.sqlite";
               description = "Path to the SQLite database file.";
             };
+
+            hmacKeyFile = lib.mkOption {
+              type = lib.types.path;
+              default = "/var/lib/st-pierre/secret";
+              description = "Path to the HMAC key file for cookie signing. Will be auto-generated if missing.";
+            };
           };
 
           config = lib.mkIf cfg.enable {
@@ -170,6 +176,7 @@
                   EMBEDDING_BASE_URL = cfg.embeddingBaseUrl;
                   EMBEDDING_MODEL = cfg.embeddingModel;
                   SQLITE_PATH = builtins.toString cfg.sqlitePath;
+                  HMAC_KEY_FILE = builtins.toString cfg.hmacKeyFile;
                   GIT_COMMIT = gitHash;
                   BUILD_DATE = lastUpdated;
                 }