feat(glyph): configure Open WebUI security and API secrets

  Add agenix-managed environment file for WEBUI_SECRET_KEY and API keys.
  Harden configuration: disable signup, set session cookie secure flag,
  configure CORS and WEBUI_URL for chat.zx.dev, and disable persistent
  config to enforce env-var-only settings.

  Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: stackptr

hosts/glyph/secrets/open-webui-env.age

@@ -1,14 +1,18 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
+{config, ...}: {
+  age.secrets.open-webui-env.file = ./../secrets/open-webui-env.age;
+
   services.open-webui = {
     enable = true;
     port = 8888;
     host = "0.0.0.0";
+    environmentFile = config.age.secrets.open-webui-env.path;
     environment = {
       ENABLE_OLLAMA_API = "False";
+      ENABLE_SIGNUP = "False";
+      ENABLE_PERSISTENT_CONFIG = "False";
+      WEBUI_URL = "https://chat.zx.dev";
+      WEBUI_SESSION_COOKIE_SECURE = "True";
+      CORS_ALLOW_ORIGIN = "https://chat.zx.dev";
     };
   };
 }

hosts/glyph/services/open-webui.nix

@@ -6,4 +6,5 @@ in {
   "hosts/glyph/secrets/pushover-user-token.age".publicKeys = keys;
   "hosts/glyph/secrets/kagi-api-key.age".publicKeys = keys;
   "hosts/glyph/secrets/context7-api-key.age".publicKeys = keys;
+  "hosts/glyph/secrets/open-webui-env.age".publicKeys = keys;
 }