feat(glyph): populate Open WebUI system prompt from llm-profile (#379)

* feat(glyph): populate Open WebUI system prompt from llm-profile flake input

Set DEFAULT_SYSTEM_PROMPT by reading the llm-profile flake input
(github:stackptr/llm-profile) at build time. Updating the prompt
only requires bumping the flake input and rebuilding, with no manual
secret editing or database changes.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* feat(glyph): move TOOL_SERVER_CONNECTIONS to plaintext environment

TOOL_SERVER_CONNECTIONS contains no sensitive values, so move it out
of the agenix secret into the declarative environment attrset. Use
builtins.toJSON to express the connection config as a Nix value rather
than a raw JSON string.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: stackptr

hosts/glyph/secrets/open-webui-env.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 rSr+rA dz/LENkfRYCRGz3S3rme3AugxvNBQHCllfUBK1x3cRU
-dVWErZ92dwbmbceW5u3Oa7uLmTUoN8EwXjcxhhRZDEI
--> ssh-ed25519 3EWhnQ xfUfB019syuLvs2b/VHjFgQcU7GQOCCN1BEb4bLBs0k
-bnKg34rlomn+YFdhv4POXqa7ihpsvmMBf9zIHzN2Sho
---- dKqr25Zk6S8nhHQLWdHx/ceYZnXv/LrCtyZymR8GU6g
-�G�K�嵥>U* �r7��]}}�|E�J��"�%5��E�7�+�M�wи*�=���Г��ڪ���+=U��6'T�Y��TY\bsHhYы&�x��:�|�؇�ٺ(@R0��
���	{�[o�i����N������=���C�ބϴ���~M՘�a�f�� ��SQ�D?��3�K��a(�t�+�*M�&s�,��5EȌ�d����-���h�
Wlfp�dn��.ӥ_�eåu��z���@ԅ�B�r���
-�x�-��c[��D�~�颉��;��t	�#�ތ+��i�{h��<Ө���s�4*7G݅h<V"fߏ�V���e���~�W���B�	�V54[��)�᪃K��ӆ��|X���9��_�-cc���/"N�P�əA IѴ�C�nO��Yk/+;��K)ӿfv��@�'{��2�ⲍ@�ͅA�����0Ѧ��1��A��%�@�4�˹l{�
-�J�#Q=�m�u�(y�黮�$-�b��w�K^�P��E�v	�}<Ѱq�q��{`�ǎ�]�]-�NS�!�p0Ƒ�����[
�����	N~�1_<Ʉ@��%^��Џ����=
�v�g���*�a���1�z�XC���'A#�ߥ#6��Qq&����U�D(FN?��h��`޹��=�!2�T��Yȡ��;*�JE��-�F.;�4J��(.6�Ґg0��(��:��TwK_�**3��Ϸ��@�4��Ә�)��ߚ1�Ty��>�G�U@d˧'��#M�&�C5Cp?�^��b���˶ �⟭���?�^/qYd
+-> ssh-ed25519 rSr+rA g7O6mNViz7fMYmza4+3RlbvfbSr8VLBMYiaP5oWq3gg
+CReRIMM2WX5FSGF68NsVttUcByI/iX7wQeXNO0SCTDM
+-> ssh-ed25519 3EWhnQ Lv80uFmKijmxgpODUfVL6hCJGF5a7bMGd4WSwPesMzQ
+T4t9ysCO57mIeyFnGbhg2pCNzG6Z7s1qGCc4CUcjtxg
+--- XlX6YrNZyEry5V+n5u+N+IbSEzO8y/FDH7raPfYCP2E
+���w1^1p
��l76mx��ۈ^L8�&\F�7����^<Kx<�aE�Nt�:���N���턙X�]w
+����#?��Hd(w�[��.3�+@Z`��1ut}	�B�Sx�l�h��Sy%����z��M�a�����Ny�9��( |0�'���ˍ����e?Db��5�����&�7�3��q��3�S^����G�u��K�N.��쭡ŠE���N.��
/a�-�ϤUm�� �H����d��jzS�}@Ee����G�VSz�HSq���2x<}�`���PNj�Oj������
�W��rY&�'Fh��|�"48�����oJc�{�G���~���$A�v��85�̕H�Fw�]� �_�E��#iV���t��(*�WRW�{�;��gxe0jTUO�]��y�|(r���.�<���P�doJ�O��Y"��q��t}z��'�w��%���Z�Prd6�h���SEpn׿�&���3�޻ƭbeCk[�B���;%���Zp̱��.#Q��Y�
cT ���z�f���$U��
+�!Q��)t�+eB�·KoS%{*�h��w�#�I�σ�m��T�x2v$

hosts/glyph/services/open-webui.nix

@@ -1,5 +1,6 @@
 {
   config,
+  inputs,
   pkgs,
   ...
 }: {
@@ -40,6 +41,26 @@
       ENABLE_API_KEYS = "True";
       USER_PERMISSIONS_FEATURES_API_KEYS = "True";
       DATABASE_URL = "postgresql:///open-webui?host=/run/postgresql";
+
+      # System prompt sourced from llm-profile flake input (github:stackptr/llm-profile)
+      DEFAULT_SYSTEM_PROMPT = builtins.readFile "${inputs.llm-profile}/README.md";
+
+      # MCP tool server: MCPJungle gateway on glyph (aggregates all registered MCP servers)
+      TOOL_SERVER_CONNECTIONS = builtins.toJSON [
+        {
+          type = "mcp";
+          url = "http://localhost:8090";
+          path = "mcp";
+          auth_type = "none";
+          key = "";
+          config.enable = true;
+          info = {
+            id = "glyph";
+            name = "Glyph";
+            description = "MCP gateway";
+          };
+        }
+      ];
     };
   };
 }