From 0803db4f45e7f76d0e09bea37d65135a04e8e0e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey=20=28they/them=29?= Date: Tue, 17 Mar 2026 13:34:35 -0700 Subject: [PATCH 1/2] feat(glyph): populate Open WebUI system prompt from llm-profile flake input Set DEFAULT_SYSTEM_PROMPT by reading the llm-profile flake input (github:stackptr/llm-profile) at build time. Updating the prompt only requires bumping the flake input and rebuilding, with no manual secret editing or database changes. Co-Authored-By: Claude Sonnet 4.6 (1M context) --- hosts/glyph/services/open-webui.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hosts/glyph/services/open-webui.nix b/hosts/glyph/services/open-webui.nix index 730bbe67..0d66667e 100644 --- a/hosts/glyph/services/open-webui.nix +++ b/hosts/glyph/services/open-webui.nix @@ -1,5 +1,6 @@ { config, + inputs, pkgs, ... }: { @@ -40,6 +41,9 @@ ENABLE_API_KEYS = "True"; USER_PERMISSIONS_FEATURES_API_KEYS = "True"; DATABASE_URL = "postgresql:///open-webui?host=/run/postgresql"; + + # System prompt sourced from llm-profile flake input (github:stackptr/llm-profile) + DEFAULT_SYSTEM_PROMPT = builtins.readFile "${inputs.llm-profile}/README.md"; }; }; } From 1e7a4c4ad6106afc72a396664e24d4cf04284f01 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey=20=28they/them=29?= Date: Tue, 17 Mar 2026 13:45:16 -0700 Subject: [PATCH 2/2] feat(glyph): move TOOL_SERVER_CONNECTIONS to plaintext environment TOOL_SERVER_CONNECTIONS contains no sensitive values, so move it out of the agenix secret into the declarative environment attrset. Use builtins.toJSON to express the connection config as a Nix value rather than a raw JSON string. Co-Authored-By: Claude Sonnet 4.6 (1M context) --- hosts/glyph/secrets/open-webui-env.age | 16 ++++++++-------- hosts/glyph/services/open-webui.nix | 17 +++++++++++++++++ 2 files changed, 25 insertions(+), 8 deletions(-) diff --git a/hosts/glyph/secrets/open-webui-env.age b/hosts/glyph/secrets/open-webui-env.age index 73092f06..8be2c975 100644 --- a/hosts/glyph/secrets/open-webui-env.age +++ b/hosts/glyph/secrets/open-webui-env.age @@ -1,9 +1,9 @@ age-encryption.org/v1 --> ssh-ed25519 rSr+rA dz/LENkfRYCRGz3S3rme3AugxvNBQHCllfUBK1x3cRU -dVWErZ92dwbmbceW5u3Oa7uLmTUoN8EwXjcxhhRZDEI --> ssh-ed25519 3EWhnQ xfUfB019syuLvs2b/VHjFgQcU7GQOCCN1BEb4bLBs0k -bnKg34rlomn+YFdhv4POXqa7ihpsvmMBf9zIHzN2Sho ---- dKqr25Zk6S8nhHQLWdHx/ceYZnXv/LrCtyZymR8GU6g -GK嵥>U* r7]}}|EJ"%5E7+Mwи*=Гڪ+=U6'TYTY\bsHhYы&x:|؇ٺ(@R0 {[oiN=Cބϴ ~M՘af SQD?3Ka(t+*M&s,5EȌd -hWlfpdn.ӥ_eåuz@ԅBr -x-c[ D~颉; t #ތ+i{h<Өs4*7G݅hGU@d˧'#M&C5Cp?^b˶ ⟭?^/qYd \ No newline at end of file +-> ssh-ed25519 rSr+rA g7O6mNViz7fMYmza4+3RlbvfbSr8VLBMYiaP5oWq3gg +CReRIMM2WX5FSGF68NsVttUcByI/iX7wQeXNO0SCTDM +-> ssh-ed25519 3EWhnQ Lv80uFmKijmxgpODUfVL6hCJGF5a7bMGd4WSwPesMzQ +T4t9ysCO57mIeyFnGbhg2pCNzG6Z7s1qGCc4CUcjtxg +--- XlX6YrNZyEry5V+n5u+N+IbSEzO8y/FDH7raPfYCP2E +w1^1pl76mxۈ^L8&\F7^