From e7765ee39f163294f9eef5de6911c6c1ecff1391 Mon Sep 17 00:00:00 2001
From: m3ta-chiron <m3ta-chiron@agentmail.to>
Date: Thu, 2 Jul 2026 20:10:12 +0200
Subject: [PATCH] feat(talk): read API key from agenix file instead of env var
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Primary: /run/agenix/elevenlabs-key (read via 'read -r' which strips
the trailing newline agenix files contain).
Fallback: ELEVENLABS_API_KEY env var (backwards compatible).

No need to export the key in shell environment anymore — if the
agenix secret exists, talk picks it up automatically.

Override path via ELEVENLABS_KEY_FILE env var if needed.
---
 pkgs/talk/README.md   | 21 ++++++++++++++++-----
 pkgs/talk/default.nix | 13 ++++++++++++-
 2 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/pkgs/talk/README.md b/pkgs/talk/README.md
index c2a3376..f17b573 100644
--- a/pkgs/talk/README.md
+++ b/pkgs/talk/README.md
@@ -22,10 +22,13 @@ pi -p "Fasse zusammen" | talk
 
 | Variable | Required | Default | Description |
 |---|---|---|---|
-| `ELEVENLABS_API_KEY` | ✅ | — | API key for ElevenLabs |
+| `ELEVENLABS_API_KEY` | ⚠️ | — | Fallback if agenix file is absent |
+| `ELEVENLABS_KEY_FILE` | ❌ | `/run/agenix/elevenlabs-key` | Path to agenix secrets file (preferred) |
 | `ELEVENLABS_VOICE_ID` | ❌ | `KXxZd16DiBqt82nbarJx` | Voice ID to use |
 | `VOICE_NOTIFY` | ❌ | `1` | Set to `0` to silence all output |
 
+The API key is read from the agenix file at `/run/agenix/elevenlabs-key` by default. The file should contain just the key (trailing newline is stripped automatically via `read -r`). If the file doesn't exist, `talk` falls back to the `ELEVENLABS_API_KEY` environment variable.
+
 ## How It Works
 
 1. Sends text to ElevenLabs `text-to-speech` API → receives MP3
@@ -72,12 +75,20 @@ crunch ai pi daily "08:00" "Fasse Basecamp Todos zusammen"
 ```nix
 # home-manager
 home.packages = [ pkgs.m3ta.talk ];
-
-# Requires in environment:
-environment.sessionVariables.ELEVENLABS_API_KEY = "your-key";
-# Or via agenix secrets
 ```
 
+The API key is read from `/run/agenix/elevenlabs-key` at runtime — set up the secret in your agenix configuration:
+
+```nix
+# secrets.nix
+age.secrets."elevenlabs-key" = {
+  file = ./secrets/elevenlabs-key.age;
+  # Optionally set owner/group if needed
+};
+```
+
+No need to export `ELEVENLABS_API_KEY` in shell environment anymore.
+
 ## Dependencies
 
 - `curl` — API calls
diff --git a/pkgs/talk/default.nix b/pkgs/talk/default.nix
index 46f6f23..aa45bd0 100644
--- a/pkgs/talk/default.nix
+++ b/pkgs/talk/default.nix
@@ -23,7 +23,18 @@
     fi
 
     # ── Config ──────────────────────────────────────────────────────
-    API_KEY="''${ELEVENLABS_API_KEY:?Set ELEVENLABS_API_KEY in your environment}"
+    # API key: read from agenix file (preferred), fall back to env var.
+    # `read -r` strips the trailing newline that agenix files contain.
+    ELEVENLABS_KEY_FILE="''${ELEVENLABS_KEY_FILE:-/run/agenix/elevenlabs-key}"
+    if [ -f "$ELEVENLABS_KEY_FILE" ]; then
+      read -r API_KEY < "$ELEVENLABS_KEY_FILE"
+    elif [ -n "''${ELEVENLABS_API_KEY:-}" ]; then
+      API_KEY="''${ELEVENLABS_API_KEY}"
+    else
+      echo "Error: No ElevenLabs API key found." >&2
+      echo "Create $ELEVENLABS_KEY_FILE (agenix) or set ELEVENLABS_API_KEY env var." >&2
+      exit 1
+    fi
     VOICE_ID="''${ELEVENLABS_VOICE_ID:-KXxZd16DiBqt82nbarJx}"
     # Argument hat Vorrang, sonst stdin lesen wenn Pipe
     if [ $# -ge 1 ]; then