Merge pull request 'feat(talk): read API key from agenix file' (#24) from feat/talk-agenix-key into master

Reviewed-on: #24

pkgs/talk/README.md

@@ -22,10 +22,13 @@ pi -p "Fasse zusammen" | talk
 
 | Variable | Required | Default | Description |
 |---|---|---|---|
-| `ELEVENLABS_API_KEY` | ✅ | — | API key for ElevenLabs |
+| `ELEVENLABS_API_KEY` | ⚠️ | — | Fallback if agenix file is absent |
+| `ELEVENLABS_KEY_FILE` | ❌ | `/run/agenix/elevenlabs-key` | Path to agenix secrets file (preferred) |
 | `ELEVENLABS_VOICE_ID` | ❌ | `KXxZd16DiBqt82nbarJx` | Voice ID to use |
 | `VOICE_NOTIFY` | ❌ | `1` | Set to `0` to silence all output |
 
+The API key is read from the agenix file at `/run/agenix/elevenlabs-key` by default. The file should contain just the key (trailing newline is stripped automatically via `read -r`). If the file doesn't exist, `talk` falls back to the `ELEVENLABS_API_KEY` environment variable.
+
 ## How It Works
 
 1. Sends text to ElevenLabs `text-to-speech` API → receives MP3
@@ -72,12 +75,20 @@ crunch ai pi daily "08:00" "Fasse Basecamp Todos zusammen"
 ```nix
 # home-manager
 home.packages = [ pkgs.m3ta.talk ];
-
-# Requires in environment:
-environment.sessionVariables.ELEVENLABS_API_KEY = "your-key";
-# Or via agenix secrets
 ```
 
+The API key is read from `/run/agenix/elevenlabs-key` at runtime — set up the secret in your agenix configuration:
+
+```nix
+# secrets.nix
+age.secrets."elevenlabs-key" = {
+  file = ./secrets/elevenlabs-key.age;
+  # Optionally set owner/group if needed
+};
+```
+
+No need to export `ELEVENLABS_API_KEY` in shell environment anymore.
+
 ## Dependencies
 
 - `curl` — API calls

pkgs/talk/default.nix

@@ -23,7 +23,18 @@
     fi
 
     # ── Config ──────────────────────────────────────────────────────
-    API_KEY="''${ELEVENLABS_API_KEY:?Set ELEVENLABS_API_KEY in your environment}"
+    # API key: read from agenix file (preferred), fall back to env var.
+    # `read -r` strips the trailing newline that agenix files contain.
+    ELEVENLABS_KEY_FILE="''${ELEVENLABS_KEY_FILE:-/run/agenix/elevenlabs-key}"
+    if [ -f "$ELEVENLABS_KEY_FILE" ]; then
+      read -r API_KEY < "$ELEVENLABS_KEY_FILE"
+    elif [ -n "''${ELEVENLABS_API_KEY:-}" ]; then
+      API_KEY="''${ELEVENLABS_API_KEY}"
+    else
+      echo "Error: No ElevenLabs API key found." >&2
+      echo "Create $ELEVENLABS_KEY_FILE (agenix) or set ELEVENLABS_API_KEY env var." >&2
+      exit 1
+    fi
     VOICE_ID="''${ELEVENLABS_VOICE_ID:-KXxZd16DiBqt82nbarJx}"
     # Argument hat Vorrang, sonst stdin lesen wenn Pipe
     if [ $# -ge 1 ]; then