feat(glyph): declarative Open WebUI model config via API sync

[stackptr]

Summary

• Adds a models attrset to open-webui.nix — listed models are activated with full config, all others are automatically deactivated
• Active models get: all capabilities (vision, web search, citations, etc.), MCPJungle tool server (server:mcp:glyph), default features (web search + code interpreter), and all builtin tools
• A oneshot systemd service (open-webui-model-sync) pushes config to Open WebUI via its API after deployment, triggered by a timer with config hash change detection
• Adds open-webui-api-key.age to secrets for API authentication

Adding a new model

models = {
  "claude-sonnet-4-6" = {};
  "claude-opus-4-6" = {};
  "claude-haiku-4-5-20251001" = {};
  # just add another entry:
  "new-model-id" = {};
};

Per-model overrides are supported via name, meta, and params attrs.

Before deploying

• Generate an API key in Open WebUI (Settings > Account > API Keys)
• Create secret: agenix -e hosts/glyph/secrets/open-webui-api-key.age with the key as the only content (no KEY= prefix)

Test plan

• Deploy to glyph
• Check journalctl -u open-webui-model-sync for successful updates
• Verify only the 3 listed models appear in the model picker
• Verify active models have MCPJungle tools and web search enabled by default

🤖 Generated with Claude Code