Convert to nix flake; fix systemd service to use nix run

- Add flake.nix with nixos-unstable nixpkgs, devShell and slopbot package
- Add flake.lock
- Update .envrc to 'use flake .'
- Update slopbot.service: use 'nix run' instead of nix-shell, remove
  broken sandbox options (ProtectHome, InaccessiblePaths, ProtectSystem,
  ReadOnlyPaths, ReadWritePaths, PrivateTmp) that block nix store access
- Delete shell.nix
- Add 'result' to .gitignore
- Restore openai to requirements.txt (was accidentally dropped)

6 files changed, 92 insertions, 19 deletions

diff --git a/.envrc b/.envrc
index 6c7f168..a5dbbcb 100644
--- a/.envrc
+++ b/.envrc
@@ -1,2 +1 @@
-export PARASAIL_API_KEY="psk-parasailzmJ0-Yj3t3mofugwBetQifS0r"
-export KAGI_API_KEY="9Iyt2Wy_ZQFJzkFPL7t6AbvlrnlY8uTBcxC8fhqakqk.MxMiJl0SPTbtjRuZmaSTGi8LQBvq8dajYN29qdOtJ8Y"
+use flake .
diff --git a/.gitignore b/.gitignore
index 8005bdc..3d9f845 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@ __pycache__/
 .env
 venv/
 .venv/
+result
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..94e0bfb
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1778869304,
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..7a028d0
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,34 @@
+{
+  description = "slopbot - Zulip bot with stock price lookups and LLM replies";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+
+  outputs = { self, nixpkgs }:
+    let
+      system = "x86_64-linux";
+      pkgs = nixpkgs.legacyPackages.${system};
+
+      pythonEnv = pkgs.python3.withPackages (ps: [
+        ps.zulip
+        ps.yfinance
+        ps.openai
+        ps.requests
+      ]);
+    in
+    {
+      devShells.${system}.default = pkgs.mkShell {
+        buildInputs = [ pythonEnv ];
+        shellHook = ''
+          echo "slopbot dev shell ready"
+          echo "Run: python main.py"
+        '';
+      };
+
+      packages.${system}.default = pkgs.writeShellScriptBin "slopbot" ''
+        cd /home/ben/src/bsima/slopbot
+        exec ${pythonEnv}/bin/python ${./main.py}
+      '';
+    };
+}
diff --git a/shell.nix b/shell.nix
deleted file mode 100644
index fcc0bd7..0000000
--- a/shell.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ pkgs ? import <nixpkgs> {} }:
-
-pkgs.mkShell {
-  buildInputs = [
-    (pkgs.python3.withPackages (ps: [
-      ps.zulip
-      ps.yfinance
-      ps.openai
-      ps.requests
-    ]))
-  ];
-
-  shellHook = ''
-    echo "slopbot dev shell ready"
-    echo "Run: python main.py"
-  '';
-}
diff --git a/slopbot.service b/slopbot.service
new file mode 100644
index 0000000..396e9d0
--- /dev/null
+++ b/slopbot.service
@@ -0,0 +1,29 @@
+[Unit]
+Description=slopbot Zulip bot
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/home/ben/src/bsima/slopbot
+EnvironmentFile=-/home/ben/src/bsima/slopbot/.env
+ExecStart=/run/current-system/sw/bin/nix --extra-experimental-features 'nix-command flakes' run /home/ben/src/bsima/slopbot#slopbot
+Restart=on-failure
+RestartSec=5
+
+NoNewPrivileges=true
+CapabilityBoundingSet=
+LockPersonality=true
+PrivateDevices=true
+ProtectClock=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=true
+RestrictRealtime=true
+SystemCallArchitectures=native
+
+[Install]
+WantedBy=multi-user.target