From 651cc2be63d829447bf2fae3f877c9e0663e817d Mon Sep 17 00:00:00 2001
From: "matthew.binning" <matthewbinning@pm.me>
Date: Thu, 12 Feb 2026 07:47:52 -0800
Subject: [PATCH] Reenable API key file

---
 hosts/crossbox/nginx.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hosts/crossbox/nginx.nix b/hosts/crossbox/nginx.nix
index 1fbcfa4..2e2bcf7 100644
--- a/hosts/crossbox/nginx.nix
+++ b/hosts/crossbox/nginx.nix
@@ -26,10 +26,9 @@ in
       map $http_authorization $auth_status {
         default "unauthorized";
         "" "no_auth";
-        # Add your Bearer tokens here manually, or use include directive
+        # Tokens loaded from file to keep secrets out of the nix store
         # Format: "Bearer YOUR_TOKEN_HERE" "authorized";
-        # You can also create /srv/nginx/secrets.map and include it:
-        # include /srv/nginx/secrets.map;
+        include /srv/nginx/secrets.map;
       }
     '';