hektor/nix
1
0
Fork 0
Code Pull Requests Actions Activity

fix(ai-tools): adopt 'taskwarrior' home manager secrets approach

Browse Source
This commit is contained in:
hektor
2026-10-12 23:44:18 +02:00
parent 034a010547
commit 622a2ae3da
2 changed files with 49 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
home/modules/ai-tools/opencode.nix
+48 -36
View File
@@ -2,49 +2,61 @@
config,
lib,
pkgs,
myUtils,
osConfig ? null,
inputs ? null,
...
}:
let
cfg = config.ai-tools.opencode;
sops = myUtils.sopsAvailability config osConfig;
standalone = osConfig == null;
in
{
config = lib.mkIf cfg.enable {
secrets.files.opencode = [ "api-key" ];
secrets.templates."opencode/auth.json" = {
path = ".local/share/opencode/auth.json";
content = ''
{
"zai-coding-plan": {
"type": "api",
"key": "${config.sops.placeholder."opencode/api-key"}"
}
}
'';
};
home.packages = [ pkgs.opencode ];
home.file.".config/opencode/opencode.json".text = builtins.toJSON {
"$schema" = "https://opencode.ai/config.json";
permission = {
external_directory = {
"/run/secrets/" = "deny";
"~/.config/sops/age/keys.txt" = "deny";
"~/.ssh/id_rsa" = "deny";
"~/.ssh/id_ed25519" = "deny";
"~/.ssh/id_ecdsa" = "deny";
"~/.ssh/id_dsa" = "deny";
"/etc/ssh/ssh_host_rsa_key" = "deny";
"/etc/ssh/ssh_host_ed25519_key" = "deny";
"/etc/ssh/ssh_host_ecdsa_key" = "deny";
"/etc/ssh/ssh_host_dsa_key" = "deny";
config = lib.mkIf config.ai-tools.opencode.enable (
lib.optionalAttrs standalone {
sops = {
secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
opencode = [ "api-key" ];
};
command = {
sops = "deny";
templates."opencode/auth.json" = {
path = "${config.home.homeDirectory}/.local/share/opencode/auth.json";
content = builtins.toJSON {
zai-coding-plan = {
type = "api";
key = config.sops.placeholder."opencode/api-key";
};
};
};
};
plugin = [ "@mohak34/opencode-notifier@latest" ];
};
};
}
// {
warnings =
lib.optional (!sops.available)
"opencode is enabled, but sops templates are not available. the opencode API key will not be configured.";
home.packages = [ pkgs.opencode ];
home.file.".config/opencode/opencode.json".text = builtins.toJSON {
"$schema" = "https://opencode.ai/config.json";
permission = {
external_directory = {
"/run/secrets/" = "deny";
"~/.config/sops/age/keys.txt" = "deny";
"~/.ssh/id_rsa" = "deny";
"~/.ssh/id_ed25519" = "deny";
"~/.ssh/id_ecdsa" = "deny";
"~/.ssh/id_dsa" = "deny";
"/etc/ssh/ssh_host_rsa_key" = "deny";
"/etc/ssh/ssh_host_ed25519_key" = "deny";
"/etc/ssh/ssh_host_ecdsa_key" = "deny";
"/etc/ssh/ssh_host_dsa_key" = "deny";
};
command = {
sops = "deny";
};
};
plugin = [ "@mohak34/opencode-notifier@latest" ];
};
}
);
}
home/modules/taskwarrior/default.nix
+1 -2
View File
@@ -9,7 +9,6 @@
}:
let
cfg = config.taskwarrior;
sops = myUtils.sopsAvailability config osConfig;
standalone = osConfig == null;
@@ -62,7 +61,7 @@ in
{
options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
config = lib.mkIf cfg.enable (
config = lib.mkIf config.taskwarrior.enable (
lib.optionalAttrs standalone {
sops = {
secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {