fix: deny opencode access to nix secret paths

2026-03-11 21:25:32 +01:00
parent 58d4bc6f13
commit 72876ca9f7
1 changed files with 9 additions and 0 deletions
@@ -74,6 +74,15 @@ in
      home.packages = with pkgs; [
        opencode
      ];
+      home.file.".config/opencode/opencode.json".text = builtins.toJSON {
+        "$schema" = "https://opencode.ai/config.json";
+        permission = {
+          external_directory = {
+            "/run/secrets/" = "deny";
+            "~/.config/sops/age/keys.txt" = "deny";
+          };
+        };
+      };
    })
  ];
 }