feat(amd): add opencode web server at opencode.amd.hoyer.world

Mirror of the sgx opencode setup: systemd service on port 4196 fronted
by nginx with a per-host ACME cert (DNS-01 via internetbs). Adds amd
key + path rule to .sops.yaml so secrets under .secrets/amd/ encrypt
for the host.

.secrets/amd/internetbs.yaml

@@ -0,0 +1,34 @@
+internetbs: ENC[AES256_GCM,data:HTTxPwcGWFo/WkWD6UZhE6qUaBmJSVFzDux3EFn2uH1mCPoW0vKykfUbbMCJo0tWMvQszetAuO5jnQJJBrIkM6vaXX06ZlDUWluh+sPavqKFeq9HDobgf9qhhaaSHgrD/hLgz+dJ+Lj87/huEMhWj8KrnPY1Hj5uDUFVaJOMgNzczSt6iLA/mdL/cEiBT5st8qk8,iv:Ug59B4G7p0zVEAuMQlEYk+GcOjy/QOxEvxbdLnRTgpA=,tag:Z/7ceoVgr3ciNFKSlncjpA==,type:str]
+sops:
+    age:
+        - recipient: age1u2glh4g65qjvlcan7u7qmhdlpvxqkc2h48m5zka8nafjrfnt5e3ss494vt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzV08vMTJrazQyRjNVaHRR
+            KzRJcFBlRWJjanhCRk16Q25DcExzUHl0Y2tNCjlzS2dnbWUwWERORWtZOFB3R0ZT
+            VEZvUjZpVVVOWkVSZHdUaWdaMHAxaW8KLS0tIFF5VThaU0lyWkh2MXVpTGtlOWwz
+            K2h0dXVFRWJ3NXkrNmw5TkpKZFJUbUUKxRBQN7jewc0knpSa4wKtcbfP3kUbWBoC
+            a0zUUXb+Ooa76Sg0tK+gz5BDUqcxcPNbwhUwWaMz4FlRHMtMkQGoaQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1dwcz3fmp29ju4svy0t0wz4ylhpwlqa8xpw4l7t4gmgqr0ev37qrsfn840l
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNnJaaUh4UDgxVzFIK1dD
+            RUFjKzVOTDU1TUhqZEN5SW9NcXFSTHlkNkNNCnprMXY5cDI3TC9PakZyNkY5NG00
+            SGhXbkJxQ2FUOUthcjNzMmQxVVg1WmcKLS0tIG16ZjFWSW5tQUw5SXV5WTgvVkt5
+            WFlyeTRBS3p4N0pVOW11NXh5M1RkZ3cKDR9dB36DavUmChJUriFOTCWN7+M9xwoK
+            2dRb1O4N0qouYpAxef8vwL7VQUXOF0pqb+F7KF87EqRtir+SmbqCfg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1cpm9xhgue7sjvq7zyeeaxwr96c93sfzxxxj76sxsq7s7kgnygvcq5jxren
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYT1FYNEJmSFhOaEtRZ3ZH
+            TWtxeVd2cVVqeURLTEk2d2tOWUFCNnRMS3gwCis1QUIzOHpLQW5tUzI0Nzk4N0VQ
+            N3lIZkVYWDU5VlAvWXNFR2w4ZTNFTTAKLS0tIFNsdG5jcHNtWjYzVHgwcjBSOTYr
+            RGZ3aTdwUi83blNCbjQwR1phd2UzdVkKpxSOiGK1cyRKdzd+d7jiTxYGwkpgB6OO
+            6TyY896Eht2iL34w7jXyH+eKJ8fzQrftpyARHy54r7LDS3TBhEFVxA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-06T08:50:35Z"
+    mac: ENC[AES256_GCM,data:Tz1EutxDgl2DQgNWNJWap5cwSAgR/Y4EjLUva7qHtXIMWa5jKPKqimY2IQhcsbqYv1zZmm+OnbO+OCIdZRbpnDCk5waBhywQNxNxjGAbv9fo/hbRFg9cm/vwA2BrXk9BR1L+gMcejRyZnnlMwEK+NomBkqAkpDZDlKjE7ebHoz0=,iv:Lk9kE3opD9y4oheETzLOiPn6Z5dLx8JEAuyCaYbkpQ4=,tag:/KtGrq7sGUxfi7BaJObhOQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1