harald/nixcfg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

refactor(opencode): extract serve service into shared NixOS module

Browse source 
New `metacfg.services.opencode` module under modules/nixos/services/opencode/
with options for port, user, homeDir, sopsFile, and extraPackages. User and
homeDir default off `metacfg.user`. Host configs for amd and sgx reduce to
enabling the module and pointing at their respective sops file.

Service PATH gains jq, yq-go, python3, gh, gnutar, gzip, unzip, wget,
diffutils, patch, file, tree, bun, uv, ast-grep, claude-code, and tmux for
agent ergonomics.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Harald Hoyer 2026-05-05 13:42:52 +02:00
parent dbbb150bcc
commit 3a1cb7487a
3 changed files with 119 additions and 116 deletions
Download patch file Download diff file Expand all files Collapse all files

60
systems/x86_64-linux/amd/opencode.nix
View file

@ -1,65 +1,9 @@
{
config,
pkgs,
lib,
...
}:
let
port = 4196;
user = "harald";
homeDir = "/home/harald";
in
{
systemd.services.opencode-serve = {
description = "OpenCode Web Server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
path = with pkgs; [
git
bash
coreutils
findutils
gnused
gnugrep
gawk
gnumake
nix
nodejs
ripgrep
fd
curl
which
];
environment = {
HOME = homeDir;
LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
};
serviceConfig = {
Type = "simple";
User = user;
Group = "users";
WorkingDirectory = homeDir;
ExecStart = "${pkgs.opencode}/bin/opencode serve --hostname 127.0.0.1 --port ${toString port}";
Restart = "always";
RestartSec = 5;
EnvironmentFile = config.sops.secrets.opencode-web-password.path;
# Security hardening
PrivateTmp = true;
ProtectSystem = "strict";
ProtectHome = false;
NoNewPrivileges = true;
ReadWritePaths = [ homeDir ];
};
};
sops.secrets.opencode-web-password = {
metacfg.services.opencode = {
enable = true;
sopsFile = ../../../.secrets/amd/opencode-web.yaml;
owner = user;
restartUnits = [ "opencode-serve.service" ];
};
}

60
systems/x86_64-linux/sgx/opencode.nix
View file

@ -1,65 +1,9 @@
{
config,
pkgs,
lib,
...
}:
let
port = 4196;
user = "harald";
homeDir = "/home/harald";
in
{
systemd.services.opencode-serve = {
description = "OpenCode Web Server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
path = with pkgs; [
git
bash
coreutils
findutils
gnused
gnugrep
gawk
gnumake
nix
nodejs
ripgrep
fd
curl
which
];
environment = {
HOME = homeDir;
LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib";
};
serviceConfig = {
Type = "simple";
User = user;
Group = "users";
WorkingDirectory = homeDir;
ExecStart = "${pkgs.opencode}/bin/opencode serve --hostname 127.0.0.1 --port ${toString port}";
Restart = "always";
RestartSec = 5;
EnvironmentFile = config.sops.secrets.opencode-web-password.path;
# Security hardening
PrivateTmp = true;
ProtectSystem = "strict";
ProtectHome = false;
NoNewPrivileges = true;
ReadWritePaths = [ homeDir ];
};
};
sops.secrets.opencode-web-password = {
metacfg.services.opencode = {
enable = true;
sopsFile = ../../../.secrets/sgx/opencode-web.yaml;
owner = user;
restartUnits = [ "opencode-serve.service" ];
};
}