feat(opencode): migrate HM to dedicated server setup

home/gabriel/features/opencode/default.nix

@@ -1,19 +1,12 @@
-{
-  config,
-  osConfig,
-  ...
-}: {
+{config, nixosConfig, lib, ...}: {
   xdg.desktopEntries.opencode = {
     name = "Opencode";
     genericName = "AI CLI Assistant";
     comment = "Terminal-based AI coding assistant";
-    exec = "opencode";
+    exec = "opencode" + (lib.optionalString nixosConfig.services.opencode.enable " attach localhost:${toString nixosConfig.services.opencode.port}") + " -c";
     icon = "terminal";
     terminal = true;
-    categories = [
-      "Development"
-      "ConsoleOnly"
-    ];
+    categories = ["Development" "ConsoleOnly"];
     mimeType = ["x-scheme-handler/opencode"];
     type = "Application";
   };
@@ -24,33 +17,8 @@
     enable = true;
     tui = {
       theme = "nix";
-      keybinds = {
-        editor_open = "alt+e";
-      };
+      keybinds = {editor_open = "alt+e";};
     };
     themes.nix.theme = import ./theme.nix {inherit (config) colorscheme;};
-    settings = {
-      autoupdate = false;
-      provider.deepseek.options.apiKey = "{file:${osConfig.sops.secrets.deepseek-apikey.path}}";
-      provider.openai.options.apiKey = "{file:${osConfig.sops.secrets.openai-free-apikey.path}}";
-
-      model = "deepseek/deepseek-v4-flash";
-      instructions = [osConfig.sops.secrets.gabs-info.path];
-    };
-    context = ./context.md; # Main context
-    agents = ./agents;
-    skills = {
-      jujutsu = ./skills/jujutsu; # From https://github.com/mtaran/jj-guide
-      gabs-tools = ./skills/gabs-tools;
-      edit-skills = ./skills/edit-skills;
-      nix-shell = ./skills/nix-shell;
-      screenshot = ./skills/screenshot;
-      firefly = ./skills/firefly;
-      lumis = ./skills/lumis;
-      browser = ./skills/browser;
-    };
   };
-
-  xdg.configFile."opencode/skills/firefly/resources/private.md".source = "${config.lib.file.mkOutOfStoreSymlink osConfig.sops.secrets.skill-firefly-private.path}";
-  xdg.configFile."opencode/skills/lumis/resources/private.md".source = "${config.lib.file.mkOutOfStoreSymlink osConfig.sops.secrets.skill-lumis-private.path}";
 }

hosts/common/optional/opencode/default.nix

@@ -2,6 +2,65 @@
   services.opencode = {
     enable = true;
     hostname = "0.0.0.0";
+    settings = {
+      autoupdate = false;
+      model = "deepseek/deepseek-v4-flash";
+      provider.deepseek.options.apiKey = "{file:${config.sops.secrets.deepseek-apikey.path}}";
+      provider.openai.options.apiKey = "{file:${config.sops.secrets.openai-free-apikey.path}}";
+      instructions = [config.sops.secrets.gabs-info.path];
+      shell = lib.getExe pkgs.bash;
+    };
+    context = ./context.md;
+    agents = {
+      image-analyzer = ./agents/image-analyzer.md;
+      pdf-reader = ./agents/pdf-reader.md;
+      whisper-transcriber = ./agents/whisper-transcriber.md;
+    };
+    skills = {
+      jujutsu = ./skills/jujutsu;
+      gabs-tools = ./skills/gabs-tools;
+      edit-skills = ./skills/edit-skills;
+      nix-shell = ./skills/nix-shell;
+      screenshot = ./skills/screenshot;
+      firefly = ./skills/firefly;
+      lumis = ./skills/lumis;
+      browser = ./skills/browser;
+    };
+    extraFiles = {
+      "skills/firefly/resources/private.md" = config.sops.secrets.skill-firefly-private.path;
+      "skills/lumis/resources/private.md" = config.sops.secrets.skill-lumis-private.path;
+    };
+  };
+
+  sops.secrets = {
+    deepseek-apikey = {
+      sopsFile = ../../secrets.yaml;
+      owner = "opencode";
+    };
+    openai-free-apikey = {
+      sopsFile = ../../secrets.yaml;
+      owner = "opencode";
+    };
+    gabs-info = {
+      sopsFile = ../../../../home/gabriel/features/opencode/private.yaml;
+      owner = "opencode";
+    };
+    skill-lumis-private = {
+      sopsFile = ../../../../home/gabriel/features/opencode/private.yaml;
+      owner = "opencode";
+    };
+    skill-firefly-private = {
+      sopsFile = ../../../../home/gabriel/features/opencode/private.yaml;
+      owner = "opencode";
+    };
+    firefly-pat = {
+      sopsFile = ../../secrets.yaml;
+      owner = "opencode";
+    };
+    pluggy-secret = {
+      sopsFile = ../../secrets.yaml;
+      owner = "opencode";
+    };
   };
 
   networking.firewall.interfaces."tailscale0".allowedTCPPorts = [

hosts/common/users/gabriel/default.nix

@@ -38,38 +38,6 @@ in {
       sopsFile = ../../secrets.yaml;
       neededForUsers = true;
     };
-
-    # Opencode secrets
-    firefly-pat = {
-      sopsFile = ../../secrets.yaml;
-      owner = "gabriel";
-    };
-    deepseek-apikey = {
-      sopsFile = ../../secrets.yaml;
-      owner = "gabriel";
-    };
-    openai-free-apikey = {
-      sopsFile = ../../secrets.yaml;
-      owner = "gabriel";
-    };
-    pluggy-secret = {
-      sopsFile = ../../secrets.yaml;
-      owner = "gabriel";
-    };
-
-    # Private opencode skills
-    gabs-info = {
-      sopsFile = ../../../../home/gabriel/features/opencode/private.yaml;
-      owner = "gabriel";
-    };
-    skill-lumis-private = {
-      sopsFile = ../../../../home/gabriel/features/opencode/private.yaml;
-      owner = "gabriel";
-    };
-    skill-firefly-private = {
-      sopsFile = ../../../../home/gabriel/features/opencode/private.yaml;
-      owner = "gabriel";
-    };
   };
 
   home-manager.users.gabriel = import ../../../../home/gabriel/${config.networking.hostName}.nix;