feat(opencode): add opencode configuration

secrets/secrets.yaml

@@ -8,6 +8,8 @@ elcafe:
         dynamic: ENC[AES256_GCM,data:BKsjTfqpZhrocHOUfxjCNS61DVb1oSdPW99IrwmNjpFcs68WvyfD0+QZ9F362L88CQDTnDSXWAbc7mcBtxhqfhkjtsdxkhtLHMGG0WxlnYungTnROh9EDJRLNyjy/RCYWOIVOXIEUE5lLwnQkboZLEiruw1Ri+r27WYmGpD5DaR4XWDankb6BQPJA6f2ziPyynjNYZaRhMIQUDFLM3QRAXPYD00eaYIQtx253z8Uocz4LpOw2JReAQkI2zc+6Oe1O4fP/Cg8klF0owR6NkNUWoIUVwLqFmU7Yr45VO+T/f96Ev0hlDaMklxYJGNOS8kRbSqpaiuMCmL2mQ6rsZGFVfdMdImSL2j51lrPFJCsg/hNGXHAxQ0/OpHtcZz/cwn5nSHBXg6gX21kOpkWGY1+BRA15X0k5sUqXkZWjkP9wkSCV6pQTbr8a3GrX2VvGwguAC4EpTCkCobXw/d9a7bMfZFeJqFhwjpU/dfBi6OjF7bniOQ7k3+5RZRDqAxJiPaBk7NKVN1FzUCvFBjKifbfICOJaPJr1CmayNuBZtsSlj0MXBYx8D8oShzhsCo/+pyni4poMYyfNC9jQKWCBsjKEa6eWb1+TfOHv4W+lSlBFg3vGm4NDxCPnACKWlhKB4WoJGRHqnp809XF2fqP4lZN8S7+sB2rhNlr2CICk9oM80FNmW/8TTtIgbpfEeFeJwNTM+S95cFSqaIRg3kfcqB/bHG37BYthcL1SC85/lxhL2LJ/O0qXxbioyxVAaBIumAO8BB1qrdbOozHZZAU1IIKylDWMWUoJMyMdhMGnOxxxWcbV2jPUXUv03DYNp3G/5F2Hlr+h0bPIJEFZ2kb14wTK+25MsgfBgky26f8qjNwROqKA+bPeB2yUKSSCJb//PzzE4xyqu1mq2/1zTal0eSRTCEnAUCj0wDqCLBMO6GnL0PS4PtGJ9n/IbOjFXZeixWGJzUTcmxPAmsClH6FV8brEMVs5bfrjLieXQvcn0b8b9/1W2jV4dJGUE1TxUQ2B92VG7PrA39O/FO8tQJZrAMXO9iMv495w0Nxbt0HYN6wsFTUwlQ+3DCXxgmmVBqVSf1OtHuhxcznl1oR+sgPSgBRLVB22mv5677ErQGCWp1luyPSF6xvhIaKe9BDwxBwJ+RsqSn4w5t1qJM9uYqFunSJPY5439B4zWG+lUy1ZDNn1oHUaX3hZUhzc9tEm+0CWFNXxH2hiRFb2nYP6Pv/GNqjZCsflY0YYty0UJBqRELGpUO3Sd+zbyJmWtvDjto726/0jHB/jb0RVThUem0PzWmmIUth0ucKp0M7zqEWNyVPbvWOK6rWQW9eaW87bFeMhrD1PC+U0ilq9DKG1J3ldc0lEBrguc4fk72T3I62pw5KdGnsmB+FjAc8kdTFKhM52ylChsAnJGFu0LyBUgjGIzZ03XkO8RbYs/wzc9VQOvyikvB67wImXMu8PJDzMxXnu58y7C4U86kvLdUfYm5bz+MxZmXsDA1L7C4si6oLf7rOCfLLc4A1a/X/aMSk330SARW/UAZ/NaFDXhotYXZUSbr41Z6b0qRPZjjZfOkdeKxTp+r07+8oJpPOaIaaOIlNRkGyRCnbCGvJ4CuUfTQuywIefBHlawGzhsDvOKorWYTuim7MbJcd19bYMG6k8qqTQlNeHjZJaDLKJ/rnSAIGDSNYRP4uUUo0gqSp82E9bXUUn5VuFSPcJ55uvFXZD0f6tLZGIyUuG5tqw3xNQF2cA+4ZXzbxi6VIZQ+ahZELkoBR+dVXQ0yGkDJusNf61A1lfI2bd7JQnJ7YVhbF1gXNnDXdWO0F8zsnZyhSSJY3ZoXLdYn+v39+AxQvE3mpX7zNsk7+0WUHuqAh6JG6OBt7jF5OVwD3bfuQfDhPlfD7YOU5/C+rekDGXmfZOMXxadvQgWFcpHdgbV7NwKqdgj6pJDVoGO8/4HGtlb94/o6dtXzfheSLUhCUZ2Im81yduu8386fCYLHX/ZsP+CuuC2wlXQaSCgoODRXXDz7jsRcQNfW2ohmFT9iDn95NI5ylCgt49t2Cr06ft7Pd0tWjh69VQ8TjNlfqm3Sxlf/Gb9ihwOOytmbDv4bNKhpRIPC0jIZv3aaA7vgdLCbySVeMo1tfMx3Xvf6q8XqlsQ/HgwBxAMmjakIAukNwtU74oJ2AYpIO/Oc47081JR2sVtGWer6l7C8KMy9O0xYtABsofkc9kHQWtAvn82sSQTuI/UgD5ttfdfVZZaanHek3vgJyTYI3sPQDVJ6SXrC0a+fqMlTL7Jux/0B70gK1z46j5C54IBCChNa4CwXhvxofyoDgyF6DVC2qZxoKXGl1veQKJh68q9hCiDlYEpiwuRCs3j6uSUG4Rssc9TKfdY3AQltVrhykEORVEgZe1HWmlms=,iv:3G3geSZRziwGiKcUMVNZ7j5s/4YA6Uk7wCSb4aFNSMo=,tag:FxARskR9+wdV7/xCKP8UdA==,type:str]
 marpa:
     nix-cache-priv-key: ENC[AES256_GCM,data:H5VsN0nOogvgxWHXHF66BbzJe17zelZCG6mU4vmVJqBoi7a5cQxzU7WnV4k1EOpMJPDj6floVmrsG4DM86FthxcTwixCNDINmaemwAXQnUkgWXFKYY7Ovzten81UVKrtkN4n1S8=,iv:pxnHD5YqyTeNZnxyEJeXAUixZEz8Uq9b2HFZZBsMOzk=,tag:xI+4tFG+Q4Z5IVxlATayJA==,type:str]
+opencode:
+    cors: ENC[AES256_GCM,data:ubvZLYOSbwUSlpyO+1R1BvgxI17gBTNmN3dK9as=,iv:vPEZPvrber41NdOFB299fpIH7o2IFsSdA5EhIdw4CNk=,tag:KufSrvozf0ov7VBpMz/Bfg==,type:str]
 extraHosts: ENC[AES256_GCM,data:4lp7w0snYle7vGVLJq3zlTxoC8eVpaSreW3P8Aq+O6oRJoWo3IASpwi7zSx6nxmLo5LGPeupVXfy3xOkG9d5QFNU2uU6vXKvOnnm6wrpS+UcYp/4U/z+R3rFnFsI5PsCgmlL1bSUFCFkXlrLDIyoW50Q/DLXDS8QaUYAtto1DcRUXc9j8RnunYF38HFlAOD/Xa4DY048pvZu8TMsmLQjM5txZnZBq4+P8aBjY3SF+K9cqZ+SgQkU+gdGo0/S/N5OUZJ3ATJ6mglPl/Nplw/Dh9HvC7jEMJZKrVzWiYquTOn0/IytqOCS2SkhsmVMRqf06hpvhlz6sFXzkDfxKMIRTULEkjZDkZ7QioSbLeqmQePSg7xs28SvToiVKSpg0PxeH5LvJE73hgX3ATUXA2BmRvqQuqBwLaDU6TPm8xkYe7qbabaN5oFtXCI/XydZTao5Glqw/BZQRTise/qGgn3Bfl/ieMYQOqCMEdHzR0Beipur6spliGFC4YnwL3Nh4CO6qOB/j61a7rqY6nLyo54jWtjvHX42pTuGWhvhGH1z4NRZqcKks+KCMB4PcCXgul1hrb04wLXYVu7R/7QqOACp4SZBUFZCj+izcsnB1sKdKliL87VBUkwOSF+1JUCY,iv:5A3jCWLkooCkuOMiybbeQ9+TRA7CoiW3qbzmJLVarSc=,tag:qLsGhrFHs65Vesj4Ot4I/g==,type:str]
 mopidy:
     spotify: ENC[AES256_GCM,data:6i9BzQmlndnROuT1H2zgN/3I6hBiFf14BlcS+XL2PbTiiEQZe2yE3tnZo3KXU9S5CjS3MwxsVdytKOFMQt2s1bVjcibBhJzoKEQByaapdzn1mK3kQLdJfhPf4Hf9YZV9Dlc60ngS7ESLZakdFVlj4rlbV5XReLhK,iv:fYd78r4U0kTyq1TZjBVXkjdNiOQ29gLJ53kwTXsi8W0=,tag:oWaeOuzdHWS4joZAdeA2pg==,type:str]
@@ -17,8 +19,7 @@ ssh:
     hosts: ENC[AES256_GCM,data:WTgCxNIyKTwFxDVlWkJcxrvUjYuVionDQSWgSqSc0SZ5mGbl228mv7Z6mXvwbN78+jIwTuuUtfmTsDoaUaSqyIReaXFsrIHAoCGoSMbJ10RiAbyDfCEH9vbHamAX22Ccfnyh7eUOb3AsAQo/pJs/95bdCpKEPy4SXcpB0tc+KpgrEijVLpRJFyB6UGl+2qg/hVfo8no5l4tZMUBxzS5KEU7pEEcA/SLfdVMM/4+aeVmJudxJPi3RsqnA8qORVpvJC0y/ln71OrFdRVrX4e47NEXzX2Hfr+hiFbW190xBp6a/kZypQl4vk4fzn8RUathQMOVmf1r4v7eJOYRWeGeZinZtQNe7SFWtiYc0pTbQ6GNyOMwzk3bMjlyzhlrTe1MqFqVbAHSsKk6ydpcjtXt4DgQ93IL4BU6emJu7HBFBOuQ9QWEvDubhB/0Y68BWUqGqY/2lPdllGJrXL87h5KJrLHSMyUX4mF9Je84aC0cv1N3d78kepo2wCz7jrfsxixT+qN7ufu/TurLloC6y2skOCmB+gcRo79Jzk4LRi+Zf+RWnWiXw5HsZWwO7so5JIDlgApkERif6vwup12jhdu+ZxcqFfjMt1wEFceS8YGNvUl0XWPgvmM9kdqn/4XXOYCnysbpcfZaBMGDOBUlbhLUybHdDzvGYV/kMU5m8xoXAjA==,iv:Gf2f71TluSEQtiHf7CIHE2tFX8N4Y17AjP1PnNuWuNA=,tag:sGmZR1lKbbOeEhPvrHHO8Q==,type:str]
 sops:
     age:
-        - recipient: age1ajemtm502nn2n4q7v4j8meyd5mxtcqngkkedxq2pqzuwu78zp93qnw8q48
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2S3VaTmg3b2QxMGtVeStr
             WWRpb0RhVFNWM3RJNEV4ZTdRVmJUa2d6YVZrCnFTOWwwTlNhc2hqM2pwZ1hkcWd1
@@ -26,8 +27,8 @@ sops:
             blMrcWVSVFB3TVc0aTQ0RUYvbDFJS0kKmGisf9VDK2RPA1uQCK5udt7sdeDyh344
             IKhPHzEHAHjKEkE6sWc6TB/l8K3IfL9zdHQZ9ZqTvCiS8CBZOwPQeg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age197lfdanym647wdaz9uy8hrfqjwj9fs8rm7vs3fsrctceu8mr9gms2jedhz
-          enc: |
+          recipient: age1ajemtm502nn2n4q7v4j8meyd5mxtcqngkkedxq2pqzuwu78zp93qnw8q48
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTRzRqTzlzVWpGMVFEbjV5
             R1RXS1RBMzZGaGZjUkFZc3RLb2JkSzlRQlJZCnp5c0pMOHBZUkhralArcUhLSmx5
@@ -35,8 +36,8 @@ sops:
             eHRMV2o0TXhoVkcyaXZqU0tsR0o2eDQKdYwEuPeQ1fntKQKIlOlxet+SJ0rT5I1y
             WDpfGZUVvghx5dwdd6EMq3sQUeoFSfjrlgIAwNtHRwMC19A68ubzhQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age17pn6suvz2f7zmrm9zxj5hr0putvcvdamqxqt7ewhncgg6ccgmp2qr00xm2
-          enc: |
+          recipient: age197lfdanym647wdaz9uy8hrfqjwj9fs8rm7vs3fsrctceu8mr9gms2jedhz
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxUEtOZ3Zac01HTjVZVXNF
             endFNVprclpJMmh1eTA2ZmVJRTJlbjI3dEVNCjA4K2U5QWlOdkI0R3JwbVpNRWJG
@@ -44,8 +45,8 @@ sops:
             YURQR2kxdExKR00vYVJMVVQxekdVOE0KDkPOMeCo1MoM5R89t1rsMWR/bGIx592Z
             wvbVmE/El4Z0QzuvXl0XK3CFlKGuwgNw5TvtQ9QZP1aAL3yN0+T5oQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1cnnpnglkvgw5ffv8qpgwpqvj203lh4uwt698y9mxjwklxt8nysmsa8hepn
-          enc: |
+          recipient: age17pn6suvz2f7zmrm9zxj5hr0putvcvdamqxqt7ewhncgg6ccgmp2qr00xm2
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQQTV1dkxMK3dxbGhiTGJG
             bkVQTUFOU1I4SXAyV21PdThSZFNOTTA0cmpFCkpXcmRXdlE0eVRYWWErQUxSWFN4
@@ -53,8 +54,8 @@ sops:
             M25EQU5zckVMa1VSK29iYW5PbHRJcVEK6+gstHbcPBdeRNvZa21nZB5sT1SdHWHs
             8St5tYl5I3CxNWFgFjOrHqteRKc+ZTcj3euAJ6Wathbw0YMiA3gz0Q==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1g68hxv73llkyc7etzh499ztcrt93pwawy0n8p93px4taqu58mehsp88vjq
-          enc: |
+          recipient: age1cnnpnglkvgw5ffv8qpgwpqvj203lh4uwt698y9mxjwklxt8nysmsa8hepn
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYRGYyUGhlL2NJelZTQ1g0
             UEhJMFlkVmdlU1E2cGE2UHF2dytVYmhQMlIwCmdrOEZjUUFrQjMzK2FxVjF0NGY1
@@ -62,8 +63,8 @@ sops:
             cUFid1RwRXA4cExWd3poK2hEaVd5Q00KjjiEiQw2OxcGv/qDudLmbM6aysYhLTxi
             Qjmh133pyznFs+pLVLdYnId42zvojAeuJD9cJYxuwwgPA2ZlKdSVrg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1awytvphvty4f9wmdn86xnjg9kgetqjx8qlwj5d2882t4fyyzy58s3vg5k4
-          enc: |
+          recipient: age1g68hxv73llkyc7etzh499ztcrt93pwawy0n8p93px4taqu58mehsp88vjq
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRbUs1Qm1hUnJldDNZNUR0
             N3d0YXp5NWtjV0xvc1ZrM3ArZllIbmJtRXpnCnp2TVRyQVFqNC9kWXpBa0NnbW9X
@@ -71,8 +72,8 @@ sops:
             bkdsaXNINEZpZjdMdHAwdElpWFQ0aW8K0guO/BF8hp1LDToVBFY5JKdz8WXOwK2P
             prGKdxPsTAfW8xTq97LHHRsLC7+4TVXnjF4LS4SM8EXIX9KCl5FIGA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1erkn7dd022e90ktyj66aux9j9xvl0uzd6ru5cmrjsvcm5rtr5pfs7q6k9h
-          enc: |
+          recipient: age1awytvphvty4f9wmdn86xnjg9kgetqjx8qlwj5d2882t4fyyzy58s3vg5k4
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4ZEVtVzM0dFhJYWd5UXZO
             ajIzSFp1VENuSjlaYSs4ZUdBSS90aEoyM25JCnhrd0lyUVN0dEV5a2tQUjZwSlFx
@@ -80,8 +81,8 @@ sops:
             NU1vREt6SXBWYU1xdW1JSm1uUGZQRVEKtaDeDNo817rXXoMkBHo0MZWtm4LayqwC
             NN8vbhGcgT+M+ehnmZ1HdPk8VWRvlQ+SMpG+a6DjK8BjYtAWcO16RQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age16crkeglm3j3f6rveylytuerptjf9mwtv3hl89ywkmnnvdkntfchsuvrsk5
-          enc: |
+          recipient: age1erkn7dd022e90ktyj66aux9j9xvl0uzd6ru5cmrjsvcm5rtr5pfs7q6k9h
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6eUFYSC82YVM1WVEwc2Fz
             aEl3TG5oOFU5MUFhQ0JhbC9yRVYxOFo0bUVJCnpwQzMyZmN4ZTlNVW5pZTY5bkdY
@@ -89,8 +90,8 @@ sops:
             ZW1hTUFtVE15QzVIVU93ZExlUWZjYzAKUZj+/NtMHCPjFFqbJ/8b2ASljV6GEk6p
             FbqV9LezRZrfl9GXBVUpB4Oeb9v2yp151aSda07/AG5YO0/jRAV/Bg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1tkywsvddjj6r6ukuqgz9aql92jfx85rz57dhmkkndysh6yx6p5rs0zj0qr
-          enc: |
+          recipient: age16crkeglm3j3f6rveylytuerptjf9mwtv3hl89ywkmnnvdkntfchsuvrsk5
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxdjFYN01HcXZMNVBJckVm
             eklKZHAxeWgvVlcwWk9yWUJpcFFBUnpUV0FZCi85dGE2L3d3OS9CdW5sL0pZTTM2
@@ -98,8 +99,8 @@ sops:
             bk04K1luNnJVTjZQY25KRXNSVG0venMK7uM4tqqmq/o4QgMlE/x/FXkQsPRkofNO
             I6C93RYgp1OcGPH14Kmp5lXtK4/pdToaRnVXPGenDQJsFhwWCEI+Fg==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age17p69ktg7yfzgdsk00f32mupe4n4fevdpw2wsv7ft30yvpeseau6s7t0zdg
-          enc: |
+          recipient: age1tkywsvddjj6r6ukuqgz9aql92jfx85rz57dhmkkndysh6yx6p5rs0zj0qr
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOTFXaHE0SDRCTnE4di9N
             S2JIbHF2a1pzNzU4UFIvQmpZMVpOUjJqd0RJClVxcTd3d05aRDN1RGVmWVpQS2lI
@@ -107,7 +108,8 @@ sops:
             dUpXZis2N2VyN0ZFbjlPRXdwRFQ1aHMKm1Mk6MPKxFmwdATCYUANRSY5rHKgmQer
             LBlqqWKt1JiIUAYtazQeQ6KYxmjVlQPY7AZw2t+EhBEPrqbTL3vOiw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-01T13:20:34Z"
-    mac: ENC[AES256_GCM,data:OueL0eHYmFKWfSyCZxburRJ2FS1xkowx7ha/Zv7r++26D85GSHDeIL9HdfByI5a1OhH90rH3WLxZrJgT3FiwBw27HhhHtS7Fs6MBFvTuPmSA7ZtMeGMWBRVjwbGAWN17BZAhJzMlZHq2nPX0xXIKT0HuTLVRPLuVCSlvDzMXsTE=,iv:+JN4Vzs8o8PJAam/uKBbUXt3ArxC88D6xR7rMeeGglg=,tag:S+OtbxLhVKFnqBZtyKDGyA==,type:str]
+          recipient: age17p69ktg7yfzgdsk00f32mupe4n4fevdpw2wsv7ft30yvpeseau6s7t0zdg
+    lastmodified: "2026-06-07T11:56:26Z"
+    mac: ENC[AES256_GCM,data:kQv2go+ITBpkicwlcy5OIFdU7DrSZCqGFKqmdHJN0hGYzGrabgiomBI7r2bqQPrzlvXNL/GSp9yv2cBO3nlgLdRakXB2ubZ+xGDkarErxuT4B1wG3ps8DaZzdG+Ed9aiHhhM3Fo5tzjF8CAFUAbIy+K45691lP/aXns2slQWVg8=,iv:PZBL1RQ4243vwlbrhRtAG7wt5i1TomQZ4mFy7bjjKRU=,tag:62St2XZxDh0kGd2OupnFPA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.0

users/modules/dev/ai/default.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  inputs,
   ...
 }:
 with lib; let
@@ -12,6 +11,7 @@ in {
   imports = [
     ./claude.nix
     ./ollama.nix
+    ./opencode.nix
   ];
 
   options.home.dev.ai = {
@@ -29,8 +29,9 @@ in {
           mcpServers = mkDefault cfg.mcpServers;
         };
         ollama.enable = mkDefault cfg.enable;
+        opencode.enable = mkDefault cfg.enable;
       };
-      packages = [pkgs.lmstudio pkgs.opencode];
+      packages = [pkgs.lmstudio];
     };
     programs.mcp = mkIf (cfg.mcpServers != {}) {
       enable = true;

users/modules/dev/ai/opencode.nix

@@ -0,0 +1,85 @@
+{
+  config,
+  lib,
+  inputs,
+  pkgs,
+  ...
+}:
+with lib; let
+  inherit (pkgs.stdenv.hostPlatform) system;
+  cfg = config.home.dev.ai.opencode;
+  defaultPackageCli = inputs.opencode.packages.${system}.opencode;
+  defaultPackageDesktop = inputs.opencode.packages.${system}.desktop;
+  corsList = domains: lists.remove "" (lists.forEach (strings.splitString "," domains) trim);
+in {
+  options.home.dev.ai.opencode = {
+    enable = mkEnableOption "Enables OpenCode";
+    package = mkOption {
+      type = types.package;
+      default = defaultPackageCli;
+      description = "The CLI package for OpenCode";
+    };
+    settings = mkOption {
+      type = types.json;
+      default = {};
+    };
+    tui = mkOption {
+      type = types.json;
+      default = {};
+    };
+    desktop = {
+      enable = mkEnableOption "Enables the desktop app";
+      package = mkOption {
+        type = types.package;
+        default = defaultPackageDesktop;
+        description = "The desktop package for OpenCode";
+      };
+    };
+    web = {
+      enable = mkEnableOption "Enables OpenCode web";
+      extraArgs = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [
+          "--hostname"
+          "0.0.0.0"
+        ];
+      };
+      cors = mkOption {
+        type = types.nullOr (types.either types.str types.path);
+        default = null;
+        example = "opencode.example.com,code.example.com";
+        description = ''
+          Either a string containing the domain allowed to connect to OpenCode’s web instance, or a file containing the target value. The latter is useful when using secret management if you don’t want to publicize the hostname of your OpenCode instance.
+
+          If you want to use multiple domains, you can separate them with a comma.
+        '';
+      };
+      mdns = {
+        enable = mkEnableOption "Enables mDNS with OpenCode";
+        hostname = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          example = "opencode.local";
+        };
+      };
+    };
+  };
+  config.programs.opencode = mkIf cfg.enable {
+    inherit (cfg) enable tui;
+    enableMcpIntegration = true;
+    extraPackages = with pkgs; [uv];
+    settings =
+      {
+        server = mkIf cfg.web.mdns.enable {
+          mdns = true;
+          mdnsDomain = mkIf (cfg.web.mdns.hostname != null) cfg.web.mdns.hostname;
+          cors = corsList cfg.web.cors;
+        };
+      }
+      // cfg.settings;
+    web = {
+      inherit (cfg.web) enable extraArgs;
+    };
+  };
+}

users/phundrak/ai.nix

@@ -0,0 +1,54 @@
+{config, ...}: {
+  home.dev.ai = {
+    enable = true;
+    opencode = {
+      tui = {
+        mouse = true;
+        theme = "nord";
+        attention = {
+          enabled = true;
+          notifications = true;
+        };
+        keybinds = {
+          leader = "ctrl+x";
+          "command_list" = "<leader><leader>";
+        };
+      };
+      settings = {
+        autoupdate = false;
+        provider = {
+          ollama = {
+            npm = "@ai-sdk/openai-compatible";
+            name = "Ollama (marpa)";
+            options.baseURL = "http://marpa:11434/v1";
+          };
+          models = {
+            "qwen3.5:9b".name = "Qwen 3.5 Medium";
+            "gemma4:e4b".name = "Gemma E4B";
+            "qwen2.5-coder:1.5b-base".name = "Qwen 2.5 Coder Light";
+          };
+        };
+        permission = {
+          "*" = "ask";
+          glob = "allow";
+          grep = "allow";
+          read = {
+            "*" = "allow";
+            "*.env" = "deny";
+            "*.env.*" = "deny";
+            "*.env.example" = "allow";
+          };
+        };
+        formatter.nixfmt = {
+          command = ["nix" "fmt" "$FILE"];
+          extensions = [".nix"];
+        };
+      };
+      web = {
+        enable = true;
+        cors = config.sops.secrets."opencode/cors".path;
+        mdns.enable = true;
+      };
+    };
+  };
+}

users/phundrak/home.nix

@@ -5,6 +5,7 @@
   ...
 }: {
   imports = [
+    ./ai.nix
     ./light-home.nix
     ./packages.nix
     ./email.nix
@@ -56,6 +57,7 @@
       emailPassword = {};
       "mopidy/bandcamp" = {};
       "mopidy/spotify" = {};
+      "opencode/cors" = {};
     };
 
     home = {
@@ -86,7 +88,6 @@
         };
       };
       dev = {
-        ai.claude.enable = true;
         editors.emacs.package = emacsPackage;
         vcs.jj.signing.enable = true;
       };