feat(opencode): add workstation API key secret

modules/ai-tools.nix

@@ -1,9 +1,12 @@
 {inputs, ...}: {
 	den.aspects.ai-tools.homeManager = {
+		lib,
 		pkgs,
 		inputs',
 		...
-	}: {
+	}: let
+		opencodeSecretPath = "/run/secrets/opencode-api-key";
+	in {
 		home.packages = [
 			inputs'.llm-agents.packages.claude-code
 			inputs'.llm-agents.packages.pi
@@ -11,6 +14,13 @@
 			pkgs.cog-cli
 		];
 
+		programs.nushell.extraEnv =
+			lib.mkAfter ''
+				if ("${opencodeSecretPath}" | path exists) {
+					$env.OPENCODE_API_KEY = (open --raw "${opencodeSecretPath}" | str trim)
+				}
+			'';
+
 		home.file = {
 			"AGENTS.md".source = ./_ai-tools/AGENTS.md;
 			".pi/agent/extensions/pi-elixir" = {

modules/hosts/chidi.nix

@@ -17,6 +17,13 @@
 					networking.hostName = "chidi";
 					networking.computerName = "chidi";
 
+					sops.secrets.opencode-api-key = {
+						sopsFile = ../../secrets/opencode-api-key;
+						format = "binary";
+						owner = "cschmatzler";
+						path = "/run/secrets/opencode-api-key";
+					};
+
 					environment.systemPackages = with pkgs; [
 						slack
 					];

modules/hosts/jason.nix

@@ -15,6 +15,13 @@
 				darwin = {...}: {
 					networking.hostName = "jason";
 					networking.computerName = "jason";
+
+					sops.secrets.opencode-api-key = {
+						sopsFile = ../../secrets/opencode-api-key;
+						format = "binary";
+						owner = "cschmatzler";
+						path = "/run/secrets/opencode-api-key";
+					};
 				};
 			})
 	];

modules/hosts/tahani.nix

@@ -37,6 +37,12 @@
 					networking.hostName = "tahani";
 
 					sops.secrets = {
+						opencode-api-key = {
+							sopsFile = ../../secrets/opencode-api-key;
+							format = "binary";
+							owner = "cschmatzler";
+							path = "/run/secrets/opencode-api-key";
+						};
 						tahani-paperless-password = {
 							sopsFile = ../../secrets/tahani-paperless-password;
 							format = "binary";