From 5d50c64133b820bd9e7392bd65326af1c4038ea1 Mon Sep 17 00:00:00 2001
From: Alex <git@ajaxbits.com>
Date: Sun, 6 Sep 2026 18:38:57 -0500
Subject: [PATCH] feat: configure encrypted OpenCode credentials

---
 components/website-editor/vm.nix      | 17 +++++++++++++++++
 secrets/grace-editor/opencode.env.age | 11 +++++++++++
 secrets/secrets.nix                   |  3 +++
 3 files changed, 31 insertions(+)
 create mode 100644 secrets/grace-editor/opencode.env.age

diff --git a/components/website-editor/vm.nix b/components/website-editor/vm.nix
index 505bf0a..b5120e8 100644
--- a/components/website-editor/vm.nix
+++ b/components/website-editor/vm.nix
@@ -1,11 +1,18 @@
 { config, lib, inputs, pkgs, ... }:
 let
   cfg = config.components.website-editor;
+  hostConfig = config;
   hostName = "grace-editor";
   repo = "https://github.com/ajaxbits/gracebobber.git";
 in
 {
   config = lib.mkIf cfg.enable {
+    age.secrets."grace-editor/opencode.env" = {
+      file = ../../secrets/grace-editor/opencode.env.age;
+      path = "/run/grace-editor-secrets/opencode.env";
+      mode = "0400";
+    };
+
     # Intentionally no autostart: run `systemctl start microvm@grace-editor`
     # when the editing environment is wanted.
     microvm.vms.${hostName} = {
@@ -89,6 +96,15 @@ in
             }
           ];
           writableStoreOverlay = "/nix/.rw-store";
+          # This is the only host secret made visible to the guest. It is a
+          # read-only directory, rather than the host-wide agenix directory.
+          shares = [ {
+            source = "/run/grace-editor-secrets";
+            mountPoint = "/run/grace-editor-secrets";
+            tag = "opencode-env";
+            proto = "virtiofs";
+            readOnly = true;
+          } ];
         };
 
         systemd.services.grace-editor-bootstrap = {
@@ -127,6 +143,7 @@ in
               "HOME=/home/agent"
               "GRACE_EDITOR_PREVIEW_URL=http://172.22.0.10:${toString cfg.previewPort}"
             ];
+            EnvironmentFile = hostConfig.age.secrets."grace-editor/opencode.env".path;
             ExecStart = "${inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.opencode2}/bin/opencode2 serve --hostname 0.0.0.0 --port ${toString cfg.editorPort}";
             Restart = "on-failure";
             RestartSec = 5;
diff --git a/secrets/grace-editor/opencode.env.age b/secrets/grace-editor/opencode.env.age
new file mode 100644
index 0000000..3dd88a1
--- /dev/null
+++ b/secrets/grace-editor/opencode.env.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 A9oJhw P9Dy/S/EMVZWkEOwyIiTaPher9OWim6GpV6EvxMRjwY
+QAO95PHil/7UfSlYrZjjdu4Kk8vy+brvOHd2J4bJu98
+-> ssh-ed25519 eJlTVQ TrjhqE5EWsFfheBG9vfA3caBiULF1QP7oUV0BnQhKB4
+shc1bLz1Ju1/U/O7Ag28/aZSc+/rktmwyXCd5jXkvC4
+-> ssh-ed25519 Pn2mDw WH7KTJMgNtrAtFQX0kOWMdeHAS0e5j17epNxI4ZtICU
+cDimqwDawCQPUj01wOCaWqzagmhvaFpxvm0SPur2F0A
+-> CL-grease q& A jaA
+ZJDueMr/eEITWUHXie4hfXqarMuB
+--- 8aSWAqEb8QgFBBR8QcOQ4FlXHEhpPS9eQ7QCCVc17A8
+ES�{�/ʕ�O�Z<�M'��R�ލ

9C�'���S��j��a��T�e�ꄱ��Kv�n�P�eY�l����jd�I��4X
a5��ω�X,k涞�8>
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index deeb2b8..77d8053 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -72,6 +72,9 @@ in
   # vpod
   "vpod/passwordfile.age".publicKeys = writers ++ [ patroclus ];
 
+  # Grace's website editor
+  "grace-editor/opencode.env.age".publicKeys = writers ++ [ patroclus ];
+
   # zfs
   "zfs/documents-encryption-passphrase.age".publicKeys = writers ++ [ patroclus ];