feat: configure encrypted OpenCode credentials

components/website-editor/vm.nix

@@ -1,11 +1,18 @@
 { config, lib, inputs, pkgs, ... }:
 let
   cfg = config.components.website-editor;
+  hostConfig = config;
   hostName = "grace-editor";
   repo = "https://github.com/ajaxbits/gracebobber.git";
 in
 {
   config = lib.mkIf cfg.enable {
+    age.secrets."grace-editor/opencode.env" = {
+      file = ../../secrets/grace-editor/opencode.env.age;
+      path = "/run/grace-editor-secrets/opencode.env";
+      mode = "0400";
+    };
+
     # Intentionally no autostart: run `systemctl start microvm@grace-editor`
     # when the editing environment is wanted.
     microvm.vms.${hostName} = {
@@ -89,6 +96,15 @@ in
             }
           ];
           writableStoreOverlay = "/nix/.rw-store";
+          # This is the only host secret made visible to the guest. It is a
+          # read-only directory, rather than the host-wide agenix directory.
+          shares = [ {
+            source = "/run/grace-editor-secrets";
+            mountPoint = "/run/grace-editor-secrets";
+            tag = "opencode-env";
+            proto = "virtiofs";
+            readOnly = true;
+          } ];
         };
 
         systemd.services.grace-editor-bootstrap = {
@@ -127,6 +143,7 @@ in
               "HOME=/home/agent"
               "GRACE_EDITOR_PREVIEW_URL=http://172.22.0.10:${toString cfg.previewPort}"
             ];
+            EnvironmentFile = hostConfig.age.secrets."grace-editor/opencode.env".path;
             ExecStart = "${inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.opencode2}/bin/opencode2 serve --hostname 0.0.0.0 --port ${toString cfg.editorPort}";
             Restart = "on-failure";
             RestartSec = 5;

secrets/grace-editor/opencode.env.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 A9oJhw P9Dy/S/EMVZWkEOwyIiTaPher9OWim6GpV6EvxMRjwY
+QAO95PHil/7UfSlYrZjjdu4Kk8vy+brvOHd2J4bJu98
+-> ssh-ed25519 eJlTVQ TrjhqE5EWsFfheBG9vfA3caBiULF1QP7oUV0BnQhKB4
+shc1bLz1Ju1/U/O7Ag28/aZSc+/rktmwyXCd5jXkvC4
+-> ssh-ed25519 Pn2mDw WH7KTJMgNtrAtFQX0kOWMdeHAS0e5j17epNxI4ZtICU
+cDimqwDawCQPUj01wOCaWqzagmhvaFpxvm0SPur2F0A
+-> CL-grease q& A jaA
+ZJDueMr/eEITWUHXie4hfXqarMuB
+--- 8aSWAqEb8QgFBBR8QcOQ4FlXHEhpPS9eQ7QCCVc17A8
+ESé{¨/Ê•ËOZ<àM'ö¢RÓލ
9CŒ'ÍÅÝS½Ãj³°aº´Tò­eäꄱõ­Kv·n¦P–eY lÇÅþÀjd½Iææ4Xa5ÑÇωX,k涞õ8>

secrets/secrets.nix

@@ -72,6 +72,9 @@ in
   # vpod
   "vpod/passwordfile.age".publicKeys = writers ++ [ patroclus ];
 
+  # Grace's website editor
+  "grace-editor/opencode.env.age".publicKeys = writers ++ [ patroclus ];
+
   # zfs
   "zfs/documents-encryption-passphrase.age".publicKeys = writers ++ [ patroclus ];