refactor(glyph): move opencode to home-manager (#389)

* refactor(glyph): move opencode to home-manager

Replace the system-level systemd service with home-manager's
programs.opencode module. Runs as user mu with access to ~/Development
and git config. Secret moved from host-level to home-level agenix.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(glyph): configure opencode models, MCP, and server settings

Set Opus 4.6 as default model, Haiku 4.5 as small model, connect
MCPJungle gateway, and disable autoupdate and sharing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat(glyph): add llm-profile as opencode rules

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: stackptr

home/secrets/opencode-env.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 j0kEgQ h0mhqqou3c2H0SaTRedKuN0ZZDFmjxloJD6HkOn3r2U
+CW4zS9B6JSwHTz/foalwTxHL+A5Hhkx39B27xdBg2IU
+-> ssh-ed25519 3EWhnQ 2kwHA9caPTzam6IlkNH0iIZ8JPDW1QqMUwvr6JviChg
+GKcuTzkrYorOGY66bvJeZAza9hQ8yAb8v2fYh8yDw6E
+--- uqY/5Y9DgAKdaPsxQeAkXNad//FiFj6JBV8OLn4AQag
+�L���Y*��0�����,w\�f��h�^�

hosts/glyph/home.nix

@@ -1,10 +1,41 @@
 {
+  config,
+  llm-profile,
   pkgs,
   pkgs-stable,
   ...
 }: {
   home.packages = [pkgs.mktorrent];
 
+  programs.opencode = {
+    enable = true;
+    web.enable = true;
+    web.extraArgs = ["--port" "8890" "--hostname" "0.0.0.0"];
+    rules = builtins.readFile "${llm-profile}/README.md";
+    settings = {
+      model = "anthropic/claude-opus-4-6";
+      small_model = "anthropic/claude-haiku-4-5";
+      enabled_providers = ["anthropic"];
+      autoupdate = false;
+      share = "disabled";
+      server = {
+        port = 8890;
+        hostname = "0.0.0.0";
+      };
+      mcp.glyph = {
+        type = "remote";
+        url = "http://127.0.0.1:8090/mcp";
+      };
+    };
+  };
+
+  systemd.user.services.opencode-web.Service.EnvironmentFile =
+    config.age.secrets.opencode-env.path;
+
+  age.secrets.opencode-env = {
+    file = ../../home/secrets/opencode-env.age;
+  };
+
   programs.beets = {
     enable = true;
     package = pkgs-stable.beets;

hosts/glyph/secrets/opencode-env.age

@@ -12,7 +12,6 @@
     ./jellyfin.nix
     ./nfs.nix
     ./open-terminal.nix
-    ./opencode.nix
     ./open-webui.nix
     ./prometheus.nix
     ./samba.nix

hosts/glyph/services/default.nix

@@ -10,6 +10,5 @@ in {
   "hosts/glyph/secrets/open-webui-api-key.age".publicKeys = keys;
   "hosts/glyph/secrets/open-webui-env.age".publicKeys = keys;
   "hosts/glyph/secrets/graphite-auth-token.age".publicKeys = keys;
-  "hosts/glyph/secrets/opencode-env.age".publicKeys = keys;
   "hosts/glyph/secrets/attic-credentials.age".publicKeys = keys;
 }

hosts/glyph/services/opencode.nix

@@ -3,4 +3,5 @@ let
 in {
   "home/secrets/aichat-env.age".publicKeys = keys;
   "home/secrets/claude-code-api-key.age".publicKeys = keys;
+  "home/secrets/opencode-env.age".publicKeys = keys;
 }