nimmo/nixos-config

Watch

Fork

You've already forked nixos-config

Code Issues 15 Pull requests Wiki Activity Actions

Harden and tune opencode configuration for Paseo-only use #140

New issue

Closed

opened 2026-08-05 09:21:13 +01:00 by nimmo · 0 comments

nimmo commented

2026-08-05 09:21:13 +01:00

Owner

Copy link

Context

The opencode configuration in modules/profiles/ai-runtime.nix was at bare minimum — only server, provider, and mcp were set. opencode is never used directly; all model access is via Paseo agents. This change hardens the config and adds quality-of-life features tuned for that Paseo-only workflow.

Scope

Tier 1 — Security/correctness

autoupdate = false — opencode is Nix-managed; prevents silent binary swaps mid-Paseo-agent-run
share = "disabled" — Paseo sessions contain SOPS paths and host inventory; no URL sharing
permission rules — enforces AGENTS.md constraints (no sudo except nixos-rebuild, no .env reads, no secrets edits, doom_loop/external_directory ask)

Tier 2 — Workflow quality

small_model = "ollama-lyra/qwen3:8b" — routes hidden title/summary system agents to lyra's idle 4070 instead of burning OpenRouter credits
enabled_providers — locks to openrouter + 3 ollama instances; prevents accidental provider discovery
instructions = ["README.md"] — supplements auto-discovered AGENTS.md with repo architecture/host inventory
ollama-lyra provider — exposes qwen3:8b, gemma4:12b, gemma4:e2b from lyra's RTX 4070 (192.168.8.146:11434)

Tier 3 — Power features

lsp = true — enables nixd (.nix), pyright (.py), gopls (.go), bash-language-server (.sh), typescript (.ts/.js)
formatter = true — enables nixfmt (.nix), ruff (.py), shfmt (.sh), gofmt (.go)
watcher.ignore — excludes result/, .git/, potential/** from file indexing
LSP and formatter binaries added to environment.systemPackages (all hosts), home.packages (desktop), and paseoRuntimePath

Cleanup

Removed legacy justfiles/opencode.just (opencode-web and opencode-share recipes) and its import from Justfile

Validation

nix flake check passes on all 5 hosts (electra, lena, vega, lyra, cosmos)
Deployed to electra via just test; opencode models confirms ollama-lyra/qwen3:8b, ollama-lyra/gemma4:12b, ollama-lyra/gemma4:e2b are available
Config file verified on disk: enabled_providers, small_model, ollama-lyra provider, lsp, formatter, watcher.ignore all present
Paseo daemon restart to surface new models in provider snapshot (deferred — requires killing running agents)

## Context The opencode configuration in `modules/profiles/ai-runtime.nix` was at bare minimum — only `server`, `provider`, and `mcp` were set. opencode is never used directly; all model access is via Paseo agents. This change hardens the config and adds quality-of-life features tuned for that Paseo-only workflow. ## Scope ### Tier 1 — Security/correctness - [x] `autoupdate = false` — opencode is Nix-managed; prevents silent binary swaps mid-Paseo-agent-run - [x] `share = "disabled"` — Paseo sessions contain SOPS paths and host inventory; no URL sharing - [x] `permission` rules — enforces AGENTS.md constraints (no sudo except nixos-rebuild, no .env reads, no secrets edits, doom_loop/external_directory ask) ### Tier 2 — Workflow quality - [x] `small_model = "ollama-lyra/qwen3:8b"` — routes hidden title/summary system agents to lyra's idle 4070 instead of burning OpenRouter credits - [x] `enabled_providers` — locks to openrouter + 3 ollama instances; prevents accidental provider discovery - [x] `instructions = ["README.md"]` — supplements auto-discovered AGENTS.md with repo architecture/host inventory - [x] `ollama-lyra` provider — exposes qwen3:8b, gemma4:12b, gemma4:e2b from lyra's RTX 4070 (192.168.8.146:11434) ### Tier 3 — Power features - [x] `lsp = true` — enables nixd (.nix), pyright (.py), gopls (.go), bash-language-server (.sh), typescript (.ts/.js) - [x] `formatter = true` — enables nixfmt (.nix), ruff (.py), shfmt (.sh), gofmt (.go) - [x] `watcher.ignore` — excludes result/**, .git/**, potential/** from file indexing - [x] LSP and formatter binaries added to `environment.systemPackages` (all hosts), `home.packages` (desktop), and `paseoRuntimePath` ### Cleanup - [x] Removed legacy `justfiles/opencode.just` (`opencode-web` and `opencode-share` recipes) and its import from `Justfile` ## Validation - [x] `nix flake check` passes on all 5 hosts (electra, lena, vega, lyra, cosmos) - [x] Deployed to electra via `just test`; `opencode models` confirms ollama-lyra/qwen3:8b, ollama-lyra/gemma4:12b, ollama-lyra/gemma4:e2b are available - [x] Config file verified on disk: `enabled_providers`, `small_model`, `ollama-lyra` provider, `lsp`, `formatter`, `watcher.ignore` all present - [ ] Paseo daemon restart to surface new models in provider snapshot (deferred — requires killing running agents)

nimmo added this to the Developer Experience and Configuration Hygiene milestone

2026-08-05 09:21:13 +01:00

nimmo added the

host:fleet

label

2026-08-05 09:21:13 +01:00

nimmo referenced this issue from a commit

2026-08-05 09:21:35 +01:00

Harden and tune opencode config for Paseo-only use

nimmo referenced this issue from a pull request that will close it,

2026-08-05 09:21:39 +01:00

Harden and tune opencode configuration for Paseo-only use #141

nimmo closed this issue

2026-08-05 11:01:42 +01:00

No Branch/Tag specified

main

feat/issue-236-electra-nova-vega

feat/issue-233-nova-builder-credentials

docs/wiki-final-cutover

fix/remediation-evaluation-evidence

fix/remediation-evidence-review

fix/chaos-synthseek-queue

pre-electra-disko-migration

Labels

Clear labels

area:authentication

Issues related to authentication area

area:flake-utilities

Issues related to flake utilities area

area:performance

Issues related to performance area

area:tbd

Area to be determined

host:chaos

Issues specific to the chaos host.

host:electra

Issues specific to the electra host.

host:fleet

Issues that span multiple hosts or the fleet as a whole.

host:lyra

Issues specific to the lyra host.

host:nova

Issues specific to the nova host.

host:vega

Issues specific to the vega host.

investigation

Issue is an investigation task

phase:cutover

The service cutover execution phase.

Preparation and preflight work before service cutover.

phase:validation

Post-cutover validation and rollback-window work.

priority:high

High priority issue

priority:medium

Medium priority issue

project:attic-postgres-lyra-rollout

Issues in the Attic PostgreSQL migration and Lyra rollout workstream.

project:auto-update-reliability

Work arising from the automated update reliability review.

project:auto-update-remediation

Guarded Nova-assisted diagnosis and remediation of failed automated updates.

project:declarative-purity-cleanup

Issues in the declarative purity cleanup workstream.

project:external-review

Review of external configurations for ideas and improvements

project:fleet-boundary-cleanup

Maintainability work that clarifies fleet configuration and automation boundaries.

project:host-facts-refactor

Issues in the host facts refactor workstream.

project:lyra-nixos-deploy

Issues in the Lyra NixOS deployment workstream.

project:lyra-service-stack-migration

Issues in the lyra service stack migration workstream.

project:nebula-mesh-network

Issues in the Nebula mesh network workstream.

project:nixos-build-deployment-pipeline

Issues in the NixOS Build & Deployment Pipeline workstream.

project:security-hardening

Work belonging to the Security Hardening milestone

project:service-stack-migration

Issues in the service stack migration workstream.

project:vega-sillytavern-cutover

Issues in the Vega SillyTavern cutover workstream.

project:wiki-rebuild

Re-found the repository wiki as the fleet's curated knowledge architecture.

repo:numtide/flake-utils

repo:numtide/nix-auth

repo:numtide/nixos-passthru-cache

repo:numtide/nix-relay

service:auto-update

NixOS flake update, cache build, and consumer deployment automation.

service:mem0

service:nix

Issues concerning Nix build, store, cache, or deployment infrastructure.

service:sillytavern

service:slskd

Soulseek daemon (slskd) work.

service:synthseek

Synthseek music discovery/library manager work.

No labels

project:attic-postgres-lyra-rollout

project:auto-update-reliability

project:auto-update-remediation

project:declarative-purity-cleanup

project:external-review

project:fleet-boundary-cleanup

project:host-facts-refactor

project:lyra-nixos-deploy

project:lyra-service-stack-migration

project:nebula-mesh-network

project:nixos-build-deployment-pipeline

project:security-hardening

project:service-stack-migration

project:vega-sillytavern-cutover

project:wiki-rebuild

repo:numtide/flake-utils

repo:numtide/nix-auth

repo:numtide/nixos-passthru-cache

repo:numtide/nix-relay

Milestone

Clear milestone

No items

No milestone

Developer Experience and Configuration Hygiene

Assignees

Clear assignees

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

nimmo/nixos-config#140

Reference in a new issue

Repository

nimmo/nixos-config

Title

Body

No description provided.

Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?

Rows
Columns