From fcb544dfa30c5b337fad0fbd307122ac07aef0f0 Mon Sep 17 00:00:00 2001
From: Jet <jet@extremist.software>
Date: Thu, 23 Apr 2026 17:05:03 -0700
Subject: [PATCH 1/3] feat: add auto opencode web on tailscale serve

---
 configuration.nix | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index c3a7dc1..a5c9f92 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -58,6 +58,25 @@
     '';
   };
 
+  systemd.services.opencode-tailnet = {
+    description = "Expose OpenCode on the tailnet";
+    after = [ "network-online.target" "tailscaled.service" "tailscale-set-operator.service" ];
+    wants = [ "network-online.target" ];
+    requires = [ "tailscaled.service" "tailscale-set-operator.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "simple";
+      User = "jet";
+      Restart = "always";
+      RestartSec = 5;
+      ExecStartPre = [
+        "${pkgs.tailscale}/bin/tailscale serve --bg 4096"
+      ];
+      ExecStart = "${config.users.users.jet.home}/.nix-profile/bin/opencode serve --hostname 127.0.0.1 --port 4096";
+      WorkingDirectory = config.users.users.jet.home;
+    };
+  };
+
   time.timeZone = "America/Los_Angeles";
   i18n.defaultLocale = "en_US.UTF-8";
 

From 9c1487cd7d6b1495170f412496c28a3bda43949a Mon Sep 17 00:00:00 2001
From: Jet <jet@extremist.software>
Date: Thu, 23 Apr 2026 17:05:03 -0700
Subject: [PATCH 2/3] feat: add auto opencode web on tailscale serve

---
 configuration.nix | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/configuration.nix b/configuration.nix
index c3a7dc1..f68f5a7 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -58,6 +58,28 @@
     '';
   };
 
+  systemd.services.opencode-tailnet = {
+    description = "Expose OpenCode on the tailnet";
+    after = [ "network-online.target" "tailscaled.service" "tailscale-set-operator.service" ];
+    wants = [ "network-online.target" ];
+    requires = [ "tailscaled.service" "tailscale-set-operator.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "simple";
+      User = "jet";
+      Restart = "always";
+      RestartSec = 5;
+      Environment = [
+        ''OPENCODE_PERMISSION={"*":"allow","external_directory":"allow","doom_loop":"allow"}''
+      ];
+      ExecStartPre = [
+        "${pkgs.tailscale}/bin/tailscale serve --bg 4096"
+      ];
+      ExecStart = "/etc/profiles/per-user/jet/bin/opencode serve --hostname 127.0.0.1 --port 4096";
+      WorkingDirectory = config.users.users.jet.home;
+    };
+  };
+
   time.timeZone = "America/Los_Angeles";
   i18n.defaultLocale = "en_US.UTF-8";
 

From 572a73105763f39043616eeb984ec7f956c702c9 Mon Sep 17 00:00:00 2001
From: Jet <jet@extremist.software>
Date: Thu, 23 Apr 2026 19:50:27 -0700
Subject: [PATCH 3/3] fix: opencode perms

---
 configuration.nix | 3 ---
 home.nix          | 9 ++++++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index f68f5a7..76b0954 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -69,9 +69,6 @@
       User = "jet";
       Restart = "always";
       RestartSec = 5;
-      Environment = [
-        ''OPENCODE_PERMISSION={"*":"allow","external_directory":"allow","doom_loop":"allow"}''
-      ];
       ExecStartPre = [
         "${pkgs.tailscale}/bin/tailscale serve --bg 4096"
       ];
diff --git a/home.nix b/home.nix
index 77971f9..0d3470e 100644
--- a/home.nix
+++ b/home.nix
@@ -603,9 +603,7 @@ in
       "dr" = "direnv reload";
       "da" = "direnv allow";
       "nfu" = "nix flake update";
-      "o" =
-        "OPENCODE_PERMISSION='{\"*\":\"allow\",\"external_directory\":\"allow\",\"doom_loop\":\"allow\"}' opencode";
-      "os" = "opencode";
+      "o" = "opencode";
       ".." = "z ..";
       j = "jj";
       jgf = "jj git fetch";
@@ -862,6 +860,11 @@ in
     "$schema" = "https://opencode.ai/config.json";
     autoupdate = false;
     plugin = [ "opencode-with-claude" ];
+    permission = {
+      "*" = "allow";
+      external_directory = "allow";
+      doom_loop = "allow";
+    };
     mcp.linear = {
       type = "remote";
       url = "https://mcp.linear.app/mcp";