Home/Nixinator: Update opencode permissions

home/christoph/nixinator/default.nix

@@ -142,21 +142,37 @@
       mcp = {
         enable = true;
         servers = {
-          deepwiki = {
+          context7 = {
-            # https://mcpservers.org/servers/devin/deepwiki
+            command = "npx";
-            url = "https://mcp.deepwiki.com/mcp";
+            args = ["-y" "@upstash/context7-mcp"];
+            env = {
+              CONTEXT7_API_KEY.file = nixosConfig.sops.secrets.context7-api-key.path;
+            };
           };
+          # deepwiki = {
+          #   # https://mcpservers.org/servers/devin/deepwiki
+          #   url = "https://mcp.deepwiki.com/mcp";
+          # };
           # github = {
           #   # https://mcpservers.org/servers/github-mcp-server
           #   url = "https://api.githubcopilot.com/mcp/";
           #   headers = {
-          #     Authorization = "Bearer ${input:github_mcp_pat}"; # TODO: How to get the token from sops-nix into here?
+          #     Authorization = "Bearer ${input:github_mcp_pat}";
           #   };
           # };
           nixos = {
             command = "uvx";
             args = ["mcp-nixos"];
           };
+          obsidian = {
+            command = "uvx";
+            args = ["mcp-obsidian"];
+            env = {
+              OBSIDIAN_API_KEY.file = nixosConfig.sops.secrets.obsidian-rest-api-key.path;
+              OBSIDIAN_HOST = "127.0.0.1";
+              OBSIDIAN_PORT = "27124";
+            };
+          };
           svelte = {
             # claude mcp add -t stdio -s [scope] svelte -- npx -y @sveltejs/mcp
             command = "npx";
@@ -168,6 +184,10 @@
             command = "npx";
             args = ["-y" "shadcn@latest" "mcp"];
           };
+          zotero = {
+            command = "uvx";
+            args = ["zotero-mcp-server"];
+          };
         };
       };
 
@@ -261,19 +281,37 @@
             "*" = "ask";
             "bash" = {
               "*" = "ask";
-              "ls *" = "allow";
+              "awk *" = "ask"; # Can modify files
-              "find *" = "ask"; # Don't want find -exec
-              "file *" = "allow";
-              "wc *" = "allow";
-              "grep *" = "allow";
-              "rg *" = "allow";
-              "test *" = "allow";
-              "echo *" = "allow";
-              "which *" = "allow";
-              "pwd *" = "allow";
-              "dirname *" = "allow";
               "basename *" = "allow";
+              "cmp *" = "allow";
+              "cut *" = "allow";
+              "df *" = "allow";
+              "dirname *" = "allow";
+              "du *" = "allow";
+              "echo *" = "allow";
+              "fd *" = "ask"; # Can execute commands
+              "file *" = "allow";
+              "find *" = "ask"; # Can execute commands
+              "grep *" = "allow";
+              "head *" = "allow";
+              "ls *" = "allow";
+              "nl *" = "allow";
+              "od *" = "allow";
+              "pwd *" = "allow";
               "readlink *" = "allow";
+              "rg *" = "ask"; # Can execute commands
+              "sed *" = "ask"; # Can modify files
+              "sha256sum *" = "allow";
+              "sha512sum *" = "allow";
+              "sort *" = "ask"; # Can modify files
+              "stat *" = "allow";
+              "tail *" = "allow";
+              "test *" = "allow";
+              "tr *" = "allow";
+              "uniq *" = "ask"; # Can modify files
+              "wc *" = "allow";
+              "which *" = "allow";
+              "xargs *" = "ask"; # Can modify files
 
               "cat *.env" = "deny";
               "cat *.env.*" = "deny";
@@ -288,11 +326,19 @@
               "nix why-depends *" = "allow";
               "nix derivation show *" = "allow";
               "nix store ping *" = "allow";
-              "nix stire diff-closures *" = "allow";
+              "nix store diff-closures *" = "allow";
 
-              "git status *" = "allow";
+              "git branch *" = "ask";
-              "git log *" = "allow";
+              "git check-ignore *" = "allow";
               "git diff *" = "allow";
+              "git log *" = "allow";
+              "git ls-files *" = "allow";
+              "git ls-tree *" = "allow";
+              "git remote *" = "ask";
+              "git rev-list *" = "allow";
+              "git rev-parse *" = "allow";
+              "git stash *" = "ask";
+              "git status *" = "allow";
             };
             "external_directory" = {
               "/nix/store/**" = "allow";
@@ -316,8 +362,8 @@
             "question" = "allow";
           };
           plugin = [
-            "opencode-claude-auth@latest" # https://github.com/griffinmartin/opencode-claude-auth
+            # "opencode-claude-auth@latest" # https://github.com/griffinmartin/opencode-claude-auth
-            "@tarquinen/opencode-dcp@latest" # better compacting
+            # "@tarquinen/opencode-dcp@latest" # better compacting
             # "opencode-lmstudio@0.3.1"
             # "@slkiser/opencode-quota"
           ];

system/nixinator/default.nix

@@ -139,6 +139,8 @@
     sops-nix.secrets.${username} = [
       "makemkv-app-key"
       "restic-repo-key"
+      "context7-api-key"
+      "obsidian-rest-api-key"
     ];
   };
 

system/services/jellyfin.nix

@@ -5,7 +5,7 @@
   pkgs,
   ...
 }: let
-  jellyfinVersion = "10.11.2";
+  jellyfinVersion = "version-12.1ubu2604";
 in {
   virtualisation.oci-containers.containers = {
     jellyfin = {

system/systemmodules/sops-nix/secrets.yaml

@@ -11,6 +11,8 @@ jellyfin-password: ENC[AES256_GCM,data:ugfwgpkIiLY0O+m/UGnBB5AFPBkCcai+RQOkxiCSo
 #
 makemkv-app-key: ENC[AES256_GCM,data:/pTxr4q4ucJLx5VI8ySzOgd4g1s+6lcZNe4crxRmidTYrhJ0I6V3CIhm4wLC105W+Xka6HIZTqPn8SbqcMC4Dt3wSus=,iv:aYsGobD+Vl/VUNAHcAxQb7HEmLT8aXyKNOELgzvKDH4=,tag:xhnVb/ns6VZEnTuoUv9w5A==,type:str]
 restic-repo-key: ENC[AES256_GCM,data:lSFuhjbhdQq4cabAVFGQ4kuaJxb7EhXgBDlgoEQWJhs=,iv:7IhGDBYEwY1TwLvc/4DOkUBQ3eqSszZcKwnT7Lllfps=,tag:yJVlMi9X0W+Kh3zMkb0QuA==,type:str]
+context7-api-key: ENC[AES256_GCM,data:lZfrz5pBDybBkswgZM3jKLM9bdXOXeFUI9wFB8BJ5aLYqmf2oRHIJi/85w==,iv:MQYZKsTG++CYfpJret1WSv7+q2ZmONCDl4OwdRo+YUk=,tag:MrWBn3CKDUDZLLIFZWV0tA==,type:str]
+obsidian-rest-api-key: ENC[AES256_GCM,data:+CmQAX0AoSmCPMF9QL3NkWVArt7N0Ci9obHKpwQUPolcdsTnAsPMWu6GAWVvqs8Qmjz5Hk3gwM0YP2JdLEF0cw==,iv:U1SsPdiJIT7q+md1Q61Ro530s7vrl+XBgu+6/ffcrEQ=,tag:xrTRPve9DcumQjlr+aKsLg==,type:str]
 #
 #ENC[AES256_GCM,data:Raagjz1qPvXC,iv:OSWTKaIlmo1paU2ZZn20XMeZ2gdM52pHmVZ3m2ngCdI=,tag:bPCdvjOFjpxxkrwA7Mhl5Q==,type:comment]
 #
@@ -39,7 +41,7 @@ sops:
             FAbbvZZ/EdIk/njLEcayFN7B4ftTcD/f4XJZiyosilZnIkk76bMOHA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14ph8vrj657e7s35d60xehzuq46t9zd6pzcm6pw4jragzrvf6xs9s77usnm
-    lastmodified: "2026-07-02T19:27:51Z"
+    lastmodified: "2026-09-14T21:08:40Z"
-    mac: ENC[AES256_GCM,data:IkpzDK4F1pEoGx1WyG8ksgMFuEa2h9KeF3m3PzM8KQkWo9iVt3jJn80jHEzWAm8riWIbo7fRkxyRetlSFTZf+MrByotgkWVVx6dMIVNYAOcg2IOK3s4NnX0L65MjbfWGQp/d27QzzEbd14WyklMWm2UO3ei82tF+UKYUEFJ2BWk=,iv:8LimsncylU+HhvVKNnjfyqZskZA72FQe92C4VrNWyQ0=,tag:L6CEno9m3ZncOskjZibq+Q==,type:str]
+    mac: ENC[AES256_GCM,data:tfkmsJfWYV11ruw8fCUkJ2gWQAvQJ4Gmsz72LnmiCdlvzeo4x9iM268ZJnuaPRuv6BXLp2XGGA4CbqhfZbO6cRxAawVfbxY2IRSo1JWITIY8qxKLb07jDMpQu/JjJz7J5T556UEvOsW6HrK3d0xvNlJ4yQIuVCBjttKTdRu5g9Y=,iv:mV5i0xJGu6fnSNPLm9J3NDDgN+sB6iadue917UjR+oU=,tag:h/vaeQ02wK/qKANerWIywQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.3