+3

home-manager/clever-cloud.nix

reviewed

··· 17 17 ]; 18 18 19 19 programs = { 20 20 + onepassword-secrets.enable = true; 21 21 + 20 22 # cli 21 23 git = { 22 24 enable = true; ··· 46 48 } 47 49 ]; 48 50 }; 51 51 + codex.enable = true; 49 52 50 53 # gui 51 54 ghostty.enable = true;

+3

home-manager/desktop.nix

reviewed

··· 19 19 ]; 20 20 21 21 programs = { 22 22 + onepassword-secrets.enable = true; 23 23 + 22 24 # cli 23 25 git = { 24 26 enable = true; ··· 67 69 } 68 70 ]; 69 71 }; 72 72 + codex.enable = true; 70 73 71 74 # gui 72 75 ghostty.enable = true;

+3

home-manager/laptop.nix

reviewed

··· 19 19 ]; 20 20 21 21 programs = { 22 22 + onepassword-secrets.enable = true; 23 23 + 22 24 # cli 23 25 git = { 24 26 enable = true; ··· 67 69 } 68 70 ]; 69 71 }; 72 72 + codex.enable = true; 70 73 71 74 # gui 72 75 ghostty.enable = true;

+44

home-manager/modules/codex.nix

reviewed

··· 1 1 + { 2 2 + config, 3 3 + pkgs, 4 4 + lib, 5 5 + ... 6 6 + }: 7 7 + 8 8 + let 9 9 + cfg = config.programs.codex; 10 10 + 11 11 + nodejsPkg = pkgs.nodejs_22; 12 12 + 13 13 + context7ApiKeyPath = config.programs.onepassword-secrets.secretPaths."context7ApiKey"; 14 14 + 15 15 + context7Runner = pkgs.writeShellScriptBin "context7-mcp-runner" '' 16 16 + export PATH="${lib.makeBinPath [ nodejsPkg ]}:$PATH" 17 17 + export CONTEXT7_API_KEY="$(${pkgs.coreutils}/bin/cat ${context7ApiKeyPath})" 18 18 + exec "${nodejsPkg}/bin/npx" -y @upstash/context7-mcp 19 19 + ''; 20 20 + in 21 21 + { 22 22 + config = lib.mkIf cfg.enable { 23 23 + home.packages = [ 24 24 + context7Runner 25 25 + ]; 26 26 + 27 27 + programs.codex = { 28 28 + package = pkgs.unstable.codex; 29 29 + custom-instructions = '' 30 30 + Always use context7 when I need code generation, setup or configuration steps, or 31 31 + library/API documentation. This means you should automatically use the Context7 MCP 32 32 + tools to resolve library id and get library docs without me having to explicitly ask. 33 33 + ''; 34 34 + settings = { 35 35 + mcp_servers = { 36 36 + context7 = { 37 37 + command = "context7-mcp-runner"; 38 38 + args = [ ]; 39 39 + }; 40 40 + }; 41 41 + }; 42 42 + }; 43 43 + }; 44 44 + }

+27

home-manager/modules/onepassword-secrets.nix

reviewed

··· 1 1 + { 2 2 + config, 3 3 + lib, 4 4 + ... 5 5 + }: 6 6 + 7 7 + let 8 8 + cfg = config.programs.onepassword-secrets; 9 9 + in 10 10 + { 11 11 + config = lib.mkIf cfg.enable { 12 12 + programs.onepassword-secrets = { 13 13 + # 0440 youn:onepassword-secrets 14 14 + tokenFile = "/etc/opnix-token"; 15 15 + 16 16 + secrets = { 17 17 + context7ApiKey = { 18 18 + reference = "op://OpNix/Context7 API Key/credential"; 19 19 + path = ".opnix/secrets/context7-api-key"; 20 20 + mode = "0600"; 21 21 + owner = "youn"; 22 22 + group = "users"; 23 23 + }; 24 24 + }; 25 25 + }; 26 26 + }; 27 27 + }