{
  inputs,
  lib,
  pkgs,
  config,
  ...
}:
{
  imports = [ inputs.ngp-nur.nixosModules.opencode-v2 ];

  services.opencode-v2 = {
    enable = lib.mkDefault true;
    user = lib.mkDefault "noah";
    group = lib.mkDefault "users";
    workingDirectory = lib.mkDefault "/home/noah/repos";
    configFile = lib.mkDefault ../config/opencode/opencode.json;
    passwordFile = config.age.secrets.opencode-password.path;
    # Let each OpenCode web client connect to the other hosts.
    cors = [
      "https://code.ngp.computer"
      "https://misaki.code.ngp.computer"
      "https://odin.code.ngp.computer"
      "https://shizuri.code.ngp.computer"
    ];
    extraPackages = lib.mkDefault (
      with pkgs;
      [
        nix
        gitMinimal
        uv
        inputs.ngp-nur.packages.${stdenv.hostPlatform.system}.mcp-victorialogs
        inputs.ngp-nur.packages.${stdenv.hostPlatform.system}.mcp-victoriatraces
        inputs.tsk.packages.${stdenv.hostPlatform.system}.default
      ]
    );
  };

  age.secrets.opencode-password = {
    file = ../secrets/opencode-password.age;
    owner = "noah";
  };

  systemd.services.opencode-v2.environment = {
    VL_INSTANCE_ENTRYPOINT = "http://misaki.tail2d94b.ts.net:9429";
    VL_INSTANCE_HEADERS = "Authorization={env:MISAKI_VL_AUTH}";
    VT_INSTANCE_ENTRYPOINT = "http://misaki.tail2d94b.ts.net:10429";
    VT_INSTANCE_HEADERS = "Authorization={env:MISAKI_VL_AUTH}";
  };

  age.secrets.readonly-victoria-auth.file = ../secrets/readonly-victoria-auth.age;

  systemd.services.opencode-v2.serviceConfig.EnvironmentFile =
    config.age.secrets.readonly-victoria-auth.path;
}