feat(omp): fetch Hindsight token from OpenBao #52

Merged
yuris merged 1 commit from feat/omp-openbao into main 2026-09-23 17:35:02 +00:00
Owner

omp is now a launcher: it reads secret/hindsight's HINDSIGHT_API_TOKEN from bao.nokopia.com and exports it before exec'ing the real binary, so the token never lives in a dotfile or environment file.

  • omp moves from system packages into the omp home module, wrapped via writeShellApplication.
  • Adds the CLIs the launcher needs: openbao (bao), plus forgejo-mcp used by omp's MCP tooling; exports BAO_ADDR.

Verified: full suda system evaluates and the wrapped omp resolves from home.packages.

`omp` is now a launcher: it reads `secret/hindsight`'s `HINDSIGHT_API_TOKEN` from `bao.nokopia.com` and exports it before exec'ing the real binary, so the token never lives in a dotfile or environment file. - `omp` moves from system packages into the `omp` home module, wrapped via `writeShellApplication`. - Adds the CLIs the launcher needs: `openbao` (`bao`), plus `forgejo-mcp` used by omp's MCP tooling; exports `BAO_ADDR`. Verified: full `suda` system evaluates and the wrapped `omp` resolves from `home.packages`.
omp is now wrapped: the launcher reads secret/hindsight HINDSIGHT_API_TOKEN from bao.nokopia.com before exec, so the token never lives in a dotfile. omp moves off system packages into the omp home module, alongside the forgejo-mcp and openbao CLIs it needs (BAO_ADDR exported).
yuris merged commit d69a1da96e into main 2026-09-23 17:35:02 +00:00
yuris deleted branch feat/omp-openbao 2026-09-23 17:35:02 +00:00
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
yuris/nixos-config!52
No description provided.