diff --git a/.gitattributes b/.gitattributes
index ca3cf03..78df606 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,4 +1,2 @@
-etcnixos/secrets/secureboot.tar filter=git-crypt diff=git-crypt
-etcnixos/secrets/wifi-passwords.nix filter=git-crypt diff=git-crypt
-etcnixos/secrets/disk-password filter=git-crypt diff=git-crypt
-etcnixos/secrets/password-hash filter=git-crypt diff=git-crypt
+/etcnixos/secrets/** filter=git-crypt diff=git-crypt
+/home-manager/secrets/** filter=git-crypt diff=git-crypt
diff --git a/home-manager/no-gui.nix b/home-manager/no-gui.nix
index 656dc0b..736328d 100644
--- a/home-manager/no-gui.nix
+++ b/home-manager/no-gui.nix
@@ -114,6 +114,7 @@ in
   imports = [
     ./progs/fish.nix
     ./progs/helix.nix
+    ./progs/opencode.nix
     (
       { ... }:
       {
diff --git a/home-manager/progs/opencode.nix b/home-manager/progs/opencode.nix
new file mode 100644
index 0000000..cac46c6
--- /dev/null
+++ b/home-manager/progs/opencode.nix
@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  programs.opencode = {
+    enable = true;
+    rules = "";
+    settings = {
+      theme = "opencode";
+      model = "moonshotai/kimi-k2-thinking";
+      autoshare = false;
+      autoupdate = true;
+      provider = {
+        openrouter = {
+          models = {
+            # put models here
+          };
+          options = {
+            # TODO! use agenix here instead
+            apiKey = "{file:${../secrets/openrouter_api_key}}";
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/home-manager/secrets/openrouter_api_key b/home-manager/secrets/openrouter_api_key
new file mode 100644
index 0000000..e3113ea
Binary files /dev/null and b/home-manager/secrets/openrouter_api_key differ