From b0e2b6eeb87df0a098ae89b414bc4fd0da1ea8c2 Mon Sep 17 00:00:00 2001
From: Elena Poelman <elena.poelman@redpencil.io>
Date: Tue, 20 Oct 2026 13:56:04 +0200
Subject: [PATCH] introduce separate weave-proxy service which holds the API
 key

This prevents opencode from having access to the `WEAVE_API_KEY` enviroment variable.
---
 README.md                                    |  6 +++---
 config/nginx/templates/default.conf.template | 11 +++++++++++
 config/opencode/opencode.json                |  4 ++--
 docker-compose.yml                           |  4 ++++
 4 files changed, 20 insertions(+), 5 deletions(-)
 create mode 100644 config/nginx/templates/default.conf.template

diff --git a/README.md b/README.md
index d39b9de..a387aa0 100644
--- a/README.md
+++ b/README.md
@@ -22,9 +22,10 @@ A first run from a clean checkout.
 
    ```yaml
    services:
-     opencode:
+     weave-proxy:
        environment:
          WEAVE_API_KEY: "your-key-here"
+     opencode:
        volumes:
          - /path/to/your/repo:/workspace/repo
    ```
@@ -121,8 +122,7 @@ name** from that stack's compose and `<port>` is the container's *internal* port
 - **`model` / `small_model`** — default model and the model used for lighter
   tasks. Both default to `weave/glm-5.2`.
 - **`provider.weave`** — the weave provider, using the
-  `@ai-sdk/openai-compatible` adapter against `https://weave.redpencil.io/v1`
-  with the key from `WEAVE_API_KEY`.
+  `@ai-sdk/openai-compatible` adapter against `http://weave-proxy/v1`.
 - **`provider.weave.models`** — the models offered in `/models`.
 - **`lsp`** — language servers baked into the image:
   `typescript-language-server` for TS/JS and `pyright` for Python.
diff --git a/config/nginx/templates/default.conf.template b/config/nginx/templates/default.conf.template
new file mode 100644
index 0000000..24a9540
--- /dev/null
+++ b/config/nginx/templates/default.conf.template
@@ -0,0 +1,11 @@
+server {
+  listen 80;
+  location / {
+    proxy_pass https://weave.redpencil.io;
+    proxy_ssl_server_name on;
+    proxy_set_header Host weave.redpencil.io;
+    proxy_set_header Authorization "Bearer ${WEAVE_API_KEY}";
+    proxy_buffering off;        # SSE streaming
+    proxy_read_timeout 600s;    # match opencode's 5-min defaults
+  }
+}
\ No newline at end of file
diff --git a/config/opencode/opencode.json b/config/opencode/opencode.json
index 3be573a..168fa93 100644
--- a/config/opencode/opencode.json
+++ b/config/opencode/opencode.json
@@ -34,8 +34,8 @@
     "weave": {
       "npm": "@ai-sdk/openai-compatible",
       "options": {
-        "baseURL": "https://weave.redpencil.io/v1",
-        "apiKey": "{env:WEAVE_API_KEY}"
+        "baseURL": "http://weave-proxy/v1",
+        "apiKey": "not-needed"
       },
       "models": {
         "kimi-K2.7-code": {
diff --git a/docker-compose.yml b/docker-compose.yml
index a8787b5..42b5007 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,4 +1,8 @@
 services:
+  weave-proxy:
+    image: nginx:1.31.7-alpine
+    volumes:
+      - ./config/nginx/templates:/etc/nginx/templates:ro
   opencode:
     image: redpencil/opencode:0.0.2
     volumes: