Deploy OpenCode on Linux with a company API key

This guide is for IT admins deploying OpenCode to employee Linux machines. Chompute generates a managed OpenCode configuration that routes requests through the Chompute gateway, injects the company provider credential at the gateway, and attributes usage to the selected team.

Linux does not use an Apple-style configuration profile. The Chompute AI Control Plane provides a .tar.gz bundle that your device or configuration management system runs as root.

Prerequisites

Configure the OpenCode tool in the Chompute AI Control Plane with an OpenAI-compatible company API key provider.
Enable at least one OpenAI Chat Completions route for OpenCode and choose the model that should be the managed default.
Create an active Chompute Access Key and an active managed team for this fleet.
Install OpenCode on a small Linux pilot group before expanding the rollout. See the OpenCode documentation.

Note

OpenCode loads Linux managed configuration from /etc/opencode/opencode.json. This root-managed file has higher priority than user and project configuration.

Create the Linux bundle

Open MDM Profiles in the Chompute AI Control Plane.
Select the Linux tab, then choose Create MDM Profile.
Select OpenCode, the configured company provider, the default model, an active Chompute access key, and the managed team.
Create the profile and choose Download Linux bundle.

The downloaded archive has this structure:

◇ Linux deployment bundle

$chompute-opencode-linux-<profile-name>.tar.gz$|-- install.sh$|-- README.md$`-- opencode/$    `-- opencode.json

Warning

The generated configuration contains a Chompute access key. Keep the archive in your secured deployment system, limit access to IT administrators, and do not place it in source control.

Deploy to Linux

Inspect and test the bundle in a secured workspace:

◇ terminal · deployment workspace

$tar -tzf <DOWNLOADED_BUNDLE>.tar.gz$mkdir chompute-opencode-linux$tar -xzf <DOWNLOADED_BUNDLE>.tar.gz -C chompute-opencode-linux$cd chompute-opencode-linux$sed -n '1,220p' README.md

Deliver the entire extracted directory with Intune Linux scripts, Fleet, JumpCloud, Ansible, Puppet, Chef, Salt, or your existing Linux management system. Run install.sh as root on each target.

The installer:

Creates /etc/opencode with root ownership.
Leaves an identical managed configuration unchanged, so repeated deployments are safe.
Backs up a changed existing file before replacing it.
Installs the generated configuration at /etc/opencode/opencode.json.

Note

Deploy to a small pilot group first. Fully quit and restart OpenCode after installation so it reloads the managed configuration.

Validate the rollout

On a pilot device, run:

◇ terminal · Linux pilot device

$sudo ./install.sh$python3 -m json.tool /etc/opencode/opencode.json$opencode debug config

Confirm the JSON parser reports no error.
Confirm opencode debug config resolves the managed Chompute provider and selected default model.
Start OpenCode and send a small test prompt.
In Chompute Insights, confirm the request appears under OpenCode and the team selected in the MDM profile.

FAQ

Can I deploy the bundle through Intune or Ansible?

Yes. Extract the archive on a secured admin machine, then deliver the entire directory and execute install.sh as root through your management tool.

Does the bundle contain the company provider API key?

The configuration points OpenCode at Chompute. The upstream provider key remains in Chompute; the bundle contains only the Chompute access key used to authenticate the managed client.

How do I rotate a compromised bundle?

Revoke the affected access key in Chompute, create a new Linux profile with a replacement key, and redeploy the new bundle.

What if OpenCode does not use the Chompute provider?

Confirm the managed file exists, validate its JSON, run opencode debug config, and fully restart OpenCode. Project configuration cannot override the system managed file.