opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: convert alerts to use GitHub Flavored Markdown (GFM) (#16850)

Browse Source 
followup to #16761 

thanks @lucasmelin !

+ thanks: @ethanndickson @Parkreiner @matifali @aqandrew 

- [x] update snippet
- [x] find/replace
- [x] spot-check


[preview](https://coder.com/docs/@16761-gfm-callouts/admin/templates/managing-templates/schedule)
(and others)

---------

Co-authored-by: EdwardAngert <17991901+EdwardAngert@users.noreply.github.com>
Co-authored-by: M Atif Ali <atif@coder.com>
This commit is contained in:
Edward Angert
2025-03-10 16:58:20 -04:00
committed by GitHub
co-authored by EdwardAngert M Atif Ali
parent e817713dc0
commit 101b62dc3e
86 changed files with 493 additions and 562 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/external-auth.md
+13 -24
View File
@@ -90,7 +90,8 @@ CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=xxxxxxx
CODER_EXTERNAL_AUTH_0_AUTH_URL="https://login.microsoftonline.com/<TENANT ID>/oauth2/authorize"
```
> Note: Your app registration in Entra ID requires the `vso.code_write` scope
> [!NOTE]
> Your app registration in Entra ID requires the `vso.code_write` scope
### Bitbucket Server
@@ -120,11 +121,8 @@ The Redirect URI for Gitea should be
### GitHub
<blockquote class="admonition tip">
If you don't require fine-grained access control, it's easier to [configure a GitHub OAuth app](#configure-a-github-oauth-app).
</blockquote>
> [!TIP]
> If you don't require fine-grained access control, it's easier to [configure a GitHub OAuth app](#configure-a-github-oauth-app).
```env
CODER_EXTERNAL_AUTH_0_ID="USER_DEFINED_ID"
@@ -179,7 +177,8 @@ CODER_EXTERNAL_AUTH_0_VALIDATE_URL="https://your-domain.com/oauth/token/info"
CODER_EXTERNAL_AUTH_0_REGEX=github\.company\.org
```
> Note: The `REGEX` variable must be set if using a custom git domain.
> [!NOTE]
> The `REGEX` variable must be set if using a custom git domain.
## Custom scopes
@@ -222,26 +221,16 @@ CODER_EXTERNAL_AUTH_0_SCOPES="repo:read repo:write write:gpg_key"
![Install GitHub App](../images/admin/github-app-install.png)
## Multiple External Providers
<blockquote class="info">
Multiple providers is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
## Multiple External Providers (Enterprise)(Premium)
Below is an example configuration with multiple providers:
<blockquote class="admonition warning">
**Note:** To support regex matching for paths like `github\.com/org`, add the following `git config` line to the [Coder agent startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script):
```shell
git config --global credential.useHttpPath true
```
</blockquote>
> [!IMPORTANT]
> To support regex matching for paths like `github\.com/org`, add the following `git config` line to the [Coder agent startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script):
>
> ```shell
> git config --global credential.useHttpPath true
> ```
```env
# Provider 1) github.com
docs/admin/infrastructure/scale-utility.md
+12 -14
View File
@@ -28,7 +28,8 @@ hardware sizing recommendations.
| Kubernetes (GKE) | 4 cores | 16 GB | 2 | db-custom-8-30720 | 2000 | 50 | 2000 simulated | `v2.8.4` | Feb 28, 2024 |
| Kubernetes (GKE) | 2 cores | 4 GB | 2 | db-custom-2-7680 | 1000 | 50 | 1000 simulated | `v2.10.2` | Apr 26, 2024 |
> Note: A simulated connection reads and writes random data at 40KB/s per connection.
> [!NOTE]
> A simulated connection reads and writes random data at 40KB/s per connection.
## Scale testing utility
@@ -36,19 +37,16 @@ Since Coder's performance is highly dependent on the templates and workflows you
support, you may wish to use our internal scale testing utility against your own
environments.
<blockquote class="admonition important">
This utility is experimental.
It is not subject to any compatibility guarantees and may cause interruptions
for your users.
To avoid potential outages and orphaned resources, we recommend that you run
scale tests on a secondary "staging" environment or a dedicated
[Kubernetes playground cluster](https://github.com/coder/coder/tree/main/scaletest/terraform).
Run it against a production environment at your own risk.
</blockquote>
> [!IMPORTANT]
> This utility is experimental.
>
> It is not subject to any compatibility guarantees and may cause interruptions
> for your users.
> To avoid potential outages and orphaned resources, we recommend that you run
> scale tests on a secondary "staging" environment or a dedicated
> [Kubernetes playground cluster](https://github.com/coder/coder/tree/main/scaletest/terraform).
>
> Run it against a production environment at your own risk.
### Create workspaces
docs/admin/infrastructure/validated-architectures/index.md
+2 -3
View File
@@ -36,9 +36,8 @@ cloud/on-premise computing, containerization, and the Coder platform.
| Reference architectures for up to 3,000 users | An approval of your architecture; the CVA solely provides recommendations and guidelines |
| Best practices for building a Coder deployment | Recommendations for every possible deployment scenario |
> For higher level design principles and architectural best practices, see
> Coder's
> [Well-Architected Framework](https://coder.com/blog/coder-well-architected-framework).
For higher level design principles and architectural best practices, see Coder's
[Well-Architected Framework](https://coder.com/blog/coder-well-architected-framework).
## General concepts
docs/admin/integrations/jfrog-artifactory.md
+2 -5
View File
@@ -131,11 +131,8 @@ To set this up, follow these steps:
}
```
<blockquote class="info">
The admin-level access token is used to provision user tokens and is never exposed to developers or stored in workspaces.
</blockquote>
> [!NOTE]
> The admin-level access token is used to provision user tokens and is never exposed to developers or stored in workspaces.
If you don't want to use the official modules, you can read through the [example template](https://github.com/coder/coder/tree/main/examples/jfrog/docker), which uses Docker as the underlying compute. The
same concepts apply to all compute types.
docs/admin/integrations/jfrog-xray.md
+5 -8
View File
@@ -56,14 +56,11 @@ workspaces using Coder's [JFrog Xray Integration](https://github.com/coder/coder
--set artifactory.secretName="jfrog-token"
```
<blockquote class="admonition warning">
To authenticate with the Artifactory registry, you may need to
create a [Docker config](https://jfrog.com/help/r/jfrog-artifactory-documentation/docker-advanced-topics) and use it in the
`imagePullSecrets` field of the Kubernetes Pod. See the [Defining ImagePullSecrets for Coder workspaces](../../tutorials/image-pull-secret.md) guide for more
information.
</blockquote>
> [!IMPORTANT]
> To authenticate with the Artifactory registry, you may need to
> create a [Docker config](https://jfrog.com/help/r/jfrog-artifactory-documentation/docker-advanced-topics) and use it in the
> `imagePullSecrets` field of the Kubernetes Pod.
> See the [Defining ImagePullSecrets for Coder workspaces](../../tutorials/image-pull-secret.md) guide for more information.
## Validate your installation
docs/admin/integrations/opentofu.md
+4 -4
View File
@@ -2,7 +2,8 @@
<!-- Keeping this in as a placeholder for supporting OpenTofu. We should fix support for custom terraform binaries ASAP. -->
> ⚠️ This guide is a work in progress. We do not officially support using custom
> [!IMPORTANT]
> This guide is a work in progress. We do not officially support using custom
> Terraform binaries in your Coder deployment. To track progress on the work,
> see this related [GitHub Issue](https://github.com/coder/coder/issues/12009).
@@ -10,9 +11,8 @@ Coder deployments support any custom Terraform binary, including
[OpenTofu](https://opentofu.org/docs/) - an open source alternative to
Terraform.
> You can read more about OpenTofu and Hashicorp's licensing in our
> [blog post](https://coder.com/blog/hashicorp-license) on the Terraform
> licensing changes.
You can read more about OpenTofu and Hashicorp's licensing in our
[blog post](https://coder.com/blog/hashicorp-license) on the Terraform licensing changes.
## Using a custom Terraform binary
docs/admin/licensing/index.md
+1 -2
View File
@@ -7,8 +7,7 @@ features, you can [request a trial](https://coder.com/trial) or
<!-- markdown-link-check-disable -->
> If you are an existing customer, you can learn more our new Premium plan in
> the [Coder v2.16 blog post](https://coder.com/blog/release-recap-2-16-0)
You can learn more about Coder Premium in the [Coder v2.16 blog post](https://coder.com/blog/release-recap-2-16-0)
<!-- markdown-link-check-enable -->
docs/admin/monitoring/health-check.md
+16 -31
View File
@@ -40,7 +40,7 @@ If there is an issue, you may see one of the following errors reported:
[`url.Parse`](https://pkg.go.dev/net/url#Parse). Example:
`https://dev.coder.com/`.
> **Tip:** You can check this [here](https://go.dev/play/p/CabcJZyTwt9).
You can use [the Go playground](https://go.dev/play/p/CabcJZyTwt9) for additional testing.
### EACS03
@@ -117,15 +117,12 @@ Coder's current activity and usage. It may be necessary to increase the
resources allocated to Coder's database. Alternatively, you can raise the
configured threshold to a higher value (this will not address the root cause).
<blockquote class="admonition tip">
You can enable
[detailed database metrics](../../reference/cli/server.md#--prometheus-collect-db-metrics)
in Coder's Prometheus endpoint. If you have
[tracing enabled](../../reference/cli/server.md#--trace), these traces may also
contain useful information regarding Coder's database activity.
</blockquote>
> [!TIP]
> You can enable
> [detailed database metrics](../../reference/cli/server.md#--prometheus-collect-db-metrics)
> in Coder's Prometheus endpoint. If you have
> [tracing enabled](../../reference/cli/server.md#--trace), these traces may also
> contain useful information regarding Coder's database activity.
## DERP
@@ -150,12 +147,9 @@ This is not necessarily a fatal error, but a possible indication of a
misconfigured reverse HTTP proxy. Additionally, while workspace users should
still be able to reach their workspaces, connection performance may be degraded.
<blockquote class="admonition note">
**Note:** This may also be shown if you have
[forced websocket connections for DERP](../../reference/cli/server.md#--derp-force-websockets).
</blockquote>
> [!NOTE]
> This may also be shown if you have
> [forced websocket connections for DERP](../../reference/cli/server.md#--derp-force-websockets).
**Solution:** ensure that any proxies you use allow connection upgrade with the
`Upgrade: derp` header.
@@ -305,13 +299,10 @@ that they are able to successfully connect to Coder. Otherwise, ensure
[`--provisioner-daemons`](../../reference/cli/server.md#--provisioner-daemons)
is set to a value greater than 0.
<blockquote class="admonition note">
**Note:** This may be a transient issue if you are currently in the process of
> [!NOTE]
> This may be a transient issue if you are currently in the process of
updating your deployment.
</blockquote>
### EPD02
#### Provisioner Daemon Version Mismatch
@@ -324,13 +315,10 @@ of API incompatibility.
**Solution:** Update the provisioner daemon to match the currently running
version of Coder.
<blockquote class="admonition note">
**Note:** This may be a transient issue if you are currently in the process of
> [!NOTE]
> This may be a transient issue if you are currently in the process of
updating your deployment.
</blockquote>
### EPD03
#### Provisioner Daemon API Version Mismatch
@@ -343,13 +331,10 @@ connect to Coder.
**Solution:** Update the provisioner daemon to match the currently running
version of Coder.
<blockquote class="admonition note">
**Note:** This may be a transient issue if you are currently in the process of
> [!NOTE]
> This may be a transient issue if you are currently in the process of
updating your deployment.
</blockquote>
### EUNKNOWN
#### Unknown Error
docs/admin/monitoring/logs.md
+2 -1
View File
@@ -43,7 +43,8 @@ Agent logs are also stored in the workspace filesystem by default:
[azure-windows](https://github.com/coder/coder/blob/2cfadad023cb7f4f85710cff0b21ac46bdb5a845/examples/templates/azure-windows/Initialize.ps1.tftpl#L64))
to see where logs are stored.
> Note: Logs are truncated once they reach 5MB in size.
> [!NOTE]
> Logs are truncated once they reach 5MB in size.
Startup script logs are also stored in the temporary directory of macOS and
Linux workspaces.
docs/admin/monitoring/notifications/index.md
+3 -6
View File
@@ -242,12 +242,9 @@ notification is indicated on the right hand side of this table.
## Delivery Preferences
<blockquote class="info">
Delivery preferences is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Delivery preferences is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Administrators can configure which delivery methods are used for each different
[event type](#event-types).
docs/admin/monitoring/notifications/slack.md
+4 -5
View File
@@ -181,12 +181,11 @@ To build the server to receive webhooks and interact with Slack:
Slack requires the bot to acknowledge when a user clicks on a URL action button.
This is handled by setting up interactivity.
1. Under "Interactivity & Shortcuts" in your Slack app settings, set the Request
URL to match the public URL of your web server's endpoint.
Under "Interactivity & Shortcuts" in your Slack app settings, set the Request
URL to match the public URL of your web server's endpoint.
> Notice: You can use any public endpoint that accepts and responds to POST
> requests with HTTP 200. For temporary testing, you can set it to
> `https://httpbin.org/status/200`.
You can use any public endpoint that accepts and responds to POST requests with HTTP 200.
For temporary testing, you can set it to `https://httpbin.org/status/200`.
Once this is set, Slack will send interaction payloads to your server, which
must respond appropriately.
docs/admin/networking/index.md
+10 -14
View File
@@ -18,7 +18,8 @@ networking logic.
In order for clients and workspaces to be able to connect:
> **Note:** We strongly recommend that clients connect to Coder and their
> [!NOTE]
> We strongly recommend that clients connect to Coder and their
> workspaces over a good quality, broadband network connection. The following
> are minimum requirements:
>
@@ -33,7 +34,8 @@ In order for clients and workspaces to be able to connect:
In order for clients to be able to establish direct connections:
> **Note:** Direct connections via the web browser are not supported. To improve
> [!NOTE]
> Direct connections via the web browser are not supported. To improve
> latency for browser-based applications running inside Coder workspaces in
> regions far from the Coder control plane, consider deploying one or more
> [workspace proxies](./workspace-proxies.md).
@@ -172,12 +174,9 @@ more.
## Browser-only connections
<blockquote class="info">
Browser-only connections is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Browser-only connections is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Some Coder deployments require that all access is through the browser to comply
with security policies. In these cases, pass the `--browser-only` flag to
@@ -189,12 +188,9 @@ via the web terminal and
### Workspace Proxies
<blockquote class="info">
Workspace proxies are an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Workspace proxies are an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Workspace proxies are a Coder Enterprise feature that allows you to provide
low-latency browser experiences for geo-distributed teams.
docs/admin/networking/port-forwarding.md
+22 -23
View File
@@ -48,17 +48,17 @@ For more examples, see `coder port-forward --help`.
## Dashboard
> To enable port forwarding via the dashboard, Coder must be configured with a
> [wildcard access URL](../../admin/setup/index.md#wildcard-access-url). If an
> access URL is not specified, Coder will create
> [a publicly accessible URL](../../admin/setup/index.md#tunnel) to reverse
> proxy the deployment, and port forwarding will work.
>
> There is a
> [DNS limitation](https://datatracker.ietf.org/doc/html/rfc1035#section-2.3.1)
> where each segment of hostnames must not exceed 63 characters. If your app
> name, agent name, workspace name and username exceed 63 characters in the
> hostname, port forwarding via the dashboard will not work.
To enable port forwarding via the dashboard, Coder must be configured with a
[wildcard access URL](../../admin/setup/index.md#wildcard-access-url). If an
access URL is not specified, Coder will create
[a publicly accessible URL](../../admin/setup/index.md#tunnel) to reverse
proxy the deployment, and port forwarding will work.
There is a
[DNS limitation](https://datatracker.ietf.org/doc/html/rfc1035#section-2.3.1)
where each segment of hostnames must not exceed 63 characters. If your app
name, agent name, workspace name and username exceed 63 characters in the
hostname, port forwarding via the dashboard will not work.
### From an coder_app resource
@@ -131,12 +131,9 @@ to the app.
### Configure maximum port sharing level
<blockquote class="info">
Configuring port sharing level is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Configuring port sharing level is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Premium-licensed template admins can control the maximum port sharing level for
workspaces under a given template in the template settings. By default, the
@@ -179,12 +176,14 @@ must include credentials (set `credentials: "include"` if using `fetch`) or the
requests cannot be authenticated and you will see an error resembling the
following:
> Access to fetch at
> '<https://coder.example.com/api/v2/applications/auth-redirect>' from origin
> '<https://8000--dev--user--apps.coder.example.com>' has been blocked by CORS
> policy: No 'Access-Control-Allow-Origin' header is present on the requested
> resource. If an opaque response serves your needs, set the request's mode to
> 'no-cors' to fetch the resource with CORS disabled.
```text
Access to fetch at
'<https://coder.example.com/api/v2/applications/auth-redirect>' from origin
'<https://8000--dev--user--apps.coder.example.com>' has been blocked by CORS
policy: No 'Access-Control-Allow-Origin' header is present on the requested
resource. If an opaque response serves your needs, set the request's mode to
'no-cors' to fetch the resource with CORS disabled.
```
#### Headers
docs/admin/networking/stun.md
+11 -10
View File
@@ -1,13 +1,13 @@
# STUN and NAT
> [Session Traversal Utilities for NAT (STUN)](https://www.rfc-editor.org/rfc/rfc8489.html)
> is a protocol used to assist applications in establishing peer-to-peer
> communications across Network Address Translations (NATs) or firewalls.
>
> [Network Address Translation (NAT)](https://en.wikipedia.org/wiki/Network_address_translation)
> is commonly used in private networks to allow multiple devices to share a
> single public IP address. The vast majority of home and corporate internet
> connections use at least one level of NAT.
[Session Traversal Utilities for NAT (STUN)](https://www.rfc-editor.org/rfc/rfc8489.html)
is a protocol used to assist applications in establishing peer-to-peer
communications across Network Address Translations (NATs) or firewalls.
[Network Address Translation (NAT)](https://en.wikipedia.org/wiki/Network_address_translation)
is commonly used in private networks to allow multiple devices to share a
single public IP address. The vast majority of home and corporate internet
connections use at least one level of NAT.
## Overview
@@ -33,8 +33,9 @@ counterpart can be reached. Once communication succeeds in one direction, we can
inspect the source address of the received packet to determine the return
address.
> The below glosses over a lot of the complexity of traversing NATs. For a more
> in-depth technical explanation, see
> [!TIP]
> The below glosses over a lot of the complexity of traversing NATs.
> For a more in-depth technical explanation, see
> [How NAT traversal works (tailscale.com)](https://tailscale.com/blog/how-nat-traversal-works).
At a high level, STUN works like this:
docs/admin/networking/workspace-proxies.md
+3 -3
View File
@@ -104,10 +104,10 @@ CODER_TLS_KEY_FILE="<key_file_location>"
### Running on Kubernetes
Make a `values-wsproxy.yaml` with the workspace proxy configuration:
Make a `values-wsproxy.yaml` with the workspace proxy configuration.
> Notice the `workspaceProxy` configuration which is `false` by default in the
> coder Helm chart.
Notice the `workspaceProxy` configuration which is `false` by default in the
Coder Helm chart:
```yaml
coder:
docs/admin/provisioners.md
+6 -6
View File
@@ -104,10 +104,9 @@ tags.
## Global PSK (Not Recommended)
> Global pre-shared keys (PSK) make it difficult to rotate keys or isolate
> provisioners.
>
> We do not recommend using global PSK.
We do not recommend using global PSK.
Global pre-shared keys (PSK) make it difficult to rotate keys or isolate provisioners.
A deployment-wide PSK can be used to authenticate any provisioner. To use a
global PSK, set a
@@ -158,7 +157,7 @@ coder templates push on-prem-chicago \
This can also be done in the UI when building a template:
> ![template tags](../images/admin/provisioner-tags.png)
![template tags](../images/admin/provisioner-tags.png)
Alternatively, a template can target a provisioner via
[workspace tags](https://github.com/coder/coder/tree/main/examples/workspace-tags)
@@ -226,7 +225,8 @@ This is illustrated in the below table:
| scope=user owner=aaa environment=on-prem datacenter=chicago | scope=user owner=aaa environment=on-prem datacenter=new_york | ✅ | ❌ |
| scope=organization owner= environment=on-prem | scope=organization owner= environment=on-prem | ❌ | ❌ |
> **Note to maintainers:** to generate this table, run the following command and
> [!TIP]
> To generate this table, run the following command and
> copy the output:
>
> ```go
docs/admin/security/0001_user_apikeys_invalidation.md
+4 -2
View File
@@ -42,7 +42,8 @@ failed to check whether the API key corresponds to a deleted user.
## Indications of Compromise
> 💡 Automated remediation steps in the upgrade purge all affected API keys.
> [!TIP]
> Automated remediation steps in the upgrade purge all affected API keys.
> Either perform the following query before upgrade or run it on a backup of
> your database from before the upgrade.
@@ -81,7 +82,8 @@ Otherwise, the following information will be reported:
- User API key ID
- Time the affected API key was last used
> 💡 If your license includes the
> [!TIP]
> If your license includes the
> [Audit Logs](https://coder.com/docs/admin/audit-logs#filtering-logs) feature,
> you can then query all actions performed by the above users by using the
> filter `email:$USER_EMAIL`.
docs/admin/security/database-encryption.md
+24 -18
View File
@@ -26,24 +26,27 @@ The following database fields are currently encrypted:
Additional database fields may be encrypted in the future.
> Implementation notes: each encrypted database column `$C` has a corresponding
> `$C_key_id` column. This column is used to determine which encryption key was
> used to encrypt the data. This allows Coder to rotate encryption keys without
> invalidating existing tokens, and provides referential integrity for encrypted
> data.
>
> The `$C_key_id` column stores the first 7 bytes of the SHA-256 hash of the
> encryption key used to encrypt the data.
>
> Encryption keys in use are stored in `dbcrypt_keys`. This table stores a
> record of all encryption keys that have been used to encrypt data. Active keys
> have a null `revoked_key_id` column, and revoked keys have a non-null
> `revoked_key_id` column. You cannot revoke a key until you have rotated all
> values using that key to a new key.
### Implementation notes
Each encrypted database column `$C` has a corresponding
`$C_key_id` column. This column is used to determine which encryption key was
used to encrypt the data. This allows Coder to rotate encryption keys without
invalidating existing tokens, and provides referential integrity for encrypted
data.
The `$C_key_id` column stores the first 7 bytes of the SHA-256 hash of the
encryption key used to encrypt the data.
Encryption keys in use are stored in `dbcrypt_keys`. This table stores a
record of all encryption keys that have been used to encrypt data. Active keys
have a null `revoked_key_id` column, and revoked keys have a non-null
`revoked_key_id` column. You cannot revoke a key until you have rotated all
values using that key to a new key.
## Enabling encryption
> NOTE: Enabling encryption does not encrypt all existing data. To encrypt
> [!NOTE]
> Enabling encryption does not encrypt all existing data. To encrypt
> existing data, see [rotating keys](#rotating-keys) below.
- Ensure you have a valid backup of your database. **Do not skip this step.** If
@@ -115,7 +118,8 @@ data:
This command will re-encrypt all tokens with the specified new encryption key.
We recommend performing this action during a maintenance window.
> Note: this command requires direct access to the database. If you are using
> [!IMPORTANT]
> This command requires direct access to the database. If you are using
> the built-in PostgreSQL database, you can run
> [`coder server postgres-builtin-url`](../../reference/cli/server_postgres-builtin-url.md)
> to get the connection URL.
@@ -138,7 +142,8 @@ To disable encryption, perform the following actions:
This command will decrypt all encrypted user tokens and revoke all active
encryption keys.
> Note: for `decrypt` command, the equivalent environment variable for
> [!NOTE]
> for `decrypt` command, the equivalent environment variable for
> `--keys` is `CODER_EXTERNAL_TOKEN_ENCRYPTION_DECRYPT_KEYS` and not
> `CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS`. This is explicitly named differently
> to help prevent accidentally decrypting data.
@@ -152,7 +157,8 @@ To disable encryption, perform the following actions:
## Deleting Encrypted Data
> NOTE: This is a destructive operation.
> [!CAUTION]
> This is a destructive operation.
To delete all encrypted data from your database, perform the following actions:
docs/admin/security/index.md
+1
View File
@@ -7,6 +7,7 @@ For other security tips, visit our guide to
## Security Advisories
> [!CAUTION]
> If you discover a vulnerability in Coder, please do not hesitate to report it
> to us by following the instructions
> [here](https://github.com/coder/coder/blob/main/SECURITY.md).
docs/admin/security/secrets.md
+2 -1
View File
@@ -38,7 +38,8 @@ Users can view their public key in their account settings:
![SSH keys in account settings](../../images/ssh-keys.png)
> Note: SSH keys are never stored in Coder workspaces, and are fetched only when
> [!NOTE]
> SSH keys are never stored in Coder workspaces, and are fetched only when
> SSH is invoked. The keys are held in-memory and never written to disk.
## Dynamic Secrets
docs/admin/setup/appearance.md
+3 -6
View File
@@ -1,11 +1,8 @@
# Appearance
<blockquote class="info">
Customizing Coder's appearance is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Customizing Coder's appearance is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Customize the look of your Coder deployment to meet your enterprise
requirements.
docs/admin/setup/index.md
+4 -3
View File
@@ -10,8 +10,7 @@ full list of the options, run `coder server --help` or see our
external URL that users and workspaces use to connect to Coder (e.g.
<https://coder.example.com>). This should not be localhost.
> Access URL should be an external IP address or domain with DNS records
> pointing to Coder.
Access URL should be an external IP address or domain with DNS records pointing to Coder.
### Tunnel
@@ -44,7 +43,8 @@ coder server
or running [coder_apps](../templates/index.md) on an absolute path. Set this to
a wildcard subdomain that resolves to Coder (e.g. `*.coder.example.com`).
> Note: We do not recommend using a top-level-domain for Coder wildcard access
> [!NOTE]
> We do not recommend using a top-level-domain for Coder wildcard access
> (for example `*.workspaces`), even on private networks with split-DNS. Some
> browsers consider these "public" domains and will refuse Coder's cookies,
> which are vital to the proper operation of this feature.
@@ -107,6 +107,7 @@ deployment information. Use `CODER_PG_CONNECTION_URL` to set the database that
Coder connects to. If unset, PostgreSQL binaries will be downloaded from Maven
(<https://repo1.maven.org/maven2>) and store all data in the config root.
> [!NOTE]
> Postgres 13 is the minimum supported version.
If you are using the built-in PostgreSQL deployment and need to use `psql` (aka
docs/admin/setup/telemetry.md
+2 -3
View File
@@ -1,8 +1,7 @@
# Telemetry
<blockquote class="info">
TL;DR: disable telemetry by setting <code>CODER_TELEMETRY_ENABLE=false</code>.
</blockquote>
> [!NOTE]
> TL;DR: disable telemetry by setting <code>CODER_TELEMETRY_ENABLE=false</code>.
Coder collects telemetry from all installations by default. We believe our users
should have the right to know what we collect, why we collect it, and how we use
docs/admin/templates/creating-templates.md
+4 -2
View File
@@ -25,7 +25,8 @@ Give your template a name, description, and icon and press `Create template`.
![Name and icon](../../images/admin/templates/import-template.png)
> **⚠️ Note**: If template creation fails, Coder is likely not authorized to
> [!NOTE]
> If template creation fails, Coder is likely not authorized to
> deploy infrastructure in the given location. Learn how to configure
> [provisioner authentication](./extending-templates/provider-authentication.md).
@@ -64,7 +65,8 @@ Next, push it to Coder with the
coder templates push
```
> ⚠️ Note: If `template push` fails, Coder is likely not authorized to deploy
> [!NOTE]
> If `template push` fails, Coder is likely not authorized to deploy
> infrastructure in the given location. Learn how to configure
> [provisioner authentication](../provisioners.md).
docs/admin/templates/extending-templates/docker-in-workspaces.md
+2 -2
View File
@@ -273,8 +273,8 @@ A
can be added to your templates to add docker support. This may come in handy if
your nodes cannot run Sysbox.
> ⚠️ **Warning**: This is insecure. Workspaces will be able to gain root access
> to the host machine.
> [!WARNING]
> This is insecure. Workspaces will be able to gain root access to the host machine.
### Use a privileged sidecar container in Docker-based templates
docs/admin/templates/extending-templates/external-auth.md
+2 -5
View File
@@ -31,11 +31,8 @@ you can require users authenticate via git prior to creating a workspace:
### Native git authentication will auto-refresh tokens
<blockquote class="info">
<p>
This is the preferred authentication method.
</p>
</blockquote>
> [!TIP]
> This is the preferred authentication method.
By default, the coder agent will configure native `git` authentication via the
`GIT_ASKPASS` environment variable. Meaning, with no additional configuration,
docs/admin/templates/extending-templates/index.md
+2 -2
View File
@@ -49,8 +49,7 @@ Persistent resources stay provisioned when workspaces are stopped, where as
ephemeral resources are destroyed and recreated on restart. All resources are
destroyed when a workspace is deleted.
> You can read more about how resource behavior and workspace state in the
> [workspace lifecycle documentation](../../../user-guides/workspace-lifecycle.md).
You can read more about how resource behavior and workspace state in the [workspace lifecycle documentation](../../../user-guides/workspace-lifecycle.md).
Template resources follow the
[behavior of Terraform resources](https://developer.hashicorp.com/terraform/language/resources/behavior#how-terraform-applies-a-configuration)
@@ -65,6 +64,7 @@ When a workspace is deleted, the Coder server essentially runs a
[terraform destroy](https://www.terraform.io/cli/commands/destroy) to remove all
resources associated with the workspace.
> [!TIP]
> Terraform's
> [prevent-destroy](https://www.terraform.io/language/meta-arguments/lifecycle#prevent_destroy)
> and
docs/admin/templates/extending-templates/modules.md
+2 -2
View File
@@ -93,7 +93,7 @@ to resolve modules via [Artifactory](https://jfrog.com/artifactory/).
}
```
6. Update module source as,
6. Update module source as:
```tf
module "module-name" {
@@ -104,7 +104,7 @@ to resolve modules via [Artifactory](https://jfrog.com/artifactory/).
}
```
> Do not forget to replace example.jfrog.io with your Artifactory URL
Replace `example.jfrog.io` with your Artifactory URL
Based on the instructions
[here](https://jfrog.com/blog/tour-terraform-registries-in-artifactory/).
docs/admin/templates/extending-templates/process-logging.md
+10 -8
View File
@@ -3,8 +3,12 @@
The workspace process logging feature allows you to log all system-level
processes executing in the workspace.
> **Note:** This feature is only available on Linux in Kubernetes. There are
> additional requirements outlined further in this document.
This feature is only available on Linux in Kubernetes. There are
additional requirements outlined further in this document.
> [!NOTE]
> Workspace process logging is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Workspace process logging adds a sidecar container to workspace pods that will
log all processes started in the workspace container (e.g., commands executed in
@@ -16,10 +20,6 @@ monitoring stack, such as CloudWatch, for further analysis or long-term storage.
Please note that these logs are not recorded or captured by the Coder
organization in any way, shape, or form.
> This is an [Premium or Enterprise](https://coder.com/pricing) feature. To
> learn more about Coder licensing, please
> [contact sales](https://coder.com/contact).
## How this works
Coder uses [eBPF](https://ebpf.io/) (which we chose for its minimal performance
@@ -164,7 +164,8 @@ would like to add workspace process logging to, follow these steps:
}
```
> **Note:** If you are using the `envbox` template, you will need to update
> [!NOTE]
> If you are using the `envbox` template, you will need to update
> the third argument to be
> `"${local.exectrace_init_script}\n\nexec /envbox docker"` instead.
@@ -212,7 +213,8 @@ would like to add workspace process logging to, follow these steps:
}
```
> **Note:** `exectrace` requires root privileges and a privileged container
> [!NOTE]
> `exectrace` requires root privileges and a privileged container
> to attach probes to the kernel. This is a requirement of eBPF.
1. Add the following environment variable to your workspace pod:
docs/admin/templates/extending-templates/provider-authentication.md
+2 -6
View File
@@ -1,11 +1,7 @@
# Provider Authentication
<blockquote class="danger">
<p>
Do not store secrets in templates. Assume every user has cleartext access
to every template.
</p>
</blockquote>
> [!CAUTION]
> Do not store secrets in templates. Assume every user has cleartext access to every template.
The Coder server's
[provisioner](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/provisioner)
docs/admin/templates/extending-templates/resource-metadata.md
+2 -3
View File
@@ -13,9 +13,8 @@ You can use `coder_metadata` to show Terraform resource attributes like these:
![ui](../../../images/admin/templates/coder-metadata-ui.png)
<blockquote class="info">
Coder automatically generates the <code>type</code> metadata.
</blockquote>
> [!NOTE]
> Coder automatically generates the <code>type</code> metadata.
You can also present automatically updating, dynamic values with
[agent metadata](./agent-metadata.md).
docs/admin/templates/extending-templates/workspace-tags.md
+2 -1
View File
@@ -71,7 +71,8 @@ added that can handle its combination of tags.
Before releasing the template version with configurable workspace tags, ensure
that every tag set is associated with at least one healthy provisioner.
> **Note:** It may be useful to run at least one provisioner with no additional
> [!NOTE]
> It may be useful to run at least one provisioner with no additional
> tag restrictions that is able to take on any job.
### Parameters types
docs/admin/templates/managing-templates/dependencies.md
+2 -1
View File
@@ -94,7 +94,8 @@ directory. When you next run
[`coder templates push`](../../../reference/cli/templates_push.md), the lock
file will be stored alongside with the other template source code.
> Note: Terraform best practices also recommend checking in your
> [!NOTE]
> Terraform best practices also recommend checking in your
> `.terraform.lock.hcl` into Git or other VCS.
The next time a workspace is built from that template, Coder will make sure to
docs/admin/templates/managing-templates/image-management.md
+10 -10
View File
@@ -11,9 +11,9 @@ practices around managing workspaces images for Coder.
3. Allow developers to bring their own images and customizations with Dev
Containers
> Note: An image is just one of the many properties defined within the template.
> Templates can pull images from a public image registry (e.g. Docker Hub) or an
> internal one, thanks to Terraform.
An image is just one of the many properties defined within the template.
Templates can pull images from a public image registry (e.g. Docker Hub) or an
internal one, thanks to Terraform.
## Create a minimal base image
@@ -31,9 +31,9 @@ to consider:
`docker`, `bash`, `jq`, and/or internal tooling
- Consider creating (and starting the container with) a non-root user
> See Coder's
> [example base image](https://github.com/coder/enterprise-images/tree/main/images/minimal)
> for reference.
See Coder's
[example base image](https://github.com/coder/enterprise-images/tree/main/images/minimal)
for reference.
## Create general-purpose golden image(s) with standard tooling
@@ -54,10 +54,10 @@ purpose images are great for:
stacks and types of projects, the golden image can be a good starting point
for those projects.
> This is often referred to as a "sandbox" or "kitchen sink" image. Since large
> multi-purpose container images can quickly become difficult to maintain, it's
> important to keep the number of general-purpose images to a minimum (2-3 in
> most cases) with a well-defined scope.
This is often referred to as a "sandbox" or "kitchen sink" image. Since large
multi-purpose container images can quickly become difficult to maintain, it's
important to keep the number of general-purpose images to a minimum (2-3 in
most cases) with a well-defined scope.
Examples:
docs/admin/templates/managing-templates/index.md
+6 -8
View File
@@ -27,8 +27,8 @@ here!
If you prefer to use Coder on the
[command line](../../../reference/cli/index.md), `coder templates init`.
> Coder starter templates are also available on our
> [GitHub repo](https://github.com/coder/coder/tree/main/examples/templates).
Coder starter templates are also available on our
[GitHub repo](https://github.com/coder/coder/tree/main/examples/templates).
## Community Templates
@@ -46,6 +46,7 @@ any template's files directly in the Coder dashboard.
If you'd prefer to use the CLI, use `coder templates pull`, edit the template
files, then `coder templates push`.
> [!TIP]
> Even if you are a Terraform expert, we suggest reading our
> [guided tour of a template](../../../tutorials/template-from-scratch.md).
@@ -60,12 +61,9 @@ infrastructure, software, or security patches. Learn more about
### Template update policies
<blockquote class="info">
Template update policies are an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Template update policies are an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Licensed template admins may want workspaces to always remain on the latest
version of their parent template. To do so, enable **Template Update Policies**
docs/admin/templates/managing-templates/schedule.md
+15 -30
View File
@@ -28,12 +28,9 @@ manage infrastructure costs.
## Failure cleanup
<blockquote class="info">
Failure cleanup is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Failure cleanup is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Failure cleanup defines how long a workspace is permitted to remain in the
failed state prior to being automatically stopped. Failure cleanup is only
@@ -41,12 +38,9 @@ available for licensed customers.
## Dormancy threshold
<blockquote class="info">
Dormancy threshold is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Dormancy threshold is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Dormancy Threshold defines how long Coder allows a workspace to remain inactive
before being moved into a dormant state. A workspace's inactivity is determined
@@ -58,12 +52,9 @@ only available for licensed customers.
## Dormancy auto-deletion
<blockquote class="info">
Dormancy auto-deletion is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Dormancy auto-deletion is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Dormancy Auto-Deletion allows a template admin to dictate how long a workspace
is permitted to remain dormant before it is automatically deleted. Dormancy
@@ -71,12 +62,9 @@ Auto-Deletion is only available for licensed customers.
## Autostop requirement
<blockquote class="info">
Autostop requirement is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Autostop requirement is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Autostop requirement is a template setting that determines how often workspaces
using the template must automatically stop. Autostop requirement ignores any
@@ -108,12 +96,9 @@ requirement during the deprecation period, but only one can be used at a time.
## User quiet hours
<blockquote class="info">
User quiet hours are an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> User quiet hours are an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
User quiet hours can be configured in the user's schedule settings page.
Workspaces on templates with an autostop requirement will only be forcibly
docs/admin/templates/open-in-coder.md
+2 -1
View File
@@ -46,7 +46,8 @@ resource "coder_agent" "dev" {
}
```
> Note: The `dir` attribute can be set in multiple ways, for example:
> [!NOTE]
> The `dir` attribute can be set in multiple ways, for example:
>
> - `~/coder`
> - `/home/coder/coder`
docs/admin/templates/template-permissions.md
+3 -8
View File
@@ -1,11 +1,8 @@
# Permissions
<blockquote class="info">
Template permissions are an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Template permissions are a Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Licensed Coder administrators can control who can use and modify the template.
@@ -24,5 +21,3 @@ user can use the template to create a workspace. To prevent this, disable the
`Allow everyone to use the template` setting when creating a template.
![Create Template Permissions](../../images/templates/create-template-permissions.png)
Permissions is a premium-only feature.
docs/admin/templates/troubleshooting.md
+4 -2
View File
@@ -144,7 +144,8 @@ if [ $status -ne 0 ]; then
fi
```
> **Note:** We don't use `set -x` here because we're manually echoing the
> [!NOTE]
> We don't use `set -x` here because we're manually echoing the
> commands. This protects against sensitive information being shown in the log.
This script tells us what command is being run and what the exit status is. If
@@ -152,7 +153,8 @@ the exit status is non-zero, it means the command failed and we exit the script.
Since we are manually checking the exit status here, we don't need `set -e` at
the top of the script to exit on error.
> **Note:** If you aren't seeing any logs, check that the `dir` directive points
> [!NOTE]
> If you aren't seeing any logs, check that the `dir` directive points
> to a valid directory in the file system.
## Slow workspace startup times
docs/admin/users/github-auth.md
+16 -15
View File
@@ -47,12 +47,12 @@ GitHub will ask you for the following Coder parameters:
`https://coder.domain.com`)
- **User Authorization Callback URL**: Set to `https://coder.domain.com`
> Note: If you want to allow multiple coder deployments hosted on subdomains
> e.g. coder1.domain.com, coder2.domain.com, to be able to authenticate with the
> same GitHub OAuth app, then you can set **User Authorization Callback URL** to
> the `https://domain.com`
If you want to allow multiple Coder deployments hosted on subdomains, such as
`coder1.domain.com`, `coder2.domain.com`, to authenticate with the
same GitHub OAuth app, then you can set **User Authorization Callback URL** to
the `https://domain.com`
Note the Client ID and Client Secret generated by GitHub. You will use these
Take note of the Client ID and Client Secret generated by GitHub. You will use these
values in the next step.
Coder will need permission to access user email addresses. Find the "Account
@@ -67,8 +67,8 @@ server:
coder server --oauth2-github-allow-signups=true --oauth2-github-allowed-orgs="your-org" --oauth2-github-client-id="8d1...e05" --oauth2-github-client-secret="57ebc9...02c24c"
```
> For GitHub Enterprise support, specify the
> `--oauth2-github-enterprise-base-url` flag.
> [!NOTE]
> For GitHub Enterprise support, specify the `--oauth2-github-enterprise-base-url` flag.
Alternatively, if you are running Coder as a system service, you can achieve the
same result as the command above by adding the following environment variables
@@ -81,11 +81,12 @@ CODER_OAUTH2_GITHUB_CLIENT_ID="8d1...e05"
CODER_OAUTH2_GITHUB_CLIENT_SECRET="57ebc9...02c24c"
```
**Note:** To allow everyone to signup using GitHub, set:
```env
CODER_OAUTH2_GITHUB_ALLOW_EVERYONE=true
```
> [!TIP]
> To allow everyone to sign up using GitHub, set:
>
> ```env
> CODER_OAUTH2_GITHUB_ALLOW_EVERYONE=true
> ```
Once complete, run `sudo service coder restart` to reboot Coder.
@@ -115,9 +116,9 @@ To upgrade Coder, run:
helm upgrade <release-name> coder-v2/coder -n <namespace> -f values.yaml
```
> We recommend requiring and auditing MFA usage for all users in your GitHub
> organizations. This can be enforced from the organization settings page in the
> "Authentication security" sidebar tab.
We recommend requiring and auditing MFA usage for all users in your GitHub
organizations. This can be enforced from the organization settings page in the
"Authentication security" sidebar tab.
## Device Flow
docs/admin/users/groups-roles.md
+3 -6
View File
@@ -33,12 +33,9 @@ may use personal workspaces.
## Custom Roles
<blockquote class="info">
Custom roles are a Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> Custom roles are a Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Starting in v2.16.0, Premium Coder deployments can configure custom roles on the
[Organization](./organizations.md) level. You can create and assign custom roles
docs/admin/users/headless-auth.md
+1 -1
View File
@@ -4,7 +4,7 @@ Headless user accounts that cannot use the web UI to log in to Coder. This is
useful for creating accounts for automated systems, such as CI/CD pipelines or
for users who only consume Coder via another client/API.
> You must have the User Admin role or above to create headless users.
You must have the User Admin role or above to create headless users.
## Create a headless user
docs/admin/users/idp-sync.md
+18 -35
View File
@@ -1,12 +1,9 @@
<!-- markdownlint-disable MD024 -->
# IdP Sync
<blockquote class="info">
IdP sync is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> IdP sync is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
IdP (Identity provider) sync allows you to use OpenID Connect (OIDC) to
synchronize Coder groups, roles, and organizations based on claims from your IdP.
@@ -110,13 +107,10 @@ Below is an example that uses the `groups` claim and maps all groups prefixed by
}
```
<blockquote class="admonition note">
You must specify Coder group IDs instead of group names. The fastest way to find
the ID for a corresponding group is by visiting
`https://coder.example.com/api/v2/groups`.
</blockquote>
> [!IMPORTANT]
> You must specify Coder group IDs instead of group names. The fastest way to find
> the ID for a corresponding group is by visiting
> `https://coder.example.com/api/v2/groups`.
Here is another example which maps `coder-admins` from the identity provider to
two groups in Coder and `coder-users` from the identity provider to another
@@ -151,13 +145,9 @@ Visit the Coder UI to confirm these changes:
### Server Flags
<blockquote class="admonition note">
Use server flags only with Coder deployments with a single organization.
You can use the dashboard to configure group sync instead.
</blockquote>
> [!NOTE]
> Use server flags only with Coder deployments with a single organization.
> You can use the dashboard to configure group sync instead.
1. Configure the Coder server to read groups from the claim name with the
[OIDC group field](../../reference/cli/server.md#--oidc-group-field) server
@@ -284,13 +274,9 @@ role:
}
```
<blockquote class="admonition note">
Be sure to use the `name` field for each role, not the display name. Use
`coder organization roles show --org=<your-org>` to see roles for your
organization.
</blockquote>
> [!NOTE]
> Be sure to use the `name` field for each role, not the display name.
> Use `coder organization roles show --org=<your-org>` to see roles for your organization.
To set these role sync settings, use the following command:
@@ -306,13 +292,9 @@ Visit the Coder UI to confirm these changes:
### Server Flags
<blockquote class="admonition note">
Use server flags only with Coder deployments with a single organization.
You can use the dashboard to configure role sync instead.
</blockquote>
> [!NOTE]
> Use server flags only with Coder deployments with a single organization.
> You can use the dashboard to configure role sync instead.
1. Configure the Coder server to read groups from the claim name with the
[OIDC role field](../../reference/cli/server.md#--oidc-user-role-field)
@@ -539,7 +521,8 @@ Below are some details specific to individual OIDC providers.
### Active Directory Federation Services (ADFS)
> **Note:** Tested on ADFS 4.0, Windows Server 2019
> [!NOTE]
> Tested on ADFS 4.0, Windows Server 2019
1. In your Federation Server, create a new application group for Coder.
Follow the steps as described in the [Windows Server documentation]
docs/admin/users/index.md
+1
View File
@@ -166,6 +166,7 @@ You can also reset a password via the CLI:
coder reset-password <username>
```
> [!NOTE]
> Resetting a user's password, e.g., the initial `owner` role-based user, only
> works when run on the host running the Coder control plane.
docs/admin/users/oidc-auth.md
+11 -10
View File
@@ -32,7 +32,8 @@ signing in via OIDC as a new user. Coder will log the claim fields returned by
the upstream identity provider in a message containing the string
`got oidc claims`, as well as the user info returned.
> **Note:** If you need to ensure that Coder only uses information from the ID
> [!NOTE]
> If you need to ensure that Coder only uses information from the ID
> token and does not hit the UserInfo endpoint, you can set the configuration
> option `CODER_OIDC_IGNORE_USERINFO=true`.
@@ -44,7 +45,8 @@ for the newly created user's email address.
If your upstream identity provider users a different claim, you can set
`CODER_OIDC_EMAIL_FIELD` to the desired claim.
> **Note** If this field is not present, Coder will attempt to use the claim
> [!NOTE]
> If this field is not present, Coder will attempt to use the claim
> field configured for `username` as an email address. If this field is not a
> valid email address, OIDC logins will fail.
@@ -59,7 +61,8 @@ disable this behavior with the following setting:
CODER_OIDC_IGNORE_EMAIL_VERIFIED=true
```
> **Note:** This will cause Coder to implicitly treat all OIDC emails as
> [!NOTE]
> This will cause Coder to implicitly treat all OIDC emails as
> "verified", regardless of what the upstream identity provider says.
### Usernames
@@ -70,7 +73,8 @@ claim field named `preferred_username` as the the username.
If your upstream identity provider uses a different claim, you can set
`CODER_OIDC_USERNAME_FIELD` to the desired claim.
> **Note:** If this claim is empty, the email address will be stripped of the
> [!NOTE]
> If this claim is empty, the email address will be stripped of the
> domain, and become the username (e.g. `example@coder.com` becomes `example`).
> To avoid conflicts, Coder may also append a random word to the resulting
> username.
@@ -99,12 +103,9 @@ CODER_DISABLE_PASSWORD_AUTH=true
## SCIM
<blockquote class="info">
SCIM is an Enterprise and Premium feature.
[Learn more](https://coder.com/pricing#compare-plans).
</blockquote>
> [!NOTE]
> SCIM is an Enterprise and Premium feature.
> [Learn more](https://coder.com/pricing#compare-plans).
Coder supports user provisioning and deprovisioning via SCIM 2.0 with header
authentication. Upon deactivation, users are
docs/admin/users/organizations.md
+2 -1
View File
@@ -1,6 +1,7 @@
# Organizations (Premium)
> Note: Organizations requires a
> [!NOTE]
> Organizations requires a
> [Premium license](https://coder.com/pricing#compare-plans). For more details,
> [contact your account team](https://coder.com/contact).
docs/admin/users/password-auth.md
+2 -1
View File
@@ -15,7 +15,8 @@ If you remove the admin user account (or forget the password), you can run the
[`coder server create-admin-user`](../../reference/cli/server_create-admin-user.md)command
on your server.
> Note: You must run this command on the same machine running the Coder server.
> [!IMPORTANT]
> You must run this command on the same machine running the Coder server.
> If you are running Coder on Kubernetes, this means using
> [kubectl exec](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_exec/)
> to exec into the pod.