fix: disable relay if built-in DERP is disabled (#12654)

Fixes https://github.com/coder/coder/issues/12493

enterprise/cli/server.go

@@ -37,41 +37,42 @@ func (r *RootCmd) Server(_ func()) *serpent.Command {
 			}
 		}
 
-		options.DERPServer = derp.NewServer(key.NewNode(), tailnet.Logger(options.Logger.Named("derp")))
+		if options.DeploymentValues.DERP.Server.Enable {
+			options.DERPServer = derp.NewServer(key.NewNode(), tailnet.Logger(options.Logger.Named("derp")))
+			var meshKey string
+			err := options.Database.InTx(func(tx database.Store) error {
+				// This will block until the lock is acquired, and will be
+				// automatically released when the transaction ends.
+				err := tx.AcquireLock(ctx, database.LockIDEnterpriseDeploymentSetup)
+				if err != nil {
+					return xerrors.Errorf("acquire lock: %w", err)
+				}
 
-		var meshKey string
-		err := options.Database.InTx(func(tx database.Store) error {
-			// This will block until the lock is acquired, and will be
-			// automatically released when the transaction ends.
-			err := tx.AcquireLock(ctx, database.LockIDEnterpriseDeploymentSetup)
-			if err != nil {
-				return xerrors.Errorf("acquire lock: %w", err)
-			}
-
-			meshKey, err = tx.GetDERPMeshKey(ctx)
-			if err == nil {
+				meshKey, err = tx.GetDERPMeshKey(ctx)
+				if err == nil {
+					return nil
+				}
+				if !errors.Is(err, sql.ErrNoRows) {
+					return xerrors.Errorf("get DERP mesh key: %w", err)
+				}
+				meshKey, err = cryptorand.String(32)
+				if err != nil {
+					return xerrors.Errorf("generate DERP mesh key: %w", err)
+				}
+				err = tx.InsertDERPMeshKey(ctx, meshKey)
+				if err != nil {
+					return xerrors.Errorf("insert DERP mesh key: %w", err)
+				}
 				return nil
-			}
-			if !errors.Is(err, sql.ErrNoRows) {
-				return xerrors.Errorf("get DERP mesh key: %w", err)
-			}
-			meshKey, err = cryptorand.String(32)
+			}, nil)
 			if err != nil {
-				return xerrors.Errorf("generate DERP mesh key: %w", err)
+				return nil, nil, err
 			}
-			err = tx.InsertDERPMeshKey(ctx, meshKey)
-			if err != nil {
-				return xerrors.Errorf("insert DERP mesh key: %w", err)
+			if meshKey == "" {
+				return nil, nil, xerrors.New("mesh key is empty")
 			}
-			return nil
-		}, nil)
-		if err != nil {
-			return nil, nil, err
+			options.DERPServer.SetMeshKey(meshKey)
 		}
-		if meshKey == "" {
-			return nil, nil, xerrors.New("mesh key is empty")
-		}
-		options.DERPServer.SetMeshKey(meshKey)
 
 		options.Auditor = audit.NewAuditor(
 			options.Database,

enterprise/cli/server_test.go

@@ -1,38 +1,43 @@
 package cli_test
 
 import (
-	"fmt"
+	"context"
 	"io"
 	"net/http"
+	"net/url"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/config"
 	"github.com/coder/coder/v2/enterprise/cli"
 	"github.com/coder/coder/v2/testutil"
 )
 
 // TestServer runs the enterprise server command
 // and waits for /healthz to return "OK".
-func TestServer(t *testing.T) {
+func TestServer_Single(t *testing.T) {
 	t.Parallel()
 
+	ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancelFunc()
+
 	var root cli.RootCmd
 	cmd, err := root.Command(root.EnterpriseSubcommands())
 	require.NoError(t, err)
-	port := testutil.RandomPort(t)
-	inv, _ := clitest.NewWithCommand(t, cmd,
+	inv, cfg := clitest.NewWithCommand(t, cmd,
 		"server",
 		"--in-memory",
-		"--http-address", fmt.Sprintf(":%d", port),
+		"--http-address", ":0",
 		"--access-url", "http://example.com",
 	)
-	waiter := clitest.StartWithWaiter(t, inv)
+	clitest.Start(t, inv.WithContext(ctx))
+	accessURL := waitAccessURL(t, cfg)
 	require.Eventually(t, func() bool {
 		reqCtx := testutil.Context(t, testutil.IntervalMedium)
-		req, err := http.NewRequestWithContext(reqCtx, http.MethodGet, fmt.Sprintf("http://localhost:%d/healthz", port), nil)
+		req, err := http.NewRequestWithContext(reqCtx, http.MethodGet, accessURL.String()+"/healthz", nil)
 		if err != nil {
 			panic(err)
 		}
@@ -48,5 +53,20 @@ func TestServer(t *testing.T) {
 		}
 		return assert.Equal(t, "OK", string(bs))
 	}, testutil.WaitShort, testutil.IntervalMedium)
-	waiter.Cancel()
+}
+
+func waitAccessURL(t *testing.T, cfg config.Root) *url.URL {
+	t.Helper()
+
+	var err error
+	var rawURL string
+	require.Eventually(t, func() bool {
+		rawURL, err = cfg.URL().Read()
+		return err == nil && rawURL != ""
+	}, testutil.WaitLong, testutil.IntervalFast, "failed to get access URL")
+
+	accessURL, err := url.Parse(rawURL)
+	require.NoError(t, err, "failed to parse access URL")
+
+	return accessURL
 }