feat: add server flag to force DERP to use always websockets (#9238)

enterprise/cli/testdata/coder_server_--help.golden

@@ -172,6 +172,13 @@ backed by Tailscale and WireGuard.
           URL to fetch a DERP mapping on startup. See:
           https://tailscale.com/kb/1118/custom-derp-servers/.
 
+      --derp-force-websockets bool, $CODER_DERP_FORCE_WEBSOCKETS
+          Force clients and agents to always use WebSocket to connect to DERP
+          relay servers. By default, DERP uses `Upgrade: derp`, which may cause
+          issues with some reverse proxies. Clients may automatically fallback
+          to WebSocket if they detect an issue with `Upgrade: derp`, but this
+          does not work in all situations.
+
       --derp-server-enable bool, $CODER_DERP_SERVER_ENABLE (default: true)
           Whether to enable or disable the embedded DERP relay server.
 

enterprise/coderd/workspaceproxy.go

@@ -717,11 +717,12 @@ func (api *API) workspaceProxyRegister(rw http.ResponseWriter, r *http.Request)
 
 	// aReq.New = updatedProxy
 	httpapi.Write(ctx, rw, http.StatusCreated, wsproxysdk.RegisterWorkspaceProxyResponse{
-		AppSecurityKey:  api.AppSecurityKey.String(),
-		DERPMeshKey:     api.DERPServer.MeshKey(),
-		DERPRegionID:    regionID,
-		DERPMap:         api.AGPL.DERPMap(),
-		SiblingReplicas: siblingsRes,
+		AppSecurityKey:      api.AppSecurityKey.String(),
+		DERPMeshKey:         api.DERPServer.MeshKey(),
+		DERPRegionID:        regionID,
+		DERPMap:             api.AGPL.DERPMap(),
+		DERPForceWebSockets: api.DeploymentValues.DERP.Config.ForceWebSockets.Value(),
+		SiblingReplicas:     siblingsRes,
 	})
 
 	go api.forceWorkspaceProxyHealthUpdate(api.ctx)

enterprise/wsproxy/wsproxy.go

@@ -11,6 +11,7 @@ import (
 	"reflect"
 	"regexp"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/go-chi/chi/v5"
@@ -121,7 +122,7 @@ type Server struct {
 
 	// DERP
 	derpMesh      *derpmesh.Mesh
-	latestDERPMap *tailcfg.DERPMap
+	latestDERPMap atomic.Pointer[tailcfg.DERPMap]
 
 	// Used for graceful shutdown. Required for the dialer.
 	ctx           context.Context
@@ -247,8 +248,9 @@ func New(ctx context.Context, opts *Options) (*Server, error) {
 			s.Logger,
 			nil,
 			func() *tailcfg.DERPMap {
-				return s.latestDERPMap
+				return s.latestDERPMap.Load()
 			},
+			regResp.DERPForceWebSockets,
 			s.DialCoordinator,
 			wsconncache.New(s.DialWorkspaceAgent, 0),
 			s.TracerProvider,
@@ -455,7 +457,7 @@ func (s *Server) handleRegister(_ context.Context, res wsproxysdk.RegisterWorksp
 	}
 	s.derpMesh.SetAddresses(addresses, false)
 
-	s.latestDERPMap = res.DERPMap
+	s.latestDERPMap.Store(res.DERPMap)
 
 	return nil
 }

enterprise/wsproxy/wsproxysdk/wsproxysdk.go

@@ -207,10 +207,11 @@ type RegisterWorkspaceProxyRequest struct {
 }
 
 type RegisterWorkspaceProxyResponse struct {
-	AppSecurityKey string           `json:"app_security_key"`
-	DERPMeshKey    string           `json:"derp_mesh_key"`
-	DERPRegionID   int32            `json:"derp_region_id"`
-	DERPMap        *tailcfg.DERPMap `json:"derp_map"`
+	AppSecurityKey      string           `json:"app_security_key"`
+	DERPMeshKey         string           `json:"derp_mesh_key"`
+	DERPRegionID        int32            `json:"derp_region_id"`
+	DERPMap             *tailcfg.DERPMap `json:"derp_map"`
+	DERPForceWebSockets bool             `json:"derp_force_websockets"`
 	// SiblingReplicas is a list of all other replicas of the proxy that have
 	// not timed out.
 	SiblingReplicas []codersdk.Replica `json:"sibling_replicas"`