feat: improve resources_monitoring for OOM & OOD monitoring (#16241)

As requested for [this
issue](https://github.com/coder/internal/issues/245) we need to have a
new resource `resources_monitoring` in the agent.

It needs to be parsed from the provisioner and inserted into a new db
table.

cli/testdata/coder_provisioner_list_--output_json.golden

@@ -7,7 +7,7 @@
     "last_seen_at": "====[timestamp]=====",
     "name": "test",
     "version": "v0.0.0-devel",
-    "api_version": "1.2",
+    "api_version": "1.3",
     "provisioners": [
       "echo"
     ],

coderd/apidoc/docs.go

@@ -13475,6 +13475,7 @@ const docTemplate = `{
                 "template",
                 "user",
                 "workspace",
+                "workspace_agent_resource_monitor",
                 "workspace_dormant",
                 "workspace_proxy"
             ],
@@ -13510,6 +13511,7 @@ const docTemplate = `{
                 "ResourceTemplate",
                 "ResourceUser",
                 "ResourceWorkspace",
+                "ResourceWorkspaceAgentResourceMonitor",
                 "ResourceWorkspaceDormant",
                 "ResourceWorkspaceProxy"
             ]

coderd/apidoc/swagger.json

@@ -12178,6 +12178,7 @@
 				"template",
 				"user",
 				"workspace",
+				"workspace_agent_resource_monitor",
 				"workspace_dormant",
 				"workspace_proxy"
 			],
@@ -12213,6 +12214,7 @@
 				"ResourceTemplate",
 				"ResourceUser",
 				"ResourceWorkspace",
+				"ResourceWorkspaceAgentResourceMonitor",
 				"ResourceWorkspaceDormant",
 				"ResourceWorkspaceProxy"
 			]

coderd/database/dbauthz/dbauthz.go

@@ -1391,6 +1391,14 @@ func (q *querier) FavoriteWorkspace(ctx context.Context, id uuid.UUID) error {
 	return update(q.log, q.auth, fetch, q.db.FavoriteWorkspace)(ctx, id)
 }
 
+func (q *querier) FetchMemoryResourceMonitorsByAgentID(ctx context.Context, agentID uuid.UUID) (database.WorkspaceAgentMemoryResourceMonitor, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspaceAgentResourceMonitor); err != nil {
+		return database.WorkspaceAgentMemoryResourceMonitor{}, err
+	}
+
+	return q.db.FetchMemoryResourceMonitorsByAgentID(ctx, agentID)
+}
+
 func (q *querier) FetchNewMessageMetadata(ctx context.Context, arg database.FetchNewMessageMetadataParams) (database.FetchNewMessageMetadataRow, error) {
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceNotificationMessage); err != nil {
 		return database.FetchNewMessageMetadataRow{}, err
@@ -1398,6 +1406,14 @@ func (q *querier) FetchNewMessageMetadata(ctx context.Context, arg database.Fetc
 	return q.db.FetchNewMessageMetadata(ctx, arg)
 }
 
+func (q *querier) FetchVolumesResourceMonitorsByAgentID(ctx context.Context, agentID uuid.UUID) ([]database.WorkspaceAgentVolumeResourceMonitor, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspaceAgentResourceMonitor); err != nil {
+		return nil, err
+	}
+
+	return q.db.FetchVolumesResourceMonitorsByAgentID(ctx, agentID)
+}
+
 func (q *querier) GetAPIKeyByID(ctx context.Context, id string) (database.APIKey, error) {
 	return fetch(q.log, q.auth, q.db.GetAPIKeyByID)(ctx, id)
 }
@@ -3003,6 +3019,14 @@ func (q *querier) InsertLicense(ctx context.Context, arg database.InsertLicenseP
 	return q.db.InsertLicense(ctx, arg)
 }
 
+func (q *querier) InsertMemoryResourceMonitor(ctx context.Context, arg database.InsertMemoryResourceMonitorParams) (database.WorkspaceAgentMemoryResourceMonitor, error) {
+	if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceWorkspaceAgentResourceMonitor); err != nil {
+		return database.WorkspaceAgentMemoryResourceMonitor{}, err
+	}
+
+	return q.db.InsertMemoryResourceMonitor(ctx, arg)
+}
+
 func (q *querier) InsertMissingGroups(ctx context.Context, arg database.InsertMissingGroupsParams) ([]database.Group, error) {
 	if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceSystem); err != nil {
 		return nil, err
@@ -3195,6 +3219,14 @@ func (q *querier) InsertUserLink(ctx context.Context, arg database.InsertUserLin
 	return q.db.InsertUserLink(ctx, arg)
 }
 
+func (q *querier) InsertVolumeResourceMonitor(ctx context.Context, arg database.InsertVolumeResourceMonitorParams) (database.WorkspaceAgentVolumeResourceMonitor, error) {
+	if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceWorkspaceAgentResourceMonitor); err != nil {
+		return database.WorkspaceAgentVolumeResourceMonitor{}, err
+	}
+
+	return q.db.InsertVolumeResourceMonitor(ctx, arg)
+}
+
 func (q *querier) InsertWorkspace(ctx context.Context, arg database.InsertWorkspaceParams) (database.WorkspaceTable, error) {
 	obj := rbac.ResourceWorkspace.WithOwner(arg.OwnerID.String()).InOrg(arg.OrganizationID)
 	tpl, err := q.GetTemplateByID(ctx, arg.TemplateID)

coderd/database/dbauthz/dbauthz_test.go

@@ -4562,3 +4562,96 @@ func (s *MethodTestSuite) TestOAuth2ProviderAppTokens() {
 		}).Asserts(rbac.ResourceOauth2AppCodeToken.WithOwner(user.ID.String()), policy.ActionDelete)
 	}))
 }
+
+func (s *MethodTestSuite) TestResourcesMonitor() {
+	s.Run("InsertMemoryResourceMonitor", s.Subtest(func(db database.Store, check *expects) {
+		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
+		check.Args(database.InsertMemoryResourceMonitorParams{}).Asserts(rbac.ResourceWorkspaceAgentResourceMonitor, policy.ActionCreate)
+	}))
+
+	s.Run("InsertVolumeResourceMonitor", s.Subtest(func(db database.Store, check *expects) {
+		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
+		check.Args(database.InsertVolumeResourceMonitorParams{}).Asserts(rbac.ResourceWorkspaceAgentResourceMonitor, policy.ActionCreate)
+	}))
+
+	s.Run("FetchMemoryResourceMonitorsByAgentID", s.Subtest(func(db database.Store, check *expects) {
+		u := dbgen.User(s.T(), db, database.User{})
+		o := dbgen.Organization(s.T(), db, database.Organization{})
+		tpl := dbgen.Template(s.T(), db, database.Template{
+			OrganizationID: o.ID,
+			CreatedBy:      u.ID,
+		})
+		tv := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
+			TemplateID:     uuid.NullUUID{UUID: tpl.ID, Valid: true},
+			OrganizationID: o.ID,
+			CreatedBy:      u.ID,
+		})
+		w := dbgen.Workspace(s.T(), db, database.WorkspaceTable{
+			TemplateID:     tpl.ID,
+			OrganizationID: o.ID,
+			OwnerID:        u.ID,
+		})
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
+			Type: database.ProvisionerJobTypeWorkspaceBuild,
+		})
+		b := dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{
+			JobID:             j.ID,
+			WorkspaceID:       w.ID,
+			TemplateVersionID: tv.ID,
+		})
+		res := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: b.JobID})
+		agt := dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{ResourceID: res.ID})
+		dbgen.WorkspaceAgentMemoryResourceMonitor(s.T(), db, database.WorkspaceAgentMemoryResourceMonitor{
+			AgentID:   agt.ID,
+			Enabled:   true,
+			Threshold: 80,
+			CreatedAt: dbtime.Now(),
+		})
+
+		monitor, err := db.FetchMemoryResourceMonitorsByAgentID(context.Background(), agt.ID)
+		require.NoError(s.T(), err)
+
+		check.Args(agt.ID).Asserts(rbac.ResourceWorkspaceAgentResourceMonitor, policy.ActionRead).Returns(monitor)
+	}))
+
+	s.Run("FetchVolumesResourceMonitorsByAgentID", s.Subtest(func(db database.Store, check *expects) {
+		u := dbgen.User(s.T(), db, database.User{})
+		o := dbgen.Organization(s.T(), db, database.Organization{})
+		tpl := dbgen.Template(s.T(), db, database.Template{
+			OrganizationID: o.ID,
+			CreatedBy:      u.ID,
+		})
+		tv := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
+			TemplateID:     uuid.NullUUID{UUID: tpl.ID, Valid: true},
+			OrganizationID: o.ID,
+			CreatedBy:      u.ID,
+		})
+		w := dbgen.Workspace(s.T(), db, database.WorkspaceTable{
+			TemplateID:     tpl.ID,
+			OrganizationID: o.ID,
+			OwnerID:        u.ID,
+		})
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
+			Type: database.ProvisionerJobTypeWorkspaceBuild,
+		})
+		b := dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{
+			JobID:             j.ID,
+			WorkspaceID:       w.ID,
+			TemplateVersionID: tv.ID,
+		})
+		res := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: b.JobID})
+		agt := dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{ResourceID: res.ID})
+		dbgen.WorkspaceAgentVolumeResourceMonitor(s.T(), db, database.WorkspaceAgentVolumeResourceMonitor{
+			AgentID:   agt.ID,
+			Path:      "/var/lib",
+			Enabled:   true,
+			Threshold: 80,
+			CreatedAt: dbtime.Now(),
+		})
+
+		monitors, err := db.FetchVolumesResourceMonitorsByAgentID(context.Background(), agt.ID)
+		require.NoError(s.T(), err)
+
+		check.Args(agt.ID).Asserts(rbac.ResourceWorkspaceAgentResourceMonitor, policy.ActionRead).Returns(monitors)
+	}))
+}

coderd/database/dbgen/dbgen.go

@@ -1032,6 +1032,29 @@ func OAuth2ProviderAppToken(t testing.TB, db database.Store, seed database.OAuth
 	return token
 }
 
+func WorkspaceAgentMemoryResourceMonitor(t testing.TB, db database.Store, seed database.WorkspaceAgentMemoryResourceMonitor) database.WorkspaceAgentMemoryResourceMonitor {
+	monitor, err := db.InsertMemoryResourceMonitor(genCtx, database.InsertMemoryResourceMonitorParams{
+		AgentID:   takeFirst(seed.AgentID, uuid.New()),
+		Enabled:   takeFirst(seed.Enabled, true),
+		Threshold: takeFirst(seed.Threshold, 100),
+		CreatedAt: takeFirst(seed.CreatedAt, dbtime.Now()),
+	})
+	require.NoError(t, err, "insert workspace agent memory resource monitor")
+	return monitor
+}
+
+func WorkspaceAgentVolumeResourceMonitor(t testing.TB, db database.Store, seed database.WorkspaceAgentVolumeResourceMonitor) database.WorkspaceAgentVolumeResourceMonitor {
+	monitor, err := db.InsertVolumeResourceMonitor(genCtx, database.InsertVolumeResourceMonitorParams{
+		AgentID:   takeFirst(seed.AgentID, uuid.New()),
+		Path:      takeFirst(seed.Path, "/"),
+		Enabled:   takeFirst(seed.Enabled, true),
+		Threshold: takeFirst(seed.Threshold, 100),
+		CreatedAt: takeFirst(seed.CreatedAt, dbtime.Now()),
+	})
+	require.NoError(t, err, "insert workspace agent volume resource monitor")
+	return monitor
+}
+
 func CustomRole(t testing.TB, db database.Store, seed database.CustomRole) database.CustomRole {
 	role, err := db.InsertCustomRole(genCtx, database.InsertCustomRoleParams{
 		Name:            takeFirst(seed.Name, strings.ToLower(testutil.GetRandomName(t))),

coderd/database/dbmem/dbmem.go

@@ -191,56 +191,58 @@ type data struct {
 	userLinks           []database.UserLink
 
 	// New tables
-	auditLogs                       []database.AuditLog
-	cryptoKeys                      []database.CryptoKey
-	dbcryptKeys                     []database.DBCryptKey
-	files                           []database.File
-	externalAuthLinks               []database.ExternalAuthLink
-	gitSSHKey                       []database.GitSSHKey
-	groupMembers                    []database.GroupMemberTable
-	groups                          []database.Group
-	jfrogXRayScans                  []database.JfrogXrayScan
-	licenses                        []database.License
-	notificationMessages            []database.NotificationMessage
-	notificationPreferences         []database.NotificationPreference
-	notificationReportGeneratorLogs []database.NotificationReportGeneratorLog
-	oauth2ProviderApps              []database.OAuth2ProviderApp
-	oauth2ProviderAppSecrets        []database.OAuth2ProviderAppSecret
-	oauth2ProviderAppCodes          []database.OAuth2ProviderAppCode
-	oauth2ProviderAppTokens         []database.OAuth2ProviderAppToken
-	parameterSchemas                []database.ParameterSchema
-	provisionerDaemons              []database.ProvisionerDaemon
-	provisionerJobLogs              []database.ProvisionerJobLog
-	provisionerJobs                 []database.ProvisionerJob
-	provisionerKeys                 []database.ProvisionerKey
-	replicas                        []database.Replica
-	templateVersions                []database.TemplateVersionTable
-	templateVersionParameters       []database.TemplateVersionParameter
-	templateVersionVariables        []database.TemplateVersionVariable
-	templateVersionWorkspaceTags    []database.TemplateVersionWorkspaceTag
-	templates                       []database.TemplateTable
-	templateUsageStats              []database.TemplateUsageStat
-	workspaceAgents                 []database.WorkspaceAgent
-	workspaceAgentMetadata          []database.WorkspaceAgentMetadatum
-	workspaceAgentLogs              []database.WorkspaceAgentLog
-	workspaceAgentLogSources        []database.WorkspaceAgentLogSource
-	workspaceAgentPortShares        []database.WorkspaceAgentPortShare
-	workspaceAgentScriptTimings     []database.WorkspaceAgentScriptTiming
-	workspaceAgentScripts           []database.WorkspaceAgentScript
-	workspaceAgentStats             []database.WorkspaceAgentStat
-	workspaceApps                   []database.WorkspaceApp
-	workspaceAppStatsLastInsertID   int64
-	workspaceAppStats               []database.WorkspaceAppStat
-	workspaceBuilds                 []database.WorkspaceBuild
-	workspaceBuildParameters        []database.WorkspaceBuildParameter
-	workspaceResourceMetadata       []database.WorkspaceResourceMetadatum
-	workspaceResources              []database.WorkspaceResource
-	workspaceModules                []database.WorkspaceModule
-	workspaces                      []database.WorkspaceTable
-	workspaceProxies                []database.WorkspaceProxy
-	customRoles                     []database.CustomRole
-	provisionerJobTimings           []database.ProvisionerJobTiming
-	runtimeConfig                   map[string]string
+	auditLogs                            []database.AuditLog
+	cryptoKeys                           []database.CryptoKey
+	dbcryptKeys                          []database.DBCryptKey
+	files                                []database.File
+	externalAuthLinks                    []database.ExternalAuthLink
+	gitSSHKey                            []database.GitSSHKey
+	groupMembers                         []database.GroupMemberTable
+	groups                               []database.Group
+	jfrogXRayScans                       []database.JfrogXrayScan
+	licenses                             []database.License
+	notificationMessages                 []database.NotificationMessage
+	notificationPreferences              []database.NotificationPreference
+	notificationReportGeneratorLogs      []database.NotificationReportGeneratorLog
+	oauth2ProviderApps                   []database.OAuth2ProviderApp
+	oauth2ProviderAppSecrets             []database.OAuth2ProviderAppSecret
+	oauth2ProviderAppCodes               []database.OAuth2ProviderAppCode
+	oauth2ProviderAppTokens              []database.OAuth2ProviderAppToken
+	parameterSchemas                     []database.ParameterSchema
+	provisionerDaemons                   []database.ProvisionerDaemon
+	provisionerJobLogs                   []database.ProvisionerJobLog
+	provisionerJobs                      []database.ProvisionerJob
+	provisionerKeys                      []database.ProvisionerKey
+	replicas                             []database.Replica
+	templateVersions                     []database.TemplateVersionTable
+	templateVersionParameters            []database.TemplateVersionParameter
+	templateVersionVariables             []database.TemplateVersionVariable
+	templateVersionWorkspaceTags         []database.TemplateVersionWorkspaceTag
+	templates                            []database.TemplateTable
+	templateUsageStats                   []database.TemplateUsageStat
+	workspaceAgents                      []database.WorkspaceAgent
+	workspaceAgentMetadata               []database.WorkspaceAgentMetadatum
+	workspaceAgentLogs                   []database.WorkspaceAgentLog
+	workspaceAgentLogSources             []database.WorkspaceAgentLogSource
+	workspaceAgentPortShares             []database.WorkspaceAgentPortShare
+	workspaceAgentScriptTimings          []database.WorkspaceAgentScriptTiming
+	workspaceAgentScripts                []database.WorkspaceAgentScript
+	workspaceAgentStats                  []database.WorkspaceAgentStat
+	workspaceAgentMemoryResourceMonitors []database.WorkspaceAgentMemoryResourceMonitor
+	workspaceAgentVolumeResourceMonitors []database.WorkspaceAgentVolumeResourceMonitor
+	workspaceApps                        []database.WorkspaceApp
+	workspaceAppStatsLastInsertID        int64
+	workspaceAppStats                    []database.WorkspaceAppStat
+	workspaceBuilds                      []database.WorkspaceBuild
+	workspaceBuildParameters             []database.WorkspaceBuildParameter
+	workspaceResourceMetadata            []database.WorkspaceResourceMetadatum
+	workspaceResources                   []database.WorkspaceResource
+	workspaceModules                     []database.WorkspaceModule
+	workspaces                           []database.WorkspaceTable
+	workspaceProxies                     []database.WorkspaceProxy
+	customRoles                          []database.CustomRole
+	provisionerJobTimings                []database.ProvisionerJobTiming
+	runtimeConfig                        map[string]string
 	// Locks is a map of lock names. Any keys within the map are currently
 	// locked.
 	locks                            map[int64]struct{}
@@ -2357,6 +2359,16 @@ func (q *FakeQuerier) FavoriteWorkspace(_ context.Context, arg uuid.UUID) error
 	return nil
 }
 
+func (q *FakeQuerier) FetchMemoryResourceMonitorsByAgentID(_ context.Context, agentID uuid.UUID) (database.WorkspaceAgentMemoryResourceMonitor, error) {
+	for _, monitor := range q.workspaceAgentMemoryResourceMonitors {
+		if monitor.AgentID == agentID {
+			return monitor, nil
+		}
+	}
+
+	return database.WorkspaceAgentMemoryResourceMonitor{}, sql.ErrNoRows
+}
+
 func (q *FakeQuerier) FetchNewMessageMetadata(_ context.Context, arg database.FetchNewMessageMetadataParams) (database.FetchNewMessageMetadataRow, error) {
 	err := validateDatabaseType(arg)
 	if err != nil {
@@ -2389,6 +2401,18 @@ func (q *FakeQuerier) FetchNewMessageMetadata(_ context.Context, arg database.Fe
 	}, nil
 }
 
+func (q *FakeQuerier) FetchVolumesResourceMonitorsByAgentID(_ context.Context, agentID uuid.UUID) ([]database.WorkspaceAgentVolumeResourceMonitor, error) {
+	monitors := []database.WorkspaceAgentVolumeResourceMonitor{}
+
+	for _, monitor := range q.workspaceAgentVolumeResourceMonitors {
+		if monitor.AgentID == agentID {
+			monitors = append(monitors, monitor)
+		}
+	}
+
+	return monitors, nil
+}
+
 func (q *FakeQuerier) GetAPIKeyByID(_ context.Context, id string) (database.APIKey, error) {
 	q.mutex.RLock()
 	defer q.mutex.RUnlock()
@@ -7795,6 +7819,21 @@ func (q *FakeQuerier) InsertLicense(
 	return l, nil
 }
 
+func (q *FakeQuerier) InsertMemoryResourceMonitor(_ context.Context, arg database.InsertMemoryResourceMonitorParams) (database.WorkspaceAgentMemoryResourceMonitor, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return database.WorkspaceAgentMemoryResourceMonitor{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	monitor := database.WorkspaceAgentMemoryResourceMonitor(arg)
+
+	q.workspaceAgentMemoryResourceMonitors = append(q.workspaceAgentMemoryResourceMonitors, monitor)
+	return monitor, nil
+}
+
 func (q *FakeQuerier) InsertMissingGroups(_ context.Context, arg database.InsertMissingGroupsParams) ([]database.Group, error) {
 	err := validateDatabaseType(arg)
 	if err != nil {
@@ -8422,6 +8461,27 @@ func (q *FakeQuerier) InsertUserLink(_ context.Context, args database.InsertUser
 	return link, nil
 }
 
+func (q *FakeQuerier) InsertVolumeResourceMonitor(_ context.Context, arg database.InsertVolumeResourceMonitorParams) (database.WorkspaceAgentVolumeResourceMonitor, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return database.WorkspaceAgentVolumeResourceMonitor{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	monitor := database.WorkspaceAgentVolumeResourceMonitor{
+		AgentID:   arg.AgentID,
+		Path:      arg.Path,
+		Enabled:   arg.Enabled,
+		Threshold: arg.Threshold,
+		CreatedAt: arg.CreatedAt,
+	}
+
+	q.workspaceAgentVolumeResourceMonitors = append(q.workspaceAgentVolumeResourceMonitors, monitor)
+	return monitor, nil
+}
+
 func (q *FakeQuerier) InsertWorkspace(_ context.Context, arg database.InsertWorkspaceParams) (database.WorkspaceTable, error) {
 	if err := validateDatabaseType(arg); err != nil {
 		return database.WorkspaceTable{}, err

coderd/database/dbmetrics/querymetrics.go

@@ -434,6 +434,13 @@ func (m queryMetricsStore) FavoriteWorkspace(ctx context.Context, arg uuid.UUID)
 	return r0
 }
 
+func (m queryMetricsStore) FetchMemoryResourceMonitorsByAgentID(ctx context.Context, agentID uuid.UUID) (database.WorkspaceAgentMemoryResourceMonitor, error) {
+	start := time.Now()
+	r0, r1 := m.s.FetchMemoryResourceMonitorsByAgentID(ctx, agentID)
+	m.queryLatencies.WithLabelValues("FetchMemoryResourceMonitorsByAgentID").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) FetchNewMessageMetadata(ctx context.Context, arg database.FetchNewMessageMetadataParams) (database.FetchNewMessageMetadataRow, error) {
 	start := time.Now()
 	r0, r1 := m.s.FetchNewMessageMetadata(ctx, arg)
@@ -441,6 +448,13 @@ func (m queryMetricsStore) FetchNewMessageMetadata(ctx context.Context, arg data
 	return r0, r1
 }
 
+func (m queryMetricsStore) FetchVolumesResourceMonitorsByAgentID(ctx context.Context, agentID uuid.UUID) ([]database.WorkspaceAgentVolumeResourceMonitor, error) {
+	start := time.Now()
+	r0, r1 := m.s.FetchVolumesResourceMonitorsByAgentID(ctx, agentID)
+	m.queryLatencies.WithLabelValues("FetchVolumesResourceMonitorsByAgentID").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) GetAPIKeyByID(ctx context.Context, id string) (database.APIKey, error) {
 	start := time.Now()
 	apiKey, err := m.s.GetAPIKeyByID(ctx, id)
@@ -1841,6 +1855,13 @@ func (m queryMetricsStore) InsertLicense(ctx context.Context, arg database.Inser
 	return license, err
 }
 
+func (m queryMetricsStore) InsertMemoryResourceMonitor(ctx context.Context, arg database.InsertMemoryResourceMonitorParams) (database.WorkspaceAgentMemoryResourceMonitor, error) {
+	start := time.Now()
+	r0, r1 := m.s.InsertMemoryResourceMonitor(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertMemoryResourceMonitor").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) InsertMissingGroups(ctx context.Context, arg database.InsertMissingGroupsParams) ([]database.Group, error) {
 	start := time.Now()
 	r0, r1 := m.s.InsertMissingGroups(ctx, arg)
@@ -1995,6 +2016,13 @@ func (m queryMetricsStore) InsertUserLink(ctx context.Context, arg database.Inse
 	return link, err
 }
 
+func (m queryMetricsStore) InsertVolumeResourceMonitor(ctx context.Context, arg database.InsertVolumeResourceMonitorParams) (database.WorkspaceAgentVolumeResourceMonitor, error) {
+	start := time.Now()
+	r0, r1 := m.s.InsertVolumeResourceMonitor(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertVolumeResourceMonitor").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) InsertWorkspace(ctx context.Context, arg database.InsertWorkspaceParams) (database.WorkspaceTable, error) {
 	start := time.Now()
 	workspace, err := m.s.InsertWorkspace(ctx, arg)

coderd/database/dbmock/dbmock.go

@@ -771,6 +771,21 @@ func (mr *MockStoreMockRecorder) FavoriteWorkspace(ctx, id any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FavoriteWorkspace", reflect.TypeOf((*MockStore)(nil).FavoriteWorkspace), ctx, id)
 }
 
+// FetchMemoryResourceMonitorsByAgentID mocks base method.
+func (m *MockStore) FetchMemoryResourceMonitorsByAgentID(ctx context.Context, agentID uuid.UUID) (database.WorkspaceAgentMemoryResourceMonitor, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "FetchMemoryResourceMonitorsByAgentID", ctx, agentID)
+	ret0, _ := ret[0].(database.WorkspaceAgentMemoryResourceMonitor)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// FetchMemoryResourceMonitorsByAgentID indicates an expected call of FetchMemoryResourceMonitorsByAgentID.
+func (mr *MockStoreMockRecorder) FetchMemoryResourceMonitorsByAgentID(ctx, agentID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FetchMemoryResourceMonitorsByAgentID", reflect.TypeOf((*MockStore)(nil).FetchMemoryResourceMonitorsByAgentID), ctx, agentID)
+}
+
 // FetchNewMessageMetadata mocks base method.
 func (m *MockStore) FetchNewMessageMetadata(ctx context.Context, arg database.FetchNewMessageMetadataParams) (database.FetchNewMessageMetadataRow, error) {
 	m.ctrl.T.Helper()
@@ -786,6 +801,21 @@ func (mr *MockStoreMockRecorder) FetchNewMessageMetadata(ctx, arg any) *gomock.C
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FetchNewMessageMetadata", reflect.TypeOf((*MockStore)(nil).FetchNewMessageMetadata), ctx, arg)
 }
 
+// FetchVolumesResourceMonitorsByAgentID mocks base method.
+func (m *MockStore) FetchVolumesResourceMonitorsByAgentID(ctx context.Context, agentID uuid.UUID) ([]database.WorkspaceAgentVolumeResourceMonitor, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "FetchVolumesResourceMonitorsByAgentID", ctx, agentID)
+	ret0, _ := ret[0].([]database.WorkspaceAgentVolumeResourceMonitor)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// FetchVolumesResourceMonitorsByAgentID indicates an expected call of FetchVolumesResourceMonitorsByAgentID.
+func (mr *MockStoreMockRecorder) FetchVolumesResourceMonitorsByAgentID(ctx, agentID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FetchVolumesResourceMonitorsByAgentID", reflect.TypeOf((*MockStore)(nil).FetchVolumesResourceMonitorsByAgentID), ctx, agentID)
+}
+
 // GetAPIKeyByID mocks base method.
 func (m *MockStore) GetAPIKeyByID(ctx context.Context, id string) (database.APIKey, error) {
 	m.ctrl.T.Helper()
@@ -3901,6 +3931,21 @@ func (mr *MockStoreMockRecorder) InsertLicense(ctx, arg any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertLicense", reflect.TypeOf((*MockStore)(nil).InsertLicense), ctx, arg)
 }
 
+// InsertMemoryResourceMonitor mocks base method.
+func (m *MockStore) InsertMemoryResourceMonitor(ctx context.Context, arg database.InsertMemoryResourceMonitorParams) (database.WorkspaceAgentMemoryResourceMonitor, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InsertMemoryResourceMonitor", ctx, arg)
+	ret0, _ := ret[0].(database.WorkspaceAgentMemoryResourceMonitor)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// InsertMemoryResourceMonitor indicates an expected call of InsertMemoryResourceMonitor.
+func (mr *MockStoreMockRecorder) InsertMemoryResourceMonitor(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertMemoryResourceMonitor", reflect.TypeOf((*MockStore)(nil).InsertMemoryResourceMonitor), ctx, arg)
+}
+
 // InsertMissingGroups mocks base method.
 func (m *MockStore) InsertMissingGroups(ctx context.Context, arg database.InsertMissingGroupsParams) ([]database.Group, error) {
 	m.ctrl.T.Helper()
@@ -4227,6 +4272,21 @@ func (mr *MockStoreMockRecorder) InsertUserLink(ctx, arg any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertUserLink", reflect.TypeOf((*MockStore)(nil).InsertUserLink), ctx, arg)
 }
 
+// InsertVolumeResourceMonitor mocks base method.
+func (m *MockStore) InsertVolumeResourceMonitor(ctx context.Context, arg database.InsertVolumeResourceMonitorParams) (database.WorkspaceAgentVolumeResourceMonitor, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InsertVolumeResourceMonitor", ctx, arg)
+	ret0, _ := ret[0].(database.WorkspaceAgentVolumeResourceMonitor)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// InsertVolumeResourceMonitor indicates an expected call of InsertVolumeResourceMonitor.
+func (mr *MockStoreMockRecorder) InsertVolumeResourceMonitor(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertVolumeResourceMonitor", reflect.TypeOf((*MockStore)(nil).InsertVolumeResourceMonitor), ctx, arg)
+}
+
 // InsertWorkspace mocks base method.
 func (m *MockStore) InsertWorkspace(ctx context.Context, arg database.InsertWorkspaceParams) (database.WorkspaceTable, error) {
 	m.ctrl.T.Helper()

coderd/database/dump.sql

@@ -1486,6 +1486,13 @@ CREATE UNLOGGED TABLE workspace_agent_logs (
     log_source_id uuid DEFAULT '00000000-0000-0000-0000-000000000000'::uuid NOT NULL
 );
 
+CREATE TABLE workspace_agent_memory_resource_monitors (
+    agent_id uuid NOT NULL,
+    enabled boolean NOT NULL,
+    threshold integer NOT NULL,
+    created_at timestamp with time zone NOT NULL
+);
+
 CREATE UNLOGGED TABLE workspace_agent_metadata (
     workspace_agent_id uuid NOT NULL,
     display_name character varying(127) NOT NULL,
@@ -1563,6 +1570,14 @@ CREATE TABLE workspace_agent_stats (
     usage boolean DEFAULT false NOT NULL
 );
 
+CREATE TABLE workspace_agent_volume_resource_monitors (
+    agent_id uuid NOT NULL,
+    enabled boolean NOT NULL,
+    threshold integer NOT NULL,
+    path text NOT NULL,
+    created_at timestamp with time zone NOT NULL
+);
+
 CREATE TABLE workspace_agents (
     id uuid NOT NULL,
     created_at timestamp with time zone NOT NULL,
@@ -2072,6 +2087,9 @@ ALTER TABLE ONLY users
 ALTER TABLE ONLY workspace_agent_log_sources
     ADD CONSTRAINT workspace_agent_log_sources_pkey PRIMARY KEY (workspace_agent_id, id);
 
+ALTER TABLE ONLY workspace_agent_memory_resource_monitors
+    ADD CONSTRAINT workspace_agent_memory_resource_monitors_pkey PRIMARY KEY (agent_id);
+
 ALTER TABLE ONLY workspace_agent_metadata
     ADD CONSTRAINT workspace_agent_metadata_pkey PRIMARY KEY (workspace_agent_id, key);
 
@@ -2087,6 +2105,9 @@ ALTER TABLE ONLY workspace_agent_scripts
 ALTER TABLE ONLY workspace_agent_logs
     ADD CONSTRAINT workspace_agent_startup_logs_pkey PRIMARY KEY (id);
 
+ALTER TABLE ONLY workspace_agent_volume_resource_monitors
+    ADD CONSTRAINT workspace_agent_volume_resource_monitors_pkey PRIMARY KEY (agent_id, path);
+
 ALTER TABLE ONLY workspace_agents
     ADD CONSTRAINT workspace_agents_pkey PRIMARY KEY (id);
 
@@ -2465,6 +2486,9 @@ ALTER TABLE ONLY user_status_changes
 ALTER TABLE ONLY workspace_agent_log_sources
     ADD CONSTRAINT workspace_agent_log_sources_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY workspace_agent_memory_resource_monitors
+    ADD CONSTRAINT workspace_agent_memory_resource_monitors_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY workspace_agent_metadata
     ADD CONSTRAINT workspace_agent_metadata_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 
@@ -2480,6 +2504,9 @@ ALTER TABLE ONLY workspace_agent_scripts
 ALTER TABLE ONLY workspace_agent_logs
     ADD CONSTRAINT workspace_agent_startup_logs_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY workspace_agent_volume_resource_monitors
+    ADD CONSTRAINT workspace_agent_volume_resource_monitors_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY workspace_agents
     ADD CONSTRAINT workspace_agents_resource_id_fkey FOREIGN KEY (resource_id) REFERENCES workspace_resources(id) ON DELETE CASCADE;
 

coderd/database/foreign_key_constraint.go

@@ -53,11 +53,13 @@ const (
 	ForeignKeyUserLinksUserID                               ForeignKeyConstraint = "user_links_user_id_fkey"                                  // ALTER TABLE ONLY user_links ADD CONSTRAINT user_links_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
 	ForeignKeyUserStatusChangesUserID                       ForeignKeyConstraint = "user_status_changes_user_id_fkey"                         // ALTER TABLE ONLY user_status_changes ADD CONSTRAINT user_status_changes_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id);
 	ForeignKeyWorkspaceAgentLogSourcesWorkspaceAgentID      ForeignKeyConstraint = "workspace_agent_log_sources_workspace_agent_id_fkey"      // ALTER TABLE ONLY workspace_agent_log_sources ADD CONSTRAINT workspace_agent_log_sources_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceAgentMemoryResourceMonitorsAgentID   ForeignKeyConstraint = "workspace_agent_memory_resource_monitors_agent_id_fkey"   // ALTER TABLE ONLY workspace_agent_memory_resource_monitors ADD CONSTRAINT workspace_agent_memory_resource_monitors_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 	ForeignKeyWorkspaceAgentMetadataWorkspaceAgentID        ForeignKeyConstraint = "workspace_agent_metadata_workspace_agent_id_fkey"         // ALTER TABLE ONLY workspace_agent_metadata ADD CONSTRAINT workspace_agent_metadata_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 	ForeignKeyWorkspaceAgentPortShareWorkspaceID            ForeignKeyConstraint = "workspace_agent_port_share_workspace_id_fkey"             // ALTER TABLE ONLY workspace_agent_port_share ADD CONSTRAINT workspace_agent_port_share_workspace_id_fkey FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE;
 	ForeignKeyWorkspaceAgentScriptTimingsScriptID           ForeignKeyConstraint = "workspace_agent_script_timings_script_id_fkey"            // ALTER TABLE ONLY workspace_agent_script_timings ADD CONSTRAINT workspace_agent_script_timings_script_id_fkey FOREIGN KEY (script_id) REFERENCES workspace_agent_scripts(id) ON DELETE CASCADE;
 	ForeignKeyWorkspaceAgentScriptsWorkspaceAgentID         ForeignKeyConstraint = "workspace_agent_scripts_workspace_agent_id_fkey"          // ALTER TABLE ONLY workspace_agent_scripts ADD CONSTRAINT workspace_agent_scripts_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 	ForeignKeyWorkspaceAgentStartupLogsAgentID              ForeignKeyConstraint = "workspace_agent_startup_logs_agent_id_fkey"               // ALTER TABLE ONLY workspace_agent_logs ADD CONSTRAINT workspace_agent_startup_logs_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceAgentVolumeResourceMonitorsAgentID   ForeignKeyConstraint = "workspace_agent_volume_resource_monitors_agent_id_fkey"   // ALTER TABLE ONLY workspace_agent_volume_resource_monitors ADD CONSTRAINT workspace_agent_volume_resource_monitors_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 	ForeignKeyWorkspaceAgentsResourceID                     ForeignKeyConstraint = "workspace_agents_resource_id_fkey"                        // ALTER TABLE ONLY workspace_agents ADD CONSTRAINT workspace_agents_resource_id_fkey FOREIGN KEY (resource_id) REFERENCES workspace_resources(id) ON DELETE CASCADE;
 	ForeignKeyWorkspaceAppStatsAgentID                      ForeignKeyConstraint = "workspace_app_stats_agent_id_fkey"                        // ALTER TABLE ONLY workspace_app_stats ADD CONSTRAINT workspace_app_stats_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id);
 	ForeignKeyWorkspaceAppStatsUserID                       ForeignKeyConstraint = "workspace_app_stats_user_id_fkey"                         // ALTER TABLE ONLY workspace_app_stats ADD CONSTRAINT workspace_app_stats_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id);

coderd/database/migrations/000289_agent_resource_monitors.down.sql

@@ -0,0 +1,2 @@
+DROP TABLE IF EXISTS workspace_agent_memory_resource_monitors;
+DROP TABLE IF EXISTS workspace_agent_volume_resource_monitors;

coderd/database/migrations/000289_agent_resource_monitors.up.sql

@@ -0,0 +1,16 @@
+CREATE TABLE workspace_agent_memory_resource_monitors (
+	agent_id 	uuid NOT NULL REFERENCES workspace_agents(id) ON DELETE CASCADE,
+	enabled 	boolean 					NOT NULL,
+	threshold 	integer 					NOT NULL,
+	created_at 	timestamp with time zone 	NOT NULL,
+	PRIMARY KEY (agent_id)
+);
+
+CREATE TABLE workspace_agent_volume_resource_monitors (
+	agent_id 	uuid NOT NULL REFERENCES workspace_agents(id) ON DELETE CASCADE,
+	enabled 	boolean 					NOT NULL,
+	threshold 	integer 					NOT NULL,
+	path 		text 						NOT NULL,
+	created_at 	timestamp with time zone 	NOT NULL,
+	PRIMARY KEY (agent_id, path)
+);

coderd/database/migrations/testdata/fixtures/000289_agent_resource_monitors.up.sql

@@ -0,0 +1,30 @@
+INSERT INTO
+	workspace_agent_memory_resource_monitors (
+		agent_id,
+		enabled,
+		threshold,
+		created_at
+	)
+	VALUES (
+		'45e89705-e09d-4850-bcec-f9a937f5d78d', -- uuid
+		true,
+		90,
+		'2024-01-01 00:00:00'
+	);
+
+INSERT INTO
+	workspace_agent_volume_resource_monitors (
+		agent_id,
+		path,
+		enabled,
+		threshold,
+		created_at
+	)
+	VALUES (
+		'45e89705-e09d-4850-bcec-f9a937f5d78d', -- uuid
+		'/',
+		true,
+		90,
+		'2024-01-01 00:00:00'
+	);
+

coderd/database/models.go

@@ -3152,6 +3152,13 @@ type WorkspaceAgentLogSource struct {
 	Icon             string    `db:"icon" json:"icon"`
 }
 
+type WorkspaceAgentMemoryResourceMonitor struct {
+	AgentID   uuid.UUID `db:"agent_id" json:"agent_id"`
+	Enabled   bool      `db:"enabled" json:"enabled"`
+	Threshold int32     `db:"threshold" json:"threshold"`
+	CreatedAt time.Time `db:"created_at" json:"created_at"`
+}
+
 type WorkspaceAgentMetadatum struct {
 	WorkspaceAgentID uuid.UUID `db:"workspace_agent_id" json:"workspace_agent_id"`
 	DisplayName      string    `db:"display_name" json:"display_name"`
@@ -3219,6 +3226,14 @@ type WorkspaceAgentStat struct {
 	Usage                       bool            `db:"usage" json:"usage"`
 }
 
+type WorkspaceAgentVolumeResourceMonitor struct {
+	AgentID   uuid.UUID `db:"agent_id" json:"agent_id"`
+	Enabled   bool      `db:"enabled" json:"enabled"`
+	Threshold int32     `db:"threshold" json:"threshold"`
+	Path      string    `db:"path" json:"path"`
+	CreatedAt time.Time `db:"created_at" json:"created_at"`
+}
+
 type WorkspaceApp struct {
 	ID                   uuid.UUID          `db:"id" json:"id"`
 	CreatedAt            time.Time          `db:"created_at" json:"created_at"`

coderd/database/querier.go

@@ -112,8 +112,10 @@ type sqlcQuerier interface {
 	DisableForeignKeysAndTriggers(ctx context.Context) error
 	EnqueueNotificationMessage(ctx context.Context, arg EnqueueNotificationMessageParams) error
 	FavoriteWorkspace(ctx context.Context, id uuid.UUID) error
+	FetchMemoryResourceMonitorsByAgentID(ctx context.Context, agentID uuid.UUID) (WorkspaceAgentMemoryResourceMonitor, error)
 	// This is used to build up the notification_message's JSON payload.
 	FetchNewMessageMetadata(ctx context.Context, arg FetchNewMessageMetadataParams) (FetchNewMessageMetadataRow, error)
+	FetchVolumesResourceMonitorsByAgentID(ctx context.Context, agentID uuid.UUID) ([]WorkspaceAgentVolumeResourceMonitor, error)
 	GetAPIKeyByID(ctx context.Context, id string) (APIKey, error)
 	// there is no unique constraint on empty token names
 	GetAPIKeyByName(ctx context.Context, arg GetAPIKeyByNameParams) (APIKey, error)
@@ -390,6 +392,7 @@ type sqlcQuerier interface {
 	InsertGroup(ctx context.Context, arg InsertGroupParams) (Group, error)
 	InsertGroupMember(ctx context.Context, arg InsertGroupMemberParams) error
 	InsertLicense(ctx context.Context, arg InsertLicenseParams) (License, error)
+	InsertMemoryResourceMonitor(ctx context.Context, arg InsertMemoryResourceMonitorParams) (WorkspaceAgentMemoryResourceMonitor, error)
 	// Inserts any group by name that does not exist. All new groups are given
 	// a random uuid, are inserted into the same organization. They have the default
 	// values for avatar, display name, and quota allowance (all zero values).
@@ -419,6 +422,7 @@ type sqlcQuerier interface {
 	// InsertUserGroupsByName adds a user to all provided groups, if they exist.
 	InsertUserGroupsByName(ctx context.Context, arg InsertUserGroupsByNameParams) error
 	InsertUserLink(ctx context.Context, arg InsertUserLinkParams) (UserLink, error)
+	InsertVolumeResourceMonitor(ctx context.Context, arg InsertVolumeResourceMonitorParams) (WorkspaceAgentVolumeResourceMonitor, error)
 	InsertWorkspace(ctx context.Context, arg InsertWorkspaceParams) (WorkspaceTable, error)
 	InsertWorkspaceAgent(ctx context.Context, arg InsertWorkspaceAgentParams) (WorkspaceAgent, error)
 	InsertWorkspaceAgentLogSources(ctx context.Context, arg InsertWorkspaceAgentLogSourcesParams) ([]WorkspaceAgentLogSource, error)

coderd/database/queries.sql.go

@@ -11765,6 +11765,141 @@ func (q *sqlQuerier) UpsertWorkspaceAgentPortShare(ctx context.Context, arg Upse
 	return i, err
 }
 
+const fetchMemoryResourceMonitorsByAgentID = `-- name: FetchMemoryResourceMonitorsByAgentID :one
+SELECT
+	agent_id, enabled, threshold, created_at
+FROM
+	workspace_agent_memory_resource_monitors
+WHERE
+	agent_id = $1
+`
+
+func (q *sqlQuerier) FetchMemoryResourceMonitorsByAgentID(ctx context.Context, agentID uuid.UUID) (WorkspaceAgentMemoryResourceMonitor, error) {
+	row := q.db.QueryRowContext(ctx, fetchMemoryResourceMonitorsByAgentID, agentID)
+	var i WorkspaceAgentMemoryResourceMonitor
+	err := row.Scan(
+		&i.AgentID,
+		&i.Enabled,
+		&i.Threshold,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const fetchVolumesResourceMonitorsByAgentID = `-- name: FetchVolumesResourceMonitorsByAgentID :many
+SELECT
+	agent_id, enabled, threshold, path, created_at
+FROM
+	workspace_agent_volume_resource_monitors
+WHERE
+	agent_id = $1
+`
+
+func (q *sqlQuerier) FetchVolumesResourceMonitorsByAgentID(ctx context.Context, agentID uuid.UUID) ([]WorkspaceAgentVolumeResourceMonitor, error) {
+	rows, err := q.db.QueryContext(ctx, fetchVolumesResourceMonitorsByAgentID, agentID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []WorkspaceAgentVolumeResourceMonitor
+	for rows.Next() {
+		var i WorkspaceAgentVolumeResourceMonitor
+		if err := rows.Scan(
+			&i.AgentID,
+			&i.Enabled,
+			&i.Threshold,
+			&i.Path,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const insertMemoryResourceMonitor = `-- name: InsertMemoryResourceMonitor :one
+INSERT INTO
+	workspace_agent_memory_resource_monitors (
+		agent_id,
+		enabled,
+		threshold,
+		created_at
+	)
+VALUES
+	($1, $2, $3, $4) RETURNING agent_id, enabled, threshold, created_at
+`
+
+type InsertMemoryResourceMonitorParams struct {
+	AgentID   uuid.UUID `db:"agent_id" json:"agent_id"`
+	Enabled   bool      `db:"enabled" json:"enabled"`
+	Threshold int32     `db:"threshold" json:"threshold"`
+	CreatedAt time.Time `db:"created_at" json:"created_at"`
+}
+
+func (q *sqlQuerier) InsertMemoryResourceMonitor(ctx context.Context, arg InsertMemoryResourceMonitorParams) (WorkspaceAgentMemoryResourceMonitor, error) {
+	row := q.db.QueryRowContext(ctx, insertMemoryResourceMonitor,
+		arg.AgentID,
+		arg.Enabled,
+		arg.Threshold,
+		arg.CreatedAt,
+	)
+	var i WorkspaceAgentMemoryResourceMonitor
+	err := row.Scan(
+		&i.AgentID,
+		&i.Enabled,
+		&i.Threshold,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const insertVolumeResourceMonitor = `-- name: InsertVolumeResourceMonitor :one
+INSERT INTO
+	workspace_agent_volume_resource_monitors (
+		agent_id,
+		path,
+		enabled,
+		threshold,
+		created_at
+	)
+VALUES
+	($1, $2, $3, $4, $5) RETURNING agent_id, enabled, threshold, path, created_at
+`
+
+type InsertVolumeResourceMonitorParams struct {
+	AgentID   uuid.UUID `db:"agent_id" json:"agent_id"`
+	Path      string    `db:"path" json:"path"`
+	Enabled   bool      `db:"enabled" json:"enabled"`
+	Threshold int32     `db:"threshold" json:"threshold"`
+	CreatedAt time.Time `db:"created_at" json:"created_at"`
+}
+
+func (q *sqlQuerier) InsertVolumeResourceMonitor(ctx context.Context, arg InsertVolumeResourceMonitorParams) (WorkspaceAgentVolumeResourceMonitor, error) {
+	row := q.db.QueryRowContext(ctx, insertVolumeResourceMonitor,
+		arg.AgentID,
+		arg.Path,
+		arg.Enabled,
+		arg.Threshold,
+		arg.CreatedAt,
+	)
+	var i WorkspaceAgentVolumeResourceMonitor
+	err := row.Scan(
+		&i.AgentID,
+		&i.Enabled,
+		&i.Threshold,
+		&i.Path,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
 const deleteOldWorkspaceAgentLogs = `-- name: DeleteOldWorkspaceAgentLogs :exec
 WITH
 	latest_builds AS (

coderd/database/queries/workspaceagentresourcemonitors.sql

@@ -0,0 +1,38 @@
+-- name: FetchMemoryResourceMonitorsByAgentID :one
+SELECT
+	*
+FROM
+	workspace_agent_memory_resource_monitors
+WHERE
+	agent_id = $1;
+
+-- name: FetchVolumesResourceMonitorsByAgentID :many
+SELECT
+	*
+FROM
+	workspace_agent_volume_resource_monitors
+WHERE
+	agent_id = $1;
+
+-- name: InsertMemoryResourceMonitor :one
+INSERT INTO
+	workspace_agent_memory_resource_monitors (
+		agent_id,
+		enabled,
+		threshold,
+		created_at
+	)
+VALUES
+	($1, $2, $3, $4) RETURNING *;
+
+-- name: InsertVolumeResourceMonitor :one
+INSERT INTO
+	workspace_agent_volume_resource_monitors (
+		agent_id,
+		path,
+		enabled,
+		threshold,
+		created_at
+	)
+VALUES
+	($1, $2, $3, $4, $5) RETURNING *;

coderd/database/unique_constraint.go

@@ -68,11 +68,13 @@ const (
 	UniqueUserStatusChangesPkey                               UniqueConstraint = "user_status_changes_pkey"                                    // ALTER TABLE ONLY user_status_changes ADD CONSTRAINT user_status_changes_pkey PRIMARY KEY (id);
 	UniqueUsersPkey                                           UniqueConstraint = "users_pkey"                                                  // ALTER TABLE ONLY users ADD CONSTRAINT users_pkey PRIMARY KEY (id);
 	UniqueWorkspaceAgentLogSourcesPkey                        UniqueConstraint = "workspace_agent_log_sources_pkey"                            // ALTER TABLE ONLY workspace_agent_log_sources ADD CONSTRAINT workspace_agent_log_sources_pkey PRIMARY KEY (workspace_agent_id, id);
+	UniqueWorkspaceAgentMemoryResourceMonitorsPkey            UniqueConstraint = "workspace_agent_memory_resource_monitors_pkey"               // ALTER TABLE ONLY workspace_agent_memory_resource_monitors ADD CONSTRAINT workspace_agent_memory_resource_monitors_pkey PRIMARY KEY (agent_id);
 	UniqueWorkspaceAgentMetadataPkey                          UniqueConstraint = "workspace_agent_metadata_pkey"                               // ALTER TABLE ONLY workspace_agent_metadata ADD CONSTRAINT workspace_agent_metadata_pkey PRIMARY KEY (workspace_agent_id, key);
 	UniqueWorkspaceAgentPortSharePkey                         UniqueConstraint = "workspace_agent_port_share_pkey"                             // ALTER TABLE ONLY workspace_agent_port_share ADD CONSTRAINT workspace_agent_port_share_pkey PRIMARY KEY (workspace_id, agent_name, port);
 	UniqueWorkspaceAgentScriptTimingsScriptIDStartedAtKey     UniqueConstraint = "workspace_agent_script_timings_script_id_started_at_key"     // ALTER TABLE ONLY workspace_agent_script_timings ADD CONSTRAINT workspace_agent_script_timings_script_id_started_at_key UNIQUE (script_id, started_at);
 	UniqueWorkspaceAgentScriptsIDKey                          UniqueConstraint = "workspace_agent_scripts_id_key"                              // ALTER TABLE ONLY workspace_agent_scripts ADD CONSTRAINT workspace_agent_scripts_id_key UNIQUE (id);
 	UniqueWorkspaceAgentStartupLogsPkey                       UniqueConstraint = "workspace_agent_startup_logs_pkey"                           // ALTER TABLE ONLY workspace_agent_logs ADD CONSTRAINT workspace_agent_startup_logs_pkey PRIMARY KEY (id);
+	UniqueWorkspaceAgentVolumeResourceMonitorsPkey            UniqueConstraint = "workspace_agent_volume_resource_monitors_pkey"               // ALTER TABLE ONLY workspace_agent_volume_resource_monitors ADD CONSTRAINT workspace_agent_volume_resource_monitors_pkey PRIMARY KEY (agent_id, path);
 	UniqueWorkspaceAgentsPkey                                 UniqueConstraint = "workspace_agents_pkey"                                       // ALTER TABLE ONLY workspace_agents ADD CONSTRAINT workspace_agents_pkey PRIMARY KEY (id);
 	UniqueWorkspaceAppStatsPkey                               UniqueConstraint = "workspace_app_stats_pkey"                                    // ALTER TABLE ONLY workspace_app_stats ADD CONSTRAINT workspace_app_stats_pkey PRIMARY KEY (id);
 	UniqueWorkspaceAppStatsUserIDAgentIDSessionIDKey          UniqueConstraint = "workspace_app_stats_user_id_agent_id_session_id_key"         // ALTER TABLE ONLY workspace_app_stats ADD CONSTRAINT workspace_app_stats_user_id_agent_id_session_id_key UNIQUE (user_id, agent_id, session_id);

coderd/provisionerdserver/provisionerdserver.go

@@ -1927,6 +1927,32 @@ func InsertWorkspaceResource(ctx context.Context, db database.Store, jobID uuid.
 			}
 		}
 
+		if prAgent.ResourcesMonitoring != nil {
+			if prAgent.ResourcesMonitoring.Memory != nil {
+				_, err = db.InsertMemoryResourceMonitor(ctx, database.InsertMemoryResourceMonitorParams{
+					AgentID:   agentID,
+					Enabled:   prAgent.ResourcesMonitoring.Memory.Enabled,
+					Threshold: prAgent.ResourcesMonitoring.Memory.Threshold,
+					CreatedAt: dbtime.Now(),
+				})
+				if err != nil {
+					return xerrors.Errorf("failed to insert agent memory resource monitor into db: %w", err)
+				}
+			}
+			for _, volume := range prAgent.ResourcesMonitoring.Volumes {
+				_, err = db.InsertVolumeResourceMonitor(ctx, database.InsertVolumeResourceMonitorParams{
+					AgentID:   agentID,
+					Path:      volume.Path,
+					Enabled:   volume.Enabled,
+					Threshold: volume.Threshold,
+					CreatedAt: dbtime.Now(),
+				})
+				if err != nil {
+					return xerrors.Errorf("failed to insert agent volume resource monitor into db: %w", err)
+				}
+			}
+		}
+
 		logSourceIDs := make([]uuid.UUID, 0, len(prAgent.Scripts))
 		logSourceDisplayNames := make([]string, 0, len(prAgent.Scripts))
 		logSourceIcons := make([]string, 0, len(prAgent.Scripts))

coderd/provisionerdserver/provisionerdserver_test.go

@@ -1874,6 +1874,57 @@ func TestInsertWorkspaceResource(t *testing.T) {
 		// that all apps are disabled.
 		require.Equal(t, []database.DisplayApp{}, agent.DisplayApps)
 	})
+
+	t.Run("ResourcesMonitoring", func(t *testing.T) {
+		t.Parallel()
+		db := dbmem.New()
+		job := uuid.New()
+		err := insert(db, job, &sdkproto.Resource{
+			Name: "something",
+			Type: "aws_instance",
+			Agents: []*sdkproto.Agent{{
+				DisplayApps: &sdkproto.DisplayApps{},
+				ResourcesMonitoring: &sdkproto.ResourcesMonitoring{
+					Memory: &sdkproto.MemoryResourceMonitor{
+						Enabled:   true,
+						Threshold: 80,
+					},
+					Volumes: []*sdkproto.VolumeResourceMonitor{
+						{
+							Path:      "/volume1",
+							Enabled:   true,
+							Threshold: 90,
+						},
+						{
+							Path:      "/volume2",
+							Enabled:   true,
+							Threshold: 50,
+						},
+					},
+				},
+			}},
+		})
+		require.NoError(t, err)
+		resources, err := db.GetWorkspaceResourcesByJobID(ctx, job)
+		require.NoError(t, err)
+		require.Len(t, resources, 1)
+		agents, err := db.GetWorkspaceAgentsByResourceIDs(ctx, []uuid.UUID{resources[0].ID})
+		require.NoError(t, err)
+		require.Len(t, agents, 1)
+
+		agent := agents[0]
+		memMonitor, err := db.FetchMemoryResourceMonitorsByAgentID(ctx, agent.ID)
+		require.NoError(t, err)
+		volMonitors, err := db.FetchVolumesResourceMonitorsByAgentID(ctx, agent.ID)
+		require.NoError(t, err)
+
+		require.Equal(t, int32(80), memMonitor.Threshold)
+		require.Len(t, volMonitors, 2)
+		require.Equal(t, int32(90), volMonitors[0].Threshold)
+		require.Equal(t, "/volume1", volMonitors[0].Path)
+		require.Equal(t, int32(50), volMonitors[1].Threshold)
+		require.Equal(t, "/volume2", volMonitors[1].Path)
+	})
 }
 
 func TestNotifications(t *testing.T) {

coderd/rbac/object_gen.go

@@ -295,6 +295,14 @@ var (
 		Type: "workspace",
 	}
 
+	// ResourceWorkspaceAgentResourceMonitor
+	// Valid Actions
+	//  - "ActionCreate" :: create workspace agent resource monitor
+	//  - "ActionRead" :: read workspace agent resource monitor
+	ResourceWorkspaceAgentResourceMonitor = Object{
+		Type: "workspace_agent_resource_monitor",
+	}
+
 	// ResourceWorkspaceDormant
 	// Valid Actions
 	//  - "ActionApplicationConnect" :: connect to workspace apps via browser
@@ -353,6 +361,7 @@ func AllResources() []Objecter {
 		ResourceTemplate,
 		ResourceUser,
 		ResourceWorkspace,
+		ResourceWorkspaceAgentResourceMonitor,
 		ResourceWorkspaceDormant,
 		ResourceWorkspaceProxy,
 	}

coderd/rbac/policy/policy.go

@@ -302,4 +302,10 @@ var RBACPermissions = map[string]PermissionDefinition{
 			ActionUpdate: actDef("update IdP sync settings"),
 		},
 	},
+	"workspace_agent_resource_monitor": {
+		Actions: map[Action]ActionDefinition{
+			ActionRead:   actDef("read workspace agent resource monitor"),
+			ActionCreate: actDef("create workspace agent resource monitor"),
+		},
+	},
 }

coderd/rbac/roles_test.go

@@ -777,6 +777,21 @@ func TestRolePermissions(t *testing.T) {
 				},
 			},
 		},
+		{
+			Name:     "ResourceMonitor",
+			Actions:  []policy.Action{policy.ActionRead, policy.ActionCreate},
+			Resource: rbac.ResourceWorkspaceAgentResourceMonitor,
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true: {owner},
+				false: {
+					memberMe, orgMemberMe, otherOrgMember,
+					orgAdmin, otherOrgAdmin,
+					orgAuditor, otherOrgAuditor,
+					templateAdmin, orgTemplateAdmin, otherOrgTemplateAdmin,
+					userAdmin, orgUserAdmin, otherOrgUserAdmin,
+				},
+			},
+		},
 	}
 
 	// We expect every permission to be tested above.

codersdk/rbacresources_gen.go

@@ -4,39 +4,40 @@ package codersdk
 type RBACResource string
 
 const (
-	ResourceWildcard               RBACResource = "*"
-	ResourceApiKey                 RBACResource = "api_key"
-	ResourceAssignOrgRole          RBACResource = "assign_org_role"
-	ResourceAssignRole             RBACResource = "assign_role"
-	ResourceAuditLog               RBACResource = "audit_log"
-	ResourceCryptoKey              RBACResource = "crypto_key"
-	ResourceDebugInfo              RBACResource = "debug_info"
-	ResourceDeploymentConfig       RBACResource = "deployment_config"
-	ResourceDeploymentStats        RBACResource = "deployment_stats"
-	ResourceFile                   RBACResource = "file"
-	ResourceGroup                  RBACResource = "group"
-	ResourceGroupMember            RBACResource = "group_member"
-	ResourceIdpsyncSettings        RBACResource = "idpsync_settings"
-	ResourceLicense                RBACResource = "license"
-	ResourceNotificationMessage    RBACResource = "notification_message"
-	ResourceNotificationPreference RBACResource = "notification_preference"
-	ResourceNotificationTemplate   RBACResource = "notification_template"
-	ResourceOauth2App              RBACResource = "oauth2_app"
-	ResourceOauth2AppCodeToken     RBACResource = "oauth2_app_code_token"
-	ResourceOauth2AppSecret        RBACResource = "oauth2_app_secret"
-	ResourceOrganization           RBACResource = "organization"
-	ResourceOrganizationMember     RBACResource = "organization_member"
-	ResourceProvisionerDaemon      RBACResource = "provisioner_daemon"
-	ResourceProvisionerJobs        RBACResource = "provisioner_jobs"
-	ResourceProvisionerKeys        RBACResource = "provisioner_keys"
-	ResourceReplicas               RBACResource = "replicas"
-	ResourceSystem                 RBACResource = "system"
-	ResourceTailnetCoordinator     RBACResource = "tailnet_coordinator"
-	ResourceTemplate               RBACResource = "template"
-	ResourceUser                   RBACResource = "user"
-	ResourceWorkspace              RBACResource = "workspace"
-	ResourceWorkspaceDormant       RBACResource = "workspace_dormant"
-	ResourceWorkspaceProxy         RBACResource = "workspace_proxy"
+	ResourceWildcard                      RBACResource = "*"
+	ResourceApiKey                        RBACResource = "api_key"
+	ResourceAssignOrgRole                 RBACResource = "assign_org_role"
+	ResourceAssignRole                    RBACResource = "assign_role"
+	ResourceAuditLog                      RBACResource = "audit_log"
+	ResourceCryptoKey                     RBACResource = "crypto_key"
+	ResourceDebugInfo                     RBACResource = "debug_info"
+	ResourceDeploymentConfig              RBACResource = "deployment_config"
+	ResourceDeploymentStats               RBACResource = "deployment_stats"
+	ResourceFile                          RBACResource = "file"
+	ResourceGroup                         RBACResource = "group"
+	ResourceGroupMember                   RBACResource = "group_member"
+	ResourceIdpsyncSettings               RBACResource = "idpsync_settings"
+	ResourceLicense                       RBACResource = "license"
+	ResourceNotificationMessage           RBACResource = "notification_message"
+	ResourceNotificationPreference        RBACResource = "notification_preference"
+	ResourceNotificationTemplate          RBACResource = "notification_template"
+	ResourceOauth2App                     RBACResource = "oauth2_app"
+	ResourceOauth2AppCodeToken            RBACResource = "oauth2_app_code_token"
+	ResourceOauth2AppSecret               RBACResource = "oauth2_app_secret"
+	ResourceOrganization                  RBACResource = "organization"
+	ResourceOrganizationMember            RBACResource = "organization_member"
+	ResourceProvisionerDaemon             RBACResource = "provisioner_daemon"
+	ResourceProvisionerJobs               RBACResource = "provisioner_jobs"
+	ResourceProvisionerKeys               RBACResource = "provisioner_keys"
+	ResourceReplicas                      RBACResource = "replicas"
+	ResourceSystem                        RBACResource = "system"
+	ResourceTailnetCoordinator            RBACResource = "tailnet_coordinator"
+	ResourceTemplate                      RBACResource = "template"
+	ResourceUser                          RBACResource = "user"
+	ResourceWorkspace                     RBACResource = "workspace"
+	ResourceWorkspaceAgentResourceMonitor RBACResource = "workspace_agent_resource_monitor"
+	ResourceWorkspaceDormant              RBACResource = "workspace_dormant"
+	ResourceWorkspaceProxy                RBACResource = "workspace_proxy"
 )
 
 type RBACAction string
@@ -60,37 +61,38 @@ const (
 // RBACResourceActions is the mapping of resources to which actions are valid for
 // said resource type.
 var RBACResourceActions = map[RBACResource][]RBACAction{
-	ResourceWildcard:               {},
-	ResourceApiKey:                 {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceAssignOrgRole:          {ActionAssign, ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceAssignRole:             {ActionAssign, ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceAuditLog:               {ActionCreate, ActionRead},
-	ResourceCryptoKey:              {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceDebugInfo:              {ActionRead},
-	ResourceDeploymentConfig:       {ActionRead, ActionUpdate},
-	ResourceDeploymentStats:        {ActionRead},
-	ResourceFile:                   {ActionCreate, ActionRead},
-	ResourceGroup:                  {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceGroupMember:            {ActionRead},
-	ResourceIdpsyncSettings:        {ActionRead, ActionUpdate},
-	ResourceLicense:                {ActionCreate, ActionDelete, ActionRead},
-	ResourceNotificationMessage:    {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceNotificationPreference: {ActionRead, ActionUpdate},
-	ResourceNotificationTemplate:   {ActionRead, ActionUpdate},
-	ResourceOauth2App:              {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceOauth2AppCodeToken:     {ActionCreate, ActionDelete, ActionRead},
-	ResourceOauth2AppSecret:        {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceOrganization:           {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceOrganizationMember:     {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceProvisionerDaemon:      {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceProvisionerJobs:        {ActionRead},
-	ResourceProvisionerKeys:        {ActionCreate, ActionDelete, ActionRead},
-	ResourceReplicas:               {ActionRead},
-	ResourceSystem:                 {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceTailnetCoordinator:     {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
-	ResourceTemplate:               {ActionCreate, ActionDelete, ActionRead, ActionUpdate, ActionUse, ActionViewInsights},
-	ResourceUser:                   {ActionCreate, ActionDelete, ActionRead, ActionReadPersonal, ActionUpdate, ActionUpdatePersonal},
-	ResourceWorkspace:              {ActionApplicationConnect, ActionCreate, ActionDelete, ActionRead, ActionSSH, ActionWorkspaceStart, ActionWorkspaceStop, ActionUpdate},
-	ResourceWorkspaceDormant:       {ActionApplicationConnect, ActionCreate, ActionDelete, ActionRead, ActionSSH, ActionWorkspaceStart, ActionWorkspaceStop, ActionUpdate},
-	ResourceWorkspaceProxy:         {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceWildcard:                      {},
+	ResourceApiKey:                        {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceAssignOrgRole:                 {ActionAssign, ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceAssignRole:                    {ActionAssign, ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceAuditLog:                      {ActionCreate, ActionRead},
+	ResourceCryptoKey:                     {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceDebugInfo:                     {ActionRead},
+	ResourceDeploymentConfig:              {ActionRead, ActionUpdate},
+	ResourceDeploymentStats:               {ActionRead},
+	ResourceFile:                          {ActionCreate, ActionRead},
+	ResourceGroup:                         {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceGroupMember:                   {ActionRead},
+	ResourceIdpsyncSettings:               {ActionRead, ActionUpdate},
+	ResourceLicense:                       {ActionCreate, ActionDelete, ActionRead},
+	ResourceNotificationMessage:           {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceNotificationPreference:        {ActionRead, ActionUpdate},
+	ResourceNotificationTemplate:          {ActionRead, ActionUpdate},
+	ResourceOauth2App:                     {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceOauth2AppCodeToken:            {ActionCreate, ActionDelete, ActionRead},
+	ResourceOauth2AppSecret:               {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceOrganization:                  {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceOrganizationMember:            {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceProvisionerDaemon:             {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceProvisionerJobs:               {ActionRead},
+	ResourceProvisionerKeys:               {ActionCreate, ActionDelete, ActionRead},
+	ResourceReplicas:                      {ActionRead},
+	ResourceSystem:                        {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceTailnetCoordinator:            {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceTemplate:                      {ActionCreate, ActionDelete, ActionRead, ActionUpdate, ActionUse, ActionViewInsights},
+	ResourceUser:                          {ActionCreate, ActionDelete, ActionRead, ActionReadPersonal, ActionUpdate, ActionUpdatePersonal},
+	ResourceWorkspace:                     {ActionApplicationConnect, ActionCreate, ActionDelete, ActionRead, ActionSSH, ActionWorkspaceStart, ActionWorkspaceStop, ActionUpdate},
+	ResourceWorkspaceAgentResourceMonitor: {ActionCreate, ActionRead},
+	ResourceWorkspaceDormant:              {ActionApplicationConnect, ActionCreate, ActionDelete, ActionRead, ActionSSH, ActionWorkspaceStart, ActionWorkspaceStop, ActionUpdate},
+	ResourceWorkspaceProxy:                {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
 }

docs/reference/api/members.md

@@ -164,54 +164,55 @@ Status Code **200**
 
 #### Enumerated Values
 
-| Property        | Value                     |
-|-----------------|---------------------------|
-| `action`        | `application_connect`     |
-| `action`        | `assign`                  |
-| `action`        | `create`                  |
-| `action`        | `delete`                  |
-| `action`        | `read`                    |
-| `action`        | `read_personal`           |
-| `action`        | `ssh`                     |
-| `action`        | `update`                  |
-| `action`        | `update_personal`         |
-| `action`        | `use`                     |
-| `action`        | `view_insights`           |
-| `action`        | `start`                   |
-| `action`        | `stop`                    |
-| `resource_type` | `*`                       |
-| `resource_type` | `api_key`                 |
-| `resource_type` | `assign_org_role`         |
-| `resource_type` | `assign_role`             |
-| `resource_type` | `audit_log`               |
-| `resource_type` | `crypto_key`              |
-| `resource_type` | `debug_info`              |
-| `resource_type` | `deployment_config`       |
-| `resource_type` | `deployment_stats`        |
-| `resource_type` | `file`                    |
-| `resource_type` | `group`                   |
-| `resource_type` | `group_member`            |
-| `resource_type` | `idpsync_settings`        |
-| `resource_type` | `license`                 |
-| `resource_type` | `notification_message`    |
-| `resource_type` | `notification_preference` |
-| `resource_type` | `notification_template`   |
-| `resource_type` | `oauth2_app`              |
-| `resource_type` | `oauth2_app_code_token`   |
-| `resource_type` | `oauth2_app_secret`       |
-| `resource_type` | `organization`            |
-| `resource_type` | `organization_member`     |
-| `resource_type` | `provisioner_daemon`      |
-| `resource_type` | `provisioner_jobs`        |
-| `resource_type` | `provisioner_keys`        |
-| `resource_type` | `replicas`                |
-| `resource_type` | `system`                  |
-| `resource_type` | `tailnet_coordinator`     |
-| `resource_type` | `template`                |
-| `resource_type` | `user`                    |
-| `resource_type` | `workspace`               |
-| `resource_type` | `workspace_dormant`       |
-| `resource_type` | `workspace_proxy`         |
+| Property        | Value                              |
+|-----------------|------------------------------------|
+| `action`        | `application_connect`              |
+| `action`        | `assign`                           |
+| `action`        | `create`                           |
+| `action`        | `delete`                           |
+| `action`        | `read`                             |
+| `action`        | `read_personal`                    |
+| `action`        | `ssh`                              |
+| `action`        | `update`                           |
+| `action`        | `update_personal`                  |
+| `action`        | `use`                              |
+| `action`        | `view_insights`                    |
+| `action`        | `start`                            |
+| `action`        | `stop`                             |
+| `resource_type` | `*`                                |
+| `resource_type` | `api_key`                          |
+| `resource_type` | `assign_org_role`                  |
+| `resource_type` | `assign_role`                      |
+| `resource_type` | `audit_log`                        |
+| `resource_type` | `crypto_key`                       |
+| `resource_type` | `debug_info`                       |
+| `resource_type` | `deployment_config`                |
+| `resource_type` | `deployment_stats`                 |
+| `resource_type` | `file`                             |
+| `resource_type` | `group`                            |
+| `resource_type` | `group_member`                     |
+| `resource_type` | `idpsync_settings`                 |
+| `resource_type` | `license`                          |
+| `resource_type` | `notification_message`             |
+| `resource_type` | `notification_preference`          |
+| `resource_type` | `notification_template`            |
+| `resource_type` | `oauth2_app`                       |
+| `resource_type` | `oauth2_app_code_token`            |
+| `resource_type` | `oauth2_app_secret`                |
+| `resource_type` | `organization`                     |
+| `resource_type` | `organization_member`              |
+| `resource_type` | `provisioner_daemon`               |
+| `resource_type` | `provisioner_jobs`                 |
+| `resource_type` | `provisioner_keys`                 |
+| `resource_type` | `replicas`                         |
+| `resource_type` | `system`                           |
+| `resource_type` | `tailnet_coordinator`              |
+| `resource_type` | `template`                         |
+| `resource_type` | `user`                             |
+| `resource_type` | `workspace`                        |
+| `resource_type` | `workspace_agent_resource_monitor` |
+| `resource_type` | `workspace_dormant`                |
+| `resource_type` | `workspace_proxy`                  |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
@@ -326,54 +327,55 @@ Status Code **200**
 
 #### Enumerated Values
 
-| Property        | Value                     |
-|-----------------|---------------------------|
-| `action`        | `application_connect`     |
-| `action`        | `assign`                  |
-| `action`        | `create`                  |
-| `action`        | `delete`                  |
-| `action`        | `read`                    |
-| `action`        | `read_personal`           |
-| `action`        | `ssh`                     |
-| `action`        | `update`                  |
-| `action`        | `update_personal`         |
-| `action`        | `use`                     |
-| `action`        | `view_insights`           |
-| `action`        | `start`                   |
-| `action`        | `stop`                    |
-| `resource_type` | `*`                       |
-| `resource_type` | `api_key`                 |
-| `resource_type` | `assign_org_role`         |
-| `resource_type` | `assign_role`             |
-| `resource_type` | `audit_log`               |
-| `resource_type` | `crypto_key`              |
-| `resource_type` | `debug_info`              |
-| `resource_type` | `deployment_config`       |
-| `resource_type` | `deployment_stats`        |
-| `resource_type` | `file`                    |
-| `resource_type` | `group`                   |
-| `resource_type` | `group_member`            |
-| `resource_type` | `idpsync_settings`        |
-| `resource_type` | `license`                 |
-| `resource_type` | `notification_message`    |
-| `resource_type` | `notification_preference` |
-| `resource_type` | `notification_template`   |
-| `resource_type` | `oauth2_app`              |
-| `resource_type` | `oauth2_app_code_token`   |
-| `resource_type` | `oauth2_app_secret`       |
-| `resource_type` | `organization`            |
-| `resource_type` | `organization_member`     |
-| `resource_type` | `provisioner_daemon`      |
-| `resource_type` | `provisioner_jobs`        |
-| `resource_type` | `provisioner_keys`        |
-| `resource_type` | `replicas`                |
-| `resource_type` | `system`                  |
-| `resource_type` | `tailnet_coordinator`     |
-| `resource_type` | `template`                |
-| `resource_type` | `user`                    |
-| `resource_type` | `workspace`               |
-| `resource_type` | `workspace_dormant`       |
-| `resource_type` | `workspace_proxy`         |
+| Property        | Value                              |
+|-----------------|------------------------------------|
+| `action`        | `application_connect`              |
+| `action`        | `assign`                           |
+| `action`        | `create`                           |
+| `action`        | `delete`                           |
+| `action`        | `read`                             |
+| `action`        | `read_personal`                    |
+| `action`        | `ssh`                              |
+| `action`        | `update`                           |
+| `action`        | `update_personal`                  |
+| `action`        | `use`                              |
+| `action`        | `view_insights`                    |
+| `action`        | `start`                            |
+| `action`        | `stop`                             |
+| `resource_type` | `*`                                |
+| `resource_type` | `api_key`                          |
+| `resource_type` | `assign_org_role`                  |
+| `resource_type` | `assign_role`                      |
+| `resource_type` | `audit_log`                        |
+| `resource_type` | `crypto_key`                       |
+| `resource_type` | `debug_info`                       |
+| `resource_type` | `deployment_config`                |
+| `resource_type` | `deployment_stats`                 |
+| `resource_type` | `file`                             |
+| `resource_type` | `group`                            |
+| `resource_type` | `group_member`                     |
+| `resource_type` | `idpsync_settings`                 |
+| `resource_type` | `license`                          |
+| `resource_type` | `notification_message`             |
+| `resource_type` | `notification_preference`          |
+| `resource_type` | `notification_template`            |
+| `resource_type` | `oauth2_app`                       |
+| `resource_type` | `oauth2_app_code_token`            |
+| `resource_type` | `oauth2_app_secret`                |
+| `resource_type` | `organization`                     |
+| `resource_type` | `organization_member`              |
+| `resource_type` | `provisioner_daemon`               |
+| `resource_type` | `provisioner_jobs`                 |
+| `resource_type` | `provisioner_keys`                 |
+| `resource_type` | `replicas`                         |
+| `resource_type` | `system`                           |
+| `resource_type` | `tailnet_coordinator`              |
+| `resource_type` | `template`                         |
+| `resource_type` | `user`                             |
+| `resource_type` | `workspace`                        |
+| `resource_type` | `workspace_agent_resource_monitor` |
+| `resource_type` | `workspace_dormant`                |
+| `resource_type` | `workspace_proxy`                  |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
@@ -488,54 +490,55 @@ Status Code **200**
 
 #### Enumerated Values
 
-| Property        | Value                     |
-|-----------------|---------------------------|
-| `action`        | `application_connect`     |
-| `action`        | `assign`                  |
-| `action`        | `create`                  |
-| `action`        | `delete`                  |
-| `action`        | `read`                    |
-| `action`        | `read_personal`           |
-| `action`        | `ssh`                     |
-| `action`        | `update`                  |
-| `action`        | `update_personal`         |
-| `action`        | `use`                     |
-| `action`        | `view_insights`           |
-| `action`        | `start`                   |
-| `action`        | `stop`                    |
-| `resource_type` | `*`                       |
-| `resource_type` | `api_key`                 |
-| `resource_type` | `assign_org_role`         |
-| `resource_type` | `assign_role`             |
-| `resource_type` | `audit_log`               |
-| `resource_type` | `crypto_key`              |
-| `resource_type` | `debug_info`              |
-| `resource_type` | `deployment_config`       |
-| `resource_type` | `deployment_stats`        |
-| `resource_type` | `file`                    |
-| `resource_type` | `group`                   |
-| `resource_type` | `group_member`            |
-| `resource_type` | `idpsync_settings`        |
-| `resource_type` | `license`                 |
-| `resource_type` | `notification_message`    |
-| `resource_type` | `notification_preference` |
-| `resource_type` | `notification_template`   |
-| `resource_type` | `oauth2_app`              |
-| `resource_type` | `oauth2_app_code_token`   |
-| `resource_type` | `oauth2_app_secret`       |
-| `resource_type` | `organization`            |
-| `resource_type` | `organization_member`     |
-| `resource_type` | `provisioner_daemon`      |
-| `resource_type` | `provisioner_jobs`        |
-| `resource_type` | `provisioner_keys`        |
-| `resource_type` | `replicas`                |
-| `resource_type` | `system`                  |
-| `resource_type` | `tailnet_coordinator`     |
-| `resource_type` | `template`                |
-| `resource_type` | `user`                    |
-| `resource_type` | `workspace`               |
-| `resource_type` | `workspace_dormant`       |
-| `resource_type` | `workspace_proxy`         |
+| Property        | Value                              |
+|-----------------|------------------------------------|
+| `action`        | `application_connect`              |
+| `action`        | `assign`                           |
+| `action`        | `create`                           |
+| `action`        | `delete`                           |
+| `action`        | `read`                             |
+| `action`        | `read_personal`                    |
+| `action`        | `ssh`                              |
+| `action`        | `update`                           |
+| `action`        | `update_personal`                  |
+| `action`        | `use`                              |
+| `action`        | `view_insights`                    |
+| `action`        | `start`                            |
+| `action`        | `stop`                             |
+| `resource_type` | `*`                                |
+| `resource_type` | `api_key`                          |
+| `resource_type` | `assign_org_role`                  |
+| `resource_type` | `assign_role`                      |
+| `resource_type` | `audit_log`                        |
+| `resource_type` | `crypto_key`                       |
+| `resource_type` | `debug_info`                       |
+| `resource_type` | `deployment_config`                |
+| `resource_type` | `deployment_stats`                 |
+| `resource_type` | `file`                             |
+| `resource_type` | `group`                            |
+| `resource_type` | `group_member`                     |
+| `resource_type` | `idpsync_settings`                 |
+| `resource_type` | `license`                          |
+| `resource_type` | `notification_message`             |
+| `resource_type` | `notification_preference`          |
+| `resource_type` | `notification_template`            |
+| `resource_type` | `oauth2_app`                       |
+| `resource_type` | `oauth2_app_code_token`            |
+| `resource_type` | `oauth2_app_secret`                |
+| `resource_type` | `organization`                     |
+| `resource_type` | `organization_member`              |
+| `resource_type` | `provisioner_daemon`               |
+| `resource_type` | `provisioner_jobs`                 |
+| `resource_type` | `provisioner_keys`                 |
+| `resource_type` | `replicas`                         |
+| `resource_type` | `system`                           |
+| `resource_type` | `tailnet_coordinator`              |
+| `resource_type` | `template`                         |
+| `resource_type` | `user`                             |
+| `resource_type` | `workspace`                        |
+| `resource_type` | `workspace_agent_resource_monitor` |
+| `resource_type` | `workspace_dormant`                |
+| `resource_type` | `workspace_proxy`                  |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
@@ -619,54 +622,55 @@ Status Code **200**
 
 #### Enumerated Values
 
-| Property        | Value                     |
-|-----------------|---------------------------|
-| `action`        | `application_connect`     |
-| `action`        | `assign`                  |
-| `action`        | `create`                  |
-| `action`        | `delete`                  |
-| `action`        | `read`                    |
-| `action`        | `read_personal`           |
-| `action`        | `ssh`                     |
-| `action`        | `update`                  |
-| `action`        | `update_personal`         |
-| `action`        | `use`                     |
-| `action`        | `view_insights`           |
-| `action`        | `start`                   |
-| `action`        | `stop`                    |
-| `resource_type` | `*`                       |
-| `resource_type` | `api_key`                 |
-| `resource_type` | `assign_org_role`         |
-| `resource_type` | `assign_role`             |
-| `resource_type` | `audit_log`               |
-| `resource_type` | `crypto_key`              |
-| `resource_type` | `debug_info`              |
-| `resource_type` | `deployment_config`       |
-| `resource_type` | `deployment_stats`        |
-| `resource_type` | `file`                    |
-| `resource_type` | `group`                   |
-| `resource_type` | `group_member`            |
-| `resource_type` | `idpsync_settings`        |
-| `resource_type` | `license`                 |
-| `resource_type` | `notification_message`    |
-| `resource_type` | `notification_preference` |
-| `resource_type` | `notification_template`   |
-| `resource_type` | `oauth2_app`              |
-| `resource_type` | `oauth2_app_code_token`   |
-| `resource_type` | `oauth2_app_secret`       |
-| `resource_type` | `organization`            |
-| `resource_type` | `organization_member`     |
-| `resource_type` | `provisioner_daemon`      |
-| `resource_type` | `provisioner_jobs`        |
-| `resource_type` | `provisioner_keys`        |
-| `resource_type` | `replicas`                |
-| `resource_type` | `system`                  |
-| `resource_type` | `tailnet_coordinator`     |
-| `resource_type` | `template`                |
-| `resource_type` | `user`                    |
-| `resource_type` | `workspace`               |
-| `resource_type` | `workspace_dormant`       |
-| `resource_type` | `workspace_proxy`         |
+| Property        | Value                              |
+|-----------------|------------------------------------|
+| `action`        | `application_connect`              |
+| `action`        | `assign`                           |
+| `action`        | `create`                           |
+| `action`        | `delete`                           |
+| `action`        | `read`                             |
+| `action`        | `read_personal`                    |
+| `action`        | `ssh`                              |
+| `action`        | `update`                           |
+| `action`        | `update_personal`                  |
+| `action`        | `use`                              |
+| `action`        | `view_insights`                    |
+| `action`        | `start`                            |
+| `action`        | `stop`                             |
+| `resource_type` | `*`                                |
+| `resource_type` | `api_key`                          |
+| `resource_type` | `assign_org_role`                  |
+| `resource_type` | `assign_role`                      |
+| `resource_type` | `audit_log`                        |
+| `resource_type` | `crypto_key`                       |
+| `resource_type` | `debug_info`                       |
+| `resource_type` | `deployment_config`                |
+| `resource_type` | `deployment_stats`                 |
+| `resource_type` | `file`                             |
+| `resource_type` | `group`                            |
+| `resource_type` | `group_member`                     |
+| `resource_type` | `idpsync_settings`                 |
+| `resource_type` | `license`                          |
+| `resource_type` | `notification_message`             |
+| `resource_type` | `notification_preference`          |
+| `resource_type` | `notification_template`            |
+| `resource_type` | `oauth2_app`                       |
+| `resource_type` | `oauth2_app_code_token`            |
+| `resource_type` | `oauth2_app_secret`                |
+| `resource_type` | `organization`                     |
+| `resource_type` | `organization_member`              |
+| `resource_type` | `provisioner_daemon`               |
+| `resource_type` | `provisioner_jobs`                 |
+| `resource_type` | `provisioner_keys`                 |
+| `resource_type` | `replicas`                         |
+| `resource_type` | `system`                           |
+| `resource_type` | `tailnet_coordinator`              |
+| `resource_type` | `template`                         |
+| `resource_type` | `user`                             |
+| `resource_type` | `workspace`                        |
+| `resource_type` | `workspace_agent_resource_monitor` |
+| `resource_type` | `workspace_dormant`                |
+| `resource_type` | `workspace_proxy`                  |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
@@ -882,53 +886,54 @@ Status Code **200**
 
 #### Enumerated Values
 
-| Property        | Value                     |
-|-----------------|---------------------------|
-| `action`        | `application_connect`     |
-| `action`        | `assign`                  |
-| `action`        | `create`                  |
-| `action`        | `delete`                  |
-| `action`        | `read`                    |
-| `action`        | `read_personal`           |
-| `action`        | `ssh`                     |
-| `action`        | `update`                  |
-| `action`        | `update_personal`         |
-| `action`        | `use`                     |
-| `action`        | `view_insights`           |
-| `action`        | `start`                   |
-| `action`        | `stop`                    |
-| `resource_type` | `*`                       |
-| `resource_type` | `api_key`                 |
-| `resource_type` | `assign_org_role`         |
-| `resource_type` | `assign_role`             |
-| `resource_type` | `audit_log`               |
-| `resource_type` | `crypto_key`              |
-| `resource_type` | `debug_info`              |
-| `resource_type` | `deployment_config`       |
-| `resource_type` | `deployment_stats`        |
-| `resource_type` | `file`                    |
-| `resource_type` | `group`                   |
-| `resource_type` | `group_member`            |
-| `resource_type` | `idpsync_settings`        |
-| `resource_type` | `license`                 |
-| `resource_type` | `notification_message`    |
-| `resource_type` | `notification_preference` |
-| `resource_type` | `notification_template`   |
-| `resource_type` | `oauth2_app`              |
-| `resource_type` | `oauth2_app_code_token`   |
-| `resource_type` | `oauth2_app_secret`       |
-| `resource_type` | `organization`            |
-| `resource_type` | `organization_member`     |
-| `resource_type` | `provisioner_daemon`      |
-| `resource_type` | `provisioner_jobs`        |
-| `resource_type` | `provisioner_keys`        |
-| `resource_type` | `replicas`                |
-| `resource_type` | `system`                  |
-| `resource_type` | `tailnet_coordinator`     |
-| `resource_type` | `template`                |
-| `resource_type` | `user`                    |
-| `resource_type` | `workspace`               |
-| `resource_type` | `workspace_dormant`       |
-| `resource_type` | `workspace_proxy`         |
+| Property        | Value                              |
+|-----------------|------------------------------------|
+| `action`        | `application_connect`              |
+| `action`        | `assign`                           |
+| `action`        | `create`                           |
+| `action`        | `delete`                           |
+| `action`        | `read`                             |
+| `action`        | `read_personal`                    |
+| `action`        | `ssh`                              |
+| `action`        | `update`                           |
+| `action`        | `update_personal`                  |
+| `action`        | `use`                              |
+| `action`        | `view_insights`                    |
+| `action`        | `start`                            |
+| `action`        | `stop`                             |
+| `resource_type` | `*`                                |
+| `resource_type` | `api_key`                          |
+| `resource_type` | `assign_org_role`                  |
+| `resource_type` | `assign_role`                      |
+| `resource_type` | `audit_log`                        |
+| `resource_type` | `crypto_key`                       |
+| `resource_type` | `debug_info`                       |
+| `resource_type` | `deployment_config`                |
+| `resource_type` | `deployment_stats`                 |
+| `resource_type` | `file`                             |
+| `resource_type` | `group`                            |
+| `resource_type` | `group_member`                     |
+| `resource_type` | `idpsync_settings`                 |
+| `resource_type` | `license`                          |
+| `resource_type` | `notification_message`             |
+| `resource_type` | `notification_preference`          |
+| `resource_type` | `notification_template`            |
+| `resource_type` | `oauth2_app`                       |
+| `resource_type` | `oauth2_app_code_token`            |
+| `resource_type` | `oauth2_app_secret`                |
+| `resource_type` | `organization`                     |
+| `resource_type` | `organization_member`              |
+| `resource_type` | `provisioner_daemon`               |
+| `resource_type` | `provisioner_jobs`                 |
+| `resource_type` | `provisioner_keys`                 |
+| `resource_type` | `replicas`                         |
+| `resource_type` | `system`                           |
+| `resource_type` | `tailnet_coordinator`              |
+| `resource_type` | `template`                         |
+| `resource_type` | `user`                             |
+| `resource_type` | `workspace`                        |
+| `resource_type` | `workspace_agent_resource_monitor` |
+| `resource_type` | `workspace_dormant`                |
+| `resource_type` | `workspace_proxy`                  |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).

docs/reference/api/schemas.md

@@ -4991,41 +4991,42 @@ Git clone makes use of this by parsing the URL from: 'Username for "https://gith
 
 #### Enumerated Values
 
-| Value                     |
-|---------------------------|
-| `*`                       |
-| `api_key`                 |
-| `assign_org_role`         |
-| `assign_role`             |
-| `audit_log`               |
-| `crypto_key`              |
-| `debug_info`              |
-| `deployment_config`       |
-| `deployment_stats`        |
-| `file`                    |
-| `group`                   |
-| `group_member`            |
-| `idpsync_settings`        |
-| `license`                 |
-| `notification_message`    |
-| `notification_preference` |
-| `notification_template`   |
-| `oauth2_app`              |
-| `oauth2_app_code_token`   |
-| `oauth2_app_secret`       |
-| `organization`            |
-| `organization_member`     |
-| `provisioner_daemon`      |
-| `provisioner_jobs`        |
-| `provisioner_keys`        |
-| `replicas`                |
-| `system`                  |
-| `tailnet_coordinator`     |
-| `template`                |
-| `user`                    |
-| `workspace`               |
-| `workspace_dormant`       |
-| `workspace_proxy`         |
+| Value                              |
+|------------------------------------|
+| `*`                                |
+| `api_key`                          |
+| `assign_org_role`                  |
+| `assign_role`                      |
+| `audit_log`                        |
+| `crypto_key`                       |
+| `debug_info`                       |
+| `deployment_config`                |
+| `deployment_stats`                 |
+| `file`                             |
+| `group`                            |
+| `group_member`                     |
+| `idpsync_settings`                 |
+| `license`                          |
+| `notification_message`             |
+| `notification_preference`          |
+| `notification_template`            |
+| `oauth2_app`                       |
+| `oauth2_app_code_token`            |
+| `oauth2_app_secret`                |
+| `organization`                     |
+| `organization_member`              |
+| `provisioner_daemon`               |
+| `provisioner_jobs`                 |
+| `provisioner_keys`                 |
+| `replicas`                         |
+| `system`                           |
+| `tailnet_coordinator`              |
+| `template`                         |
+| `user`                             |
+| `workspace`                        |
+| `workspace_agent_resource_monitor` |
+| `workspace_dormant`                |
+| `workspace_proxy`                  |
 
 ## codersdk.RateLimitConfig
 

provisioner/terraform/resources.go

@@ -56,6 +56,23 @@ type agentAttributes struct {
 	Metadata                 []agentMetadata              `mapstructure:"metadata"`
 	DisplayApps              []agentDisplayAppsAttributes `mapstructure:"display_apps"`
 	Order                    int64                        `mapstructure:"order"`
+	ResourcesMonitoring      []agentResourcesMonitoring   `mapstructure:"resources_monitoring"`
+}
+
+type agentResourcesMonitoring struct {
+	Memory  []agentMemoryResourceMonitor `mapstructure:"memory"`
+	Volumes []agentVolumeResourceMonitor `mapstructure:"volume"`
+}
+
+type agentMemoryResourceMonitor struct {
+	Enabled   bool  `mapstructure:"enabled"`
+	Threshold int32 `mapstructure:"threshold"`
+}
+
+type agentVolumeResourceMonitor struct {
+	Path      string `mapstructure:"path"`
+	Enabled   bool   `mapstructure:"enabled"`
+	Threshold int32  `mapstructure:"threshold"`
 }
 
 type agentDisplayAppsAttributes struct {
@@ -239,6 +256,29 @@ func ConvertState(ctx context.Context, modules []*tfjson.StateModule, rawGraph s
 				}
 			}
 
+			resourcesMonitoring := &proto.ResourcesMonitoring{
+				Volumes: make([]*proto.VolumeResourceMonitor, 0),
+			}
+
+			for _, resource := range attrs.ResourcesMonitoring {
+				for _, memoryResource := range resource.Memory {
+					resourcesMonitoring.Memory = &proto.MemoryResourceMonitor{
+						Enabled:   memoryResource.Enabled,
+						Threshold: memoryResource.Threshold,
+					}
+				}
+			}
+
+			for _, resource := range attrs.ResourcesMonitoring {
+				for _, volume := range resource.Volumes {
+					resourcesMonitoring.Volumes = append(resourcesMonitoring.Volumes, &proto.VolumeResourceMonitor{
+						Path:      volume.Path,
+						Enabled:   volume.Enabled,
+						Threshold: volume.Threshold,
+					})
+				}
+			}
+
 			agent := &proto.Agent{
 				Name:                     tfResource.Name,
 				Id:                       attrs.ID,
@@ -249,6 +289,7 @@ func ConvertState(ctx context.Context, modules []*tfjson.StateModule, rawGraph s
 				ConnectionTimeoutSeconds: attrs.ConnectionTimeoutSeconds,
 				TroubleshootingUrl:       attrs.TroubleshootingURL,
 				MotdFile:                 attrs.MOTDFile,
+				ResourcesMonitoring:      resourcesMonitoring,
 				Metadata:                 metadata,
 				DisplayApps:              displayApps,
 				Order:                    attrs.Order,

provisioner/terraform/resources_test.go

@@ -66,6 +66,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 		},
@@ -83,6 +84,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}, {
 				Name: "second",
@@ -101,6 +103,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_InstanceId{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 		},
@@ -117,6 +120,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 				ModulePath: "module.module",
 			}},
@@ -134,6 +138,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}, {
 					Name:                     "dev2",
 					OperatingSystem:          "darwin",
@@ -142,6 +147,7 @@ func TestConvertResources(t *testing.T) {
 					ConnectionTimeoutSeconds: 1,
 					MotdFile:                 "/etc/motd",
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 					Scripts: []*proto.Script{{
 						Icon:        "/emojis/25c0.png",
 						DisplayName: "Shutdown Script",
@@ -157,6 +163,7 @@ func TestConvertResources(t *testing.T) {
 					ConnectionTimeoutSeconds: 120,
 					TroubleshootingUrl:       "https://coder.com/troubleshoot",
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}, {
 					Name:                     "dev4",
 					OperatingSystem:          "linux",
@@ -164,6 +171,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 		},
@@ -205,6 +213,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 		},
@@ -231,6 +240,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 		},
@@ -265,6 +275,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}, {
 				Name: "dev2",
@@ -284,6 +295,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 		},
@@ -308,6 +320,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}, {
 				Name: "dev2",
@@ -325,6 +338,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}, {
 				Name: "env1",
@@ -337,6 +351,75 @@ func TestConvertResources(t *testing.T) {
 				Type: "coder_env",
 			}},
 		},
+		"multiple-agents-multiple-monitors": {
+			resources: []*proto.Resource{{
+				Name: "dev",
+				Type: "null_resource",
+				Agents: []*proto.Agent{
+					{
+						Name:            "dev1",
+						OperatingSystem: "linux",
+						Architecture:    "amd64",
+						Apps: []*proto.App{
+							{
+								Slug:        "app1",
+								DisplayName: "app1",
+								// Subdomain defaults to false if unspecified.
+								Subdomain: false,
+								OpenIn:    proto.AppOpenIn_SLIM_WINDOW,
+							},
+							{
+								Slug:        "app2",
+								DisplayName: "app2",
+								Subdomain:   true,
+								Healthcheck: &proto.Healthcheck{
+									Url:       "http://localhost:13337/healthz",
+									Interval:  5,
+									Threshold: 6,
+								},
+								OpenIn: proto.AppOpenIn_SLIM_WINDOW,
+							},
+						},
+						Auth:                     &proto.Agent_Token{},
+						ConnectionTimeoutSeconds: 120,
+						DisplayApps:              &displayApps,
+						ResourcesMonitoring: &proto.ResourcesMonitoring{
+							Memory: &proto.MemoryResourceMonitor{
+								Enabled:   true,
+								Threshold: 80,
+							},
+						},
+					},
+					{
+						Name:                     "dev2",
+						OperatingSystem:          "linux",
+						Architecture:             "amd64",
+						Apps:                     []*proto.App{},
+						Auth:                     &proto.Agent_Token{},
+						ConnectionTimeoutSeconds: 120,
+						DisplayApps:              &displayApps,
+						ResourcesMonitoring: &proto.ResourcesMonitoring{
+							Memory: &proto.MemoryResourceMonitor{
+								Enabled:   true,
+								Threshold: 99,
+							},
+							Volumes: []*proto.VolumeResourceMonitor{
+								{
+									Path:      "volume2",
+									Enabled:   false,
+									Threshold: 50,
+								},
+								{
+									Path:      "volume1",
+									Enabled:   true,
+									Threshold: 80,
+								},
+							},
+						},
+					},
+				},
+			}},
+		},
 		"multiple-agents-multiple-scripts": {
 			resources: []*proto.Resource{{
 				Name: "dev1",
@@ -360,6 +443,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}, {
 				Name: "dev2",
@@ -378,6 +462,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 		},
@@ -417,6 +502,7 @@ func TestConvertResources(t *testing.T) {
 					}},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 		},
@@ -468,6 +554,7 @@ func TestConvertResources(t *testing.T) {
 						Auth:                     &proto.Agent_Token{},
 						ConnectionTimeoutSeconds: 120,
 						DisplayApps:              &displayApps,
+						ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 						Scripts: []*proto.Script{{
 							DisplayName: "Startup Script",
 							RunOnStart:  true,
@@ -490,6 +577,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 			parameters: []*proto.RichParameter{{
@@ -569,6 +657,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 			parameters: []*proto.RichParameter{{
@@ -595,6 +684,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 			parameters: []*proto.RichParameter{{
@@ -648,6 +738,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &displayApps,
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 			externalAuthProviders: []*proto.ExternalAuthProviderResource{{Id: "github"}, {Id: "gitlab", Optional: true}},
@@ -666,6 +757,7 @@ func TestConvertResources(t *testing.T) {
 						VscodeInsiders: true,
 						WebTerminal:    true,
 					},
+					ResourcesMonitoring: &proto.ResourcesMonitoring{},
 				}},
 			}},
 		},
@@ -680,6 +772,7 @@ func TestConvertResources(t *testing.T) {
 					Auth:                     &proto.Agent_Token{},
 					ConnectionTimeoutSeconds: 120,
 					DisplayApps:              &proto.DisplayApps{},
+					ResourcesMonitoring:      &proto.ResourcesMonitoring{},
 				}},
 			}},
 		},

provisioner/terraform/testdata/calling-module/calling-module.tfplan.json

@@ -259,7 +259,7 @@
       ]
     }
   ],
-  "timestamp": "2025-01-28T15:12:27Z",
+  "timestamp": "2025-01-29T22:47:46Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/calling-module/calling-module.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "c559c8be-3b52-444a-bf51-81d270002ec6",
+            "id": "14f0eb08-1bdb-4d48-ab20-e06584ee5b68",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "ddc9b3fb-9fb8-4a87-ac35-79854980d9e8",
+            "token": "454fffe5-3c59-4a9e-80a0-0d1644ce3b24",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -68,7 +68,7 @@
                 "outputs": {
                   "script": ""
                 },
-                "random": "7258064144792284733"
+                "random": "8389680299908922676"
               },
               "sensitive_values": {
                 "inputs": {},
@@ -83,7 +83,7 @@
               "provider_name": "registry.terraform.io/hashicorp/null",
               "schema_version": 0,
               "values": {
-                "id": "229848906584483141",
+                "id": "8124127383117450432",
                 "triggers": null
               },
               "sensitive_values": {},

provisioner/terraform/testdata/chaining-resources/chaining-resources.tfplan.json

@@ -204,7 +204,7 @@
       ]
     }
   },
-  "timestamp": "2025-01-28T15:12:29Z",
+  "timestamp": "2025-01-29T22:47:48Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/chaining-resources/chaining-resources.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "03e2b129-b68a-4ef2-8f7b-9d7d5f37ca53",
+            "id": "038d5038-be85-4609-bde3-56b7452e4386",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "654a785d-f5dc-4900-91a2-6b147e50e646",
+            "token": "e570d762-5584-4192-a474-be9e137b2f09",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -56,7 +56,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "2274350610501479414",
+            "id": "690495753077748083",
             "triggers": null
           },
           "sensitive_values": {},
@@ -73,7 +73,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "7072775735272284574",
+            "id": "3238567980725122951",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/conflicting-resources/conflicting-resources.tfplan.json

@@ -204,7 +204,7 @@
       ]
     }
   },
-  "timestamp": "2025-01-28T15:12:31Z",
+  "timestamp": "2025-01-29T22:47:50Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/conflicting-resources/conflicting-resources.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "358633fb-7027-405f-89f2-e5af0d8b20ce",
+            "id": "be15a1b3-f041-4471-9dec-9784c68edb26",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "be3fe571-825b-49f6-83a1-c1559fb5fab2",
+            "token": "df2580ad-59cc-48fb-bb21-40a8be5a5a66",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -56,7 +56,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "6032937966896590151",
+            "id": "9103672483967127580",
             "triggers": null
           },
           "sensitive_values": {},
@@ -72,7 +72,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "2643104793080563075",
+            "id": "4372402015997897970",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfplan.json

@@ -203,7 +203,7 @@
       ]
     }
   },
-  "timestamp": "2025-01-28T15:12:34Z",
+  "timestamp": "2025-01-29T22:47:53Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "8952fd46-e4f8-4cc0-952e-1e5432cba8b0",
+            "id": "398e27d3-10cc-4522-9144-34658eedad0e",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "dc0ec51c-31b0-4231-9c37-3ba3612aab3d",
+            "token": "33068dbe-54d7-45eb-bfe5-87a9756802e2",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -56,7 +56,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "7702081486633943931",
+            "id": "5682617535476100233",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/display-apps/display-apps.tfplan.json

@@ -203,7 +203,7 @@
       ]
     }
   },
-  "timestamp": "2025-01-28T15:12:33Z",
+  "timestamp": "2025-01-29T22:47:52Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/display-apps/display-apps.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "98465962-626d-429d-b741-6a82dc619290",
+            "id": "810cdd01-a27d-442f-9e69-bdaecced8a59",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "69fbb7df-37e7-455e-8a84-59387b71a13b",
+            "token": "fade1b71-d52b-4ef2-bb05-961f7795bab9",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -56,7 +56,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3493181194980203436",
+            "id": "5174735461860530782",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/external-auth-providers/external-auth-providers.tfplan.json

@@ -227,7 +227,7 @@
       ]
     }
   },
-  "timestamp": "2025-01-28T15:12:36Z",
+  "timestamp": "2025-01-29T22:47:55Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/external-auth-providers/external-auth-providers.tfstate.json

@@ -54,7 +54,7 @@
               }
             ],
             "env": null,
-            "id": "bc3376e8-2bee-4051-aa2b-4ebb0a23ed36",
+            "id": "7ead336b-d366-4991-b38d-bdb8b9333ae9",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -64,7 +64,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "7e184d36-e137-404f-8316-e3d436ea5ea1",
+            "token": "a3d2c620-f065-4b29-ae58-370292e787d4",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -84,7 +84,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "2888417441231317883",
+            "id": "3060850815800759131",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/instance-id/instance-id.tfplan.json

@@ -224,7 +224,7 @@
       ]
     }
   ],
-  "timestamp": "2025-01-28T15:12:38Z",
+  "timestamp": "2025-01-29T22:47:57Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/instance-id/instance-id.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "e159f254-a48c-4880-9137-431f128a74f9",
+            "id": "c6e99a38-f10b-4242-a7c6-bd9186008b9d",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "403743af-9b14-4e59-abea-fdc83ba245ca",
+            "token": "ecddacca-df83-4dd2-b6cb-71f439e9e5f5",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -56,8 +56,8 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 0,
           "values": {
-            "agent_id": "e159f254-a48c-4880-9137-431f128a74f9",
-            "id": "1be21476-70a7-43d7-98c4-eaa0a4a41382",
+            "agent_id": "c6e99a38-f10b-4242-a7c6-bd9186008b9d",
+            "id": "0ed215f9-07b0-455f-828d-faee5f63ea93",
             "instance_id": "example"
           },
           "sensitive_values": {},
@@ -73,7 +73,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3205865520469319314",
+            "id": "1340003819945612525",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/mapped-apps/mapped-apps.tfplan.json

@@ -326,7 +326,7 @@
       ]
     }
   ],
-  "timestamp": "2025-01-28T15:12:40Z",
+  "timestamp": "2025-01-29T22:47:59Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/mapped-apps/mapped-apps.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "4a06e166-5a7e-4092-a3df-4f1a3004f9be",
+            "id": "18098e15-2e8b-4c83-9362-0823834ae628",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "c02dc689-b086-42d1-9224-43a80b272b09",
+            "token": "59691c9e-bf9e-4c93-9768-ba3582c68727",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -57,14 +57,14 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "4a06e166-5a7e-4092-a3df-4f1a3004f9be",
+            "agent_id": "18098e15-2e8b-4c83-9362-0823834ae628",
             "command": null,
             "display_name": "app1",
             "external": false,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
-            "id": "83027af7-2f83-4b67-bc31-1a03e9638854",
+            "id": "8f031ab5-e051-4eff-9f7e-233f5825c3fd",
             "open_in": "slim-window",
             "order": null,
             "share": "owner",
@@ -88,14 +88,14 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "4a06e166-5a7e-4092-a3df-4f1a3004f9be",
+            "agent_id": "18098e15-2e8b-4c83-9362-0823834ae628",
             "command": null,
             "display_name": "app2",
             "external": false,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
-            "id": "f80e5b41-bae3-4837-9bb7-8c6f3f263f44",
+            "id": "5462894e-7fdc-4fd0-8715-7829e53efea2",
             "open_in": "slim-window",
             "order": null,
             "share": "owner",
@@ -118,7 +118,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "291249994602235015",
+            "id": "2699316377754222096",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/multiple-agents-multiple-apps/multiple-agents-multiple-apps.tfplan.json

@@ -573,19 +573,19 @@
   },
   "relevant_attributes": [
     {
-      "resource": "coder_agent.dev2",
+      "resource": "coder_agent.dev1",
       "attribute": [
         "id"
       ]
     },
     {
-      "resource": "coder_agent.dev1",
+      "resource": "coder_agent.dev2",
       "attribute": [
         "id"
       ]
     }
   ],
-  "timestamp": "2025-01-28T15:12:43Z",
+  "timestamp": "2025-01-29T22:48:03Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/multiple-agents-multiple-apps/multiple-agents-multiple-apps.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "abbe0827-18fe-4978-97bc-7b5282a24264",
+            "id": "00794e64-40d3-43df-885a-4b1cc5f5b965",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "89ff8dd5-395b-41c5-933b-bcdc520c98ed",
+            "token": "7c0a6e5e-dd2c-46e4-a5f5-f71aae7515c3",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -70,7 +70,7 @@
               }
             ],
             "env": null,
-            "id": "c459a282-0b66-4bd3-8571-5e2e9391578a",
+            "id": "1b8ddc14-25c2-4eab-b282-71b12d45de73",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -80,7 +80,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "daa8d077-285a-40fa-a8fb-867d7129a5bc",
+            "token": "39497aa1-11a1-40c0-854d-554c2e27ef77",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -100,14 +100,14 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "abbe0827-18fe-4978-97bc-7b5282a24264",
+            "agent_id": "00794e64-40d3-43df-885a-4b1cc5f5b965",
             "command": null,
             "display_name": null,
             "external": false,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
-            "id": "a6353ab2-3b98-42d8-9f6a-3076de30901b",
+            "id": "c9cf036f-5fd9-408a-8c28-90cde4c5b0cf",
             "open_in": "slim-window",
             "order": null,
             "share": "owner",
@@ -130,7 +130,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "abbe0827-18fe-4978-97bc-7b5282a24264",
+            "agent_id": "00794e64-40d3-43df-885a-4b1cc5f5b965",
             "command": null,
             "display_name": null,
             "external": false,
@@ -143,7 +143,7 @@
             ],
             "hidden": false,
             "icon": null,
-            "id": "5e88d032-507a-42a6-beec-6e4347c3adf9",
+            "id": "e40999b2-8ceb-4e35-962b-c0b7b95c8bc8",
             "open_in": "slim-window",
             "order": null,
             "share": "owner",
@@ -168,14 +168,14 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "c459a282-0b66-4bd3-8571-5e2e9391578a",
+            "agent_id": "1b8ddc14-25c2-4eab-b282-71b12d45de73",
             "command": null,
             "display_name": null,
             "external": false,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
-            "id": "b6e356de-041a-462b-81e3-c0d10dd0d0b8",
+            "id": "4e61c245-271a-41e1-9a37-2badf68bf5cd",
             "open_in": "slim-window",
             "order": null,
             "share": "owner",
@@ -198,7 +198,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3689009350968113540",
+            "id": "7796235346668423309",
             "triggers": null
           },
           "sensitive_values": {},
@@ -214,7 +214,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "2490343974856468132",
+            "id": "8353198974918613541",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/multiple-agents-multiple-envs/multiple-agents-multiple-envs.tfplan.json

@@ -470,19 +470,19 @@
   },
   "relevant_attributes": [
     {
-      "resource": "coder_agent.dev2",
+      "resource": "coder_agent.dev1",
       "attribute": [
         "id"
       ]
     },
     {
-      "resource": "coder_agent.dev1",
+      "resource": "coder_agent.dev2",
       "attribute": [
         "id"
       ]
     }
   ],
-  "timestamp": "2025-01-28T15:12:45Z",
+  "timestamp": "2025-01-29T22:48:05Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/multiple-agents-multiple-envs/multiple-agents-multiple-envs.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "8a650370-c43d-47b7-8012-27eef203c154",
+            "id": "f1398cbc-4e67-4a0e-92b7-15dc33221872",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "c566f0a7-9926-460a-8f06-9ce4031859dc",
+            "token": "acbbabee-e370-4aba-b876-843fb10201e8",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -70,7 +70,7 @@
               }
             ],
             "env": null,
-            "id": "33300ef0-5b62-4e60-ae45-64d8784c8da4",
+            "id": "ea44429d-fc3c-4ea6-ba23-a997dc66cad8",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -80,7 +80,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "915682f8-647b-4856-b81c-4887aaab9dba",
+            "token": "51fea695-82dd-4ccd-bf25-2c55a82b4851",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -100,8 +100,8 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "8a650370-c43d-47b7-8012-27eef203c154",
-            "id": "8e3b8ee2-229d-4b8d-b1e2-f970d5fd2ef0",
+            "agent_id": "f1398cbc-4e67-4a0e-92b7-15dc33221872",
+            "id": "f8f7b3f7-5c4b-47b9-959e-32d2044329e3",
             "name": "ENV_1",
             "value": "Env 1"
           },
@@ -118,8 +118,8 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "8a650370-c43d-47b7-8012-27eef203c154",
-            "id": "afd2e7c1-b580-4e83-9f02-d4a35448701b",
+            "agent_id": "f1398cbc-4e67-4a0e-92b7-15dc33221872",
+            "id": "b7171d98-09c9-4bc4-899d-4b7343cd86ca",
             "name": "ENV_2",
             "value": "Env 2"
           },
@@ -136,8 +136,8 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "33300ef0-5b62-4e60-ae45-64d8784c8da4",
-            "id": "a5b91527-2a7e-4f3c-bc04-01ee322d2c91",
+            "agent_id": "ea44429d-fc3c-4ea6-ba23-a997dc66cad8",
+            "id": "84021f25-1736-4884-8e5c-553e9c1f6fa6",
             "name": "ENV_3",
             "value": "Env 3"
           },
@@ -154,7 +154,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "5412697184517577000",
+            "id": "4901314428677246063",
             "triggers": null
           },
           "sensitive_values": {},
@@ -170,7 +170,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "6595408937266951935",
+            "id": "3203010350140581146",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tf

@@ -0,0 +1,67 @@
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = "0.22.0"
+    }
+  }
+}
+
+resource "coder_agent" "dev1" {
+  os   = "linux"
+  arch = "amd64"
+  resources_monitoring {
+    memory {
+      enabled   = true
+      threshold = 80
+    }
+  }
+}
+
+resource "coder_agent" "dev2" {
+  os   = "linux"
+  arch = "amd64"
+  resources_monitoring {
+    memory {
+      enabled   = true
+      threshold = 99
+    }
+    volume {
+      path      = "volume1"
+      enabled   = true
+      threshold = 80
+    }
+    volume {
+      path      = "volume2"
+      enabled   = false
+      threshold = 50
+    }
+  }
+}
+
+# app1 is for testing subdomain default.
+resource "coder_app" "app1" {
+  agent_id = coder_agent.dev1.id
+  slug     = "app1"
+  # subdomain should default to false.
+  # subdomain = false
+}
+
+# app2 tests that subdomaincan be true, and that healthchecks work.
+resource "coder_app" "app2" {
+  agent_id  = coder_agent.dev1.id
+  slug      = "app2"
+  subdomain = true
+  healthcheck {
+    url       = "http://localhost:13337/healthz"
+    interval  = 5
+    threshold = 6
+  }
+}
+
+resource "null_resource" "dev" {
+  depends_on = [
+    coder_agent.dev1,
+    coder_agent.dev2
+  ]
+}

provisioner/terraform/testdata/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfplan.dot

@@ -0,0 +1,26 @@
+digraph {
+	compound = "true"
+	newrank = "true"
+	subgraph "root" {
+		"[root] coder_agent.dev1 (expand)" [label = "coder_agent.dev1", shape = "box"]
+		"[root] coder_agent.dev2 (expand)" [label = "coder_agent.dev2", shape = "box"]
+		"[root] coder_app.app1 (expand)" [label = "coder_app.app1", shape = "box"]
+		"[root] coder_app.app2 (expand)" [label = "coder_app.app2", shape = "box"]
+		"[root] null_resource.dev (expand)" [label = "null_resource.dev", shape = "box"]
+		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"]" [label = "provider[\"registry.terraform.io/hashicorp/null\"]", shape = "diamond"]
+		"[root] coder_agent.dev1 (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] coder_agent.dev2 (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] coder_app.app1 (expand)" -> "[root] coder_agent.dev1 (expand)"
+		"[root] coder_app.app2 (expand)" -> "[root] coder_agent.dev1 (expand)"
+		"[root] null_resource.dev (expand)" -> "[root] coder_agent.dev1 (expand)"
+		"[root] null_resource.dev (expand)" -> "[root] coder_agent.dev2 (expand)"
+		"[root] null_resource.dev (expand)" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"]"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_agent.dev2 (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_app.app1 (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_app.app2 (expand)"
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)" -> "[root] null_resource.dev (expand)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)"
+	}
+}

provisioner/terraform/testdata/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfplan.json

@@ -0,0 +1,625 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.9.8",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_agent.dev1",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "dev1",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "arch": "amd64",
+            "auth": "token",
+            "connection_timeout": 120,
+            "dir": null,
+            "env": null,
+            "metadata": [],
+            "motd_file": null,
+            "order": null,
+            "os": "linux",
+            "resources_monitoring": [
+              {
+                "memory": [
+                  {
+                    "enabled": true,
+                    "threshold": 80
+                  }
+                ],
+                "volume": []
+              }
+            ],
+            "shutdown_script": null,
+            "startup_script": null,
+            "startup_script_behavior": "non-blocking",
+            "troubleshooting_url": null
+          },
+          "sensitive_values": {
+            "display_apps": [],
+            "metadata": [],
+            "resources_monitoring": [
+              {
+                "memory": [
+                  {}
+                ],
+                "volume": []
+              }
+            ],
+            "token": true
+          }
+        },
+        {
+          "address": "coder_agent.dev2",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "dev2",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "arch": "amd64",
+            "auth": "token",
+            "connection_timeout": 120,
+            "dir": null,
+            "env": null,
+            "metadata": [],
+            "motd_file": null,
+            "order": null,
+            "os": "linux",
+            "resources_monitoring": [
+              {
+                "memory": [
+                  {
+                    "enabled": true,
+                    "threshold": 99
+                  }
+                ],
+                "volume": [
+                  {
+                    "enabled": false,
+                    "path": "volume2",
+                    "threshold": 50
+                  },
+                  {
+                    "enabled": true,
+                    "path": "volume1",
+                    "threshold": 80
+                  }
+                ]
+              }
+            ],
+            "shutdown_script": null,
+            "startup_script": null,
+            "startup_script_behavior": "non-blocking",
+            "troubleshooting_url": null
+          },
+          "sensitive_values": {
+            "display_apps": [],
+            "metadata": [],
+            "resources_monitoring": [
+              {
+                "memory": [
+                  {}
+                ],
+                "volume": [
+                  {},
+                  {}
+                ]
+              }
+            ],
+            "token": true
+          }
+        },
+        {
+          "address": "coder_app.app1",
+          "mode": "managed",
+          "type": "coder_app",
+          "name": "app1",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "command": null,
+            "display_name": null,
+            "external": false,
+            "healthcheck": [],
+            "hidden": false,
+            "icon": null,
+            "open_in": "slim-window",
+            "order": null,
+            "share": "owner",
+            "slug": "app1",
+            "subdomain": null,
+            "url": null
+          },
+          "sensitive_values": {
+            "healthcheck": []
+          }
+        },
+        {
+          "address": "coder_app.app2",
+          "mode": "managed",
+          "type": "coder_app",
+          "name": "app2",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "command": null,
+            "display_name": null,
+            "external": false,
+            "healthcheck": [
+              {
+                "interval": 5,
+                "threshold": 6,
+                "url": "http://localhost:13337/healthz"
+              }
+            ],
+            "hidden": false,
+            "icon": null,
+            "open_in": "slim-window",
+            "order": null,
+            "share": "owner",
+            "slug": "app2",
+            "subdomain": true,
+            "url": null
+          },
+          "sensitive_values": {
+            "healthcheck": [
+              {}
+            ]
+          }
+        },
+        {
+          "address": "null_resource.dev",
+          "mode": "managed",
+          "type": "null_resource",
+          "name": "dev",
+          "provider_name": "registry.terraform.io/hashicorp/null",
+          "schema_version": 0,
+          "values": {
+            "triggers": null
+          },
+          "sensitive_values": {}
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "coder_agent.dev1",
+      "mode": "managed",
+      "type": "coder_agent",
+      "name": "dev1",
+      "provider_name": "registry.terraform.io/coder/coder",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "arch": "amd64",
+          "auth": "token",
+          "connection_timeout": 120,
+          "dir": null,
+          "env": null,
+          "metadata": [],
+          "motd_file": null,
+          "order": null,
+          "os": "linux",
+          "resources_monitoring": [
+            {
+              "memory": [
+                {
+                  "enabled": true,
+                  "threshold": 80
+                }
+              ],
+              "volume": []
+            }
+          ],
+          "shutdown_script": null,
+          "startup_script": null,
+          "startup_script_behavior": "non-blocking",
+          "troubleshooting_url": null
+        },
+        "after_unknown": {
+          "display_apps": true,
+          "id": true,
+          "init_script": true,
+          "metadata": [],
+          "resources_monitoring": [
+            {
+              "memory": [
+                {}
+              ],
+              "volume": []
+            }
+          ],
+          "token": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "display_apps": [],
+          "metadata": [],
+          "resources_monitoring": [
+            {
+              "memory": [
+                {}
+              ],
+              "volume": []
+            }
+          ],
+          "token": true
+        }
+      }
+    },
+    {
+      "address": "coder_agent.dev2",
+      "mode": "managed",
+      "type": "coder_agent",
+      "name": "dev2",
+      "provider_name": "registry.terraform.io/coder/coder",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "arch": "amd64",
+          "auth": "token",
+          "connection_timeout": 120,
+          "dir": null,
+          "env": null,
+          "metadata": [],
+          "motd_file": null,
+          "order": null,
+          "os": "linux",
+          "resources_monitoring": [
+            {
+              "memory": [
+                {
+                  "enabled": true,
+                  "threshold": 99
+                }
+              ],
+              "volume": [
+                {
+                  "enabled": false,
+                  "path": "volume2",
+                  "threshold": 50
+                },
+                {
+                  "enabled": true,
+                  "path": "volume1",
+                  "threshold": 80
+                }
+              ]
+            }
+          ],
+          "shutdown_script": null,
+          "startup_script": null,
+          "startup_script_behavior": "non-blocking",
+          "troubleshooting_url": null
+        },
+        "after_unknown": {
+          "display_apps": true,
+          "id": true,
+          "init_script": true,
+          "metadata": [],
+          "resources_monitoring": [
+            {
+              "memory": [
+                {}
+              ],
+              "volume": [
+                {},
+                {}
+              ]
+            }
+          ],
+          "token": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "display_apps": [],
+          "metadata": [],
+          "resources_monitoring": [
+            {
+              "memory": [
+                {}
+              ],
+              "volume": [
+                {},
+                {}
+              ]
+            }
+          ],
+          "token": true
+        }
+      }
+    },
+    {
+      "address": "coder_app.app1",
+      "mode": "managed",
+      "type": "coder_app",
+      "name": "app1",
+      "provider_name": "registry.terraform.io/coder/coder",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "command": null,
+          "display_name": null,
+          "external": false,
+          "healthcheck": [],
+          "hidden": false,
+          "icon": null,
+          "open_in": "slim-window",
+          "order": null,
+          "share": "owner",
+          "slug": "app1",
+          "subdomain": null,
+          "url": null
+        },
+        "after_unknown": {
+          "agent_id": true,
+          "healthcheck": [],
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "healthcheck": []
+        }
+      }
+    },
+    {
+      "address": "coder_app.app2",
+      "mode": "managed",
+      "type": "coder_app",
+      "name": "app2",
+      "provider_name": "registry.terraform.io/coder/coder",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "command": null,
+          "display_name": null,
+          "external": false,
+          "healthcheck": [
+            {
+              "interval": 5,
+              "threshold": 6,
+              "url": "http://localhost:13337/healthz"
+            }
+          ],
+          "hidden": false,
+          "icon": null,
+          "open_in": "slim-window",
+          "order": null,
+          "share": "owner",
+          "slug": "app2",
+          "subdomain": true,
+          "url": null
+        },
+        "after_unknown": {
+          "agent_id": true,
+          "healthcheck": [
+            {}
+          ],
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "healthcheck": [
+            {}
+          ]
+        }
+      }
+    },
+    {
+      "address": "null_resource.dev",
+      "mode": "managed",
+      "type": "null_resource",
+      "name": "dev",
+      "provider_name": "registry.terraform.io/hashicorp/null",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "triggers": null
+        },
+        "after_unknown": {
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "coder": {
+        "name": "coder",
+        "full_name": "registry.terraform.io/coder/coder",
+        "version_constraint": "0.22.0"
+      },
+      "null": {
+        "name": "null",
+        "full_name": "registry.terraform.io/hashicorp/null"
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_agent.dev1",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "dev1",
+          "provider_config_key": "coder",
+          "expressions": {
+            "arch": {
+              "constant_value": "amd64"
+            },
+            "os": {
+              "constant_value": "linux"
+            },
+            "resources_monitoring": [
+              {
+                "memory": [
+                  {
+                    "enabled": {
+                      "constant_value": true
+                    },
+                    "threshold": {
+                      "constant_value": 80
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "schema_version": 1
+        },
+        {
+          "address": "coder_agent.dev2",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "dev2",
+          "provider_config_key": "coder",
+          "expressions": {
+            "arch": {
+              "constant_value": "amd64"
+            },
+            "os": {
+              "constant_value": "linux"
+            },
+            "resources_monitoring": [
+              {
+                "memory": [
+                  {
+                    "enabled": {
+                      "constant_value": true
+                    },
+                    "threshold": {
+                      "constant_value": 99
+                    }
+                  }
+                ],
+                "volume": [
+                  {
+                    "enabled": {
+                      "constant_value": true
+                    },
+                    "path": {
+                      "constant_value": "volume1"
+                    },
+                    "threshold": {
+                      "constant_value": 80
+                    }
+                  },
+                  {
+                    "enabled": {
+                      "constant_value": false
+                    },
+                    "path": {
+                      "constant_value": "volume2"
+                    },
+                    "threshold": {
+                      "constant_value": 50
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "schema_version": 1
+        },
+        {
+          "address": "coder_app.app1",
+          "mode": "managed",
+          "type": "coder_app",
+          "name": "app1",
+          "provider_config_key": "coder",
+          "expressions": {
+            "agent_id": {
+              "references": [
+                "coder_agent.dev1.id",
+                "coder_agent.dev1"
+              ]
+            },
+            "slug": {
+              "constant_value": "app1"
+            }
+          },
+          "schema_version": 1
+        },
+        {
+          "address": "coder_app.app2",
+          "mode": "managed",
+          "type": "coder_app",
+          "name": "app2",
+          "provider_config_key": "coder",
+          "expressions": {
+            "agent_id": {
+              "references": [
+                "coder_agent.dev1.id",
+                "coder_agent.dev1"
+              ]
+            },
+            "healthcheck": [
+              {
+                "interval": {
+                  "constant_value": 5
+                },
+                "threshold": {
+                  "constant_value": 6
+                },
+                "url": {
+                  "constant_value": "http://localhost:13337/healthz"
+                }
+              }
+            ],
+            "slug": {
+              "constant_value": "app2"
+            },
+            "subdomain": {
+              "constant_value": true
+            }
+          },
+          "schema_version": 1
+        },
+        {
+          "address": "null_resource.dev",
+          "mode": "managed",
+          "type": "null_resource",
+          "name": "dev",
+          "provider_config_key": "null",
+          "schema_version": 0,
+          "depends_on": [
+            "coder_agent.dev1",
+            "coder_agent.dev2"
+          ]
+        }
+      ]
+    }
+  },
+  "relevant_attributes": [
+    {
+      "resource": "coder_agent.dev1",
+      "attribute": [
+        "id"
+      ]
+    }
+  ],
+  "timestamp": "2025-01-29T22:48:06Z",
+  "applyable": true,
+  "complete": true,
+  "errored": false
+}

provisioner/terraform/testdata/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfstate.dot

@@ -0,0 +1,26 @@
+digraph {
+	compound = "true"
+	newrank = "true"
+	subgraph "root" {
+		"[root] coder_agent.dev1 (expand)" [label = "coder_agent.dev1", shape = "box"]
+		"[root] coder_agent.dev2 (expand)" [label = "coder_agent.dev2", shape = "box"]
+		"[root] coder_app.app1 (expand)" [label = "coder_app.app1", shape = "box"]
+		"[root] coder_app.app2 (expand)" [label = "coder_app.app2", shape = "box"]
+		"[root] null_resource.dev (expand)" [label = "null_resource.dev", shape = "box"]
+		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"]" [label = "provider[\"registry.terraform.io/hashicorp/null\"]", shape = "diamond"]
+		"[root] coder_agent.dev1 (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] coder_agent.dev2 (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] coder_app.app1 (expand)" -> "[root] coder_agent.dev1 (expand)"
+		"[root] coder_app.app2 (expand)" -> "[root] coder_agent.dev1 (expand)"
+		"[root] null_resource.dev (expand)" -> "[root] coder_agent.dev1 (expand)"
+		"[root] null_resource.dev (expand)" -> "[root] coder_agent.dev2 (expand)"
+		"[root] null_resource.dev (expand)" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"]"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_agent.dev2 (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_app.app1 (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_app.app2 (expand)"
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)" -> "[root] null_resource.dev (expand)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)"
+	}
+}

provisioner/terraform/testdata/multiple-agents-multiple-monitors/multiple-agents-multiple-monitors.tfstate.json

@@ -0,0 +1,231 @@
+{
+  "format_version": "1.0",
+  "terraform_version": "1.9.8",
+  "values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_agent.dev1",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "dev1",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "arch": "amd64",
+            "auth": "token",
+            "connection_timeout": 120,
+            "dir": null,
+            "display_apps": [
+              {
+                "port_forwarding_helper": true,
+                "ssh_helper": true,
+                "vscode": true,
+                "vscode_insiders": false,
+                "web_terminal": true
+              }
+            ],
+            "env": null,
+            "id": "2f065c5c-cbed-4abe-b30b-942f410b6109",
+            "init_script": "",
+            "metadata": [],
+            "motd_file": null,
+            "order": null,
+            "os": "linux",
+            "resources_monitoring": [
+              {
+                "memory": [
+                  {
+                    "enabled": true,
+                    "threshold": 80
+                  }
+                ],
+                "volume": []
+              }
+            ],
+            "shutdown_script": null,
+            "startup_script": null,
+            "startup_script_behavior": "non-blocking",
+            "token": "c34d255f-3dc8-4409-94e0-828ea7ab7793",
+            "troubleshooting_url": null
+          },
+          "sensitive_values": {
+            "display_apps": [
+              {}
+            ],
+            "metadata": [],
+            "resources_monitoring": [
+              {
+                "memory": [
+                  {}
+                ],
+                "volume": []
+              }
+            ],
+            "token": true
+          }
+        },
+        {
+          "address": "coder_agent.dev2",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "dev2",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "arch": "amd64",
+            "auth": "token",
+            "connection_timeout": 120,
+            "dir": null,
+            "display_apps": [
+              {
+                "port_forwarding_helper": true,
+                "ssh_helper": true,
+                "vscode": true,
+                "vscode_insiders": false,
+                "web_terminal": true
+              }
+            ],
+            "env": null,
+            "id": "d62d9086-47e6-44be-88da-d8fc4cb70423",
+            "init_script": "",
+            "metadata": [],
+            "motd_file": null,
+            "order": null,
+            "os": "linux",
+            "resources_monitoring": [
+              {
+                "memory": [
+                  {
+                    "enabled": true,
+                    "threshold": 99
+                  }
+                ],
+                "volume": [
+                  {
+                    "enabled": false,
+                    "path": "volume2",
+                    "threshold": 50
+                  },
+                  {
+                    "enabled": true,
+                    "path": "volume1",
+                    "threshold": 80
+                  }
+                ]
+              }
+            ],
+            "shutdown_script": null,
+            "startup_script": null,
+            "startup_script_behavior": "non-blocking",
+            "token": "f306a11c-a37e-4086-ab22-6102e255d153",
+            "troubleshooting_url": null
+          },
+          "sensitive_values": {
+            "display_apps": [
+              {}
+            ],
+            "metadata": [],
+            "resources_monitoring": [
+              {
+                "memory": [
+                  {}
+                ],
+                "volume": [
+                  {},
+                  {}
+                ]
+              }
+            ],
+            "token": true
+          }
+        },
+        {
+          "address": "coder_app.app1",
+          "mode": "managed",
+          "type": "coder_app",
+          "name": "app1",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "agent_id": "2f065c5c-cbed-4abe-b30b-942f410b6109",
+            "command": null,
+            "display_name": null,
+            "external": false,
+            "healthcheck": [],
+            "hidden": false,
+            "icon": null,
+            "id": "dfd0f1de-9c17-4a69-9a2b-5d3f64f28310",
+            "open_in": "slim-window",
+            "order": null,
+            "share": "owner",
+            "slug": "app1",
+            "subdomain": null,
+            "url": null
+          },
+          "sensitive_values": {
+            "healthcheck": []
+          },
+          "depends_on": [
+            "coder_agent.dev1"
+          ]
+        },
+        {
+          "address": "coder_app.app2",
+          "mode": "managed",
+          "type": "coder_app",
+          "name": "app2",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "agent_id": "2f065c5c-cbed-4abe-b30b-942f410b6109",
+            "command": null,
+            "display_name": null,
+            "external": false,
+            "healthcheck": [
+              {
+                "interval": 5,
+                "threshold": 6,
+                "url": "http://localhost:13337/healthz"
+              }
+            ],
+            "hidden": false,
+            "icon": null,
+            "id": "70b2d438-0cdd-420a-9fd6-91d019d95a75",
+            "open_in": "slim-window",
+            "order": null,
+            "share": "owner",
+            "slug": "app2",
+            "subdomain": true,
+            "url": null
+          },
+          "sensitive_values": {
+            "healthcheck": [
+              {}
+            ]
+          },
+          "depends_on": [
+            "coder_agent.dev1"
+          ]
+        },
+        {
+          "address": "null_resource.dev",
+          "mode": "managed",
+          "type": "null_resource",
+          "name": "dev",
+          "provider_name": "registry.terraform.io/hashicorp/null",
+          "schema_version": 0,
+          "values": {
+            "id": "6263120086083011264",
+            "triggers": null
+          },
+          "sensitive_values": {},
+          "depends_on": [
+            "coder_agent.dev1",
+            "coder_agent.dev2"
+          ]
+        }
+      ]
+    }
+  }
+}

provisioner/terraform/testdata/multiple-agents-multiple-scripts/multiple-agents-multiple-scripts.tfplan.json

@@ -521,19 +521,19 @@
   },
   "relevant_attributes": [
     {
-      "resource": "coder_agent.dev1",
+      "resource": "coder_agent.dev2",
       "attribute": [
         "id"
       ]
     },
     {
-      "resource": "coder_agent.dev2",
+      "resource": "coder_agent.dev1",
       "attribute": [
         "id"
       ]
     }
   ],
-  "timestamp": "2025-01-28T15:12:47Z",
+  "timestamp": "2025-01-29T22:48:08Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/multiple-agents-multiple-scripts/multiple-agents-multiple-scripts.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "c7aacfcb-cec3-4a25-9a7a-85f52b6b4455",
+            "id": "bd762939-8952-4ac7-a9e5-618ec420b518",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "e3ef0184-6f6e-4ddb-bdbe-b42edfd11299",
+            "token": "f86127e8-2852-4c02-9f07-c376ec04318f",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -70,7 +70,7 @@
               }
             ],
             "env": null,
-            "id": "094174ad-dd05-4510-a525-cb0f627e5ca7",
+            "id": "60244093-3c9d-4655-b34f-c4713f7001c1",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -80,7 +80,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "7d48d7b2-95b8-463c-b3ec-5fd1d0c54d3e",
+            "token": "cad61f70-873f-440c-ad1c-9d34be2e19c4",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -100,11 +100,11 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "c7aacfcb-cec3-4a25-9a7a-85f52b6b4455",
+            "agent_id": "bd762939-8952-4ac7-a9e5-618ec420b518",
             "cron": null,
             "display_name": "Foobar Script 1",
             "icon": null,
-            "id": "eaf4ff5b-028c-4c32-bb77-893823c44158",
+            "id": "b34b6cd5-e85d-41c8-ad92-eaaceb2404cb",
             "log_path": null,
             "run_on_start": true,
             "run_on_stop": false,
@@ -125,11 +125,11 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "c7aacfcb-cec3-4a25-9a7a-85f52b6b4455",
+            "agent_id": "bd762939-8952-4ac7-a9e5-618ec420b518",
             "cron": null,
             "display_name": "Foobar Script 2",
             "icon": null,
-            "id": "d3ade231-2366-4931-9a08-c773a3e36c86",
+            "id": "d6f4e24c-3023-417d-b9be-4c83dbdf4802",
             "log_path": null,
             "run_on_start": true,
             "run_on_stop": false,
@@ -150,11 +150,11 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "094174ad-dd05-4510-a525-cb0f627e5ca7",
+            "agent_id": "60244093-3c9d-4655-b34f-c4713f7001c1",
             "cron": null,
             "display_name": "Foobar Script 3",
             "icon": null,
-            "id": "e46767c9-d946-4fd4-8fc7-7a7638dac480",
+            "id": "a19e9106-5eb5-4941-b6ae-72a7724efdf0",
             "log_path": null,
             "run_on_start": true,
             "run_on_stop": false,
@@ -175,7 +175,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "2128129616327953329",
+            "id": "8576645433635584827",
             "triggers": null
           },
           "sensitive_values": {},
@@ -191,7 +191,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "5573020717214922097",
+            "id": "1280398780322015606",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/multiple-agents/multiple-agents.tfplan.json

@@ -451,7 +451,7 @@
       ]
     }
   },
-  "timestamp": "2025-01-28T15:12:42Z",
+  "timestamp": "2025-01-29T22:48:01Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/multiple-agents/multiple-agents.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "84e64491-0764-47cb-9306-04d3efd91a9c",
+            "id": "215a9369-35c9-4abe-b1c0-3eb3ab1c1922",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "806a0146-3c12-42b6-b75a-3345d96202da",
+            "token": "3fdd733c-b02e-4d81-a032-7c8d7ee3dcd8",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -70,7 +70,7 @@
               }
             ],
             "env": null,
-            "id": "ba3a4b21-ab23-4935-8ec9-2c0560763550",
+            "id": "b79acfba-d148-4940-80aa-0c72c037a3ed",
             "init_script": "",
             "metadata": [],
             "motd_file": "/etc/motd",
@@ -80,7 +80,7 @@
             "shutdown_script": "echo bye bye",
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "2f6d9e04-39c9-4286-a3a0-a1e79244307e",
+            "token": "e841a152-a794-4b05-9818-95e7440d402d",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -114,7 +114,7 @@
               }
             ],
             "env": null,
-            "id": "12be3c35-2ebe-4261-b446-9e2a85861cbd",
+            "id": "4e863395-523b-443a-83c2-ab27e42a06b2",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -124,7 +124,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "blocking",
-            "token": "f70062bd-eec8-4365-9ad6-b0ac2f86389e",
+            "token": "ee0a5e1d-879e-4bff-888e-6cf94533f0bd",
             "troubleshooting_url": "https://coder.com/troubleshoot"
           },
           "sensitive_values": {
@@ -158,7 +158,7 @@
               }
             ],
             "env": null,
-            "id": "8b3d14b5-3250-40db-a34f-ee68a86ee83c",
+            "id": "611c43f5-fa8f-4641-9b5c-a58a8945caa1",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -168,7 +168,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "e0faea68-a3cf-47b1-a218-1bcacc2b5671",
+            "token": "2d2669c7-6385-4ce8-8948-e4b24db45132",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -188,7 +188,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "4314804032090970668",
+            "id": "5237006672454822031",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/multiple-apps/multiple-apps.tfplan.json

@@ -445,7 +445,7 @@
       ]
     }
   ],
-  "timestamp": "2025-01-28T15:12:49Z",
+  "timestamp": "2025-01-29T22:48:10Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/multiple-apps/multiple-apps.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "8d73f5d4-2b2d-46a5-83e4-e0e877442c1b",
+            "id": "cae4d590-8332-45b6-9453-e0151ca4f219",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -36,7 +36,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "44ad1e8f-c0ca-43a1-8db0-a4488a4f5019",
+            "token": "6db086ba-440b-4e66-8803-80e021cda61a",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -56,14 +56,14 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "8d73f5d4-2b2d-46a5-83e4-e0e877442c1b",
+            "agent_id": "cae4d590-8332-45b6-9453-e0151ca4f219",
             "command": null,
             "display_name": null,
             "external": false,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
-            "id": "6a133b2e-f377-4bcd-bad0-a17383a56ee1",
+            "id": "64803468-4ec4-49fe-beb7-e65eaf8e01ca",
             "open_in": "slim-window",
             "order": null,
             "share": "owner",
@@ -86,7 +86,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "8d73f5d4-2b2d-46a5-83e4-e0e877442c1b",
+            "agent_id": "cae4d590-8332-45b6-9453-e0151ca4f219",
             "command": null,
             "display_name": null,
             "external": false,
@@ -99,7 +99,7 @@
             ],
             "hidden": false,
             "icon": null,
-            "id": "e6172860-5fbd-461a-a6cf-fe248f6d5206",
+            "id": "df3f07ab-1796-41c9-8e7d-b957dca031d4",
             "open_in": "slim-window",
             "order": null,
             "share": "owner",
@@ -124,14 +124,14 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "agent_id": "8d73f5d4-2b2d-46a5-83e4-e0e877442c1b",
+            "agent_id": "cae4d590-8332-45b6-9453-e0151ca4f219",
             "command": null,
             "display_name": null,
             "external": false,
             "healthcheck": [],
             "hidden": false,
             "icon": null,
-            "id": "0758094c-a525-4349-9380-c3194970e986",
+            "id": "fdb06774-4140-42ef-989b-12b98254b27c",
             "open_in": "slim-window",
             "order": null,
             "share": "owner",
@@ -154,7 +154,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3814707844241202483",
+            "id": "8206837964247342986",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/resource-metadata-duplicate/resource-metadata-duplicate.tfplan.json

@@ -431,7 +431,7 @@
       ]
     }
   ],
-  "timestamp": "2025-01-28T15:12:52Z",
+  "timestamp": "2025-01-29T22:48:14Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/resource-metadata-duplicate/resource-metadata-duplicate.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "150cb21b-afd7-4003-95e6-61379b6ac0db",
+            "id": "b3257d67-247c-4fc6-92a8-fc997501a0e1",
             "init_script": "",
             "metadata": [
               {
@@ -45,7 +45,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "03682f65-8522-4cea-9b04-21eba526176a",
+            "token": "ac3563fb-3069-4919-b076-6687c765772b",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -70,7 +70,7 @@
             "daily_cost": 29,
             "hide": true,
             "icon": "/icon/server.svg",
-            "id": "691311fd-cde3-496d-9c12-e1ec3f1893a6",
+            "id": "fcd81afa-64ad-45e3-b000-31d1b19df922",
             "item": [
               {
                 "is_null": false,
@@ -85,7 +85,7 @@
                 "value": ""
               }
             ],
-            "resource_id": "4084338678065726432"
+            "resource_id": "8033209281634385030"
           },
           "sensitive_values": {
             "item": [
@@ -109,7 +109,7 @@
             "daily_cost": 20,
             "hide": true,
             "icon": "/icon/server.svg",
-            "id": "a5942656-b809-4345-862d-6547a1877756",
+            "id": "186819f3-a92f-4785-9ee4-d79f57711f63",
             "item": [
               {
                 "is_null": false,
@@ -118,7 +118,7 @@
                 "value": "world"
               }
             ],
-            "resource_id": "4084338678065726432"
+            "resource_id": "8033209281634385030"
           },
           "sensitive_values": {
             "item": [
@@ -138,7 +138,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "4084338678065726432",
+            "id": "8033209281634385030",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/resource-metadata/resource-metadata.tfplan.json

@@ -383,7 +383,7 @@
       ]
     }
   ],
-  "timestamp": "2025-01-28T15:12:51Z",
+  "timestamp": "2025-01-29T22:48:12Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/resource-metadata/resource-metadata.tfstate.json

@@ -26,7 +26,7 @@
               }
             ],
             "env": null,
-            "id": "7831f70f-bd99-4ab7-81e1-d89ac28949f4",
+            "id": "066d91d2-860a-4a44-9443-9eaf9315729b",
             "init_script": "",
             "metadata": [
               {
@@ -45,7 +45,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "0b4f3b4d-6208-4e2a-ad30-0fdf2ea2a89a",
+            "token": "9b6cc6dd-0e02-489f-b651-7a01804c406f",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -70,7 +70,7 @@
             "daily_cost": 29,
             "hide": true,
             "icon": "/icon/server.svg",
-            "id": "7feb87a9-59bd-47ad-89fb-5952af8e3b4a",
+            "id": "fa791d91-9718-420e-9fa8-7a02e7af1563",
             "item": [
               {
                 "is_null": false,
@@ -97,7 +97,7 @@
                 "value": "squirrel"
               }
             ],
-            "resource_id": "2050925556127272012"
+            "resource_id": "2710066198333857753"
           },
           "sensitive_values": {
             "item": [
@@ -120,7 +120,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "2050925556127272012",
+            "id": "2710066198333857753",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/rich-parameters-order/rich-parameters-order.tfplan.json

@@ -135,7 +135,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "5c13c4a2-82a8-4ff6-84a1-fb59e9b4ec84",
+              "id": "e8485920-025a-4c2c-b018-722f61b64347",
               "mutable": false,
               "name": "Example",
               "option": null,
@@ -162,7 +162,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "f50a83b9-5ca0-4d88-a809-309af7ffdaa3",
+              "id": "6156655b-f893-4eba-914e-e87414f4bf7e",
               "mutable": false,
               "name": "Sample",
               "option": null,
@@ -268,7 +268,7 @@
       ]
     }
   },
-  "timestamp": "2025-01-28T15:12:56Z",
+  "timestamp": "2025-01-29T22:48:18Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/rich-parameters-order/rich-parameters-order.tfstate.json

@@ -17,7 +17,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "6e955979-5b7c-46e0-8a25-cb021d0058ee",
+            "id": "4b774ce8-1e9f-4721-8a14-05efd3eb2dab",
             "mutable": false,
             "name": "Example",
             "option": null,
@@ -44,7 +44,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "3a54609f-17c7-4421-8c4f-5b044dd9b392",
+            "id": "447ae720-c046-452e-8d2c-1b5d4060b798",
             "mutable": false,
             "name": "Sample",
             "option": null,
@@ -80,7 +80,7 @@
               }
             ],
             "env": null,
-            "id": "12a8f98a-aaf2-424e-b2c5-350d3d6b96a9",
+            "id": "b8d637c2-a19c-479c-b3e2-374f15ce37c3",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -90,7 +90,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "eae94617-6afd-448b-b150-4553232eadcb",
+            "token": "52ce8a0d-12c9-40b5-9f86-dc6240b98d5f",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -110,7 +110,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "5331481064350611404",
+            "id": "769369130050936586",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/rich-parameters-validation/rich-parameters-validation.tfplan.json

@@ -135,7 +135,7 @@
               "display_name": null,
               "ephemeral": true,
               "icon": null,
-              "id": "dcb15aa0-6eaa-447f-97f3-cc4b5843e6de",
+              "id": "30116bcb-f109-4807-be06-666a60b6cbb2",
               "mutable": true,
               "name": "number_example",
               "option": null,
@@ -162,7 +162,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "cb4a203b-e538-4eff-9cba-99036d4dc211",
+              "id": "755395f4-d163-4b90-a8f4-e7ae24e17dd0",
               "mutable": false,
               "name": "number_example_max",
               "option": null,
@@ -201,7 +201,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "2eae2208-c0bf-4328-a540-791ae5070a6b",
+              "id": "dec9fa47-a252-4eb7-868b-10d0fe7bad57",
               "mutable": false,
               "name": "number_example_max_zero",
               "option": null,
@@ -240,7 +240,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "4e4ac773-251c-4313-907b-b1e551f706f8",
+              "id": "57107f82-107b-484d-8491-0787f051dca7",
               "mutable": false,
               "name": "number_example_min",
               "option": null,
@@ -279,7 +279,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "83cb6129-f722-4727-bc35-8b2f16ea8297",
+              "id": "c21a61f4-26e0-49bb-99c8-56240433c21b",
               "mutable": false,
               "name": "number_example_min_max",
               "option": null,
@@ -318,7 +318,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "1705a7f5-edf7-44ff-ac72-3d8458b28dde",
+              "id": "4894f5cc-f4e6-4a86-bdfa-36c9d3f8f1a3",
               "mutable": false,
               "name": "number_example_min_zero",
               "option": null,
@@ -550,7 +550,7 @@
       ]
     }
   },
-  "timestamp": "2025-01-28T15:12:58Z",
+  "timestamp": "2025-01-29T22:48:20Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/rich-parameters-validation/rich-parameters-validation.tfstate.json

@@ -17,7 +17,7 @@
             "display_name": null,
             "ephemeral": true,
             "icon": null,
-            "id": "68980de4-76e1-4153-a716-43032486f8d8",
+            "id": "9b5bb411-bfe5-471a-8f2d-9fcc8c17b616",
             "mutable": true,
             "name": "number_example",
             "option": null,
@@ -44,7 +44,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "74234739-2df2-4bc9-abdc-b3cf5bb15786",
+            "id": "2ebaf3ec-9272-48f4-981d-09485ae7960e",
             "mutable": false,
             "name": "number_example_max",
             "option": null,
@@ -83,7 +83,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "b5c4c69e-0280-4b50-94d9-6e7840653ee3",
+            "id": "d05a833c-d0ca-4f22-8b80-40851c111b61",
             "mutable": false,
             "name": "number_example_max_zero",
             "option": null,
@@ -122,7 +122,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "bb4fd588-a9b7-4e32-a7d2-cec38c1626d0",
+            "id": "de0cd614-72b3-4404-80a1-e3c780823fc9",
             "mutable": false,
             "name": "number_example_min",
             "option": null,
@@ -161,7 +161,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "66b9418f-7829-4668-b759-e64d9b6b60d5",
+            "id": "66eae3e1-9bb5-44f8-8f15-2b400628d0e7",
             "mutable": false,
             "name": "number_example_min_max",
             "option": null,
@@ -200,7 +200,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "21616e3c-0873-44a8-9d38-5ed5972369c8",
+            "id": "d24d37f9-5a91-4c7f-9915-bfc10f6d353d",
             "mutable": false,
             "name": "number_example_min_zero",
             "option": null,
@@ -248,7 +248,7 @@
               }
             ],
             "env": null,
-            "id": "6baff07a-f16f-413b-86c8-08400444de15",
+            "id": "81170f06-8f49-43fb-998f-dc505a29632c",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -258,7 +258,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "fadd98a1-a53e-4fcf-8e67-f6843fc7916b",
+            "token": "f8433068-1acc-4225-94c0-725f86cdc002",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -278,7 +278,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "7668002711899884618",
+            "id": "3641782836917385715",
             "triggers": null
           },
           "sensitive_values": {},

provisioner/terraform/testdata/rich-parameters/rich-parameters.tfplan.json

@@ -135,7 +135,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "051532f3-719b-4268-91a6-a4d7b0607fd6",
+              "id": "72f11f9b-8c7f-4e4a-a207-f080b114862b",
               "mutable": false,
               "name": "Example",
               "option": [
@@ -179,7 +179,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "b010a50c-ce09-4ae0-a211-1479c46276d0",
+              "id": "b154b8a7-d31f-46f7-b876-e5bfdf50950c",
               "mutable": false,
               "name": "number_example",
               "option": null,
@@ -206,7 +206,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "429eb922-edf8-4261-b97a-dcc5df295dfd",
+              "id": "8199f88e-8b73-4385-bbb2-315182f753ef",
               "mutable": false,
               "name": "number_example_max_zero",
               "option": null,
@@ -245,7 +245,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "629371d3-5ae2-4804-a601-efe4da369f53",
+              "id": "110c995d-46d7-4277-8f57-a3d3d42733c3",
               "mutable": false,
               "name": "number_example_min_max",
               "option": null,
@@ -284,7 +284,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "57e52542-557d-4b02-ad1e-9acf7c541f10",
+              "id": "e7a1f991-48a8-44c5-8a5c-597db8539cb7",
               "mutable": false,
               "name": "number_example_min_zero",
               "option": null,
@@ -323,7 +323,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "849e5d40-f3e0-45ce-9a38-5d998a23c4fd",
+              "id": "27d12cdf-da7e-466b-907a-4824920305da",
               "mutable": false,
               "name": "Sample",
               "option": null,
@@ -354,7 +354,7 @@
                   "display_name": null,
                   "ephemeral": false,
                   "icon": null,
-                  "id": "9acf8c1b-2154-41d4-9032-8a03bf7da173",
+                  "id": "1242389a-5061-482a-8274-410174fb3fc0",
                   "mutable": true,
                   "name": "First parameter from module",
                   "option": null,
@@ -381,7 +381,7 @@
                   "display_name": null,
                   "ephemeral": false,
                   "icon": null,
-                  "id": "06953561-1163-4002-abd2-9bce05bac7c0",
+                  "id": "72418f70-4e3c-400f-9a7d-bf3467598deb",
                   "mutable": true,
                   "name": "Second parameter from module",
                   "option": null,
@@ -413,7 +413,7 @@
                       "display_name": null,
                       "ephemeral": false,
                       "icon": null,
-                      "id": "b80bd599-31cd-4210-80a7-8ec921c1603e",
+                      "id": "9b4b60d8-21bb-4d52-910a-536355e9a85f",
                       "mutable": true,
                       "name": "First parameter from child module",
                       "option": null,
@@ -440,7 +440,7 @@
                       "display_name": null,
                       "ephemeral": false,
                       "icon": null,
-                      "id": "2042eaa9-b1a8-45d0-b3ba-4d40fdca861c",
+                      "id": "4edca123-07bf-4409-ad40-ed26f93beb5f",
                       "mutable": true,
                       "name": "Second parameter from child module",
                       "option": null,
@@ -793,7 +793,7 @@
       }
     }
   },
-  "timestamp": "2025-01-28T15:12:54Z",
+  "timestamp": "2025-01-29T22:48:16Z",
   "applyable": true,
   "complete": true,
   "errored": false

provisioner/terraform/testdata/rich-parameters/rich-parameters.tfstate.json

@@ -17,7 +17,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "485ba640-621b-4183-b636-94c29684bab3",
+            "id": "7298c15e-11c8-4a9e-a2ef-044dbc44d519",
             "mutable": false,
             "name": "Example",
             "option": [
@@ -61,7 +61,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "8276bb70-1da5-4221-82eb-929a71dca8ab",
+            "id": "a0dda000-20cb-42a7-9f83-1a1de0876e48",
             "mutable": false,
             "name": "number_example",
             "option": null,
@@ -88,7 +88,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "d758e074-9a82-4a61-9185-28f3d2f00b42",
+            "id": "82a297b9-bbcb-4807-9de3-7217953dc6b0",
             "mutable": false,
             "name": "number_example_max_zero",
             "option": null,
@@ -127,7 +127,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "5f3dbc24-5f0e-484f-b502-7837583303b0",
+            "id": "ae1c376b-e28b-456a-b36e-125b3bc6d938",
             "mutable": false,
             "name": "number_example_min_max",
             "option": null,
@@ -166,7 +166,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "9b8c1c07-2035-4ae6-b8a9-fa6e511f5b73",
+            "id": "57573ac3-5610-4887-b269-376071867eb5",
             "mutable": false,
             "name": "number_example_min_zero",
             "option": null,
@@ -205,7 +205,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "644bcbb8-8421-49aa-aa03-d0b578ca22f4",
+            "id": "0e08645d-0105-49ef-b278-26cdc30a826c",
             "mutable": false,
             "name": "Sample",
             "option": null,
@@ -241,7 +241,7 @@
               }
             ],
             "env": null,
-            "id": "284ea31f-3b9d-4d10-8416-986366aca746",
+            "id": "c5c402bd-215b-487f-862f-eca25fe88a72",
             "init_script": "",
             "metadata": [],
             "motd_file": null,
@@ -251,7 +251,7 @@
             "shutdown_script": null,
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
-            "token": "5b083a65-fbe1-4e2c-85b6-a7d3e68fd657",
+            "token": "b70d10f3-90bc-4abd-8cd9-b11da843954a",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -271,7 +271,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "7111632494185759846",
+            "id": "8544034527967282476",
             "triggers": null
           },
           "sensitive_values": {},
@@ -296,7 +296,7 @@
                 "display_name": null,
                 "ephemeral": false,
                 "icon": null,
-                "id": "5d8b2d66-01d1-4c0d-bfc7-897649720b3a",
+                "id": "68ae438d-7194-4f5b-adeb-9c74059d9888",
                 "mutable": true,
                 "name": "First parameter from module",
                 "option": null,
@@ -323,7 +323,7 @@
                 "display_name": null,
                 "ephemeral": false,
                 "icon": null,
-                "id": "93c3c0f7-6faa-42c9-bf86-c16d1dbddaeb",
+                "id": "32f0f7f3-26a5-4023-a4e6-d9436cfe8cb4",
                 "mutable": true,
                 "name": "Second parameter from module",
                 "option": null,
@@ -355,7 +355,7 @@
                     "display_name": null,
                     "ephemeral": false,
                     "icon": null,
-                    "id": "3440bc15-6b18-4b01-bc42-e5f1e18f4205",
+                    "id": "5235636a-3319-47ae-8879-b62f9ee9c5aa",
                     "mutable": true,
                     "name": "First parameter from child module",
                     "option": null,
@@ -382,7 +382,7 @@
                     "display_name": null,
                     "ephemeral": false,
                     "icon": null,
-                    "id": "56843ac2-6be7-47be-9d9c-b2fb7f5aa5dc",
+                    "id": "54fa94ff-3048-457d-8de2-c182f6287c8d",
                     "mutable": true,
                     "name": "Second parameter from child module",
                     "option": null,

provisionerd/proto/version.go

@@ -6,9 +6,12 @@ import "github.com/coder/coder/v2/apiversion"
 //
 // API v1.2:
 //   - Add support for `open_in` parameters in the workspace apps.
+//
+// API v1.3:
+//   - Add new field named `resources_monitoring` in the Agent with resources monitoring..
 const (
 	CurrentMajor = 1
-	CurrentMinor = 2
+	CurrentMinor = 3
 )
 
 // CurrentVersion is the current provisionerd API version.

provisionersdk/proto/provisioner.proto

@@ -129,6 +129,7 @@ message Agent {
 	repeated Script scripts = 21;
 	repeated Env extra_envs = 22;
 	int64 order = 23;
+	ResourcesMonitoring resources_monitoring = 24;
 }
 
 enum AppSharingLevel {
@@ -137,6 +138,22 @@ enum AppSharingLevel {
     PUBLIC = 2;
 }
 
+message ResourcesMonitoring {
+	MemoryResourceMonitor memory = 1;
+	repeated VolumeResourceMonitor volumes = 2;
+}
+
+message MemoryResourceMonitor {
+	bool enabled = 1;
+	int32 threshold = 2;
+}
+
+message VolumeResourceMonitor {
+	string path = 1;
+	bool enabled = 2;
+	int32 threshold = 3;
+}
+
 message DisplayApps {
     bool vscode = 1;
     bool vscode_insiders = 2;

site/e2e/provisionerGenerated.ts

@@ -146,6 +146,7 @@ export interface Agent {
   scripts: Script[];
   extraEnvs: Env[];
   order: number;
+  resourcesMonitoring: ResourcesMonitoring | undefined;
 }
 
 export interface Agent_Metadata {
@@ -162,6 +163,22 @@ export interface Agent_EnvEntry {
   value: string;
 }
 
+export interface ResourcesMonitoring {
+  memory: MemoryResourceMonitor | undefined;
+  volumes: VolumeResourceMonitor[];
+}
+
+export interface MemoryResourceMonitor {
+  enabled: boolean;
+  threshold: number;
+}
+
+export interface VolumeResourceMonitor {
+  path: string;
+  enabled: boolean;
+  threshold: number;
+}
+
 export interface DisplayApps {
   vscode: boolean;
   vscodeInsiders: boolean;
@@ -581,6 +598,9 @@ export const Agent = {
     if (message.order !== 0) {
       writer.uint32(184).int64(message.order);
     }
+    if (message.resourcesMonitoring !== undefined) {
+      ResourcesMonitoring.encode(message.resourcesMonitoring, writer.uint32(194).fork()).ldelim();
+    }
     return writer;
   },
 };
@@ -621,6 +641,45 @@ export const Agent_EnvEntry = {
   },
 };
 
+export const ResourcesMonitoring = {
+  encode(message: ResourcesMonitoring, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
+    if (message.memory !== undefined) {
+      MemoryResourceMonitor.encode(message.memory, writer.uint32(10).fork()).ldelim();
+    }
+    for (const v of message.volumes) {
+      VolumeResourceMonitor.encode(v!, writer.uint32(18).fork()).ldelim();
+    }
+    return writer;
+  },
+};
+
+export const MemoryResourceMonitor = {
+  encode(message: MemoryResourceMonitor, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
+    if (message.enabled === true) {
+      writer.uint32(8).bool(message.enabled);
+    }
+    if (message.threshold !== 0) {
+      writer.uint32(16).int32(message.threshold);
+    }
+    return writer;
+  },
+};
+
+export const VolumeResourceMonitor = {
+  encode(message: VolumeResourceMonitor, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
+    if (message.path !== "") {
+      writer.uint32(10).string(message.path);
+    }
+    if (message.enabled === true) {
+      writer.uint32(16).bool(message.enabled);
+    }
+    if (message.threshold !== 0) {
+      writer.uint32(24).int32(message.threshold);
+    }
+    return writer;
+  },
+};
+
 export const DisplayApps = {
   encode(message: DisplayApps, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
     if (message.vscode === true) {

site/src/api/rbacresourcesGenerated.ts

@@ -168,6 +168,10 @@ export const RBACResourceActions: Partial<
 		stop: "allows stopping a workspace",
 		update: "edit workspace settings (scheduling, permissions, parameters)",
 	},
+	workspace_agent_resource_monitor: {
+		create: "create workspace agent resource monitor",
+		read: "read workspace agent resource monitor",
+	},
 	workspace_dormant: {
 		application_connect: "connect to workspace apps via browser",
 		create: "create a new workspace",

site/src/api/typesGenerated.ts

@@ -1848,6 +1848,7 @@ export type RBACResource =
 	| "user"
 	| "*"
 	| "workspace"
+	| "workspace_agent_resource_monitor"
 	| "workspace_dormant"
 	| "workspace_proxy";
 
@@ -1883,6 +1884,7 @@ export const RBACResources: RBACResource[] = [
 	"user",
 	"*",
 	"workspace",
+	"workspace_agent_resource_monitor",
 	"workspace_dormant",
 	"workspace_proxy",
 ];