Nick Vigilante
2ee96f82f9
Screen readers announce a table header cell with no text as an unnamed column, and axe reports it as empty-table-header. - clidocgen writes "Property | Value" over each option's metadata table instead of an empty header row; the CLI reference is regenerated. - The port-forwarding CORS matrix labels its corner cells (From user, From workspace, To user, To workspace, To app). - Four Markdown matrices get a corner label, byte-identical to #30873. - docshtmlcheck (make lint/docs-html) now fails on empty header cells in Markdown pipe tables and raw HTML tables, naming the file, line, and the table's first header. Assisted-by: AI
15 KiB
Generated
title, description
| title | description |
|---|---|
| `coder ai-gateway start` | Run a standalone AI Gateway server |
Run a standalone AI Gateway server
Usage
coder ai-gateway start [flags]
Description
Runs a standalone replica of the AI Gateway. Standalone replicas serve LLM client traffic on a dedicated HTTP listener and connect to coderd using the Coder deployment URL and an AI Gateway key.
Set --url or CODER_URL to the Coder deployment address, and set --key (CODER_AI_GATEWAY_KEY) or --key-file (CODER_AI_GATEWAY_KEY_FILE). A user login or session token is not required.
Options
--key
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_AI_GATEWAY_KEY |
The AI Gateway key used to authenticate to coderd.
--key-file
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_AI_GATEWAY_KEY_FILE |
Path to a file containing the AI Gateway key used to authenticate to coderd.
--http-address
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_AI_GATEWAY_HTTP_ADDRESS |
| Default | 127.0.0.1:4001 |
The bind address to serve incoming AI Gateway client traffic.
--tls-cert-file
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_AI_GATEWAY_TLS_CERT_FILE |
Path to a PEM-encoded TLS certificate. Enables TLS termination when set together with --tls-key-file.
--tls-key-file
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_AI_GATEWAY_TLS_KEY_FILE |
Path to a PEM-encoded TLS private key. Enables TLS termination when set together with --tls-cert-file.
--prometheus-enable
| Property | Value |
|---|---|
| Type | bool |
| Environment | $CODER_PROMETHEUS_ENABLE |
| YAML | introspection.prometheus.enable |
Serve prometheus metrics on the address defined by prometheus address.
--prometheus-address
| Property | Value |
|---|---|
| Type | host:port |
| Environment | $CODER_PROMETHEUS_ADDRESS |
| YAML | introspection.prometheus.address |
| Default | 127.0.0.1:2112 |
The bind address to serve prometheus metrics.
--trace
| Property | Value |
|---|---|
| Type | bool |
| Environment | $CODER_TRACE_ENABLE |
| YAML | introspection.tracing.enable |
Whether application tracing data is collected. It exports to a backend configured by environment variables. See: https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md.
--trace-honeycomb-api-key
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_TRACE_HONEYCOMB_API_KEY |
Enables trace exporting to Honeycomb.io using the provided API Key.
--trace-logs
| Property | Value |
|---|---|
| Type | bool |
| Environment | $CODER_TRACE_LOGS |
| YAML | introspection.tracing.captureLogs |
Enables capturing of logs as events in traces. This is useful for debugging, but may result in a very large amount of events being sent to the tracing backend which may incur significant costs.
-l, --log-filter
| Property | Value |
|---|---|
| Type | string-array |
| Environment | $CODER_LOG_FILTER |
| YAML | introspection.logging.filter |
Filter debug logs by matching against a given regex. Use .* to match all debug logs.
--log-human
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_LOGGING_HUMAN |
| YAML | introspection.logging.humanPath |
| Default | /dev/stderr |
Output human-readable logs to a given file.
--log-json
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_LOGGING_JSON |
| YAML | introspection.logging.jsonPath |
Output JSON logs to a given file.
--log-stackdriver
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_LOGGING_STACKDRIVER |
| YAML | introspection.logging.stackdriverPath |
Output Stackdriver compatible logs to a given file.
--experiments
| Property | Value |
|---|---|
| Type | string-array |
| Environment | $CODER_EXPERIMENTS |
| YAML | experiments |
Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.
-c, --config
| Property | Value |
|---|---|
| Type | yaml-config-path |
| Environment | $CODER_CONFIG_PATH |
Specify a YAML file to load configuration from.
--ai-gateway-max-concurrency
| Property | Value |
|---|---|
| Type | int |
| Environment | $CODER_AI_GATEWAY_MAX_CONCURRENCY |
| YAML | ai_gateway.max_concurrency |
| Default | 0 |
Maximum number of concurrent AI Gateway requests per replica. Set to 0 to disable (unlimited).
--ai-gateway-rate-limit
| Property | Value |
|---|---|
| Type | int |
| Environment | $CODER_AI_GATEWAY_RATE_LIMIT |
| YAML | ai_gateway.rate_limit |
| Default | 0 |
Maximum number of AI Gateway requests per second per replica. Set to 0 to disable (unlimited).
--ai-gateway-structured-logging
| Property | Value |
|---|---|
| Type | bool |
| Environment | $CODER_AI_GATEWAY_STRUCTURED_LOGGING |
| YAML | ai_gateway.structured_logging |
| Default | false |
Emit structured logs for AI Gateway interception records. Use this for exporting these records to external SIEM or observability systems.
--ai-gateway-structured-logging-source
| Property | Value |
|---|---|
| Type | coderd|gateway|both |
| Environment | $CODER_AI_GATEWAY_STRUCTURED_LOGGING_SOURCE |
| YAML | ai_gateway.structured_logging_source |
| Default | coderd |
Which process emits AI Gateway interception records when structured logging is enabled: coderd, the gateway, or both. The gateway emits records that are never persisted, such as those dropped by --ai-gateway-disable-content-recording, but cannot report thread_parent_id or thread_root_id. Use both to verify a move from one to the other; records reaching coderd are then reported twice. A standalone gateway must be configured to emit its own records, and its logs shipped rather than coderd's.
--ai-gateway-disable-content-recording
| Property | Value |
|---|---|
| Type | bool |
| Environment | $CODER_AI_GATEWAY_DISABLE_CONTENT_RECORDING |
| YAML | ai_gateway.disable_content_recording |
| Default | false |
Stop recording the content of intercepted conversations. No user prompt, tool call or model reasoning record is stored, including tool names and the arguments they were called with. Interceptions and token usage are still recorded, so cost controls, budget enforcement and spend reporting are unaffected. Sessions show no conversation detail, prompt and tool call telemetry report zero, and interceptions are no longer grouped into threads for clients that do not send their own session ID. Combine with --ai-gateway-structured-logging-source=gateway to keep exporting these records to a SIEM instead.
--ai-gateway-send-actor-headers
| Property | Value |
|---|---|
| Type | bool |
| Environment | $CODER_AI_GATEWAY_SEND_ACTOR_HEADERS |
| YAML | ai_gateway.send_actor_headers |
| Default | false |
Add configured headers identifying the authenticated user to intercepted upstream requests. Use this when a proxy between AI Gateway and an upstream AI provider needs user identity. When enabled, removes client-supplied headers at configured actor-header destinations before adding authenticated values. Client headers starting with X-AI-Bridge-Actor are always removed.
--ai-gateway-actor-header-id
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_AI_GATEWAY_ACTOR_HEADER_ID |
| YAML | ai_gateway.actor_header_id |
| Default | X-AI-Bridge-Actor-ID |
Header name for the authenticated user's ID. Empty disables this header. Requires AI Gateway actor headers to be enabled.
--ai-gateway-actor-header-username
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_AI_GATEWAY_ACTOR_HEADER_USERNAME |
| YAML | ai_gateway.actor_header_username |
| Default | X-AI-Bridge-Actor-Metadata-Username |
Header name for the authenticated user's username. Empty disables this header. Requires AI Gateway actor headers to be enabled.
--ai-gateway-actor-header-email
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_AI_GATEWAY_ACTOR_HEADER_EMAIL |
| YAML | ai_gateway.actor_header_email |
Header name for the authenticated user's email address. Empty disables this header. Requires AI Gateway actor headers to be enabled. Applies to every configured provider; email is personal information.
--ai-gateway-dump-dir
| Property | Value |
|---|---|
| Type | string |
| Environment | $CODER_AI_GATEWAY_DUMP_DIR |
| YAML | ai_gateway.api_dump_dir |
Base directory for dumping AI Gateway request/response pairs to disk for debugging. When set, each provider writes under a subdirectory named after the provider. Sensitive headers are redacted. Leave empty to disable.
--ai-gateway-allow-byok
| Property | Value |
|---|---|
| Type | bool |
| Environment | $CODER_AI_GATEWAY_ALLOW_BYOK |
| YAML | ai_gateway.allow_byok |
| Default | true |
Allow users to provide their own LLM API keys or subscriptions. When disabled, only centralized key authentication is permitted.
--ai-gateway-circuit-breaker-enabled
| Property | Value |
|---|---|
| Type | bool |
| Environment | $CODER_AI_GATEWAY_CIRCUIT_BREAKER_ENABLED |
| YAML | ai_gateway.circuit_breaker_enabled |
| Default | false |
Enable the circuit breaker to protect against cascading failures from upstream AI provider overload (503, 529).