opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
7a545b35ed05574e29a472aedd4e4ed0817d0fd5
coder/docs/reference/cli/server.md
T
Nick Vigilante 0a7bb80a1e feat: make CLI/API doc generators emit front-matter metadata (Phase 2) (#27246) 
## Summary

Phase 2 of the H1 → front-matter migration (`DOCS-483`; parent
`DOCS-477`). Makes the two reference-doc generators emit per-page
metadata as YAML front matter instead of a leading `# H1`, so generated
pages are self-describing and `make gen` stops reverting migrated pages
(Phase 3).

Phase 1 (`DOCS-482`) made the coder.com renderers prefer a front-matter
`title` (manifest fallback).

> [!NOTE]
> Rebased onto `main` and fully regenerated, and updated across two
rounds of Coder Agents Review — see **Review follow-ups** below.

## Changes

- **`scripts/clidocgen/command.tpl` + `gen.go` + `main.go`** — front
matter now carries `title` (from `fullName`) and `description` (from the
command's `Short`), and the leading `# H1` is dropped. The CLI index
page's front matter is taken from the manifest `Command Line` route
(title/description/icon_path).
- **`scripts/apidocgen/postprocess/main.go`** — reads the manifest and,
at write time, injects front matter carrying each section's `title` plus
any curated `description`, `state`, and `icon_path`. The API index
page's front matter is taken from the manifest `REST API` route.
- **`scripts/docgenenv`** (new shared code) — one `YAMLScalar`
front-matter escaper, one `Route`/`Manifest` schema +
`LoadManifest`/`FindRoute`, and one `FrontMatter(Route)` emitter, all
imported by both generators (no duplicated helpers, types, or emitters).
- Regenerated all **166 CLI + 31 API** reference pages.

### Metadata → front matter, and what stays in the manifest

Every *per-page* manifest field is mirrored into the page's front
matter: `title`, `description`, `state`, `icon_path`. The **structural**
fields stay in `manifest.json`:

- `children` — the nav tree (explicitly out of scope).
- `path` — the manifest's pointer to the file; a page carrying its own
path is redundant/error-prone, so it's treated like `children`.

The fields are **duplicated** into front matter and **`manifest.json` is
left unchanged**, so this is a **no-op for rendering today** (coder.com
strips front matter for `llms`, and Algolia + the renderer read only
`title`). Removing the fields from the manifest is the natural
follow-up, gated on the renderer reading them from front matter first.

### Why the API side changes the postprocessor, not the `.dot` templates

The issue text suggested editing
`scripts/apidocgen/markdown-template/*`. I deliberately did **not**,
because the postprocessor derives each page's **filename, section title,
and manifest route** from the leading `# {name}` line
(`extractSectionName`). Emitting front matter from the template would
break that extraction. Instead the widdershins templates still emit `#
{name}`, the postprocessor reads it (and now verifies it), and then
swaps the heading for a front-matter block as each section is written.

## Review follow-ups (Coder Agents Review)

### Round 1 — addressed in `e53d5e03` (all threads resolved)

- **CRF-1 / CRF-4** — de-duplicated the escaper and the
`route`/`manifest` schema + traversal into `scripts/docgenenv` (shared
by both generators).
- **CRF-2** — `YAMLScalar` now quotes YAML-reserved scalars
(`true/false/null/…`, numbers); no current value is affected.
- **CRF-3** — added unit tests: a `YAMLScalar` round-trip, `FindRoute`,
and `prependFrontMatter`.
- **CRF-5** — the CLI and API **index** pages now mirror their manifest
route's title/description/icon_path instead of a hardcoded
`coder`/`API`, fixing a rendered-heading regression (`REST API`/`Command
Line` were being overwritten).
- **CRF-6** — dropped the dead `#login` anchor in
`docs/support/support-bundle.md` (the migrated `login.md` no longer
mints that heading anchor).
- **CRF-7 / CRF-8 / CRF-11** — renamed to `prependFrontMatter`, switched
to `bytes.Cut`, and it now strips the first line only when it is the `#
{name}` heading (`extractSectionName` errors otherwise).
- **CRF-9** — removed the orphan `docs/reference/api/chat.md` (not in
the manifest, not linked; the real page is `chats.md`).
- **CRF-10** — the metadata read and the manifest rewrite now share one
`FindRoute` traversal.
- **CRF-13** — moot under squash-merge; this branch is a single
scopeless commit.
- **CRF-15** — the pre-existing `sort.Slice`/`slices.IsSorted`
comparator is left as-is per the review (out of scope; safe today
because section names are unique).

### Round 2 — addressed in `ee796e7107` (all threads resolved)

- **CRF-16** (P1) — removed three em-dashes from new doc comments (the
only `make lint` failure on the prior head); the emdash gate is green.
- **CRF-17 / CRF-18** — unified front-matter emission into one shared
`docgenenv.FrontMatter(Route)`, used by the API postprocessor directly
and by `command.tpl` via a `frontMatter` template func. This retires the
hand-written template YAML and the
`indexTitle`/`indexDescription`/`indexIconPath` closures, so a new
front-matter field is wired in one place, and it gives the CLI index the
`state` arm it previously lacked. Verified byte-identical: a full CLI +
API regen produces zero page changes.
- **CRF-19** — CLI child sort switched to `slices.SortFunc` +
`cmp.Compare` (typed comparator).
- **CRF-20** — reworded the `prependFrontMatter` comment:
`extractSectionName`'s fail-fast is the load-bearing guard; the prefix
check is a defensive backstop.
- **CRF-21** — added `icon_path`/`state` coverage in `docgenenv`'s
`TestFrontMatter/AllFields` (the branch the index page relies on,
previously at 0%).
- **CRF-22** — `YAMLScalar` no longer emits a trailing-space value as a
bare scalar (YAML strips it on read, so it would not round-trip); added
test coverage.
- **CRF-24** — the shared emitter removed the duplicated `cliIndexRoute`
doc comment; the rationale now lives in one place.
- **CRF-23** (Phase 3, out of scope here) — noted: the API generator
wipes and regenerates `reference/api/` from the manifest, so removing
curated metadata from the manifest in Phase 3 needs another source first
(a generator that preserves existing front matter, or metadata carried
alongside the swagger annotations).
- **Process (Mafu-san)** — the verification set below now leads with
`make lint`, the mandatory CI gate that the earlier list omitted.

## Cross-repo dependency

**Resolved — this PR no longer has a hard merge-ordering gate** (CRF-14
was right; the earlier "must merge after #968" note was stale).

The coder.com surfaces that would otherwise leak raw front matter from
`coder/coder` `main` are already front-matter-aware on merged PRs:

- **coder.com#964** (`DOCS-554`, llms-full.txt corpus + Algolia) —
**merged**.
- **coder.com#974** (`DOCS-574`, the `.md` proxy twin + `llms.txt` index
titles) — **merged**.

coder.com#968 (`DOCS-577`) was re-scoped to only the renderer
route-metadata generalization; it's a no-op on today's corpus and its
own description confirms the "deploy before the generators" constraint
no longer applies (that was driven by the llms corpus, now in #964).
Worth a final confirmation that #964/#974 are **deployed** before merge,
but there's no branch/PR ordering blocker left.

## Verification & evidence

AI was the primary author of this PR (see disclosure below); per the [AI
Contribution
Guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
here is manual verification.

- `make lint` (golangci-lint + the emdash gate) passes; `go build` / `go
vet` / `go test` are clean for the generators + `scripts/docgenenv`;
`pnpm check-docs` passes.
- `swagger.json`, `docs.go`, and `manifest.json` are **unchanged** —
metadata is duplicated into front matter; command/section names and
routes did not move.
- The diff is purely additive front matter
(`title`/`description`/`state`/`icon_path`) + the leading H1 removal; no
body reflow. A full CLI + API regen produces **zero** page changes
beyond the two index pages.

<details>
<summary>Terminal evidence</summary>

CLI `description` from the command's `Short` (`YAMLScalar` quotes when
needed, e.g. a `Short` with a colon):

```md
---
title: server
description: Start a Coder server
---
```

API pages inherit curated manifest metadata (only Agents/Chats have any
today):

```md
---
title: Chats
description: "REST endpoints for Coder Agents Chats API (programmatic agent sessions)."
state:
  - early access
---
```

Diff scope + "no body changes" proof (uses an explicit `base..HEAD`
range, so it actually tests the claim):

```
$ git diff --shortstat origin/main
 210 files changed, 1447 insertions(+), 344 deletions(-)
# = 166 CLI + 31 API reference pages + generators + scripts/docgenenv
# swagger.json / docs.go / manifest.json: NOT modified

# Every removed line under docs/reference is a leading "# H1"; nothing else:
$ git diff origin/main..HEAD -- docs/reference/ | grep '^-' | grep -v '^---' | grep -v '^-# '
(empty)

$ pnpm check-docs
Summary: 0 error(s)
```

</details>

Linear: DOCS-483

> This PR was created with AI assistance (Coder Agents).
2026-08-11 15:22:55 +00:00

2160 lines
102 KiB
Markdown
Generated
Raw Blame History

---
# Code generated by make gen. DO NOT EDIT.
title: server
description: Start a Coder server
---
<!-- DO NOT EDIT | GENERATED CONTENT -->
Start a Coder server
## Usage
```console
coder server [flags]
```
## Subcommands
| Name | Purpose |
|---------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------|
| [<code>create-admin-user</code>](./server_create-admin-user.md) | Create a new admin user with the given username, email and password and adds it to every organization. |
| [<code>postgres-builtin-url</code>](./server_postgres-builtin-url.md) | Output the connection URL for the built-in PostgreSQL deployment. |
| [<code>postgres-builtin-serve</code>](./server_postgres-builtin-serve.md) | Run the built-in PostgreSQL deployment. |
| [<code>fix-oidc-links</code>](./server_fix-oidc-links.md) | Reset OIDC linked IDs that do not match the expected issuer, allowing users to re-authenticate. |
| [<code>dbcrypt</code>](./server_dbcrypt.md) | Manage database encryption. |
## Options
### --access-url
| | |
|-------------|-----------------------------------|
| Type | <code>url</code> |
| Environment | <code>$CODER_ACCESS_URL</code> |
| YAML | <code>networking.accessURL</code> |
The URL that users will use to access the Coder deployment.
### --wildcard-access-url
| | |
|-------------|-------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_WILDCARD_ACCESS_URL</code> |
| YAML | <code>networking.wildcardAccessURL</code> |
Specifies the wildcard hostname to use for workspace applications in the form "*.example.com".
### --docs-url
| | |
|-------------|-------------------------------------|
| Type | <code>url</code> |
| Environment | <code>$CODER_DOCS_URL</code> |
| YAML | <code>networking.docsURL</code> |
| Default | <code>https://coder.com/docs</code> |
Specifies the custom docs URL.
### --redirect-to-access-url
| | |
|-------------|---------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_REDIRECT_TO_ACCESS_URL</code> |
| YAML | <code>networking.redirectToAccessURL</code> |
Specifies whether to redirect requests that do not match the access URL host.
### --http-address
| | |
|-------------|------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_HTTP_ADDRESS</code> |
| YAML | <code>networking.http.httpAddress</code> |
| Default | <code>127.0.0.1:3000</code> |
HTTP bind address of the server. Unset to disable the HTTP endpoint.
### --tls-address
| | |
|-------------|-------------------------------------|
| Type | <code>host:port</code> |
| Environment | <code>$CODER_TLS_ADDRESS</code> |
| YAML | <code>networking.tls.address</code> |
| Default | <code>127.0.0.1:3443</code> |
HTTPS bind address of the server.
### --tls-enable
| | |
|-------------|------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_TLS_ENABLE</code> |
| YAML | <code>networking.tls.enable</code> |
Whether TLS will be enabled.
### --tls-cert-file
| | |
|-------------|---------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_TLS_CERT_FILE</code> |
| YAML | <code>networking.tls.certFiles</code> |
Path to each certificate for TLS. It requires a PEM-encoded file. To configure the listener to use a CA certificate, concatenate the primary certificate and the CA certificate together. The primary certificate should appear first in the combined file.
### --tls-client-ca-file
| | |
|-------------|------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_TLS_CLIENT_CA_FILE</code> |
| YAML | <code>networking.tls.clientCAFile</code> |
PEM-encoded Certificate Authority file used for checking the authenticity of client.
### --tls-client-auth
| | |
|-------------|----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_TLS_CLIENT_AUTH</code> |
| YAML | <code>networking.tls.clientAuth</code> |
| Default | <code>none</code> |
Policy the server will follow for TLS Client Authentication. Accepted values are "none", "request", "require-any", "verify-if-given", or "require-and-verify".
### --tls-key-file
| | |
|-------------|--------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_TLS_KEY_FILE</code> |
| YAML | <code>networking.tls.keyFiles</code> |
Paths to the private keys for each of the certificates. It requires a PEM-encoded file.
### --tls-min-version
| | |
|-------------|----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_TLS_MIN_VERSION</code> |
| YAML | <code>networking.tls.minVersion</code> |
| Default | <code>tls12</code> |
Minimum supported version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13".
### --tls-client-cert-file
| | |
|-------------|--------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_TLS_CLIENT_CERT_FILE</code> |
| YAML | <code>networking.tls.clientCertFile</code> |
Path to certificate for client TLS authentication. It requires a PEM-encoded file.
### --tls-client-key-file
| | |
|-------------|-------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_TLS_CLIENT_KEY_FILE</code> |
| YAML | <code>networking.tls.clientKeyFile</code> |
Path to key for client TLS authentication. It requires a PEM-encoded file.
### --tls-ciphers
| | |
|-------------|----------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_TLS_CIPHERS</code> |
| YAML | <code>networking.tls.tlsCiphers</code> |
Specify specific TLS ciphers that allowed to be used. See https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L53-L75.
### --tls-allow-insecure-ciphers
| | |
|-------------|-----------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_TLS_ALLOW_INSECURE_CIPHERS</code> |
| YAML | <code>networking.tls.tlsAllowInsecureCiphers</code> |
| Default | <code>false</code> |
By default, only ciphers marked as 'secure' are allowed to be used. See https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L82-L95.
### --derp-server-enable
| | |
|-------------|----------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DERP_SERVER_ENABLE</code> |
| YAML | <code>networking.derp.enable</code> |
| Default | <code>true</code> |
Whether to enable or disable the embedded DERP relay server.
### --derp-server-region-name
| | |
|-------------|---------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_DERP_SERVER_REGION_NAME</code> |
| YAML | <code>networking.derp.regionName</code> |
| Default | <code>Coder Embedded Relay</code> |
Region name that for the embedded DERP server.
### --derp-server-stun-addresses
| | |
|-------------|------------------------------------------------------------------------------------------------------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_DERP_SERVER_STUN_ADDRESSES</code> |
| YAML | <code>networking.derp.stunAddresses</code> |
| Default | <code>stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302,stun3.l.google.com:19302,stun4.l.google.com:19302</code> |
Addresses for STUN servers to establish P2P connections. It's recommended to have at least two STUN servers to give users the best chance of connecting P2P to workspaces. Each STUN server will get it's own DERP region, with region IDs starting at `--derp-server-region-id + 1`. Use special value 'disable' to turn off STUN completely.
### --derp-server-relay-url
| | |
|-------------|-------------------------------------------|
| Type | <code>url</code> |
| Environment | <code>$CODER_DERP_SERVER_RELAY_URL</code> |
| YAML | <code>networking.derp.relayURL</code> |
An HTTP URL that is accessible by other replicas to relay DERP traffic. Required for high availability.
### --block-direct-connections
| | |
|-------------|------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_BLOCK_DIRECT</code> |
| YAML | <code>networking.derp.blockDirect</code> |
Block peer-to-peer (aka. direct) workspace connections. All workspace connections from the CLI will be proxied through Coder (or custom configured DERP servers) and will never be peer-to-peer when enabled. Workspaces may still reach out to STUN servers to get their address until they are restarted after this change has been made, but new connections will still be proxied regardless.
### --derp-force-websockets
| | |
|-------------|----------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DERP_FORCE_WEBSOCKETS</code> |
| YAML | <code>networking.derp.forceWebSockets</code> |
Force clients and agents to always use WebSocket to connect to DERP relay servers. By default, DERP uses `Upgrade: derp`, which may cause issues with some reverse proxies. Clients may automatically fallback to WebSocket if they detect an issue with `Upgrade: derp`, but this does not work in all situations.
### --derp-config-url
| | |
|-------------|-------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_DERP_CONFIG_URL</code> |
| YAML | <code>networking.derp.url</code> |
URL to fetch a DERP mapping on startup. See: https://tailscale.com/kb/1118/custom-derp-servers/.
### --derp-config-path
| | |
|-------------|-----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_DERP_CONFIG_PATH</code> |
| YAML | <code>networking.derp.configPath</code> |
Path to read a DERP mapping from. See: https://tailscale.com/kb/1118/custom-derp-servers/.
### --stats-collection-usage-stats-enable
| | |
|-------------|--------------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_STATS_COLLECTION_USAGE_STATS_ENABLE</code> |
| YAML | <code>introspection.statsCollection.usageStats.enable</code> |
| Default | <code>true</code> |
Enable the collection of application and workspace usage along with the associated API endpoints and the template insights page. Disabling this will also disable traffic and connection insights in the deployment stats shown to admins in the bottom bar of the Coder UI, and will prevent Prometheus collection of these values.
### --prometheus-enable
| | |
|-------------|----------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_PROMETHEUS_ENABLE</code> |
| YAML | <code>introspection.prometheus.enable</code> |
Serve prometheus metrics on the address defined by prometheus address.
### --prometheus-address
| | |
|-------------|-----------------------------------------------|
| Type | <code>host:port</code> |
| Environment | <code>$CODER_PROMETHEUS_ADDRESS</code> |
| YAML | <code>introspection.prometheus.address</code> |
| Default | <code>127.0.0.1:2112</code> |
The bind address to serve prometheus metrics.
### --prometheus-collect-agent-stats
| | |
|-------------|-----------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_PROMETHEUS_COLLECT_AGENT_STATS</code> |
| YAML | <code>introspection.prometheus.collect_agent_stats</code> |
Collect agent stats (may increase charges for metrics storage).
### --prometheus-aggregate-agent-stats-by
| | |
|-------------|----------------------------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_PROMETHEUS_AGGREGATE_AGENT_STATS_BY</code> |
| YAML | <code>introspection.prometheus.aggregate_agent_stats_by</code> |
| Default | <code>agent_name,template_name,username,workspace_name</code> |
When collecting agent stats, aggregate metrics by a given set of comma-separated labels to reduce cardinality. Accepted values are agent_name, template_name, username, workspace_name.
### --prometheus-collect-db-metrics
| | |
|-------------|----------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_PROMETHEUS_COLLECT_DB_METRICS</code> |
| YAML | <code>introspection.prometheus.collect_db_metrics</code> |
| Default | <code>false</code> |
Collect database query metrics (may increase charges for metrics storage). If set to false, a reduced set of database metrics are still collected.
### --pprof-enable
| | |
|-------------|-----------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_PPROF_ENABLE</code> |
| YAML | <code>introspection.pprof.enable</code> |
Serve pprof metrics on the address defined by pprof address.
### --pprof-address
| | |
|-------------|------------------------------------------|
| Type | <code>host:port</code> |
| Environment | <code>$CODER_PPROF_ADDRESS</code> |
| YAML | <code>introspection.pprof.address</code> |
| Default | <code>127.0.0.1:6060</code> |
The bind address to serve pprof.
### --oauth2-github-client-id
| | |
|-------------|---------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OAUTH2_GITHUB_CLIENT_ID</code> |
| YAML | <code>oauth2.github.clientID</code> |
Client ID for Login with GitHub.
### --oauth2-github-client-secret
| | |
|-------------|-------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OAUTH2_GITHUB_CLIENT_SECRET</code> |
Client secret for Login with GitHub.
### --oauth2-github-device-flow
| | |
|-------------|-----------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_OAUTH2_GITHUB_DEVICE_FLOW</code> |
| YAML | <code>oauth2.github.deviceFlow</code> |
| Default | <code>false</code> |
Enable device flow for Login with GitHub.
### --oauth2-github-default-provider-enable
| | |
|-------------|-----------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_OAUTH2_GITHUB_DEFAULT_PROVIDER_ENABLE</code> |
| YAML | <code>oauth2.github.defaultProviderEnable</code> |
| Default | <code>true</code> |
Enable the default GitHub OAuth2 provider managed by Coder.
### --oauth2-github-allowed-orgs
| | |
|-------------|------------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_OAUTH2_GITHUB_ALLOWED_ORGS</code> |
| YAML | <code>oauth2.github.allowedOrgs</code> |
Organizations the user must be a member of to Login with GitHub.
### --oauth2-github-allowed-teams
| | |
|-------------|-------------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_OAUTH2_GITHUB_ALLOWED_TEAMS</code> |
| YAML | <code>oauth2.github.allowedTeams</code> |
Teams inside organizations the user must be a member of to Login with GitHub. Structured as: `<organization-name>/<team-slug>`.
### --oauth2-github-allow-signups
| | |
|-------------|-------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS</code> |
| YAML | <code>oauth2.github.allowSignups</code> |
Whether new users can sign up with GitHub.
### --oauth2-github-allow-everyone
| | |
|-------------|--------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_OAUTH2_GITHUB_ALLOW_EVERYONE</code> |
| YAML | <code>oauth2.github.allowEveryone</code> |
Allow all logins, setting this option means allowed orgs and teams must be empty.
### --oauth2-github-enterprise-base-url
| | |
|-------------|-------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OAUTH2_GITHUB_ENTERPRISE_BASE_URL</code> |
| YAML | <code>oauth2.github.enterpriseBaseURL</code> |
Base URL of a GitHub Enterprise deployment to use for Login with GitHub.
### --oidc-allow-signups
| | |
|-------------|----------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_OIDC_ALLOW_SIGNUPS</code> |
| YAML | <code>oidc.allowSignups</code> |
| Default | <code>true</code> |
Whether new users can sign up with OIDC.
### --oidc-client-id
| | |
|-------------|------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_CLIENT_ID</code> |
| YAML | <code>oidc.clientID</code> |
Client ID to use for Login with OIDC.
### --oidc-client-secret
| | |
|-------------|----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_CLIENT_SECRET</code> |
Client secret to use for Login with OIDC.
### --oidc-client-key-file
| | |
|-------------|------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_CLIENT_KEY_FILE</code> |
| YAML | <code>oidc.oidcClientKeyFile</code> |
Pem encoded RSA private key to use for oauth2 PKI/JWT authorization. This can be used instead of oidc-client-secret if your IDP supports it.
### --oidc-client-cert-file
| | |
|-------------|-------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_CLIENT_CERT_FILE</code> |
| YAML | <code>oidc.oidcClientCertFile</code> |
Pem encoded certificate file to use for oauth2 PKI/JWT authorization. The public certificate that accompanies oidc-client-key-file. A standard x509 certificate is expected.
### --oidc-email-domain
| | |
|-------------|---------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_OIDC_EMAIL_DOMAIN</code> |
| YAML | <code>oidc.emailDomain</code> |
Email domains that clients logging in with OIDC must match.
### --oidc-issuer-url
| | |
|-------------|-------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_ISSUER_URL</code> |
| YAML | <code>oidc.issuerURL</code> |
Issuer URL to use for Login with OIDC.
### --oidc-scopes
| | |
|-------------|-----------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_OIDC_SCOPES</code> |
| YAML | <code>oidc.scopes</code> |
| Default | <code>openid,profile,email</code> |
Scopes to grant when authenticating with OIDC.
### --oidc-ignore-email-verified
| | |
|-------------|------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_OIDC_IGNORE_EMAIL_VERIFIED</code> |
| YAML | <code>oidc.ignoreEmailVerified</code> |
Ignore the email_verified claim from the upstream provider.
### --oidc-username-field
| | |
|-------------|-----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_USERNAME_FIELD</code> |
| YAML | <code>oidc.usernameField</code> |
| Default | <code>preferred_username</code> |
OIDC claim field to use as the username.
### --oidc-name-field
| | |
|-------------|-------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_NAME_FIELD</code> |
| YAML | <code>oidc.nameField</code> |
| Default | <code>name</code> |
OIDC claim field to use as the name.
### --oidc-email-field
| | |
|-------------|--------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_EMAIL_FIELD</code> |
| YAML | <code>oidc.emailField</code> |
| Default | <code>email</code> |
OIDC claim field to use as the email.
### --oidc-auth-url-params
| | |
|-------------|------------------------------------------|
| Type | <code>struct[map[string]string]</code> |
| Environment | <code>$CODER_OIDC_AUTH_URL_PARAMS</code> |
| YAML | <code>oidc.authURLParams</code> |
| Default | <code>{"access_type": "offline"}</code> |
OIDC auth URL parameters to pass to the upstream provider.
### --oidc-ignore-userinfo
| | |
|-------------|------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_OIDC_IGNORE_USERINFO</code> |
| YAML | <code>oidc.ignoreUserInfo</code> |
| Default | <code>false</code> |
Ignore the userinfo endpoint and only use the ID token for user information.
### --oidc-group-field
| | |
|-------------|--------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_GROUP_FIELD</code> |
| YAML | <code>oidc.groupField</code> |
This field must be set if using the group sync feature and the scope name is not 'groups'. Set to the claim to be used for groups.
### --oidc-group-mapping
| | |
|-------------|----------------------------------------|
| Type | <code>struct[map[string]string]</code> |
| Environment | <code>$CODER_OIDC_GROUP_MAPPING</code> |
| YAML | <code>oidc.groupMapping</code> |
| Default | <code>{}</code> |
A map of OIDC group IDs and the group in Coder it should map to. This is useful for when OIDC providers only return group IDs.
### --oidc-group-auto-create
| | |
|-------------|--------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_OIDC_GROUP_AUTO_CREATE</code> |
| YAML | <code>oidc.enableGroupAutoCreate</code> |
| Default | <code>false</code> |
Automatically creates missing groups from a user's groups claim.
### --oidc-group-regex-filter
| | |
|-------------|---------------------------------------------|
| Type | <code>regexp</code> |
| Environment | <code>$CODER_OIDC_GROUP_REGEX_FILTER</code> |
| YAML | <code>oidc.groupRegexFilter</code> |
| Default | <code>.*</code> |
If provided any group name not matching the regex is ignored. This allows for filtering out groups that are not needed. This filter is applied after the group mapping.
### --oidc-allowed-groups
| | |
|-------------|-----------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_OIDC_ALLOWED_GROUPS</code> |
| YAML | <code>oidc.groupAllowed</code> |
If provided any group name not in the list will not be allowed to authenticate. This allows for restricting access to a specific set of groups. This filter is applied after the group mapping and before the regex filter.
### --oidc-user-role-field
| | |
|-------------|------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_USER_ROLE_FIELD</code> |
| YAML | <code>oidc.userRoleField</code> |
This field must be set if using the user roles sync feature. Set this to the name of the claim used to store the user's role. The roles should be sent as an array of strings.
### --oidc-user-role-mapping
| | |
|-------------|--------------------------------------------|
| Type | <code>struct[map[string][]string]</code> |
| Environment | <code>$CODER_OIDC_USER_ROLE_MAPPING</code> |
| YAML | <code>oidc.userRoleMapping</code> |
| Default | <code>{}</code> |
A map of the OIDC passed in user roles and the groups in Coder it should map to. This is useful if the group names do not match. If mapped to the empty string, the role will ignored.
### --oidc-user-role-default
| | |
|-------------|--------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_OIDC_USER_ROLE_DEFAULT</code> |
| YAML | <code>oidc.userRoleDefault</code> |
If user role sync is enabled, these roles are always included for all authenticated users. The 'member' role is always assigned.
### --oidc-sign-in-text
| | |
|-------------|---------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_SIGN_IN_TEXT</code> |
| YAML | <code>oidc.signInText</code> |
| Default | <code>OpenID Connect</code> |
The text to show on the OpenID Connect sign in button.
### --oidc-icon-url
| | |
|-------------|-----------------------------------|
| Type | <code>url</code> |
| Environment | <code>$CODER_OIDC_ICON_URL</code> |
| YAML | <code>oidc.iconURL</code> |
URL pointing to the icon to use on the OpenID Connect login button.
### --oidc-signups-disabled-text
| | |
|-------------|------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_OIDC_SIGNUPS_DISABLED_TEXT</code> |
| YAML | <code>oidc.signupsDisabledText</code> |
The custom text to show on the error page informing about disabled OIDC signups. Markdown format is supported.
### --dangerous-oidc-skip-issuer-checks
| | |
|-------------|-------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DANGEROUS_OIDC_SKIP_ISSUER_CHECKS</code> |
| YAML | <code>oidc.dangerousSkipIssuerChecks</code> |
OIDC issuer urls must match in the request, the id_token 'iss' claim, and in the well-known configuration. This flag disables that requirement, and can lead to an insecure OIDC configuration. It is not recommended to use this flag.
### --telemetry
| | |
|-------------|--------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_TELEMETRY_ENABLE</code> |
| YAML | <code>telemetry.enable</code> |
| Default | <code>true</code> |
Whether telemetry is enabled or not. Coder collects anonymized usage data to help improve our product.
### --trace
| | |
|-------------|-------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_TRACE_ENABLE</code> |
| YAML | <code>introspection.tracing.enable</code> |
Whether application tracing data is collected. It exports to a backend configured by environment variables. See: https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md.
### --trace-honeycomb-api-key
| | |
|-------------|---------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_TRACE_HONEYCOMB_API_KEY</code> |
Enables trace exporting to Honeycomb.io using the provided API Key.
### --trace-logs
| | |
|-------------|------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_TRACE_LOGS</code> |
| YAML | <code>introspection.tracing.captureLogs</code> |
Enables capturing of logs as events in traces. This is useful for debugging, but may result in a very large amount of events being sent to the tracing backend which may incur significant costs.
### --provisioner-daemons
| | |
|-------------|-----------------------------------------|
| Type | <code>int</code> |
| Environment | <code>$CODER_PROVISIONER_DAEMONS</code> |
| YAML | <code>provisioning.daemons</code> |
| Default | <code>3</code> |
Number of provisioner daemons to create on start. If builds are stuck in queued state for a long time, consider increasing this.
### --provisioner-daemon-poll-interval
| | |
|-------------|------------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_PROVISIONER_DAEMON_POLL_INTERVAL</code> |
| YAML | <code>provisioning.daemonPollInterval</code> |
| Default | <code>1s</code> |
Deprecated and ignored.
### --provisioner-daemon-poll-jitter
| | |
|-------------|----------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_PROVISIONER_DAEMON_POLL_JITTER</code> |
| YAML | <code>provisioning.daemonPollJitter</code> |
| Default | <code>100ms</code> |
Deprecated and ignored.
### --provisioner-force-cancel-interval
| | |
|-------------|-------------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_PROVISIONER_FORCE_CANCEL_INTERVAL</code> |
| YAML | <code>provisioning.forceCancelInterval</code> |
| Default | <code>10m0s</code> |
Time to force cancel provisioning tasks that are stuck.
### --provisioner-daemon-psk
| | |
|-------------|--------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_PROVISIONER_DAEMON_PSK</code> |
Pre-shared key to authenticate external provisioner daemons to Coder server.
### -l, --log-filter
| | |
|-------------|-------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_LOG_FILTER</code> |
| YAML | <code>introspection.logging.filter</code> |
Filter debug logs by matching against a given regex. Use .* to match all debug logs.
### --log-human
| | |
|-------------|----------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_LOGGING_HUMAN</code> |
| YAML | <code>introspection.logging.humanPath</code> |
| Default | <code>/dev/stderr</code> |
Output human-readable logs to a given file.
### --log-json
| | |
|-------------|---------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_LOGGING_JSON</code> |
| YAML | <code>introspection.logging.jsonPath</code> |
Output JSON logs to a given file.
### --log-stackdriver
| | |
|-------------|----------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_LOGGING_STACKDRIVER</code> |
| YAML | <code>introspection.logging.stackdriverPath</code> |
Output Stackdriver compatible logs to a given file.
### --enable-terraform-debug-mode
| | |
|-------------|-------------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_ENABLE_TERRAFORM_DEBUG_MODE</code> |
| YAML | <code>introspection.logging.enableTerraformDebugMode</code> |
| Default | <code>false</code> |
Allow administrators to enable Terraform debug output.
### --additional-csp-policy
| | |
|-------------|--------------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_ADDITIONAL_CSP_POLICY</code> |
| YAML | <code>networking.http.additionalCSPPolicy</code> |
Coder configures a Content Security Policy (CSP) to protect against XSS attacks. This setting allows you to add additional CSP directives, which can open the attack surface of the deployment. Format matches the CSP directive format, e.g. --additional-csp-policy="script-src https://example.com".
### --dangerous-allow-path-app-sharing
| | |
|-------------|------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DANGEROUS_ALLOW_PATH_APP_SHARING</code> |
Allow workspace apps that are not served from subdomains to be shared. Path-based app sharing is DISABLED by default for security purposes. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.
### --dangerous-allow-path-app-site-owner-access
| | |
|-------------|----------------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DANGEROUS_ALLOW_PATH_APP_SITE_OWNER_ACCESS</code> |
Allow site-owners to access workspace apps from workspaces they do not own. Owners cannot access path-based apps they do not own by default. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.
### --experiments
| | |
|-------------|---------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_EXPERIMENTS</code> |
| YAML | <code>experiments</code> |
Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.
### --update-check
| | |
|-------------|----------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_UPDATE_CHECK</code> |
| YAML | <code>updateCheck</code> |
| Default | <code>false</code> |
Periodically check for new releases of Coder and inform the owner. The check is performed once per day.
### --max-token-lifetime
| | |
|-------------|-----------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_MAX_TOKEN_LIFETIME</code> |
| YAML | <code>networking.http.maxTokenLifetime</code> |
| Default | <code>876600h0m0s</code> |
The maximum lifetime duration users can specify when creating an API token.
### --max-admin-token-lifetime
| | |
|-------------|----------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_MAX_ADMIN_TOKEN_LIFETIME</code> |
| YAML | <code>networking.http.maxAdminTokenLifetime</code> |
| Default | <code>168h0m0s</code> |
The maximum lifetime duration administrators can specify when creating an API token.
### --default-token-lifetime
| | |
|-------------|--------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_DEFAULT_TOKEN_LIFETIME</code> |
| YAML | <code>defaultTokenLifetime</code> |
| Default | <code>168h0m0s</code> |
The default lifetime duration for API tokens. This value is used when creating a token without specifying a duration, such as when authenticating the CLI or an IDE plugin.
### --default-oauth-refresh-lifetime
| | |
|-------------|----------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_DEFAULT_OAUTH_REFRESH_LIFETIME</code> |
| YAML | <code>defaultOAuthRefreshLifetime</code> |
| Default | <code>720h0m0s</code> |
The default lifetime duration for OAuth2 refresh tokens. This controls how long refresh tokens remain valid after issuance or rotation.
### --swagger-enable
| | |
|-------------|------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_SWAGGER_ENABLE</code> |
| YAML | <code>enableSwagger</code> |
Expose the swagger endpoint via /swagger.
### --proxy-trusted-headers
| | |
|-------------|---------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_PROXY_TRUSTED_HEADERS</code> |
| YAML | <code>networking.proxyTrustedHeaders</code> |
Headers to trust for forwarding IP addresses. e.g. Cf-Connecting-Ip, True-Client-Ip, X-Forwarded-For.
### --proxy-trusted-origins
| | |
|-------------|---------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_PROXY_TRUSTED_ORIGINS</code> |
| YAML | <code>networking.proxyTrustedOrigins</code> |
Origin addresses to respect "proxy-trusted-headers" and X-Forwarded-Host for subdomain app routing. e.g. 192.168.1.0/24.
### --cache-dir
| | |
|-------------|-------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_CACHE_DIRECTORY</code> |
| YAML | <code>cacheDir</code> |
| Default | <code>~/.cache/coder</code> |
The directory to cache temporary files. If unspecified and $CACHE_DIRECTORY is set, it will be used for compatibility with systemd. This directory is NOT safe to be configured as a shared directory across coderd/provisionerd replicas.
### --postgres-url
| | |
|-------------|---------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_PG_CONNECTION_URL</code> |
URL of a PostgreSQL database. If empty, PostgreSQL binaries will be downloaded from Maven (https://repo1.maven.org/maven2) and store all data in the config root. Access the built-in database with "coder server postgres-builtin-url". Note that any special characters in the URL must be URL-encoded.
### --postgres-auth
| | |
|-------------|----------------------------------|
| Type | <code>password\|awsiamrds</code> |
| Environment | <code>$CODER_PG_AUTH</code> |
| YAML | <code>pgAuth</code> |
| Default | <code>password</code> |
Type of auth to use when connecting to postgres. For AWS RDS, using IAM authentication (awsiamrds) is recommended.
### --postgres-conn-max-open
| | |
|-------------|--------------------------------------|
| Type | <code>int</code> |
| Environment | <code>$CODER_PG_CONN_MAX_OPEN</code> |
| YAML | <code>pgConnMaxOpen</code> |
| Default | <code>10</code> |
Maximum number of open connections to the database. Defaults to 10.
### --postgres-conn-max-idle
| | |
|-------------|--------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_PG_CONN_MAX_IDLE</code> |
| YAML | <code>pgConnMaxIdle</code> |
| Default | <code>auto</code> |
Maximum number of idle connections to the database. Set to "auto" (the default) to use max open / 3. Value must be greater or equal to 0; 0 means explicitly no idle connections.
### --secure-auth-cookie
| | |
|-------------|------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_SECURE_AUTH_COOKIE</code> |
| YAML | <code>networking.secureAuthCookie</code> |
Controls if the 'Secure' property is set on browser session cookies.
### --samesite-auth-cookie
| | |
|-------------|--------------------------------------------|
| Type | <code>lax\|none</code> |
| Environment | <code>$CODER_SAMESITE_AUTH_COOKIE</code> |
| YAML | <code>networking.sameSiteAuthCookie</code> |
| Default | <code>lax</code> |
Controls the 'SameSite' property is set on browser session cookies.
### --host-prefix-cookie
| | |
|-------------|------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_HOST_PREFIX_COOKIE</code> |
| YAML | <code>networking.hostPrefixCookie</code> |
| Default | <code>false</code> |
Recommended to be enabled. Enables `__Host-` prefix for cookies to guarantee they are only set by the right domain. This change is disruptive to any workspaces built before release 2.31, requiring a workspace restart.
### --terms-of-service-url
| | |
|-------------|------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_TERMS_OF_SERVICE_URL</code> |
| YAML | <code>termsOfServiceURL</code> |
A URL to an external Terms of Service that must be accepted by users when logging in.
### --strict-transport-security
| | |
|-------------|-----------------------------------------------------|
| Type | <code>int</code> |
| Environment | <code>$CODER_STRICT_TRANSPORT_SECURITY</code> |
| YAML | <code>networking.tls.strictTransportSecurity</code> |
| Default | <code>0</code> |
Controls if the 'Strict-Transport-Security' header is set on all static file responses. This header should only be set if the server is accessed via HTTPS. This value is the MaxAge in seconds of the header.
### --strict-transport-security-options
| | |
|-------------|------------------------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_STRICT_TRANSPORT_SECURITY_OPTIONS</code> |
| YAML | <code>networking.tls.strictTransportSecurityOptions</code> |
Two optional fields can be set in the Strict-Transport-Security header; 'includeSubDomains' and 'preload'. The 'strict-transport-security' flag must be set to a non-zero value for these options to be used.
### --ssh-keygen-algorithm
| | |
|-------------|------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_SSH_KEYGEN_ALGORITHM</code> |
| YAML | <code>sshKeygenAlgorithm</code> |
| Default | <code>ed25519</code> |
The algorithm to use for generating ssh keys. Accepted values are "ed25519", "ecdsa", or "rsa4096".
### --browser-only
| | |
|-------------|-------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_BROWSER_ONLY</code> |
| YAML | <code>networking.browserOnly</code> |
Whether Coder only allows connections to workspaces via the browser.
### --cluster-host
| | |
|-------------|---------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_CLUSTER_HOST</code> |
| YAML | <code>networking.cluster.clusterHost</code> |
Hostname or (more commonly) IP to reach this replica for clustering.
### --scim-auth-header
| | |
|-------------|--------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_SCIM_AUTH_HEADER</code> |
Enables SCIM and sets the authentication header for the built-in SCIM server. New users are automatically created with OIDC authentication.
### --scim-use-legacy
| | |
|-------------|-------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_SCIM_USE_LEGACY</code> |
| YAML | <code>scimUseLegacy</code> |
| Default | <code>true</code> |
Use the legacy SCIM implementation instead of the SCIM 2.0 handler. This is provided for backward compatibility for existing users.
### --external-token-encryption-keys
| | |
|-------------|----------------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS</code> |
Encrypt OIDC and Git authentication tokens with AES-256-GCM in the database. The value must be a comma-separated list of base64-encoded keys. Each key, when base64-decoded, must be exactly 32 bytes in length. The first key will be used to encrypt new values. Subsequent keys will be used as a fallback when decrypting. During normal operation it is recommended to only set one key unless you are in the process of rotating keys with the `coder server dbcrypt rotate` command.
### --disable-path-apps
| | |
|-------------|---------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DISABLE_PATH_APPS</code> |
| YAML | <code>disablePathApps</code> |
Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.
### --disable-owner-workspace-access
| | |
|-------------|----------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DISABLE_OWNER_WORKSPACE_ACCESS</code> |
| YAML | <code>disableOwnerWorkspaceAccess</code> |
Remove the permission for the 'owner' role to have workspace execution on all workspaces. This prevents the 'owner' from ssh, apps, and terminal access based on the 'owner' role. They still have their user permissions to access their own workspaces.
### --disable-workspace-sharing
| | |
|-------------|-----------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DISABLE_WORKSPACE_SHARING</code> |
| YAML | <code>disableWorkspaceSharing</code> |
Disable workspace sharing. Workspace ACL checking is disabled and only owners can have ssh, apps and terminal access to workspaces. Access based on the 'owner' role is also allowed unless disabled via --disable-owner-workspace-access.
### --disable-chat-sharing
| | |
|-------------|------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DISABLE_CHAT_SHARING</code> |
| YAML | <code>disableChatSharing</code> |
Disable chat sharing. Chat ACL checking is disabled and only owners can access their chats.
### --session-duration
| | |
|-------------|----------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_SESSION_DURATION</code> |
| YAML | <code>networking.http.sessionDuration</code> |
| Default | <code>24h0m0s</code> |
The token expiry duration for browser sessions. Sessions may last longer if they are actively making requests, but this functionality can be disabled via --disable-session-expiry-refresh.
### --disable-session-expiry-refresh
| | |
|-------------|----------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DISABLE_SESSION_EXPIRY_REFRESH</code> |
| YAML | <code>networking.http.disableSessionExpiryRefresh</code> |
Disable automatic session expiry bumping due to activity. This forces all sessions to become invalid after the session expiry duration has been reached.
### --disable-password-auth
| | |
|-------------|--------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DISABLE_PASSWORD_AUTH</code> |
| YAML | <code>networking.http.disablePasswordAuth</code> |
Disable password authentication. This is recommended for security purposes in production deployments that rely on an identity provider. Any user with the owner role will be able to sign in with their password regardless of this setting to avoid potential lock out. If you are locked out of your account, you can use the `coder server create-admin` command to create a new admin user directly in the database.
### -c, --config
| | |
|-------------|---------------------------------|
| Type | <code>yaml-config-path</code> |
| Environment | <code>$CODER_CONFIG_PATH</code> |
Specify a YAML file to load configuration from.
### --workspace-hostname-suffix
| | |
|-------------|-----------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_WORKSPACE_HOSTNAME_SUFFIX</code> |
| YAML | <code>client.workspaceHostnameSuffix</code> |
| Default | <code>coder</code> |
Workspace hostnames use this suffix in SSH config and Coder Connect on Coder Desktop. By default it is coder, resulting in names like myworkspace.coder. The suffix must not start with a dot, and must not contain spaces, newlines, or glob characters (* and ?).
### --ssh-config-options
| | |
|-------------|----------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_SSH_CONFIG_OPTIONS</code> |
| YAML | <code>client.sshConfigOptions</code> |
These SSH config options will override the default SSH config options. Provide options in "key=value" or "key value" format separated by commas. Using this incorrectly can break SSH to your deployment, use cautiously. The following options are not allowed: Host, Match, Include, ProxyCommand, ProxyJump, LocalCommand, PermitLocalCommand, RemoteCommand, KnownHostsCommand, PKCS11Provider, SecurityKeyProvider, SmartcardDevice, XAuthLocation. Option values must not contain newline, carriage return, or NUL characters.
### --cli-upgrade-message
| | |
|-------------|-----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_CLI_UPGRADE_MESSAGE</code> |
| YAML | <code>client.cliUpgradeMessage</code> |
The upgrade message to display to users when a client/server mismatch is detected. By default it instructs users to update using 'curl -L https://coder.com/install.sh | sh'.
### --write-config
| | |
|------|-------------------|
| Type | <code>bool</code> |
<br/>Write out the current server config as YAML to stdout.
### --support-links
| | |
|-------------|--------------------------------------------|
| Type | <code>struct[[]codersdk.LinkConfig]</code> |
| Environment | <code>$CODER_SUPPORT_LINKS</code> |
| YAML | <code>supportLinks</code> |
Support links to display in the top right drop down menu.
### --external-auth-github-default-provider-enable
| | |
|-------------|------------------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_EXTERNAL_AUTH_GITHUB_DEFAULT_PROVIDER_ENABLE</code> |
| YAML | <code>externalAuthGithubDefaultProviderEnable</code> |
| Default | <code>true</code> |
Enable the default GitHub external auth provider managed by Coder.
### --proxy-health-interval
| | |
|-------------|--------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_PROXY_HEALTH_INTERVAL</code> |
| YAML | <code>networking.http.proxyHealthInterval</code> |
| Default | <code>1m0s</code> |
The interval in which coderd should be checking the status of workspace proxies.
### --default-quiet-hours-schedule
| | |
|-------------|---------------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_QUIET_HOURS_DEFAULT_SCHEDULE</code> |
| YAML | <code>userQuietHoursSchedule.defaultQuietHoursSchedule</code> |
| Default | <code>CRON_TZ=UTC 0 0 ** *</code> |
The default daily cron schedule applied to users that haven't set a custom quiet hours schedule themselves. The quiet hours schedule determines when workspaces will be force stopped due to the template's autostop requirement, and will round the max deadline up to be within the user's quiet hours window (or default). The format is the same as the standard cron format, but the day-of-month, month and day-of-week must be *. Only one hour and minute can be specified (ranges or comma separated values are not supported).
### --allow-custom-quiet-hours
| | |
|-------------|-----------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_ALLOW_CUSTOM_QUIET_HOURS</code> |
| YAML | <code>userQuietHoursSchedule.allowCustomQuietHours</code> |
| Default | <code>true</code> |
Allow users to set their own quiet hours schedule for workspaces to stop in (depending on template autostop requirement settings). If false, users can't change their quiet hours schedule and the site default is always used.
### --web-terminal-renderer
| | |
|-------------|-------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_WEB_TERMINAL_RENDERER</code> |
| YAML | <code>client.webTerminalRenderer</code> |
| Default | <code>canvas</code> |
The renderer to use when opening a web terminal. Valid values are 'canvas', 'webgl', or 'dom'.
### --allow-workspace-renames
| | |
|-------------|---------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_ALLOW_WORKSPACE_RENAMES</code> |
| YAML | <code>allowWorkspaceRenames</code> |
| Default | <code>false</code> |
Allow users to rename their workspaces. WARNING: Renaming a workspace can cause Terraform resources that depend on the workspace name to be destroyed and recreated, potentially causing data loss. Only enable this if your templates do not use workspace names in resource identifiers, or if you understand the risks.
### --health-check-refresh
| | |
|-------------|------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_HEALTH_CHECK_REFRESH</code> |
| YAML | <code>introspection.healthcheck.refresh</code> |
| Default | <code>10m0s</code> |
Refresh interval for healthchecks.
### --health-check-threshold-database
| | |
|-------------|----------------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_HEALTH_CHECK_THRESHOLD_DATABASE</code> |
| YAML | <code>introspection.healthcheck.thresholdDatabase</code> |
| Default | <code>15ms</code> |
The threshold for the database health check. If the median latency of the database exceeds this threshold over 5 attempts, the database is considered unhealthy. The default value is 15ms.
### --email-from
| | |
|-------------|--------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_FROM</code> |
| YAML | <code>email.from</code> |
The sender's address to use.
### --email-smarthost
| | |
|-------------|-------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_SMARTHOST</code> |
| YAML | <code>email.smarthost</code> |
The intermediary SMTP host through which emails are sent.
### --email-hello
| | |
|-------------|---------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_HELLO</code> |
| YAML | <code>email.hello</code> |
| Default | <code>localhost</code> |
The hostname identifying the SMTP server.
### --email-force-tls
| | |
|-------------|-------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_EMAIL_FORCE_TLS</code> |
| YAML | <code>email.forceTLS</code> |
| Default | <code>false</code> |
Force a TLS connection to the configured SMTP smarthost.
### --email-auth-identity
| | |
|-------------|-----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_AUTH_IDENTITY</code> |
| YAML | <code>email.emailAuth.identity</code> |
Identity to use with PLAIN authentication.
### --email-auth-username
| | |
|-------------|-----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_AUTH_USERNAME</code> |
| YAML | <code>email.emailAuth.username</code> |
Username to use with PLAIN/LOGIN authentication.
### --email-auth-password
| | |
|-------------|-----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_AUTH_PASSWORD</code> |
Password to use with PLAIN/LOGIN authentication.
### --email-auth-password-file
| | |
|-------------|----------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_AUTH_PASSWORD_FILE</code> |
| YAML | <code>email.emailAuth.passwordFile</code> |
File from which to load password for use with PLAIN/LOGIN authentication.
### --email-tls-starttls
| | |
|-------------|----------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_EMAIL_TLS_STARTTLS</code> |
| YAML | <code>email.emailTLS.startTLS</code> |
Enable STARTTLS to upgrade insecure SMTP connections using TLS.
### --email-tls-server-name
| | |
|-------------|------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_TLS_SERVERNAME</code> |
| YAML | <code>email.emailTLS.serverName</code> |
Server name to verify against the target certificate.
### --email-tls-skip-verify
| | |
|-------------|------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_EMAIL_TLS_SKIPVERIFY</code> |
| YAML | <code>email.emailTLS.insecureSkipVerify</code> |
Skip verification of the target server's certificate (insecure).
### --email-tls-ca-cert-file
| | |
|-------------|------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_TLS_CACERTFILE</code> |
| YAML | <code>email.emailTLS.caCertFile</code> |
CA certificate file to use.
### --email-tls-cert-file
| | |
|-------------|----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_TLS_CERTFILE</code> |
| YAML | <code>email.emailTLS.certFile</code> |
Certificate file to use.
### --email-tls-cert-key-file
| | |
|-------------|-------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_EMAIL_TLS_CERTKEYFILE</code> |
| YAML | <code>email.emailTLS.certKeyFile</code> |
Certificate key file to use.
### --notifications-method
| | |
|-------------|------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_METHOD</code> |
| YAML | <code>notifications.method</code> |
| Default | <code>smtp</code> |
Which delivery method to use (available options: 'smtp', 'webhook').
### --notifications-dispatch-timeout
| | |
|-------------|----------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_NOTIFICATIONS_DISPATCH_TIMEOUT</code> |
| YAML | <code>notifications.dispatchTimeout</code> |
| Default | <code>1m0s</code> |
How long to wait while a notification is being sent before giving up.
### --notifications-email-from
| | |
|-------------|----------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_FROM</code> |
| YAML | <code>notifications.email.from</code> |
The sender's address to use.
### --notifications-email-smarthost
| | |
|-------------|---------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_SMARTHOST</code> |
| YAML | <code>notifications.email.smarthost</code> |
The intermediary SMTP host through which emails are sent.
### --notifications-email-hello
| | |
|-------------|-----------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_HELLO</code> |
| YAML | <code>notifications.email.hello</code> |
The hostname identifying the SMTP server.
### --notifications-email-force-tls
| | |
|-------------|---------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_FORCE_TLS</code> |
| YAML | <code>notifications.email.forceTLS</code> |
Force a TLS connection to the configured SMTP smarthost.
### --notifications-email-auth-identity
| | |
|-------------|-------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_AUTH_IDENTITY</code> |
| YAML | <code>notifications.email.emailAuth.identity</code> |
Identity to use with PLAIN authentication.
### --notifications-email-auth-username
| | |
|-------------|-------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_AUTH_USERNAME</code> |
| YAML | <code>notifications.email.emailAuth.username</code> |
Username to use with PLAIN/LOGIN authentication.
### --notifications-email-auth-password
| | |
|-------------|-------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_AUTH_PASSWORD</code> |
Password to use with PLAIN/LOGIN authentication.
### --notifications-email-auth-password-file
| | |
|-------------|------------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_AUTH_PASSWORD_FILE</code> |
| YAML | <code>notifications.email.emailAuth.passwordFile</code> |
File from which to load password for use with PLAIN/LOGIN authentication.
### --notifications-email-tls-starttls
| | |
|-------------|------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_TLS_STARTTLS</code> |
| YAML | <code>notifications.email.emailTLS.startTLS</code> |
Enable STARTTLS to upgrade insecure SMTP connections using TLS.
### --notifications-email-tls-server-name
| | |
|-------------|--------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_TLS_SERVERNAME</code> |
| YAML | <code>notifications.email.emailTLS.serverName</code> |
Server name to verify against the target certificate.
### --notifications-email-tls-skip-verify
| | |
|-------------|--------------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_TLS_SKIPVERIFY</code> |
| YAML | <code>notifications.email.emailTLS.insecureSkipVerify</code> |
Skip verification of the target server's certificate (insecure).
### --notifications-email-tls-ca-cert-file
| | |
|-------------|--------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_TLS_CACERTFILE</code> |
| YAML | <code>notifications.email.emailTLS.caCertFile</code> |
CA certificate file to use.
### --notifications-email-tls-cert-file
| | |
|-------------|------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_TLS_CERTFILE</code> |
| YAML | <code>notifications.email.emailTLS.certFile</code> |
Certificate file to use.
### --notifications-email-tls-cert-key-file
| | |
|-------------|---------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_NOTIFICATIONS_EMAIL_TLS_CERTKEYFILE</code> |
| YAML | <code>notifications.email.emailTLS.certKeyFile</code> |
Certificate key file to use.
### --notifications-webhook-endpoint
| | |
|-------------|----------------------------------------------------|
| Type | <code>url</code> |
| Environment | <code>$CODER_NOTIFICATIONS_WEBHOOK_ENDPOINT</code> |
| YAML | <code>notifications.webhook.endpoint</code> |
The endpoint to which to send webhooks.
### --notifications-inbox-enabled
| | |
|-------------|-------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_NOTIFICATIONS_INBOX_ENABLED</code> |
| YAML | <code>notifications.inbox.enabled</code> |
| Default | <code>true</code> |
Enable Coder Inbox.
### --notifications-max-send-attempts
| | |
|-------------|-----------------------------------------------------|
| Type | <code>int</code> |
| Environment | <code>$CODER_NOTIFICATIONS_MAX_SEND_ATTEMPTS</code> |
| YAML | <code>notifications.maxSendAttempts</code> |
| Default | <code>5</code> |
The upper limit of attempts to send a notification.
### --workspace-prebuilds-reconciliation-interval
| | |
|-------------|-----------------------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL</code> |
| YAML | <code>workspace_prebuilds.reconciliation_interval</code> |
| Default | <code>1m0s</code> |
How often to reconcile workspace prebuilds state.
### --hide-ai-tasks
| | |
|-------------|-----------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_HIDE_AI_TASKS</code> |
| YAML | <code>client.hideAITasks</code> |
| Default | <code>false</code> |
Hide AI tasks from the dashboard.
### --chat-debug-logging-enabled
| | |
|-------------|------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_CHAT_DEBUG_LOGGING_ENABLED</code> |
| YAML | <code>chat.debugLoggingEnabled</code> |
| Default | <code>false</code> |
Force chat debug logging on for every chat, bypassing the runtime admin and user opt-in settings.
### --ai-gateway-enabled
| | |
|-------------|----------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_AI_GATEWAY_ENABLED</code> |
| YAML | <code>ai_gateway.enabled</code> |
| Default | <code>true</code> |
Whether to start an in-memory AI Gateway instance.
### --ai-gateway-openai-base-url
| | |
|-------------|------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_OPENAI_BASE_URL</code> |
| YAML | <code>ai_gateway.openai_base_url</code> |
| Default | <code>https://api.openai.com/v1/</code> |
Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The base URL of the OpenAI API.
### --ai-gateway-openai-key
| | |
|-------------|-------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_OPENAI_KEY</code> |
Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The key to authenticate against the OpenAI API.
### --ai-gateway-anthropic-base-url
| | |
|-------------|---------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_ANTHROPIC_BASE_URL</code> |
| YAML | <code>ai_gateway.anthropic_base_url</code> |
| Default | <code>https://api.anthropic.com/</code> |
Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The base URL of the Anthropic API.
### --ai-gateway-anthropic-key
| | |
|-------------|----------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_ANTHROPIC_KEY</code> |
Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The key to authenticate against the Anthropic API.
### --ai-gateway-bedrock-base-url
| | |
|-------------|-------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_BEDROCK_BASE_URL</code> |
| YAML | <code>ai_gateway.bedrock_base_url</code> |
Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The base URL to use for the AWS Bedrock API. Use this setting to specify an exact URL to use. Takes precedence over CODER_AI_GATEWAY_BEDROCK_REGION.
### --ai-gateway-bedrock-region
| | |
|-------------|-----------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_BEDROCK_REGION</code> |
| YAML | <code>ai_gateway.bedrock_region</code> |
Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The AWS Bedrock API region to use. Constructs a base URL to use for the AWS Bedrock API in the form of `https://bedrock-runtime.<region>.amazonaws.com`.
### --ai-gateway-bedrock-access-key
| | |
|-------------|---------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_BEDROCK_ACCESS_KEY</code> |
Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The access key to authenticate against the AWS Bedrock API.
### --ai-gateway-bedrock-access-key-secret
| | |
|-------------|----------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_BEDROCK_ACCESS_KEY_SECRET</code> |
Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The access key secret to use with the access key to authenticate against the AWS Bedrock API.
### --ai-gateway-bedrock-model
| | |
|-------------|---------------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_BEDROCK_MODEL</code> |
| YAML | <code>ai_gateway.bedrock_model</code> |
| Default | <code>global.anthropic.claude-sonnet-4-5-20250929-v1:0</code> |
Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The model to use when making requests to the AWS Bedrock API.
### --ai-gateway-bedrock-small-fastmodel
| | |
|-------------|--------------------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_BEDROCK_SMALL_FAST_MODEL</code> |
| YAML | <code>ai_gateway.bedrock_small_fast_model</code> |
| Default | <code>global.anthropic.claude-haiku-4-5-20251001-v1:0</code> |
Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The small fast model to use when making requests to the AWS Bedrock API. Claude Code uses Haiku-class models to perform background tasks. See https://docs.claude.com/en/docs/claude-code/settings#environment-variables.
### --ai-gateway-retention
| | |
|-------------|------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_AI_GATEWAY_RETENTION</code> |
| YAML | <code>ai_gateway.retention</code> |
| Default | <code>60d</code> |
Length of time to retain data such as interceptions and all related records (token, prompt, tool use).
### --ai-gateway-max-concurrency
| | |
|-------------|------------------------------------------------|
| Type | <code>int</code> |
| Environment | <code>$CODER_AI_GATEWAY_MAX_CONCURRENCY</code> |
| YAML | <code>ai_gateway.max_concurrency</code> |
| Default | <code>0</code> |
Maximum number of concurrent AI Gateway requests per replica. Set to 0 to disable (unlimited).
### --ai-gateway-rate-limit
| | |
|-------------|-------------------------------------------|
| Type | <code>int</code> |
| Environment | <code>$CODER_AI_GATEWAY_RATE_LIMIT</code> |
| YAML | <code>ai_gateway.rate_limit</code> |
| Default | <code>0</code> |
Maximum number of AI Gateway requests per second per replica. Set to 0 to disable (unlimited).
### --ai-gateway-structured-logging
| | |
|-------------|---------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_AI_GATEWAY_STRUCTURED_LOGGING</code> |
| YAML | <code>ai_gateway.structured_logging</code> |
| Default | <code>false</code> |
Emit structured logs for AI Gateway interception records. Use this for exporting these records to external SIEM or observability systems.
### --ai-gateway-send-actor-headers
| | |
|-------------|---------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_AI_GATEWAY_SEND_ACTOR_HEADERS</code> |
| YAML | <code>ai_gateway.send_actor_headers</code> |
| Default | <code>false</code> |
Once enabled, extra headers will be added to upstream requests to identify the user (actor) making requests to AI Gateway. This is only needed if you are using a proxy between AI Gateway and an upstream AI provider. This will send X-Ai-Bridge-Actor-Id (the ID of the user making the request) and X-Ai-Bridge-Actor-Metadata-Username (their username).
### --ai-gateway-dump-dir
| | |
|-------------|-----------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_DUMP_DIR</code> |
| YAML | <code>ai_gateway.api_dump_dir</code> |
Base directory for dumping AI Gateway request/response pairs to disk for debugging. When set, each provider writes under a subdirectory named after the provider. Sensitive headers are redacted. Leave empty to disable.
### --ai-gateway-allow-byok
| | |
|-------------|-------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_AI_GATEWAY_ALLOW_BYOK</code> |
| YAML | <code>ai_gateway.allow_byok</code> |
| Default | <code>true</code> |
Allow users to provide their own LLM API keys or subscriptions. When disabled, only centralized key authentication is permitted.
### --ai-gateway-circuit-breaker-enabled
| | |
|-------------|--------------------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_AI_GATEWAY_CIRCUIT_BREAKER_ENABLED</code> |
| YAML | <code>ai_gateway.circuit_breaker_enabled</code> |
| Default | <code>false</code> |
Enable the circuit breaker to protect against cascading failures from upstream AI provider overload (503, 529).
### --ai-budget-policy
| | |
|-------------|---------------------------------------|
| Type | <code>highest</code> |
| Environment | <code>$CODER_AI_BUDGET_POLICY</code> |
| YAML | <code>ai_gateway.budget_policy</code> |
| Default | <code>highest</code> |
Determines the effective group when a user belongs to multiple groups with AI budgets. "highest" selects the group with the largest spend limit, and is currently the only supported value.
### --ai-budget-period
| | |
|-------------|---------------------------------------|
| Type | <code>month</code> |
| Environment | <code>$CODER_AI_BUDGET_PERIOD</code> |
| YAML | <code>ai_gateway.budget_period</code> |
| Default | <code>month</code> |
Determines when accumulated AI spend resets to zero, aligned to UTC calendar boundaries. Only "month" is currently supported.
### --ai-gateway-proxy-enabled
| | |
|-------------|----------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_ENABLED</code> |
| YAML | <code>ai_gateway_proxy.enabled</code> |
| Default | <code>false</code> |
Enable the AI Gateway MITM Proxy for intercepting and decrypting AI provider requests.
### --ai-gateway-proxy-listen-addr
| | |
|-------------|--------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_LISTEN_ADDR</code> |
| YAML | <code>ai_gateway_proxy.listen_addr</code> |
| Default | <code>:8888</code> |
The address the AI Gateway Proxy will listen on.
### --ai-gateway-proxy-target
| | |
|-------------|---------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_TARGET</code> |
| YAML | <code>ai_gateway_proxy.target</code> |
Base URL of the AI Gateway to forward intercepted requests to. Defaults to the embedded AI Gateway address at the Coder access URL plus /api/v2/ai-gateway.
### --ai-gateway-proxy-tls-cert-file
| | |
|-------------|----------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_TLS_CERT_FILE</code> |
| YAML | <code>ai_gateway_proxy.tls_cert_file</code> |
Path to the TLS certificate file for the AI Gateway Proxy listener. Must be set together with AI Gateway Proxy TLS Key File.
### --ai-gateway-proxy-tls-key-file
| | |
|-------------|---------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_TLS_KEY_FILE</code> |
| YAML | <code>ai_gateway_proxy.tls_key_file</code> |
Path to the TLS private key file for the AI Gateway Proxy listener. Must be set together with AI Gateway Proxy TLS Certificate File.
### --ai-gateway-proxy-cert-file
| | |
|-------------|------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_CERT_FILE</code> |
| YAML | <code>ai_gateway_proxy.cert_file</code> |
Path to the CA certificate file used to intercept (MITM) HTTPS traffic from AI clients. This CA must be trusted by AI clients for the proxy to decrypt their requests.
### --ai-gateway-proxy-key-file
| | |
|-------------|-----------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_KEY_FILE</code> |
| YAML | <code>ai_gateway_proxy.key_file</code> |
Path to the CA private key file used to intercept (MITM) HTTPS traffic from AI clients.
### --ai-gateway-proxy-upstream
| | |
|-------------|-----------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_UPSTREAM</code> |
| YAML | <code>ai_gateway_proxy.upstream_proxy</code> |
URL of an upstream HTTP proxy to chain tunneled (non-allowlisted) requests through. Format: http://[user:pass@]host:port or https://[user:pass@]host:port.
### --ai-gateway-proxy-upstream-ca
| | |
|-------------|--------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_UPSTREAM_CA</code> |
| YAML | <code>ai_gateway_proxy.upstream_proxy_ca</code> |
Path to a PEM-encoded CA certificate to trust for the upstream proxy's TLS connection. Only needed for HTTPS upstream proxies with certificates not trusted by the system. If not provided, the system certificate pool is used.
### --ai-gateway-proxy-allowed-private-cidrs
| | |
|-------------|------------------------------------------------------------|
| Type | <code>string-array</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_ALLOWED_PRIVATE_CIDRS</code> |
| YAML | <code>ai_gateway_proxy.allowed_private_cidrs</code> |
Comma-separated list of CIDR ranges that are permitted even though they fall within blocked private/reserved IP ranges. By default all private ranges are blocked to prevent SSRF attacks. Use this to allow access to specific internal networks.
### --ai-gateway-proxy-dump-dir
| | |
|-------------|-----------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_AI_GATEWAY_PROXY_DUMP_DIR</code> |
| YAML | <code>ai_gateway_proxy.api_dump_dir</code> |
Directory for dumping MITM request/response pairs to disk for debugging. When set, each proxied request produces .req.txt and .resp.txt files organized by provider. Sensitive headers are redacted. Leave empty to disable.
### --audit-logs-retention
| | |
|-------------|------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_AUDIT_LOGS_RETENTION</code> |
| YAML | <code>retention.audit_logs</code> |
| Default | <code>0</code> |
How long audit log entries are retained. Set to 0 to disable (keep indefinitely). We advise keeping audit logs for at least a year, and in accordance with your compliance requirements.
### --connection-logs-retention
| | |
|-------------|-----------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_CONNECTION_LOGS_RETENTION</code> |
| YAML | <code>retention.connection_logs</code> |
| Default | <code>0</code> |
How long connection log entries are retained. Set to 0 to disable (keep indefinitely).
### --api-keys-retention
| | |
|-------------|----------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_API_KEYS_RETENTION</code> |
| YAML | <code>retention.api_keys</code> |
| Default | <code>7d</code> |
How long expired API keys are retained before being deleted. Keeping expired keys allows the backend to return a more helpful error when a user tries to use an expired key. Set to 0 to disable automatic deletion of expired keys.
### --workspace-agent-logs-retention
| | |
|-------------|----------------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_WORKSPACE_AGENT_LOGS_RETENTION</code> |
| YAML | <code>retention.workspace_agent_logs</code> |
| Default | <code>7d</code> |
How long workspace agent logs are retained. Logs from non-latest builds are deleted if the agent hasn't connected within this period. Logs from the latest build are always retained. Set to 0 to disable automatic deletion.
### --boundary-log-retention
| | |
|-------------|--------------------------------------------|
| Type | <code>duration</code> |
| Environment | <code>$CODER_BOUNDARY_LOG_RETENTION</code> |
| YAML | <code>retention.boundary_logs</code> |
| Default | <code>0</code> |
How long boundary audit log entries are retained. Boundary logs record HTTP requests processed by a Boundary confinement proxy. Set to 0 to disable automatic deletion (keep indefinitely). Adjust to match your organization's regulatory requirements.
### --disable-template-builder
| | |
|-------------|----------------------------------------------|
| Type | <code>bool</code> |
| Environment | <code>$CODER_DISABLE_TEMPLATE_BUILDER</code> |
| YAML | <code>templateBuilder.disabled</code> |
Disable the template builder feature for guided template creation. When disabled, all /api/v2/templatebuilder/* endpoints return 404.
### --template-builder-registry-url
| | |
|-------------|---------------------------------------------------|
| Type | <code>string</code> |
| Environment | <code>$CODER_TEMPLATE_BUILDER_REGISTRY_URL</code> |
| YAML | <code>templateBuilder.registryURL</code> |
| Default | <code>registry.coder.com</code> |
The base URL of the module registry used by the template builder for module source paths.
Reference in New Issue View Git Blame Copy Permalink