mirror of
https://github.com/coder/coder.git
synced 2026-10-16 14:48:56 +08:00
## Summary Threads the deployment's configured module registry (`CODER_TEMPLATE_BUILDER_REGISTRY_URL`) into template-builder **base** rendering, so a base that embeds a catalog module (e.g. the quickstart base's `git-clone`) resolves its `source` through a registry mirror the same way wizard-composed modules already do. Previously base-embedded module sources hardcoded `registry.coder.com`, so on a mirror/private-registry deployment a base-embedded module reached the public registry while wizard modules used the mirror. Implements [DOCS-610](https://linear.app/codercom/issue/DOCS-610). ## What changed * `BaseRenderContext.RegistryBase` (new field), mirroring `ModuleRenderContext.RegistryBase`. `Compose` threads the deployment registry through `renderBase` into the base render context, and the four hardcoded base module sources (`quickstart` git-clone, `azure-linux`/`gcp-linux`/`gcp-windows` region modules) now use `{{ .RegistryBase }}`. Because the value defaults back to `registry.coder.com`, rendered sources stay byte-identical; the only golden change is the removal of the now-stale quickstart "follow-up" note. * **Boot-time validation.** `codersdk.ValidateTemplateBuilderRegistryURL` runs in `DeploymentValues.Validate()`, gated on the builder being enabled, matching the chat-hook precedent. A malformed value fails at server start naming the option, instead of surfacing as a per-request error to a template author who cannot fix it. It uses `net/url` in authority form to reject a scheme, path, query, fragment, trailing slash, or credentials and accept a bare `host[:port]`; it does not canonicalize the host. * `Compose` **trusts the validated value**, defaulting an unset one and defensively rejecting a malformed one for direct callers that bypass boot. ## Tests * `codersdk`: validator accept/reject matrix (incl. credentials-without-echo) and a `DeploymentValues.Validate` boundary test with a disabled-skips-validation case. * `templatebuilder`: a base honors the mirror and falls back to the default when unset, plus a defensive-reject case; existing compose tests updated to bare-host registry values. <details><summary>Design decision log</summary> This PR is a deliberately minimal reimplementation of the [DOCS-610](https://linear.app/codercom/issue/DOCS-610/template-builder-base-embedded-modules-should-honor-the-deployment) scope, started fresh from `main` rather than carrying forward an earlier, larger draft (coder/coder#28480). Key decisions: * **Scope kept to the ticket.** The ticket's fix is three bullets: add a registry field to `BaseRenderContext`, thread the deployment `RegistryURL` through `Compose` -> `renderBase`, and use it in base module sources. Independent hardening explored in the earlier draft was dropped as out of scope: `terraform-svchost`-based IDN/punycode/port canonicalization, a rendered-HCL backstop with a 500 mapping, and HCL module-source extraction helpers. Telemetry misclassification of mirror modules is tracked separately ([DOCS-712](https://linear.app/codercom/issue/DOCS-712/telemetry-misclassifies-registry-mirror-modules-as-non-coder)) and is not addressed here. * **Default lives in the render layer.** `templatebuilder.DefaultRegistryBase` holds the fallback host; `codersdk` keeps its own option-default literal. An earlier version exported the constant from `codersdk`, which only emitted a dead `typesGenerated.ts` entry that nothing in the frontend consumed, so it was moved out. The `codersdk` validator is a function, so it generates no TS type. * **Validate at the config boundary, fail fast.** The repo convention is to hard-fail structurally invalid config in `DeploymentValues.Validate()` (access URL, OAuth lifetimes, chat hook URL) and to warn only for functional-but-risky settings. A malformed registry host is structurally invalid, so it fails at boot. This also puts the error in front of the admin who set it, rather than a template author hitting a per-request error they cannot fix. * `net/url`**, not a regex.** The codebase validates identifiers/names with regexes but host/URL-shaped config with `url.Parse` (chat hook URL, OAuth redirect URIs, AI provider base URL). This value is host-shaped, so it follows that convention. `url.Parse("//" + v)` with `u.Host == v` rejects a scheme/path/query/fragment/trailing-slash in one check. </details> > This PR was created with AI assistance (Coder Agents).
263 lines
6.1 KiB
Plaintext
263 lines
6.1 KiB
Plaintext
terraform {
|
|
required_providers {
|
|
coder = {
|
|
source = "coder/coder"
|
|
}
|
|
docker = {
|
|
source = "kreuzwerker/docker"
|
|
}
|
|
external = {
|
|
source = "hashicorp/external"
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "docker_socket" {
|
|
default = ""
|
|
description = "(Optional) Docker socket URI"
|
|
type = string
|
|
}
|
|
|
|
provider "docker" {
|
|
host = var.docker_socket != "" ? var.docker_socket : null
|
|
}
|
|
|
|
data "coder_provisioner" "me" {}
|
|
data "coder_workspace" "me" {}
|
|
data "coder_workspace_owner" "me" {}
|
|
|
|
# --- Parameters ---
|
|
|
|
data "coder_parameter" "languages" {
|
|
name = "languages"
|
|
display_name = "Programming Languages"
|
|
description = "Select the languages to pre-install in your workspace"
|
|
type = "list(string)"
|
|
form_type = "multi-select"
|
|
default = jsonencode(["python"])
|
|
mutable = true
|
|
icon = "/icon/code.svg"
|
|
order = 1
|
|
|
|
option {
|
|
name = "Python"
|
|
value = "python"
|
|
icon = "/icon/python.svg"
|
|
}
|
|
option {
|
|
name = "Node.js"
|
|
value = "nodejs"
|
|
icon = "/icon/nodejs.svg"
|
|
}
|
|
option {
|
|
name = "Go"
|
|
value = "go"
|
|
icon = "/icon/go.svg"
|
|
}
|
|
option {
|
|
name = "Rust"
|
|
value = "rust"
|
|
icon = "/icon/rust.svg"
|
|
}
|
|
option {
|
|
name = "Java"
|
|
value = "java"
|
|
icon = "/icon/java.svg"
|
|
}
|
|
option {
|
|
name = "C/C++"
|
|
value = "cpp"
|
|
icon = "/icon/cpp.svg"
|
|
}
|
|
}
|
|
|
|
data "coder_parameter" "git_repo" {
|
|
name = "git_repo"
|
|
display_name = "Git Repository (Optional)"
|
|
description = "URL of a Git repository to clone into your workspace (leave empty to skip)"
|
|
type = "string"
|
|
default = ""
|
|
mutable = true
|
|
icon = "/icon/git.svg"
|
|
order = 2
|
|
}
|
|
|
|
# --- Locals ---
|
|
|
|
locals {
|
|
username = data.coder_workspace_owner.me.name
|
|
languages = jsondecode(data.coder_parameter.languages.value)
|
|
}
|
|
|
|
# --- Agent ---
|
|
|
|
resource "coder_agent" "main" {
|
|
arch = data.coder_provisioner.me.arch
|
|
os = "linux"
|
|
startup_script = <<-EOT
|
|
set -e
|
|
if [ ! -f ~/.init_done ]; then
|
|
cp -rT /etc/skel ~
|
|
touch ~/.init_done
|
|
fi
|
|
EOT
|
|
|
|
env = {
|
|
GIT_AUTHOR_NAME = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
|
|
GIT_AUTHOR_EMAIL = "${data.coder_workspace_owner.me.email}"
|
|
GIT_COMMITTER_NAME = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
|
|
GIT_COMMITTER_EMAIL = "${data.coder_workspace_owner.me.email}"
|
|
}
|
|
|
|
metadata {
|
|
display_name = "CPU Usage"
|
|
key = "0_cpu_usage"
|
|
script = "coder stat cpu"
|
|
interval = 10
|
|
timeout = 1
|
|
}
|
|
|
|
metadata {
|
|
display_name = "RAM Usage"
|
|
key = "1_ram_usage"
|
|
script = "coder stat mem"
|
|
interval = 10
|
|
timeout = 1
|
|
}
|
|
|
|
metadata {
|
|
display_name = "Home Disk"
|
|
key = "3_home_disk"
|
|
script = "coder stat disk --path $${HOME}"
|
|
interval = 60
|
|
timeout = 1
|
|
}
|
|
}
|
|
|
|
# --- Language installation ---
|
|
# All languages install in a single script to avoid apt-get lock
|
|
# conflicts (coder_script resources run in parallel).
|
|
|
|
resource "coder_script" "install_languages" {
|
|
count = length(local.languages) > 0 ? 1 : 0
|
|
agent_id = coder_agent.main.id
|
|
display_name = "Install Languages"
|
|
icon = "/icon/code.svg"
|
|
run_on_start = true
|
|
start_blocks_login = true
|
|
script = templatefile("${path.module}/install-languages.sh.tftpl", {
|
|
LANGUAGES = join(",", local.languages)
|
|
})
|
|
}
|
|
|
|
# --- Git clone ---
|
|
module "git-clone" {
|
|
count = data.coder_workspace.me.start_count * (data.coder_parameter.git_repo.value != "" ? 1 : 0)
|
|
source = "registry.coder.com/coder/git-clone/coder"
|
|
version = "~> 2.0"
|
|
agent_id = coder_agent.main.id
|
|
url = data.coder_parameter.git_repo.value
|
|
}
|
|
|
|
# --- Presets ---
|
|
|
|
data "coder_workspace_preset" "web_dev" {
|
|
name = "Web Development"
|
|
icon = "/icon/nodejs.svg"
|
|
parameters = {
|
|
languages = jsonencode(["python", "nodejs"])
|
|
git_repo = ""
|
|
}
|
|
}
|
|
|
|
data "coder_workspace_preset" "backend_go" {
|
|
name = "Backend (Go)"
|
|
icon = "/icon/go.svg"
|
|
parameters = {
|
|
languages = jsonencode(["go"])
|
|
git_repo = ""
|
|
}
|
|
}
|
|
|
|
data "coder_workspace_preset" "data_science" {
|
|
name = "Data Science"
|
|
icon = "/icon/python.svg"
|
|
parameters = {
|
|
languages = jsonencode(["python"])
|
|
git_repo = ""
|
|
}
|
|
}
|
|
|
|
data "coder_workspace_preset" "full_stack" {
|
|
name = "Full Stack"
|
|
icon = "/icon/code.svg"
|
|
parameters = {
|
|
languages = jsonencode(["python", "nodejs", "go"])
|
|
git_repo = ""
|
|
}
|
|
}
|
|
|
|
# --- Docker resources ---
|
|
|
|
resource "docker_volume" "home_volume" {
|
|
name = "coder-${data.coder_workspace.me.id}-home"
|
|
lifecycle {
|
|
ignore_changes = all
|
|
}
|
|
labels {
|
|
label = "coder.owner"
|
|
value = data.coder_workspace_owner.me.name
|
|
}
|
|
labels {
|
|
label = "coder.owner_id"
|
|
value = data.coder_workspace_owner.me.id
|
|
}
|
|
labels {
|
|
label = "coder.workspace_id"
|
|
value = data.coder_workspace.me.id
|
|
}
|
|
labels {
|
|
label = "coder.workspace_name_at_creation"
|
|
value = data.coder_workspace.me.name
|
|
}
|
|
depends_on = []
|
|
}
|
|
|
|
resource "docker_container" "workspace" {
|
|
count = data.coder_workspace.me.start_count
|
|
image = "codercom/enterprise-base:ubuntu"
|
|
name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
|
|
hostname = data.coder_workspace.me.name
|
|
entrypoint = [
|
|
"sh", "-c",
|
|
replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal"),
|
|
]
|
|
env = ["CODER_AGENT_TOKEN=${coder_agent.main.token}"]
|
|
host {
|
|
host = "host.docker.internal"
|
|
ip = "host-gateway"
|
|
}
|
|
volumes {
|
|
container_path = "/home/coder"
|
|
volume_name = docker_volume.home_volume.name
|
|
read_only = false
|
|
}
|
|
labels {
|
|
label = "coder.owner"
|
|
value = data.coder_workspace_owner.me.name
|
|
}
|
|
labels {
|
|
label = "coder.owner_id"
|
|
value = data.coder_workspace_owner.me.id
|
|
}
|
|
labels {
|
|
label = "coder.workspace_id"
|
|
value = data.coder_workspace.me.id
|
|
}
|
|
labels {
|
|
label = "coder.workspace_name"
|
|
value = data.coder_workspace.me.name
|
|
}
|
|
depends_on = []
|
|
}
|