Coder

does ``coder templates init`` still work with rich parameters ?

image

how do I debug these errors ?
is there a way to get the stack trace ?

I will suggest using terraform validate locally before pushing the template to coder. It will highlight the line numbers and exact errors.

means I need to install terraform CLI though

it's now updated to match the latest coder version, but be aware that the image build time is quite high

edit: it's kind of broken on some stiff, will fix in a bit

I'm assuming you reverted because I can't see any new commits . Just ping me anytime you're done, no rush 👍

https://github.com/uwu/basic-env

this is the repo, right?

yeah, i didn't push because my yubikey wasn't in

Well your resources worked, I'm running Microsoft's VSCode now and settings sync works 🥳

Weird about the path based URLs but no matter

Is there a reason why EXTENSIONS_GALLERY is built into the image instead of using "coder_agent" env?

Also I'm not sure if it's applying correctly in my container

i wanted to make the image standalone if someone wants to import it in some other tool

also EXTENSIONS_GALLERY is for coder/code-server to use microsoft's extension store

yes, I think Microsoft's VSCode doesn't support subpaths because it assumes it will be served on /

Ah, got it. then EXTENSIONS_GALLERY should be unnecessary for microsofts vscode

I think it might work too, but in this case it's really unnecessary because it overwrites the extension gallery to the same one

Any idea why this might be failing?

```
resource "docker_image" "base_image" {
  count = var.docker_image == "base" ? 0 : 1
  name  = "coder-base"
  build {
    context    = "./images/"
    dockerfile = "base.Dockerfile"
    tag        = ["coder-base:latest"]
  }
  triggers = {
    dir_sha1 = sha1(join("", [for f in fileset(path.module, "images/*") : filesha1(f)]))
  }
  keep_locally = true
}

resource "coder_metadata" "base_image_info" {
  resource_id = docker_image.base_image[0].id
  hide        = true
}
```

```  Error: Invalid index
  The given key does not identify an element in this collection value.```

Works after commenting `coder_metadata` block

<@1050410533469290517> btw i pushed uwu/basic-env

Ah I see I need to implement rich parameters yet

Found some bugs with rich parameters I think, I'll post them later in github probably

But everything else works great, thanks 🙂

```data "coder_parameter" "dotfiles_uri" {
  default     = ""
  name        = "Dotfiles"
  description = "Dotfiles repo URI (optional - reference https://dotfiles.github.io)"
  type        = "string"
  mutable     = true
}
```

This one in UI shows "required" when empty. It should ignore it

Also I've added `description` for options but they're not showing

```
data "coder_parameter" "docker_image" {
  default     = "base"
  name        = "Workspace image"
  description = "What Docker image would you like to use for your workspace?"
  type        = "string"
  icon        = "${data.coder_workspace.me.access_url}/icon/docker.png"
  mutable     = true

  option {
    name        = "Base"
    value       = "base"
    description = "Ubuntu image with Git and Docker tooling"
  }
  option {
    name        = "Laravel"
    value       = "laravel"
    description = "Laravel image with PHP, Node.js, Yarn, Composer"
  }
}
```

This is based on the Terraform provider
https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter#nested-schema-for-option

I moved to 18 but I think it might just be a 1 version thing

Yeah, that's a bug on our side. Toss open an issue, we'll fix it!

todo issues (so i can remember):
- terraform verbose
- invalid regex

- ui stuff in <#991429648200245358>

if you can tell me what to create issues for in <#991429648200245358>, i'll do those too when i get the time

Where do I find the log for the `startup_script` again? I know I looked at it in the past, but can't find it right now.

We'll be making this visible in the UI very, very soon!

```
cat /tmp/coder-startup-script.log
```

should do the trick

Yeah, I just couldn't remember the log location ^^

It's fine, I customize the images myself 😄 thanks

Is there somewhere documentation about separating provisiond instances and using the provisioner-tag flag?

Sadly not yet - I'll be working on that soon, though.

You can follow along here: https://github.com/coder/coder/issues/5853

I added some basic instructions in the GitHub issues there

This is documented now, by the way 🙂 https://coder.com/docs/v2/latest/admin/provisioners

Thank you! One thing for the future, that is missing for me is to assign certain tags to a specific group. Because if I give access to templates to a group, I also want to controll, what credentials they've access to.

I see, that totally makes sense. https://github.com/coder/coder/issues/6646

Do you expect some of your users/groups to be creating templates through Coder? Or is the plan to let them manage it via CI/CD and make pull requests to create/modify templates?

I would use a mix actually: have everything managed via CI/CD but with team-based maintainers (we have already too much dependencies on us few infra people 😉 )

I see. What level of control would like to give the team-based maintainers in Coder?

For example
- Write access to specific templates
- Access to specific provisioners
- Ability to create templates, and add their team

Ideally they would be able to create new templates - but for the time being this could be handled by the actual owner. I think the most important bit is, to pin them to certain provisioners with a defined set of secrets to deploy.

I see, so some type of role to set the provisioners for each template that the managers cannot edit would work?

I haven't completely mapped this out yet - but I thought of creating some (flux-like) gitops infrastructure which applies all the metadata bits. Like you have a repository with manifests for templates which tell where the source (repo) of the template lives, what groups it should be accessible to and which provisioners are allowed to use. The to-be-created service would then poll this manifest collection and create missing templates and set the permissions/provisioner tags accordingly. The update of templates can then be in the hands of the template maintainers. 

This way we always have an overview of the current state and a commit-trail of changes. Interactions with the infra team could then be reduced to a merge request per NEW template. But thats just some of the many ideas that I have in my head for now. I've to see if I find the time to build this.

I'm not sure how pinning to a group exactly would work in our current groups system

Ideally we help with some of this too so that it's not on your team to build this entire path

I think what would work is to no allow template admins to change provisioner tags

as always, too many conflicting ideas in my head and too little time 😉

Haha I can relate. I'm going to write up some thoughts on how we can improve template authorship while maintaining provisioner isolation and not giving admins too much power (e.g. stealing credentials from other users). 

I'll be sure to share it with you before we land on anything concrete.

Is there somewhere documentation about

I want to move my team to use coder on AWS in some form (6-10 people that need 6vCPU + 16GB RAM minimum).

I would have thought the default way of doing this would be an EKS cluster, but it seems it's actually EC2 instances? How much control does coder give me over how the EC2 VM"s are built?

Entire control!

You write the entire spec, and can use `aws-instance-identity` as the auth type for zero-trust agent authentication.

Okay cool. So EC2 is definitely the way to go for AWS

I'm torn between doing that and setting up this; https://symbiosis.host/

Either way I think coder is great for our team so good job :))

I've never used Symbiosis so I don't have a strong POV. I can tell you from our telemetry that a lot of folks use EC2 instances with Coder, so you should be good to go.

If you run into any issues, of course just give us a shout!

This is a really minor problem, but does anyone else have their coder-server open in a new windows rather than in a new tab?

Could you open an issue to make this a user preference? We've gotten so many reports of this that we should just do it.

Yeah, we've probably seen this like ~10 times now. Enough to make it an option in the user settings.

https://github.com/coder/coder/issues/6408

making it a preference is fine. I prefer new windows.

I have set up the OpenID Connect for signing in to Coder and anybody with an account from my domain can log in. I wanted to know if there's a way to restrict that access inside Coder?

Restrict the domain or specific accounts?

I guess Coder can't control the domain...so restrict the accounts that can log in

it could theoretically check for the email domain

yeah we want only a group of user to be able to login. So as in other products there must be a way to control this. Usualy a group in claim. E.g.  group CODER_USER. Anyone which is not in this group wont be able to use coder. A permission denied or something else should be shown

https://github.com/coder/coder/issues/6413

will you be specifying all allowed users emails in `CODER_USER`?

No. In our company all permission are assigned via groups in Azure AD. This is a must have

i understand but how to tell coder to allow access to only that group

coder groups are currently for controlling permissions for the templates

somehow coder needs to know which users can login and then all coder groups will be the subset of that allowed group

if the issue <@992342069001605140> linked gets a feature, then you will be able to restrict which users can login because of the OIDC group claims

in this case, the groups in coder are managed by OIDC, and coder gets sent the user's groups on login

so basically,
```js
if(<openid response>.groups.has("some_group")) {
   //allow
}
```

Is there other software that you use that has this feature (restrict signups in Coder by identify provider group/role claim)?

I was reading through GitLab's docs and didn't find anything. I typically see this managed via the identify provider, but I could totally be missing something.

We currently have this flag https://coder.com/docs/v2/latest/cli/coder_server#--oidc-allow-signups which simply restricts any new user from being created, but I don't think that would work since you can only create user/pass users from the UI.

<@363022107753578496> thanks for your hint. No I found how we can restrict access to an assigned group in Azure Enterprise Apps. Sorry for the noise

Can I force coder to spin up a workspace on a certain k8s node?

Maybe I'm misunderstanding k8s, but my reason for doing this is wanting to use a host mount, so it'll have to be the "node" that I'm interested in.

You can taint a specific Kubernetes node so pods target it.
https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/

<@206225075026788353>  Taints cause pods to avoid nodes. Node affinity is what Sharp needs. 🙂 Says it in the description above too. 😄

<@149286699187437568>  - What do you need to mount? Because, needing to mount something on a particular node sort of breaks what k8s is all about.

But I just want non-k8s storage that I don't need to worry about

Unless I really am misunderstanding k8s and I can have a shared volume on all k8s nodes?

Yes, you can "add" a third party app like minio to create an S3 like experience, or just use persistent volumes and persistent volume claims. k3s, if you set it up, will take the storage and give it to k8s for its local-path storage class.  
https://kubernetes.io/docs/concepts/storage/storage-classes/
https://min.io/
I'm actually using Longhorn, which comes with Rancher, which I use as a monitoring tool. 
https://www.rancher.com/
https://longhorn.io/

Did the ability to determine what folder the editor opens in get into Coder?

Any best practices for creating and mounting an NFS storage to workspaces? Workspaces are being deployed to multiple docker hosts that users can choose when creating the workspace. 
Basically, I want a shared local directory to be mounted to the workspace irrespective of the docker host provisioning that workspace.

My advise would be: so never use NFS  - but that is mainly because NFS caused so much instability and pain in my last 15 years of experience 😉

In general you have two options: mount the NFS as docker volume or mount a host directory on the NFS