# Configuration reference

Coder server is configured primarily through environment variables.
This page lists every option so you can search by environment variable name, CLI flag, or YAML key.
For first-time setup guidance and worked examples, see [Configure Control Plane Access](/beta-docs/@main/admin/setup/).

Each option can be set through one or more of the methods below.
An option lists only the methods that apply to it.

* An environment variable (recommended for production deployments running as a system service, container, or Helm chart).
* A CLI flag passed to `coder server` (useful for one-off invocations and local development).
* A key in a YAML configuration file passed with `--config`.

For a full description of each option's accepted values and behavior, follow the flag link into the [`coder server` CLI reference](/beta-docs/@main/reference/cli/server/).

An option that holds a secret is marked as such.
Coder never writes those options to a YAML configuration file.

Deprecated options are listed at the end of each section.

## General [#general]

### Cache directory [#cache-directory]

The directory to cache temporary files.
If unspecified and $CACHE\_DIRECTORY is set, it will be used for compatibility with systemd.
This directory is NOT safe to be configured as a shared directory across coderd/provisionerd replicas.

* Type: `string`
* Environment variable: `CODER_CACHE_DIRECTORY`
* CLI flag: [`--cache-dir`](/beta-docs/@main/reference/cli/server/#--cache-dir)
* YAML key: `cacheDir`
* Default value: `~/.cache/coder`

### Default OAuth refresh lifetime [#default-oauth-refresh-lifetime]

The default lifetime duration for OAuth2 refresh tokens.
This controls how long refresh tokens remain valid after issuance or rotation.

* Type: `duration`
* Environment variable: `CODER_DEFAULT_OAUTH_REFRESH_LIFETIME`
* CLI flag: [`--default-oauth-refresh-lifetime`](/beta-docs/@main/reference/cli/server/#--default-oauth-refresh-lifetime)
* YAML key: `defaultOAuthRefreshLifetime`
* Default value: `720h0m0s`

### Default token lifetime [#default-token-lifetime]

The default lifetime duration for API tokens.
This value is used when creating a token without specifying a duration, such as when authenticating the CLI or an IDE plugin.

* Type: `duration`
* Environment variable: `CODER_DEFAULT_TOKEN_LIFETIME`
* CLI flag: [`--default-token-lifetime`](/beta-docs/@main/reference/cli/server/#--default-token-lifetime)
* YAML key: `defaultTokenLifetime`
* Default value: `168h0m0s`

### Disable chat caller-supplied tools [#disable-chat-caller-supplied-tools]

Disable caller-supplied tools in chats.
Chat requests that include unsafe\_dynamic\_tools or inline\_mcp\_servers are rejected, and existing chats run without their dynamic tools and inline MCP servers.

* Type: `bool`
* Environment variable: `CODER_DISABLE_CHAT_CALLER_SUPPLIED_TOOLS`
* CLI flag: [`--disable-chat-caller-supplied-tools`](/beta-docs/@main/reference/cli/server/#--disable-chat-caller-supplied-tools)
* YAML key: `disableChatCallerSuppliedTools`

### Disable chat sharing [#disable-chat-sharing]

Disable chat and chat project sharing.
Existing shares stop granting access and new shares are rejected.
Owners keep access to their own chats and projects, and administrators keep only the access their roles grant.

* Type: `bool`
* Environment variable: `CODER_DISABLE_CHAT_SHARING`
* CLI flag: [`--disable-chat-sharing`](/beta-docs/@main/reference/cli/server/#--disable-chat-sharing)
* YAML key: `disableChatSharing`

### Disable owner workspace access [#disable-owner-workspace-access]

Remove the permission for the 'owner' role to have workspace execution on all workspaces.
This prevents the 'owner' from ssh, apps, and terminal access based on the 'owner' role.
They still have their user permissions to access their own workspaces.

* Type: `bool`
* Environment variable: `CODER_DISABLE_OWNER_WORKSPACE_ACCESS`
* CLI flag: [`--disable-owner-workspace-access`](/beta-docs/@main/reference/cli/server/#--disable-owner-workspace-access)
* YAML key: `disableOwnerWorkspaceAccess`

### Disable path apps [#disable-path-apps]

Disable workspace apps that are not served from subdomains.
Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript.
This is recommended for security purposes if a --wildcard-access-url is configured.

* Type: `bool`
* Environment variable: `CODER_DISABLE_PATH_APPS`
* CLI flag: [`--disable-path-apps`](/beta-docs/@main/reference/cli/server/#--disable-path-apps)
* YAML key: `disablePathApps`

### Disable user secret file path [#disable-user-secret-file-path]

Disable Coder-managed file path delivery for user secrets.
Stored paths remain until users clear them and resume if this setting is turned off.

* Type: `bool`
* Environment variable: `CODER_DISABLE_USER_SECRET_FILE_PATH`
* CLI flag: [`--disable-user-secret-file-path`](/beta-docs/@main/reference/cli/server/#--disable-user-secret-file-path)
* YAML key: `disableUserSecretFilePath`

### Disable workspace agent context sync [#disable-workspace-agent-context-sync]

Stop persisting workspace agent context snapshots (instructions, skills, and MCP state used for pinned chat context).
When set, coderd rejects agent context pushes as unimplemented and agents stop sending them; chats cannot pin workspace context.
Use this to shed the database write load of context sync on large deployments.

* Type: `bool`
* Environment variable: `CODER_DISABLE_WORKSPACE_AGENT_CONTEXT_SYNC`
* CLI flag: [`--disable-workspace-agent-context-sync`](/beta-docs/@main/reference/cli/server/#--disable-workspace-agent-context-sync)
* YAML key: `disableWorkspaceAgentContextSync`

### Disable workspace sharing [#disable-workspace-sharing]

Disable workspace sharing.
Workspace ACL checking is disabled and only owners can have ssh, apps and terminal access to workspaces.
Access based on the 'owner' role is also allowed unless disabled via --disable-owner-workspace-access.

* Type: `bool`
* Environment variable: `CODER_DISABLE_WORKSPACE_SHARING`
* CLI flag: [`--disable-workspace-sharing`](/beta-docs/@main/reference/cli/server/#--disable-workspace-sharing)
* YAML key: `disableWorkspaceSharing`

### Enable swagger endpoint [#enable-swagger-endpoint]

Expose the swagger endpoint via /swagger.

* Type: `bool`
* Environment variable: `CODER_SWAGGER_ENABLE`
* CLI flag: [`--swagger-enable`](/beta-docs/@main/reference/cli/server/#--swagger-enable)
* YAML key: `enableSwagger`

### Experiments [#experiments]

Enable one or more experiments.
These are not ready for production.
Separate multiple experiments with commas, or enter '\*' to opt-in to all available experiments.

* Type: `string-array`
* Environment variable: `CODER_EXPERIMENTS`
* CLI flag: [`--experiments`](/beta-docs/@main/reference/cli/server/#--experiments)
* YAML key: `experiments`

### External auth GitHub default provider enable [#external-auth-github-default-provider-enable]

Enable the default GitHub external auth provider managed by Coder.

* Type: `bool`
* Environment variable: `CODER_EXTERNAL_AUTH_GITHUB_DEFAULT_PROVIDER_ENABLE`
* CLI flag: [`--external-auth-github-default-provider-enable`](/beta-docs/@main/reference/cli/server/#--external-auth-github-default-provider-enable)
* YAML key: `externalAuthGithubDefaultProviderEnable`
* Default value: `true`

### External token encryption keys [#external-token-encryption-keys]

Encrypt OIDC and Git authentication tokens with AES-256-GCM in the database.
The value must be a comma-separated list of base64-encoded keys.
Each key, when base64-decoded, must be exactly 32 bytes in length.
The first key will be used to encrypt new values.
Subsequent keys will be used as a fallback when decrypting.
During normal operation it is recommended to only set one key unless you are in the process of rotating keys with the `coder server dbcrypt rotate` command.

* Type: `string-array`
* Environment variable: `CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS`
* CLI flag: [`--external-token-encryption-keys`](/beta-docs/@main/reference/cli/server/#--external-token-encryption-keys)
* Holds a secret: Coder never writes this option to a YAML configuration file.
  Set it through the environment variable above.

### Postgres auth [#postgres-auth]

Type of auth to use when connecting to postgres.
For AWS RDS, using IAM authentication (awsiamrds) is recommended.

* Type: `enum`, one of `password`, `awsiamrds`
* Environment variable: `CODER_PG_AUTH`
* CLI flag: [`--postgres-auth`](/beta-docs/@main/reference/cli/server/#--postgres-auth)
* YAML key: `pgAuth`
* Default value: `password`

### Postgres connection max idle [#postgres-connection-max-idle]

Maximum number of idle connections to the database.
Set to "auto" (the default) to use max open / 3.
Value must be greater or equal to 0; 0 means explicitly no idle connections.

* Type: `string`
* Environment variable: `CODER_PG_CONN_MAX_IDLE`
* CLI flag: [`--postgres-conn-max-idle`](/beta-docs/@main/reference/cli/server/#--postgres-conn-max-idle)
* YAML key: `pgConnMaxIdle`
* Default value: `auto`

### Postgres connection max open [#postgres-connection-max-open]

Maximum number of open connections to the database.
Defaults to 10.

* Type: `int`
* Environment variable: `CODER_PG_CONN_MAX_OPEN`
* CLI flag: [`--postgres-conn-max-open`](/beta-docs/@main/reference/cli/server/#--postgres-conn-max-open)
* YAML key: `pgConnMaxOpen`
* Default value: `10`

### Postgres connection URL [#postgres-connection-url]

URL of a PostgreSQL database.
If empty, PostgreSQL binaries will be downloaded from Maven ([https://repo1.maven.org/maven2](https://repo1.maven.org/maven2)) and store all data in the config root.
Access the built-in database with "coder server postgres-builtin-url".
Note that any special characters in the URL must be URL-encoded.

* Type: `string`
* Environment variable: `CODER_PG_CONNECTION_URL`
* CLI flag: [`--postgres-url`](/beta-docs/@main/reference/cli/server/#--postgres-url)
* Holds a secret: Coder never writes this option to a YAML configuration file.
  Set it through the environment variable above.

### SCIM API key [#scim-api-key]

Enables SCIM and sets the authentication header for the built-in SCIM server.
New users are automatically created with OIDC authentication.

* Type: `string`
* Environment variable: `CODER_SCIM_AUTH_HEADER`
* CLI flag: [`--scim-auth-header`](/beta-docs/@main/reference/cli/server/#--scim-auth-header)
* Holds a secret: Coder never writes this option to a YAML configuration file.
  Set it through the environment variable above.

### SCIM use legacy [#scim-use-legacy]

Use the legacy SCIM implementation instead of the SCIM 2.0 handler.
This is provided for backward compatibility for existing users.

* Type: `bool`
* Environment variable: `CODER_SCIM_USE_LEGACY`
* CLI flag: [`--scim-use-legacy`](/beta-docs/@main/reference/cli/server/#--scim-use-legacy)
* YAML key: `scimUseLegacy`
* Default value: `true`

### SSH keygen algorithm [#ssh-keygen-algorithm]

The algorithm to use for generating ssh keys.
Accepted values are "ed25519", "ecdsa", or "rsa4096".

* Type: `string`
* Environment variable: `CODER_SSH_KEYGEN_ALGORITHM`
* CLI flag: [`--ssh-keygen-algorithm`](/beta-docs/@main/reference/cli/server/#--ssh-keygen-algorithm)
* YAML key: `sshKeygenAlgorithm`
* Default value: `ed25519`

### Support links [#support-links]

Support links to display in the top right drop down menu.

* Type: `YAML sequence`
* Environment variable: `CODER_SUPPORT_LINKS`
* CLI flag: [`--support-links`](/beta-docs/@main/reference/cli/server/#--support-links)
* YAML key: `supportLinks`

### Terms of service URL [#terms-of-service-url]

A URL to an external Terms of Service that must be accepted by users when logging in.

* Type: `string`
* Environment variable: `CODER_TERMS_OF_SERVICE_URL`
* CLI flag: [`--terms-of-service-url`](/beta-docs/@main/reference/cli/server/#--terms-of-service-url)
* YAML key: `termsOfServiceURL`

### Update check [#update-check]

Periodically check for new releases of Coder and inform the owner.
The check is performed once per day.

* Type: `bool`
* Environment variable: `CODER_UPDATE_CHECK`
* CLI flag: [`--update-check`](/beta-docs/@main/reference/cli/server/#--update-check)
* YAML key: `updateCheck`
* Default value: `false`

## AI Gateway [#ai-gateway]

### AI budget period [#ai-budget-period]

Determines when accumulated AI spend resets to zero, aligned to UTC calendar boundaries.
Only "month" is currently supported.

* Type: `enum`, must be `month`
* Environment variable: `CODER_AI_BUDGET_PERIOD`
* CLI flag: [`--ai-budget-period`](/beta-docs/@main/reference/cli/server/#--ai-budget-period)
* YAML key: `ai_gateway.budget_period`
* Default value: `month`

### AI budget policy [#ai-budget-policy]

Determines the effective group when a user belongs to multiple groups with AI budgets. "highest" selects the group with the largest spend limit, and is currently the only supported value.

* Type: `enum`, must be `highest`
* Environment variable: `CODER_AI_BUDGET_POLICY`
* CLI flag: [`--ai-budget-policy`](/beta-docs/@main/reference/cli/server/#--ai-budget-policy)
* YAML key: `ai_gateway.budget_policy`
* Default value: `highest`

### API dump directory [#api-dump-directory]

Base directory for dumping AI Gateway request/response pairs to disk for debugging.
When set, each provider writes under a subdirectory named after the provider.
Sensitive headers are redacted.
Leave empty to disable.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_DUMP_DIR`
* CLI flag: [`--ai-gateway-dump-dir`](/beta-docs/@main/reference/cli/server/#--ai-gateway-dump-dir)
* YAML key: `ai_gateway.api_dump_dir`

### Actor header email [#actor-header-email]

Header name for the authenticated user's email address.
Empty disables this header.
Requires AI Gateway actor headers to be enabled.
Applies to every configured provider; email is personal information.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_ACTOR_HEADER_EMAIL`
* CLI flag: [`--ai-gateway-actor-header-email`](/beta-docs/@main/reference/cli/server/#--ai-gateway-actor-header-email)
* YAML key: `ai_gateway.actor_header_email`

### Actor header ID [#actor-header-id]

Header name for the authenticated user's ID.
Empty disables this header.
Requires AI Gateway actor headers to be enabled.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_ACTOR_HEADER_ID`
* CLI flag: [`--ai-gateway-actor-header-id`](/beta-docs/@main/reference/cli/server/#--ai-gateway-actor-header-id)
* YAML key: `ai_gateway.actor_header_id`
* Default value: `X-AI-Bridge-Actor-ID`

### Actor header username [#actor-header-username]

Header name for the authenticated user's username.
Empty disables this header.
Requires AI Gateway actor headers to be enabled.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_ACTOR_HEADER_USERNAME`
* CLI flag: [`--ai-gateway-actor-header-username`](/beta-docs/@main/reference/cli/server/#--ai-gateway-actor-header-username)
* YAML key: `ai_gateway.actor_header_username`
* Default value: `X-AI-Bridge-Actor-Metadata-Username`

### Allow BYOK [#allow-byok]

Allow users to provide their own LLM API keys or subscriptions.
When disabled, only centralized key authentication is permitted.

* Type: `bool`
* Environment variable: `CODER_AI_GATEWAY_ALLOW_BYOK`
* CLI flag: [`--ai-gateway-allow-byok`](/beta-docs/@main/reference/cli/server/#--ai-gateway-allow-byok)
* YAML key: `ai_gateway.allow_byok`
* Default value: `true`

### Circuit breaker enabled [#circuit-breaker-enabled]

Enable the circuit breaker to protect against cascading failures from upstream AI provider overload (503, 529).

* Type: `bool`
* Environment variable: `CODER_AI_GATEWAY_CIRCUIT_BREAKER_ENABLED`
* CLI flag: [`--ai-gateway-circuit-breaker-enabled`](/beta-docs/@main/reference/cli/server/#--ai-gateway-circuit-breaker-enabled)
* YAML key: `ai_gateway.circuit_breaker_enabled`
* Default value: `false`

### Data retention duration [#data-retention-duration]

Length of time to retain data such as interceptions and all related records (token, prompt, tool use).

* Type: `duration`
* Environment variable: `CODER_AI_GATEWAY_RETENTION`
* CLI flag: [`--ai-gateway-retention`](/beta-docs/@main/reference/cli/server/#--ai-gateway-retention)
* YAML key: `ai_gateway.retention`
* Default value: `60d`

### Disable content recording [#disable-content-recording]

Stop recording the content of intercepted conversations.
No user prompt, tool call or model reasoning record is stored, including tool names and the arguments they were called with.
Interceptions and token usage are still recorded, so cost controls, budget enforcement and spend reporting are unaffected.
Sessions show no conversation detail, prompt and tool call telemetry report zero, and interceptions are no longer grouped into threads for clients that do not send their own session ID.
Combine with --ai-gateway-structured-logging-source=gateway to keep exporting these records to a SIEM instead.

* Type: `bool`
* Environment variable: `CODER_AI_GATEWAY_DISABLE_CONTENT_RECORDING`
* CLI flag: [`--ai-gateway-disable-content-recording`](/beta-docs/@main/reference/cli/server/#--ai-gateway-disable-content-recording)
* YAML key: `ai_gateway.disable_content_recording`
* Default value: `false`

### Enabled [#enabled]

Whether to start an in-memory AI Gateway instance.

* Type: `bool`
* Environment variable: `CODER_AI_GATEWAY_ENABLED`
* CLI flag: [`--ai-gateway-enabled`](/beta-docs/@main/reference/cli/server/#--ai-gateway-enabled)
* YAML key: `ai_gateway.enabled`
* Default value: `true`

### Max concurrency [#max-concurrency]

Maximum number of concurrent AI Gateway requests per replica.
Set to 0 to disable (unlimited).

* Type: `int`
* Environment variable: `CODER_AI_GATEWAY_MAX_CONCURRENCY`
* CLI flag: [`--ai-gateway-max-concurrency`](/beta-docs/@main/reference/cli/server/#--ai-gateway-max-concurrency)
* YAML key: `ai_gateway.max_concurrency`
* Default value: `0`

### Rate limit [#rate-limit]

Maximum number of AI Gateway requests per second per replica.
Set to 0 to disable (unlimited).

* Type: `int`
* Environment variable: `CODER_AI_GATEWAY_RATE_LIMIT`
* CLI flag: [`--ai-gateway-rate-limit`](/beta-docs/@main/reference/cli/server/#--ai-gateway-rate-limit)
* YAML key: `ai_gateway.rate_limit`
* Default value: `0`

### Send actor headers [#send-actor-headers]

Add configured headers identifying the authenticated user to intercepted upstream requests.
Use this when a proxy between AI Gateway and an upstream AI provider needs user identity.
When enabled, removes client-supplied headers at configured actor-header destinations before adding authenticated values.
Client headers starting with X-AI-Bridge-Actor are always removed.

* Type: `bool`
* Environment variable: `CODER_AI_GATEWAY_SEND_ACTOR_HEADERS`
* CLI flag: [`--ai-gateway-send-actor-headers`](/beta-docs/@main/reference/cli/server/#--ai-gateway-send-actor-headers)
* YAML key: `ai_gateway.send_actor_headers`
* Default value: `false`

### Structured logging [#structured-logging]

Emit structured logs for AI Gateway interception records.
Use this for exporting these records to external SIEM or observability systems.

* Type: `bool`
* Environment variable: `CODER_AI_GATEWAY_STRUCTURED_LOGGING`
* CLI flag: [`--ai-gateway-structured-logging`](/beta-docs/@main/reference/cli/server/#--ai-gateway-structured-logging)
* YAML key: `ai_gateway.structured_logging`
* Default value: `false`

### Structured logging source [#structured-logging-source]

Which process emits AI Gateway interception records when structured logging is enabled: coderd, the gateway, or both.
The gateway emits records that are never persisted, such as those dropped by --ai-gateway-disable-content-recording, but cannot report thread\_parent\_id or thread\_root\_id.
Use both to verify a move from one to the other; records reaching coderd are then reported twice.
A standalone gateway must be configured to emit its own records, and its logs shipped rather than coderd's.

* Type: `enum`, one of `coderd`, `gateway`, `both`
* Environment variable: `CODER_AI_GATEWAY_STRUCTURED_LOGGING_SOURCE`
* CLI flag: [`--ai-gateway-structured-logging-source`](/beta-docs/@main/reference/cli/server/#--ai-gateway-structured-logging-source)
* YAML key: `ai_gateway.structured_logging_source`
* Default value: `coderd`

## AI Gateway Proxy [#ai-gateway-proxy]

### API dump directory [#api-dump-directory-1]

Directory for dumping MITM request/response pairs to disk for debugging.
When set, each proxied request produces .req.txt and .resp.txt files organized by provider.
Sensitive headers are redacted.
Leave empty to disable.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_PROXY_DUMP_DIR`
* CLI flag: [`--ai-gateway-proxy-dump-dir`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-dump-dir)
* YAML key: `ai_gateway_proxy.api_dump_dir`

### Allowed private CIDRs [#allowed-private-cidrs]

Comma-separated list of CIDR ranges that are permitted even though they fall within blocked private/reserved IP ranges.
By default all private ranges are blocked to prevent SSRF attacks.
Use this to allow access to specific internal networks.

* Type: `string-array`
* Environment variable: `CODER_AI_GATEWAY_PROXY_ALLOWED_PRIVATE_CIDRS`
* CLI flag: [`--ai-gateway-proxy-allowed-private-cidrs`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-allowed-private-cidrs)
* YAML key: `ai_gateway_proxy.allowed_private_cidrs`

### Enabled [#enabled-1]

Enable the AI Gateway MITM Proxy for intercepting and decrypting AI provider requests.

* Type: `bool`
* Environment variable: `CODER_AI_GATEWAY_PROXY_ENABLED`
* CLI flag: [`--ai-gateway-proxy-enabled`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-enabled)
* YAML key: `ai_gateway_proxy.enabled`
* Default value: `false`

### Listen address [#listen-address]

The address the AI Gateway Proxy will listen on.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_PROXY_LISTEN_ADDR`
* CLI flag: [`--ai-gateway-proxy-listen-addr`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-listen-addr)
* YAML key: `ai_gateway_proxy.listen_addr`
* Default value: `:8888`

### MITM CA certificate file [#mitm-ca-certificate-file]

Path to the CA certificate file used to intercept (MITM) HTTPS traffic from AI clients.
This CA must be trusted by AI clients for the proxy to decrypt their requests.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_PROXY_CERT_FILE`
* CLI flag: [`--ai-gateway-proxy-cert-file`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-cert-file)
* YAML key: `ai_gateway_proxy.cert_file`

### MITM CA key file [#mitm-ca-key-file]

Path to the CA private key file used to intercept (MITM) HTTPS traffic from AI clients.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_PROXY_KEY_FILE`
* CLI flag: [`--ai-gateway-proxy-key-file`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-key-file)
* YAML key: `ai_gateway_proxy.key_file`

### TLS certificate file [#tls-certificate-file]

Path to the TLS certificate file for the AI Gateway Proxy listener.
Must be set together with AI Gateway Proxy TLS Key File.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_PROXY_TLS_CERT_FILE`
* CLI flag: [`--ai-gateway-proxy-tls-cert-file`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-tls-cert-file)
* YAML key: `ai_gateway_proxy.tls_cert_file`

### TLS key file [#tls-key-file]

Path to the TLS private key file for the AI Gateway Proxy listener.
Must be set together with AI Gateway Proxy TLS Certificate File.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_PROXY_TLS_KEY_FILE`
* CLI flag: [`--ai-gateway-proxy-tls-key-file`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-tls-key-file)
* YAML key: `ai_gateway_proxy.tls_key_file`

### Target [#target]

Base URL of the AI Gateway to forward intercepted requests to.
Defaults to the embedded AI Gateway address at the Coder access URL plus /api/v2/ai-gateway.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_PROXY_TARGET`
* CLI flag: [`--ai-gateway-proxy-target`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-target)
* YAML key: `ai_gateway_proxy.target`

### Upstream proxy [#upstream-proxy]

URL of an upstream HTTP proxy to chain tunneled (non-allowlisted) requests through.
Format: http\://\[user:pass@]host:port or https\://\[user:pass@]host:port.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_PROXY_UPSTREAM`
* CLI flag: [`--ai-gateway-proxy-upstream`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-upstream)
* YAML key: `ai_gateway_proxy.upstream_proxy`

### Upstream proxy CA [#upstream-proxy-ca]

Path to a PEM-encoded CA certificate to trust for the upstream proxy's TLS connection.
Only needed for HTTPS upstream proxies with certificates not trusted by the system.
If not provided, the system certificate pool is used.

* Type: `string`
* Environment variable: `CODER_AI_GATEWAY_PROXY_UPSTREAM_CA`
* CLI flag: [`--ai-gateway-proxy-upstream-ca`](/beta-docs/@main/reference/cli/server/#--ai-gateway-proxy-upstream-ca)
* YAML key: `ai_gateway_proxy.upstream_proxy_ca`

## Chat [#chat]

Configure the background chat processing daemon.

### Debug logging enabled [#debug-logging-enabled]

Force chat debug logging on for every chat, bypassing the runtime admin and user opt-in settings.

* Type: `bool`
* Environment variable: `CODER_CHAT_DEBUG_LOGGING_ENABLED`
* CLI flag: [`--chat-debug-logging-enabled`](/beta-docs/@main/reference/cli/server/#--chat-debug-logging-enabled)
* YAML key: `chat.debugLoggingEnabled`
* Default value: `false`

### Max attachments per chat [#max-attachments-per-chat]

Maximum number of files linked to a chat, including user uploads, files the agent attaches, and desktop recordings and their thumbnails.
Linking a file beyond the limit permanently deletes the chat's earliest-uploaded files, and earlier messages show them as expired.
A message that includes more files than the limit is rejected with HTTP 400.
Must be at least 1.

* Type: `int`
* Environment variable: `CODER_CHAT_MAX_ATTACHMENTS_PER_CHAT`
* CLI flag: [`--chat-max-attachments-per-chat`](/beta-docs/@main/reference/cli/server/#--chat-max-attachments-per-chat)
* YAML key: `chat.maxAttachmentsPerChat`
* Default value: `50`

### Max concurrent recording uploads [#max-concurrent-recording-uploads]

Maximum number of virtual desktop recordings that each Coder server stores at the same time.
Each upload holds the recording and its thumbnail in memory, up to 110 MB.
Additional recordings wait for a free slot and are discarded if none frees up within 90 seconds.
Must be at least 1.

* Type: `int`
* Environment variable: `CODER_CHAT_MAX_CONCURRENT_RECORDING_UPLOADS`
* CLI flag: [`--chat-max-concurrent-recording-uploads`](/beta-docs/@main/reference/cli/server/#--chat-max-concurrent-recording-uploads)
* YAML key: `chat.maxConcurrentRecordingUploads`
* Default value: `25`

### Max generation retries [#max-generation-retries]

Maximum number of consecutive retries after a model generation fails with a transient error, such as a rate limit, an overloaded provider, or a stream that stops sending data.
The count resets after each successful step.
When the retries run out, the chat moves to the error state and shows the provider error.
Advisor calls and the generation of chat titles, summaries, and turn status labels use the same limit.
Must be at least 1.

* Type: `int`
* Environment variable: `CODER_CHAT_MAX_GENERATION_RETRIES`
* CLI flag: [`--chat-max-generation-retries`](/beta-docs/@main/reference/cli/server/#--chat-max-generation-retries)
* YAML key: `chat.maxGenerationRetries`
* Default value: `25`

### Max prompt bytes [#max-prompt-bytes]

Maximum size in bytes of the deployment system prompt, the plan mode instructions, and each user's custom prompt.
Saving a longer prompt fails with HTTP 400.
Lowering the limit does not affect prompts that are already saved.
Must be at least 1.

* Type: `int`
* Environment variable: `CODER_CHAT_MAX_PROMPT_BYTES`
* CLI flag: [`--chat-max-prompt-bytes`](/beta-docs/@main/reference/cli/server/#--chat-max-prompt-bytes)
* YAML key: `chat.maxPromptBytes`
* Default value: `131072`

### Max queued messages per chat [#max-queued-messages-per-chat]

Maximum number of messages that can be queued in a chat.
Sending a message to a chat whose queue is full fails with HTTP 429.
Must be at least 1.

* Type: `int`
* Environment variable: `CODER_CHAT_MAX_QUEUED_MESSAGES_PER_CHAT`
* CLI flag: [`--chat-max-queued-messages-per-chat`](/beta-docs/@main/reference/cli/server/#--chat-max-queued-messages-per-chat)
* YAML key: `chat.maxQueuedMessagesPerChat`
* Default value: `20`

### Max steps per turn [#max-steps-per-turn]

Maximum number of steps in a chat turn.
Each model response is one step; compaction summaries, advisor calls, and retried attempts do not count.
A turn that reaches the limit runs the tools from the last response, then ends without an error.
Must be at least 1.

* Type: `int`
* Environment variable: `CODER_CHAT_MAX_STEPS_PER_TURN`
* CLI flag: [`--chat-max-steps-per-turn`](/beta-docs/@main/reference/cli/server/#--chat-max-steps-per-turn)
* YAML key: `chat.maxStepsPerTurn`
* Default value: `1200`

### Stream silence timeout [#stream-silence-timeout]

Maximum time to wait for the next streamed part from the chat model before the attempt is canceled and retried.
This also bounds the time to first token.
Set to 0 to disable.
Must be no more than 24h.

* Type: `duration`
* Environment variable: `CODER_CHAT_STREAM_SILENCE_TIMEOUT`
* CLI flag: [`--chat-stream-silence-timeout`](/beta-docs/@main/reference/cli/server/#--chat-stream-silence-timeout)
* YAML key: `chat.streamSilenceTimeout`
* Default value: `10m0s`

## Client [#client]

These options change the behavior of how clients interact with the Coder.
Clients include the Coder CLI, Coder Desktop, IDE extensions, and the web UI.

### CLI upgrade message [#cli-upgrade-message]

The upgrade message to display to users when a client/server mismatch is detected.
By default it instructs users to update using 'curl -fsSL [https://coder.com/install.sh](https://coder.com/install.sh) | sh'.

* Type: `string`
* Environment variable: `CODER_CLI_UPGRADE_MESSAGE`
* CLI flag: [`--cli-upgrade-message`](/beta-docs/@main/reference/cli/server/#--cli-upgrade-message)
* YAML key: `client.cliUpgradeMessage`

### SSH config options [#ssh-config-options]

These SSH config options will override the default SSH config options.
Provide options in "key=value" or "key value" format separated by commas.
Using this incorrectly can break SSH to your deployment, use cautiously.
The following options are not allowed: Host, Match, Include, ProxyCommand, ProxyJump, LocalCommand, PermitLocalCommand, RemoteCommand, KnownHostsCommand, PKCS11Provider, SecurityKeyProvider, SmartcardDevice, XAuthLocation.
Option values must not contain newline, carriage return, or NUL characters.

* Type: `string-array`
* Environment variable: `CODER_SSH_CONFIG_OPTIONS`
* CLI flag: [`--ssh-config-options`](/beta-docs/@main/reference/cli/server/#--ssh-config-options)
* YAML key: `client.sshConfigOptions`

### Web terminal renderer [#web-terminal-renderer]

The renderer to use when opening a web terminal.
Valid values are 'canvas', 'webgl', or 'dom'.

* Type: `string`
* Environment variable: `CODER_WEB_TERMINAL_RENDERER`
* CLI flag: [`--web-terminal-renderer`](/beta-docs/@main/reference/cli/server/#--web-terminal-renderer)
* YAML key: `client.webTerminalRenderer`
* Default value: `canvas`

### Workspace hostname suffix [#workspace-hostname-suffix]

Workspace hostnames use this suffix in SSH config and Coder Connect on Coder Desktop.
By default it is coder, resulting in names like myworkspace.coder.
The suffix must not start with a dot, and must not contain spaces, newlines, or glob characters (\* and ?).

* Type: `string`
* Environment variable: `CODER_WORKSPACE_HOSTNAME_SUFFIX`
* CLI flag: [`--workspace-hostname-suffix`](/beta-docs/@main/reference/cli/server/#--workspace-hostname-suffix)
* YAML key: `client.workspaceHostnameSuffix`
* Default value: `coder`

## Config [#config]

Use a YAML configuration file when your server launch become unwieldy.

### Path [#path]

Specify a YAML file to load configuration from.

* Type: `yaml-config-path`
* Environment variable: `CODER_CONFIG_PATH`
* CLI flag: [`--config`](/beta-docs/@main/reference/cli/server/#-c---config)

### Write config [#write-config]

Write out the current server config as YAML to stdout.

* Type: `bool`
* CLI flag: [`--write-config`](/beta-docs/@main/reference/cli/server/#--write-config)

## Email [#email]

Configure how emails are sent.

### Force TLS [#force-tls]

Force a TLS connection to the configured SMTP smarthost.

* Type: `bool`
* Environment variable: `CODER_EMAIL_FORCE_TLS`
* CLI flag: [`--email-force-tls`](/beta-docs/@main/reference/cli/server/#--email-force-tls)
* YAML key: `email.forceTLS`
* Default value: `false`

### From address [#from-address]

The sender's address to use.

* Type: `string`
* Environment variable: `CODER_EMAIL_FROM`
* CLI flag: [`--email-from`](/beta-docs/@main/reference/cli/server/#--email-from)
* YAML key: `email.from`

### Hello [#hello]

The hostname identifying the SMTP server.

* Type: `string`
* Environment variable: `CODER_EMAIL_HELLO`
* CLI flag: [`--email-hello`](/beta-docs/@main/reference/cli/server/#--email-hello)
* YAML key: `email.hello`
* Default value: `localhost`

### Smarthost [#smarthost]

The intermediary SMTP host through which emails are sent.

* Type: `string`
* Environment variable: `CODER_EMAIL_SMARTHOST`
* CLI flag: [`--email-smarthost`](/beta-docs/@main/reference/cli/server/#--email-smarthost)
* YAML key: `email.smarthost`

### Email authentication [#email-authentication]

Configure SMTP authentication options.

#### Identity [#identity]

Identity to use with PLAIN authentication.

* Type: `string`
* Environment variable: `CODER_EMAIL_AUTH_IDENTITY`
* CLI flag: [`--email-auth-identity`](/beta-docs/@main/reference/cli/server/#--email-auth-identity)
* YAML key: `email.emailAuth.identity`

#### Password [#password]

Password to use with PLAIN/LOGIN authentication.

* Type: `string`
* Environment variable: `CODER_EMAIL_AUTH_PASSWORD`
* CLI flag: [`--email-auth-password`](/beta-docs/@main/reference/cli/server/#--email-auth-password)
* Holds a secret: Coder never writes this option to a YAML configuration file.
  Set it through the environment variable above.

#### Password file [#password-file]

File from which to load password for use with PLAIN/LOGIN authentication.

* Type: `string`
* Environment variable: `CODER_EMAIL_AUTH_PASSWORD_FILE`
* CLI flag: [`--email-auth-password-file`](/beta-docs/@main/reference/cli/server/#--email-auth-password-file)
* YAML key: `email.emailAuth.passwordFile`

#### Username [#username]

Username to use with PLAIN/LOGIN authentication.

* Type: `string`
* Environment variable: `CODER_EMAIL_AUTH_USERNAME`
* CLI flag: [`--email-auth-username`](/beta-docs/@main/reference/cli/server/#--email-auth-username)
* YAML key: `email.emailAuth.username`

### Email TLS [#email-tls]

Configure TLS for your SMTP server target.

#### Certificate authority file [#certificate-authority-file]

CA certificate file to use.

* Type: `string`
* Environment variable: `CODER_EMAIL_TLS_CACERTFILE`
* CLI flag: [`--email-tls-ca-cert-file`](/beta-docs/@main/reference/cli/server/#--email-tls-ca-cert-file)
* YAML key: `email.emailTLS.caCertFile`

#### Certificate file [#certificate-file]

Certificate file to use.

* Type: `string`
* Environment variable: `CODER_EMAIL_TLS_CERTFILE`
* CLI flag: [`--email-tls-cert-file`](/beta-docs/@main/reference/cli/server/#--email-tls-cert-file)
* YAML key: `email.emailTLS.certFile`

#### Certificate key file [#certificate-key-file]

Certificate key file to use.

* Type: `string`
* Environment variable: `CODER_EMAIL_TLS_CERTKEYFILE`
* CLI flag: [`--email-tls-cert-key-file`](/beta-docs/@main/reference/cli/server/#--email-tls-cert-key-file)
* YAML key: `email.emailTLS.certKeyFile`

#### Server name [#server-name]

Server name to verify against the target certificate.

* Type: `string`
* Environment variable: `CODER_EMAIL_TLS_SERVERNAME`
* CLI flag: [`--email-tls-server-name`](/beta-docs/@main/reference/cli/server/#--email-tls-server-name)
* YAML key: `email.emailTLS.serverName`

#### Skip certificate verification (insecure) [#skip-certificate-verification-insecure]

Skip verification of the target server's certificate (insecure).

* Type: `bool`
* Environment variable: `CODER_EMAIL_TLS_SKIPVERIFY`
* CLI flag: [`--email-tls-skip-verify`](/beta-docs/@main/reference/cli/server/#--email-tls-skip-verify)
* YAML key: `email.emailTLS.insecureSkipVerify`

#### StartTLS [#starttls]

Enable STARTTLS to upgrade insecure SMTP connections using TLS.

* Type: `bool`
* Environment variable: `CODER_EMAIL_TLS_STARTTLS`
* CLI flag: [`--email-tls-starttls`](/beta-docs/@main/reference/cli/server/#--email-tls-starttls)
* YAML key: `email.emailTLS.startTLS`

## Introspection [#introspection]

Configure logging, tracing, stat collection, and metrics exporting.

### Health check [#health-check]

#### Refresh [#refresh]

Refresh interval for healthchecks.

* Type: `duration`
* Environment variable: `CODER_HEALTH_CHECK_REFRESH`
* CLI flag: [`--health-check-refresh`](/beta-docs/@main/reference/cli/server/#--health-check-refresh)
* YAML key: `introspection.healthcheck.refresh`
* Default value: `10m0s`

#### Threshold: database [#threshold-database]

The threshold for the database health check.
If the median latency of the database exceeds this threshold over 5 attempts, the database is considered unhealthy.
The default value is 15ms.

* Type: `duration`
* Environment variable: `CODER_HEALTH_CHECK_THRESHOLD_DATABASE`
* CLI flag: [`--health-check-threshold-database`](/beta-docs/@main/reference/cli/server/#--health-check-threshold-database)
* YAML key: `introspection.healthcheck.thresholdDatabase`
* Default value: `15ms`

### Logging [#logging]

#### Enable Terraform debug mode [#enable-terraform-debug-mode]

Allow administrators to enable Terraform debug output.

* Type: `bool`
* Environment variable: `CODER_ENABLE_TERRAFORM_DEBUG_MODE`
* CLI flag: [`--enable-terraform-debug-mode`](/beta-docs/@main/reference/cli/server/#--enable-terraform-debug-mode)
* YAML key: `introspection.logging.enableTerraformDebugMode`
* Default value: `false`

#### Human log location [#human-log-location]

Output human-readable logs to a given file.

* Type: `string`
* Environment variable: `CODER_LOGGING_HUMAN`
* CLI flag: [`--log-human`](/beta-docs/@main/reference/cli/server/#--log-human)
* YAML key: `introspection.logging.humanPath`
* Default value: `/dev/stderr`

#### JSON log location [#json-log-location]

Output JSON logs to a given file.

* Type: `string`
* Environment variable: `CODER_LOGGING_JSON`
* CLI flag: [`--log-json`](/beta-docs/@main/reference/cli/server/#--log-json)
* YAML key: `introspection.logging.jsonPath`

#### Log filter [#log-filter]

Filter debug logs by matching against a given regex.
Use .\* to match all debug logs.

* Type: `string-array`
* Environment variable: `CODER_LOG_FILTER`
* CLI flag: [`--log-filter`](/beta-docs/@main/reference/cli/server/#-l---log-filter)
* YAML key: `introspection.logging.filter`

#### Stackdriver log location [#stackdriver-log-location]

Output Stackdriver compatible logs to a given file.

* Type: `string`
* Environment variable: `CODER_LOGGING_STACKDRIVER`
* CLI flag: [`--log-stackdriver`](/beta-docs/@main/reference/cli/server/#--log-stackdriver)
* YAML key: `introspection.logging.stackdriverPath`

### Prometheus [#prometheus]

#### Address [#address]

The bind address to serve prometheus metrics.

* Type: `host:port`
* Environment variable: `CODER_PROMETHEUS_ADDRESS`
* CLI flag: [`--prometheus-address`](/beta-docs/@main/reference/cli/server/#--prometheus-address)
* YAML key: `introspection.prometheus.address`
* Default value: `127.0.0.1:2112`

#### Aggregate agent stats by [#aggregate-agent-stats-by]

When collecting agent stats, aggregate metrics by a given set of comma-separated labels to reduce cardinality.
Accepted values are agent\_name, template\_name, username, workspace\_name.

* Type: `string-array`
* Environment variable: `CODER_PROMETHEUS_AGGREGATE_AGENT_STATS_BY`
* CLI flag: [`--prometheus-aggregate-agent-stats-by`](/beta-docs/@main/reference/cli/server/#--prometheus-aggregate-agent-stats-by)
* YAML key: `introspection.prometheus.aggregate_agent_stats_by`
* Default value: `agent_name,template_name,username,workspace_name`

#### Collect agent stats [#collect-agent-stats]

Collect agent stats (may increase charges for metrics storage).

* Type: `bool`
* Environment variable: `CODER_PROMETHEUS_COLLECT_AGENT_STATS`
* CLI flag: [`--prometheus-collect-agent-stats`](/beta-docs/@main/reference/cli/server/#--prometheus-collect-agent-stats)
* YAML key: `introspection.prometheus.collect_agent_stats`

#### Collect database metrics [#collect-database-metrics]

Collect database query metrics (may increase charges for metrics storage).
If set to false, a reduced set of database metrics are still collected.

* Type: `bool`
* Environment variable: `CODER_PROMETHEUS_COLLECT_DB_METRICS`
* CLI flag: [`--prometheus-collect-db-metrics`](/beta-docs/@main/reference/cli/server/#--prometheus-collect-db-metrics)
* YAML key: `introspection.prometheus.collect_db_metrics`
* Default value: `false`

#### Enable [#enable]

Serve prometheus metrics on the address defined by prometheus address.

* Type: `bool`
* Environment variable: `CODER_PROMETHEUS_ENABLE`
* CLI flag: [`--prometheus-enable`](/beta-docs/@main/reference/cli/server/#--prometheus-enable)
* YAML key: `introspection.prometheus.enable`

### Stats collection [#stats-collection]

#### Usage stats [#usage-stats]

##### Enable [#enable-1]

Enable the collection of application and workspace usage along with the associated API endpoints and the template insights page.
Disabling this will also disable traffic and connection insights in the deployment stats shown to admins in the bottom bar of the Coder UI, and will prevent Prometheus collection of these values.

* Type: `bool`
* Environment variable: `CODER_STATS_COLLECTION_USAGE_STATS_ENABLE`
* CLI flag: [`--stats-collection-usage-stats-enable`](/beta-docs/@main/reference/cli/server/#--stats-collection-usage-stats-enable)
* YAML key: `introspection.statsCollection.usageStats.enable`
* Default value: `true`

### Tracing [#tracing]

#### Capture logs in traces [#capture-logs-in-traces]

Enables capturing of logs as events in traces.
This is useful for debugging, but may result in a very large amount of events being sent to the tracing backend which may incur significant costs.

* Type: `bool`
* Environment variable: `CODER_TRACE_LOGS`
* CLI flag: [`--trace-logs`](/beta-docs/@main/reference/cli/server/#--trace-logs)
* YAML key: `introspection.tracing.captureLogs`

#### Trace enable [#trace-enable]

Whether application tracing data is collected.
It exports to a backend configured by environment variables.
See: [https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md](https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md).

* Type: `bool`
* Environment variable: `CODER_TRACE_ENABLE`
* CLI flag: [`--trace`](/beta-docs/@main/reference/cli/server/#--trace)
* YAML key: `introspection.tracing.enable`

#### Trace Honeycomb API key [#trace-honeycomb-api-key]

Enables trace exporting to Honeycomb.io using the provided API Key.

* Type: `string`
* Environment variable: `CODER_TRACE_HONEYCOMB_API_KEY`
* CLI flag: [`--trace-honeycomb-api-key`](/beta-docs/@main/reference/cli/server/#--trace-honeycomb-api-key)
* Holds a secret: Coder never writes this option to a YAML configuration file.
  Set it through the environment variable above.

### pprof [#pprof]

#### Address [#address-1]

The bind address to serve pprof.

* Type: `host:port`
* Environment variable: `CODER_PPROF_ADDRESS`
* CLI flag: [`--pprof-address`](/beta-docs/@main/reference/cli/server/#--pprof-address)
* YAML key: `introspection.pprof.address`
* Default value: `127.0.0.1:6060`

#### Enable [#enable-2]

Serve pprof metrics on the address defined by pprof address.

* Type: `bool`
* Environment variable: `CODER_PPROF_ENABLE`
* CLI flag: [`--pprof-enable`](/beta-docs/@main/reference/cli/server/#--pprof-enable)
* YAML key: `introspection.pprof.enable`

## MCP [#mcp]

### Allowed private CIDRs [#allowed-private-cidrs-1]

MCP server destinations in private or reserved IP ranges are blocked by default for SSRF protection.
This applies to OAuth2 discovery, OAuth2 token and revocation exchanges, and runtime MCP connections from coderd.
This option exempts specific CIDRs.

* Type: `string-array`
* Environment variable: `CODER_MCP_ALLOWED_PRIVATE_CIDRS`
* CLI flag: [`--mcp-allowed-private-cidrs`](/beta-docs/@main/reference/cli/server/#--mcp-allowed-private-cidrs)
* YAML key: `mcp.allowed_private_cidrs`

## Networking [#networking]

### Access URL [#access-url]

The URL that users will use to access the Coder deployment.

* Type: `url`
* Environment variable: `CODER_ACCESS_URL`
* CLI flag: [`--access-url`](/beta-docs/@main/reference/cli/server/#--access-url)
* YAML key: `networking.accessURL`

### Browser only [#browser-only]

Whether Coder only allows connections to workspaces via the browser.

* Type: `bool`
* Environment variable: `CODER_BROWSER_ONLY`
* CLI flag: [`--browser-only`](/beta-docs/@main/reference/cli/server/#--browser-only)
* YAML key: `networking.browserOnly`

### Docs URL [#docs-url]

Specifies the custom docs URL.

* Type: `url`
* Environment variable: `CODER_DOCS_URL`
* CLI flag: [`--docs-url`](/beta-docs/@main/reference/cli/server/#--docs-url)
* YAML key: `networking.docsURL`
* Default value: `https://coder.com/docs`

### Proxy trusted headers [#proxy-trusted-headers]

Headers to trust for forwarding IP addresses. e.g. Cf-Connecting-Ip, True-Client-Ip, X-Forwarded-For.

* Type: `string-array`
* Environment variable: `CODER_PROXY_TRUSTED_HEADERS`
* CLI flag: [`--proxy-trusted-headers`](/beta-docs/@main/reference/cli/server/#--proxy-trusted-headers)
* YAML key: `networking.proxyTrustedHeaders`

### Proxy trusted origins [#proxy-trusted-origins]

Origin addresses to respect "proxy-trusted-headers" and X-Forwarded-Host for subdomain app routing. e.g. 192.168.1.0/24.

* Type: `string-array`
* Environment variable: `CODER_PROXY_TRUSTED_ORIGINS`
* CLI flag: [`--proxy-trusted-origins`](/beta-docs/@main/reference/cli/server/#--proxy-trusted-origins)
* YAML key: `networking.proxyTrustedOrigins`

### Redirect to access URL [#redirect-to-access-url]

Specifies whether to redirect requests that do not match the access URL host.

* Type: `bool`
* Environment variable: `CODER_REDIRECT_TO_ACCESS_URL`
* CLI flag: [`--redirect-to-access-url`](/beta-docs/@main/reference/cli/server/#--redirect-to-access-url)
* YAML key: `networking.redirectToAccessURL`

### SameSite auth cookie [#samesite-auth-cookie]

Controls the 'SameSite' property is set on browser session cookies.

* Type: `enum`, one of `lax`, `none`
* Environment variable: `CODER_SAMESITE_AUTH_COOKIE`
* CLI flag: [`--samesite-auth-cookie`](/beta-docs/@main/reference/cli/server/#--samesite-auth-cookie)
* YAML key: `networking.sameSiteAuthCookie`
* Default value: `lax`

### Secure auth cookie [#secure-auth-cookie]

Controls if the 'Secure' property is set on browser session cookies.

* Type: `bool`
* Environment variable: `CODER_SECURE_AUTH_COOKIE`
* CLI flag: [`--secure-auth-cookie`](/beta-docs/@main/reference/cli/server/#--secure-auth-cookie)
* YAML key: `networking.secureAuthCookie`
* Default value: `(computed at runtime)`

### Wildcard access URL [#wildcard-access-url]

Specifies the wildcard hostname to use for workspace applications in the form "\*.example.com".

* Type: `string`
* Environment variable: `CODER_WILDCARD_ACCESS_URL`
* CLI flag: [`--wildcard-access-url`](/beta-docs/@main/reference/cli/server/#--wildcard-access-url)
* YAML key: `networking.wildcardAccessURL`

### \_\_Host prefix cookies [#__host-prefix-cookies]

Recommended to be enabled.
Enables `__Host-` prefix for cookies to guarantee they are only set by the right domain.
This change is disruptive to any workspaces built before release 2.31, requiring a workspace restart.

* Type: `bool`
* Environment variable: `CODER_HOST_PREFIX_COOKIE`
* CLI flag: [`--host-prefix-cookie`](/beta-docs/@main/reference/cli/server/#--host-prefix-cookie)
* YAML key: `networking.hostPrefixCookie`
* Default value: `false`

### Cluster [#cluster]

Configure network clustering.
Coder Servers in the primary region form a cluster by communicating directly.

#### Host [#host]

Hostname or (more commonly) IP to reach this replica for clustering.

* Type: `string`
* Environment variable: `CODER_CLUSTER_HOST`
* CLI flag: [`--cluster-host`](/beta-docs/@main/reference/cli/server/#--cluster-host)
* YAML key: `networking.cluster.clusterHost`

### DERP [#derp]

Most Coder deployments never have to think about DERP because all connections between workspaces and users are peer-to-peer.
However, when Coder cannot establish a peer to peer connection, Coder uses a distributed relay network backed by Tailscale and WireGuard.

#### Block direct connections [#block-direct-connections]

Block peer-to-peer (aka. direct) workspace connections.
All workspace connections from the CLI will be proxied through Coder (or custom configured DERP servers) and will never be peer-to-peer when enabled.
Workspaces may still reach out to STUN servers to get their address until they are restarted after this change has been made, but new connections will still be proxied regardless.

* Type: `bool`
* Environment variable: `CODER_BLOCK_DIRECT`
* CLI flag: [`--block-direct-connections`](/beta-docs/@main/reference/cli/server/#--block-direct-connections)
* YAML key: `networking.derp.blockDirect`

#### Config path [#config-path]

Path to read a DERP mapping from.
See: [https://tailscale.com/kb/1118/custom-derp-servers/](https://tailscale.com/kb/1118/custom-derp-servers/).

* Type: `string`
* Environment variable: `CODER_DERP_CONFIG_PATH`
* CLI flag: [`--derp-config-path`](/beta-docs/@main/reference/cli/server/#--derp-config-path)
* YAML key: `networking.derp.configPath`

#### Config URL [#config-url]

URL to fetch a DERP mapping on startup.
See: [https://tailscale.com/kb/1118/custom-derp-servers/](https://tailscale.com/kb/1118/custom-derp-servers/).

* Type: `string`
* Environment variable: `CODER_DERP_CONFIG_URL`
* CLI flag: [`--derp-config-url`](/beta-docs/@main/reference/cli/server/#--derp-config-url)
* YAML key: `networking.derp.url`

#### Force WebSockets [#force-websockets]

Force clients and agents to always use WebSocket to connect to DERP relay servers.
By default, DERP uses `Upgrade: derp`, which may cause issues with some reverse proxies.
Clients may automatically fallback to WebSocket if they detect an issue with `Upgrade: derp`, but this does not work in all situations.

* Type: `bool`
* Environment variable: `CODER_DERP_FORCE_WEBSOCKETS`
* CLI flag: [`--derp-force-websockets`](/beta-docs/@main/reference/cli/server/#--derp-force-websockets)
* YAML key: `networking.derp.forceWebSockets`

#### Server enable [#server-enable]

Whether to enable or disable the embedded DERP relay server.

* Type: `bool`
* Environment variable: `CODER_DERP_SERVER_ENABLE`
* CLI flag: [`--derp-server-enable`](/beta-docs/@main/reference/cli/server/#--derp-server-enable)
* YAML key: `networking.derp.enable`
* Default value: `true`

#### Server region name [#server-region-name]

Region name that for the embedded DERP server.

* Type: `string`
* Environment variable: `CODER_DERP_SERVER_REGION_NAME`
* CLI flag: [`--derp-server-region-name`](/beta-docs/@main/reference/cli/server/#--derp-server-region-name)
* YAML key: `networking.derp.regionName`
* Default value: `Coder Embedded Relay`

#### Server relay URL [#server-relay-url]

An HTTP URL that is accessible by other replicas to relay DERP traffic.
Required for high availability.

* Type: `url`
* Environment variable: `CODER_DERP_SERVER_RELAY_URL`
* CLI flag: [`--derp-server-relay-url`](/beta-docs/@main/reference/cli/server/#--derp-server-relay-url)
* YAML key: `networking.derp.relayURL`

#### Server STUN addresses [#server-stun-addresses]

Addresses for STUN servers to establish P2P connections.
It's recommended to have at least two STUN servers to give users the best chance of connecting P2P to workspaces.
Each STUN server will get it's own DERP region, with region IDs starting at `--derp-server-region-id + 1`.
Use special value 'disable' to turn off STUN completely.

* Type: `string-array`
* Environment variable: `CODER_DERP_SERVER_STUN_ADDRESSES`
* CLI flag: [`--derp-server-stun-addresses`](/beta-docs/@main/reference/cli/server/#--derp-server-stun-addresses)
* YAML key: `networking.derp.stunAddresses`
* Default value: `stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302,stun3.l.google.com:19302,stun4.l.google.com:19302`

### HTTP [#http]

#### Additional CSP policy [#additional-csp-policy]

Coder configures a Content Security Policy (CSP) to protect against XSS attacks.
This setting allows you to add additional CSP directives, which can open the attack surface of the deployment.
Format matches the CSP directive format, e.g. --additional-csp-policy="script-src [https://example.com](https://example.com)".

* Type: `string-array`
* Environment variable: `CODER_ADDITIONAL_CSP_POLICY`
* CLI flag: [`--additional-csp-policy`](/beta-docs/@main/reference/cli/server/#--additional-csp-policy)
* YAML key: `networking.http.additionalCSPPolicy`

#### Disable password authentication [#disable-password-authentication]

Disable password authentication.
This is recommended for security purposes in production deployments that rely on an identity provider.
This applies to all users, including owners.
Ensure an owner can sign in through your identity provider before enabling this.
To recover access, unset this option, restart the server, and use `coder server create-admin-user` if needed.

* Type: `bool`
* Environment variable: `CODER_DISABLE_PASSWORD_AUTH`
* CLI flag: [`--disable-password-auth`](/beta-docs/@main/reference/cli/server/#--disable-password-auth)
* YAML key: `networking.http.disablePasswordAuth`

#### Disable session expiry refresh [#disable-session-expiry-refresh]

Disable automatic session expiry bumping due to activity.
This forces all sessions to become invalid after the session expiry duration has been reached.

* Type: `bool`
* Environment variable: `CODER_DISABLE_SESSION_EXPIRY_REFRESH`
* CLI flag: [`--disable-session-expiry-refresh`](/beta-docs/@main/reference/cli/server/#--disable-session-expiry-refresh)
* YAML key: `networking.http.disableSessionExpiryRefresh`

#### Address [#address-2]

HTTP bind address of the server.
Unset to disable the HTTP endpoint.

* Type: `string`
* Environment variable: `CODER_HTTP_ADDRESS`
* CLI flag: [`--http-address`](/beta-docs/@main/reference/cli/server/#--http-address)
* YAML key: `networking.http.httpAddress`
* Default value: `127.0.0.1:3000`

#### Max token lifetime [#max-token-lifetime]

The maximum lifetime duration users can specify when creating an API token.

* Type: `duration`
* Environment variable: `CODER_MAX_TOKEN_LIFETIME`
* CLI flag: [`--max-token-lifetime`](/beta-docs/@main/reference/cli/server/#--max-token-lifetime)
* YAML key: `networking.http.maxTokenLifetime`
* Default value: `876600h0m0s`

#### Maximum admin token lifetime [#maximum-admin-token-lifetime]

The maximum lifetime duration administrators can specify when creating an API token.

* Type: `duration`
* Environment variable: `CODER_MAX_ADMIN_TOKEN_LIFETIME`
* CLI flag: [`--max-admin-token-lifetime`](/beta-docs/@main/reference/cli/server/#--max-admin-token-lifetime)
* YAML key: `networking.http.maxAdminTokenLifetime`
* Default value: `168h0m0s`

#### Proxy health check interval [#proxy-health-check-interval]

The interval in which coderd should be checking the status of workspace proxies.

* Type: `duration`
* Environment variable: `CODER_PROXY_HEALTH_INTERVAL`
* CLI flag: [`--proxy-health-interval`](/beta-docs/@main/reference/cli/server/#--proxy-health-interval)
* YAML key: `networking.http.proxyHealthInterval`
* Default value: `1m0s`

#### Session duration [#session-duration]

The token expiry duration for browser sessions.
Sessions may last longer if they are actively making requests, but this functionality can be disabled via --disable-session-expiry-refresh.

* Type: `duration`
* Environment variable: `CODER_SESSION_DURATION`
* CLI flag: [`--session-duration`](/beta-docs/@main/reference/cli/server/#--session-duration)
* YAML key: `networking.http.sessionDuration`
* Default value: `24h0m0s`

### TLS [#tls]

Configure TLS / HTTPS for your Coder deployment.
If you're running Coder behind a TLS-terminating reverse proxy or are accessing Coder over a secure link, you can safely ignore these settings.

#### Strict-Transport-Security [#strict-transport-security]

Controls if the 'Strict-Transport-Security' header is set on all static file responses.
This header should only be set if the server is accessed via HTTPS.
This value is the MaxAge in seconds of the header.

* Type: `int`
* Environment variable: `CODER_STRICT_TRANSPORT_SECURITY`
* CLI flag: [`--strict-transport-security`](/beta-docs/@main/reference/cli/server/#--strict-transport-security)
* YAML key: `networking.tls.strictTransportSecurity`
* Default value: `0`

#### Strict-Transport-Security options [#strict-transport-security-options]

Two optional fields can be set in the Strict-Transport-Security header; 'includeSubDomains' and 'preload'.
The 'strict-transport-security' flag must be set to a non-zero value for these options to be used.

* Type: `string-array`
* Environment variable: `CODER_STRICT_TRANSPORT_SECURITY_OPTIONS`
* CLI flag: [`--strict-transport-security-options`](/beta-docs/@main/reference/cli/server/#--strict-transport-security-options)
* YAML key: `networking.tls.strictTransportSecurityOptions`

#### Address [#address-3]

HTTPS bind address of the server.

* Type: `host:port`
* Environment variable: `CODER_TLS_ADDRESS`
* CLI flag: [`--tls-address`](/beta-docs/@main/reference/cli/server/#--tls-address)
* YAML key: `networking.tls.address`
* Default value: `127.0.0.1:3443`

#### Allow insecure ciphers [#allow-insecure-ciphers]

By default, only ciphers marked as 'secure' are allowed to be used.
See [https://github.com/golang/go/blob/master/src/crypto/tls/cipher\_suites.go#L82-L95](https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L82-L95).

* Type: `bool`
* Environment variable: `CODER_TLS_ALLOW_INSECURE_CIPHERS`
* CLI flag: [`--tls-allow-insecure-ciphers`](/beta-docs/@main/reference/cli/server/#--tls-allow-insecure-ciphers)
* YAML key: `networking.tls.tlsAllowInsecureCiphers`
* Default value: `false`

#### Certificate files [#certificate-files]

Path to each certificate for TLS.
It requires a PEM-encoded file.
To configure the listener to use a CA certificate, concatenate the primary certificate and the CA certificate together.
The primary certificate should appear first in the combined file.

* Type: `string-array`
* Environment variable: `CODER_TLS_CERT_FILE`
* CLI flag: [`--tls-cert-file`](/beta-docs/@main/reference/cli/server/#--tls-cert-file)
* YAML key: `networking.tls.certFiles`

#### Ciphers [#ciphers]

Specify specific TLS ciphers that allowed to be used.
See [https://github.com/golang/go/blob/master/src/crypto/tls/cipher\_suites.go#L53-L75](https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L53-L75).

* Type: `string-array`
* Environment variable: `CODER_TLS_CIPHERS`
* CLI flag: [`--tls-ciphers`](/beta-docs/@main/reference/cli/server/#--tls-ciphers)
* YAML key: `networking.tls.tlsCiphers`

#### Client auth [#client-auth]

Policy the server will follow for TLS Client Authentication.
Accepted values are "none", "request", "require-any", "verify-if-given", or "require-and-verify".

* Type: `string`
* Environment variable: `CODER_TLS_CLIENT_AUTH`
* CLI flag: [`--tls-client-auth`](/beta-docs/@main/reference/cli/server/#--tls-client-auth)
* YAML key: `networking.tls.clientAuth`
* Default value: `none`

#### Client CA files [#client-ca-files]

PEM-encoded Certificate Authority file used for checking the authenticity of client.

* Type: `string`
* Environment variable: `CODER_TLS_CLIENT_CA_FILE`
* CLI flag: [`--tls-client-ca-file`](/beta-docs/@main/reference/cli/server/#--tls-client-ca-file)
* YAML key: `networking.tls.clientCAFile`

#### Client cert file [#client-cert-file]

Path to certificate for client TLS authentication.
It requires a PEM-encoded file.

* Type: `string`
* Environment variable: `CODER_TLS_CLIENT_CERT_FILE`
* CLI flag: [`--tls-client-cert-file`](/beta-docs/@main/reference/cli/server/#--tls-client-cert-file)
* YAML key: `networking.tls.clientCertFile`

#### Client key file [#client-key-file]

Path to key for client TLS authentication.
It requires a PEM-encoded file.

* Type: `string`
* Environment variable: `CODER_TLS_CLIENT_KEY_FILE`
* CLI flag: [`--tls-client-key-file`](/beta-docs/@main/reference/cli/server/#--tls-client-key-file)
* YAML key: `networking.tls.clientKeyFile`

#### Enable [#enable-3]

Whether TLS will be enabled.

* Type: `bool`
* Environment variable: `CODER_TLS_ENABLE`
* CLI flag: [`--tls-enable`](/beta-docs/@main/reference/cli/server/#--tls-enable)
* YAML key: `networking.tls.enable`

#### Key files [#key-files]

Paths to the private keys for each of the certificates.
It requires a PEM-encoded file.

* Type: `string-array`
* Environment variable: `CODER_TLS_KEY_FILE`
* CLI flag: [`--tls-key-file`](/beta-docs/@main/reference/cli/server/#--tls-key-file)
* YAML key: `networking.tls.keyFiles`

#### Minimum version [#minimum-version]

Minimum supported version of TLS.
Accepted values are "tls10", "tls11", "tls12" or "tls13".

* Type: `string`
* Environment variable: `CODER_TLS_MIN_VERSION`
* CLI flag: [`--tls-min-version`](/beta-docs/@main/reference/cli/server/#--tls-min-version)
* YAML key: `networking.tls.minVersion`
* Default value: `tls12`

## Notifications [#notifications]

Configure how notifications are processed and delivered.

### Dispatch timeout [#dispatch-timeout]

How long to wait while a notification is being sent before giving up.

* Type: `duration`
* Environment variable: `CODER_NOTIFICATIONS_DISPATCH_TIMEOUT`
* CLI flag: [`--notifications-dispatch-timeout`](/beta-docs/@main/reference/cli/server/#--notifications-dispatch-timeout)
* YAML key: `notifications.dispatchTimeout`
* Default value: `1m0s`

### Max send attempts [#max-send-attempts]

The upper limit of attempts to send a notification.

* Type: `int`
* Environment variable: `CODER_NOTIFICATIONS_MAX_SEND_ATTEMPTS`
* CLI flag: [`--notifications-max-send-attempts`](/beta-docs/@main/reference/cli/server/#--notifications-max-send-attempts)
* YAML key: `notifications.maxSendAttempts`
* Default value: `5`

### Method [#method]

Which delivery method to use (available options: 'smtp', 'webhook').

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_METHOD`
* CLI flag: [`--notifications-method`](/beta-docs/@main/reference/cli/server/#--notifications-method)
* YAML key: `notifications.method`
* Default value: `smtp`

### Email [#email-1]

Configure how email notifications are sent.

#### Force TLS [#force-tls-1]

**Deprecated.**
Force a TLS connection to the configured SMTP smarthost.

* Type: `bool`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_FORCE_TLS`
* CLI flag: [`--notifications-email-force-tls`](/beta-docs/@main/reference/cli/server/#--notifications-email-force-tls)
* YAML key: `notifications.email.forceTLS`

#### From address [#from-address-1]

**Deprecated.**
The sender's address to use.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_FROM`
* CLI flag: [`--notifications-email-from`](/beta-docs/@main/reference/cli/server/#--notifications-email-from)
* YAML key: `notifications.email.from`

#### Hello [#hello-1]

**Deprecated.**
The hostname identifying the SMTP server.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_HELLO`
* CLI flag: [`--notifications-email-hello`](/beta-docs/@main/reference/cli/server/#--notifications-email-hello)
* YAML key: `notifications.email.hello`

#### Smarthost [#smarthost-1]

**Deprecated.**
The intermediary SMTP host through which emails are sent.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_SMARTHOST`
* CLI flag: [`--notifications-email-smarthost`](/beta-docs/@main/reference/cli/server/#--notifications-email-smarthost)
* YAML key: `notifications.email.smarthost`

#### Email authentication [#email-authentication-1]

Configure SMTP authentication options.

##### Identity [#identity-1]

**Deprecated.**
Identity to use with PLAIN authentication.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_AUTH_IDENTITY`
* CLI flag: [`--notifications-email-auth-identity`](/beta-docs/@main/reference/cli/server/#--notifications-email-auth-identity)
* YAML key: `notifications.email.emailAuth.identity`

##### Password [#password-1]

**Deprecated.**
Password to use with PLAIN/LOGIN authentication.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_AUTH_PASSWORD`
* CLI flag: [`--notifications-email-auth-password`](/beta-docs/@main/reference/cli/server/#--notifications-email-auth-password)
* Holds a secret: Coder never writes this option to a YAML configuration file.
  Set it through the environment variable above.

##### Password file [#password-file-1]

**Deprecated.**
File from which to load password for use with PLAIN/LOGIN authentication.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_AUTH_PASSWORD_FILE`
* CLI flag: [`--notifications-email-auth-password-file`](/beta-docs/@main/reference/cli/server/#--notifications-email-auth-password-file)
* YAML key: `notifications.email.emailAuth.passwordFile`

##### Username [#username-1]

**Deprecated.**
Username to use with PLAIN/LOGIN authentication.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_AUTH_USERNAME`
* CLI flag: [`--notifications-email-auth-username`](/beta-docs/@main/reference/cli/server/#--notifications-email-auth-username)
* YAML key: `notifications.email.emailAuth.username`

#### Email TLS [#email-tls-1]

Configure TLS for your SMTP server target.

##### Certificate authority file [#certificate-authority-file-1]

**Deprecated.**
CA certificate file to use.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_TLS_CACERTFILE`
* CLI flag: [`--notifications-email-tls-ca-cert-file`](/beta-docs/@main/reference/cli/server/#--notifications-email-tls-ca-cert-file)
* YAML key: `notifications.email.emailTLS.caCertFile`

##### Certificate file [#certificate-file-1]

**Deprecated.**
Certificate file to use.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_TLS_CERTFILE`
* CLI flag: [`--notifications-email-tls-cert-file`](/beta-docs/@main/reference/cli/server/#--notifications-email-tls-cert-file)
* YAML key: `notifications.email.emailTLS.certFile`

##### Certificate key file [#certificate-key-file-1]

**Deprecated.**
Certificate key file to use.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_TLS_CERTKEYFILE`
* CLI flag: [`--notifications-email-tls-cert-key-file`](/beta-docs/@main/reference/cli/server/#--notifications-email-tls-cert-key-file)
* YAML key: `notifications.email.emailTLS.certKeyFile`

##### Server name [#server-name-1]

**Deprecated.**
Server name to verify against the target certificate.

* Type: `string`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_TLS_SERVERNAME`
* CLI flag: [`--notifications-email-tls-server-name`](/beta-docs/@main/reference/cli/server/#--notifications-email-tls-server-name)
* YAML key: `notifications.email.emailTLS.serverName`

##### Skip certificate verification (insecure) [#skip-certificate-verification-insecure-1]

**Deprecated.**
Skip verification of the target server's certificate (insecure).

* Type: `bool`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_TLS_SKIPVERIFY`
* CLI flag: [`--notifications-email-tls-skip-verify`](/beta-docs/@main/reference/cli/server/#--notifications-email-tls-skip-verify)
* YAML key: `notifications.email.emailTLS.insecureSkipVerify`

##### StartTLS [#starttls-1]

**Deprecated.**
Enable STARTTLS to upgrade insecure SMTP connections using TLS.

* Type: `bool`
* Environment variable: `CODER_NOTIFICATIONS_EMAIL_TLS_STARTTLS`
* CLI flag: [`--notifications-email-tls-starttls`](/beta-docs/@main/reference/cli/server/#--notifications-email-tls-starttls)
* YAML key: `notifications.email.emailTLS.startTLS`

### Inbox [#inbox]

#### Enabled [#enabled-2]

Enable Coder Inbox.

* Type: `bool`
* Environment variable: `CODER_NOTIFICATIONS_INBOX_ENABLED`
* CLI flag: [`--notifications-inbox-enabled`](/beta-docs/@main/reference/cli/server/#--notifications-inbox-enabled)
* YAML key: `notifications.inbox.enabled`
* Default value: `true`

### Webhook [#webhook]

#### Endpoint [#endpoint]

The endpoint to which to send webhooks.

* Type: `url`
* Environment variable: `CODER_NOTIFICATIONS_WEBHOOK_ENDPOINT`
* CLI flag: [`--notifications-webhook-endpoint`](/beta-docs/@main/reference/cli/server/#--notifications-webhook-endpoint)
* YAML key: `notifications.webhook.endpoint`

## OAuth2 [#oauth2]

Configure OAuth2: GitHub login and user-provisioning, and Coder's own OAuth 2.1 authorization server.

### GitHub [#github]

#### Allow everyone [#allow-everyone]

Allow all logins, setting this option means allowed orgs and teams must be empty.

* Type: `bool`
* Environment variable: `CODER_OAUTH2_GITHUB_ALLOW_EVERYONE`
* CLI flag: [`--oauth2-github-allow-everyone`](/beta-docs/@main/reference/cli/server/#--oauth2-github-allow-everyone)
* YAML key: `oauth2.github.allowEveryone`

#### Allow signups [#allow-signups]

Whether new users can sign up with GitHub.

* Type: `bool`
* Environment variable: `CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS`
* CLI flag: [`--oauth2-github-allow-signups`](/beta-docs/@main/reference/cli/server/#--oauth2-github-allow-signups)
* YAML key: `oauth2.github.allowSignups`

#### Allowed orgs [#allowed-orgs]

Organizations the user must be a member of to Login with GitHub.

* Type: `string-array`
* Environment variable: `CODER_OAUTH2_GITHUB_ALLOWED_ORGS`
* CLI flag: [`--oauth2-github-allowed-orgs`](/beta-docs/@main/reference/cli/server/#--oauth2-github-allowed-orgs)
* YAML key: `oauth2.github.allowedOrgs`

#### Allowed teams [#allowed-teams]

Teams inside organizations the user must be a member of to Login with GitHub.
Structured as: `<organization-name>/<team-slug>`.

* Type: `string-array`
* Environment variable: `CODER_OAUTH2_GITHUB_ALLOWED_TEAMS`
* CLI flag: [`--oauth2-github-allowed-teams`](/beta-docs/@main/reference/cli/server/#--oauth2-github-allowed-teams)
* YAML key: `oauth2.github.allowedTeams`

#### Client ID [#client-id]

Client ID for Login with GitHub.

* Type: `string`
* Environment variable: `CODER_OAUTH2_GITHUB_CLIENT_ID`
* CLI flag: [`--oauth2-github-client-id`](/beta-docs/@main/reference/cli/server/#--oauth2-github-client-id)
* YAML key: `oauth2.github.clientID`

#### Client secret [#client-secret]

Client secret for Login with GitHub.

* Type: `string`
* Environment variable: `CODER_OAUTH2_GITHUB_CLIENT_SECRET`
* CLI flag: [`--oauth2-github-client-secret`](/beta-docs/@main/reference/cli/server/#--oauth2-github-client-secret)
* Holds a secret: Coder never writes this option to a YAML configuration file.
  Set it through the environment variable above.

#### Default provider enable [#default-provider-enable]

Enable the default GitHub OAuth2 provider managed by Coder.

* Type: `bool`
* Environment variable: `CODER_OAUTH2_GITHUB_DEFAULT_PROVIDER_ENABLE`
* CLI flag: [`--oauth2-github-default-provider-enable`](/beta-docs/@main/reference/cli/server/#--oauth2-github-default-provider-enable)
* YAML key: `oauth2.github.defaultProviderEnable`
* Default value: `true`

#### Device flow [#device-flow]

Enable device flow for Login with GitHub.

* Type: `bool`
* Environment variable: `CODER_OAUTH2_GITHUB_DEVICE_FLOW`
* CLI flag: [`--oauth2-github-device-flow`](/beta-docs/@main/reference/cli/server/#--oauth2-github-device-flow)
* YAML key: `oauth2.github.deviceFlow`
* Default value: `false`

#### Enterprise base URL [#enterprise-base-url]

Base URL of a GitHub Enterprise deployment to use for Login with GitHub.

* Type: `string`
* Environment variable: `CODER_OAUTH2_GITHUB_ENTERPRISE_BASE_URL`
* CLI flag: [`--oauth2-github-enterprise-base-url`](/beta-docs/@main/reference/cli/server/#--oauth2-github-enterprise-base-url)
* YAML key: `oauth2.github.enterpriseBaseURL`

### Provider [#provider]

#### Enable [#enable-4]

Enable the OAuth 2.1 authorization server, which lets external applications (such as MCP clients) obtain tokens for Coder on behalf of users.
Disabled by default.
When disabled, the OAuth2 endpoints and discovery documents return 404.

* Type: `bool`
* Environment variable: `CODER_OAUTH2_PROVIDER_ENABLE`
* CLI flag: [`--oauth2-provider-enable`](/beta-docs/@main/reference/cli/server/#--oauth2-provider-enable)
* YAML key: `oauth2.provider.enable`
* Default value: `false`

## OIDC [#oidc]

### Enable OIDC group auto create [#enable-oidc-group-auto-create]

Automatically creates missing groups from a user's groups claim.

* Type: `bool`
* Environment variable: `CODER_OIDC_GROUP_AUTO_CREATE`
* CLI flag: [`--oidc-group-auto-create`](/beta-docs/@main/reference/cli/server/#--oidc-group-auto-create)
* YAML key: `oidc.enableGroupAutoCreate`
* Default value: `false`

### Allow signups [#allow-signups-1]

Whether new users can sign up with OIDC.

* Type: `bool`
* Environment variable: `CODER_OIDC_ALLOW_SIGNUPS`
* CLI flag: [`--oidc-allow-signups`](/beta-docs/@main/reference/cli/server/#--oidc-allow-signups)
* YAML key: `oidc.allowSignups`
* Default value: `true`

### Allowed groups [#allowed-groups]

If provided any group name not in the list will not be allowed to authenticate.
This allows for restricting access to a specific set of groups.
This filter is applied after the group mapping and before the regex filter.

* Type: `string-array`
* Environment variable: `CODER_OIDC_ALLOWED_GROUPS`
* CLI flag: [`--oidc-allowed-groups`](/beta-docs/@main/reference/cli/server/#--oidc-allowed-groups)
* YAML key: `oidc.groupAllowed`

### Auth URL parameters [#auth-url-parameters]

OIDC auth URL parameters to pass to the upstream provider.

* Type: `YAML mapping`
* Environment variable: `CODER_OIDC_AUTH_URL_PARAMS`
* CLI flag: [`--oidc-auth-url-params`](/beta-docs/@main/reference/cli/server/#--oidc-auth-url-params)
* YAML key: `oidc.authURLParams`
* Default value: `{"access_type": "offline"}`

### Client cert file [#client-cert-file-1]

Pem encoded certificate file to use for oauth2 PKI/JWT authorization.
The public certificate that accompanies oidc-client-key-file.
A standard x509 certificate is expected.

* Type: `string`
* Environment variable: `CODER_OIDC_CLIENT_CERT_FILE`
* CLI flag: [`--oidc-client-cert-file`](/beta-docs/@main/reference/cli/server/#--oidc-client-cert-file)
* YAML key: `oidc.oidcClientCertFile`

### Client ID [#client-id-1]

Client ID to use for Login with OIDC.

* Type: `string`
* Environment variable: `CODER_OIDC_CLIENT_ID`
* CLI flag: [`--oidc-client-id`](/beta-docs/@main/reference/cli/server/#--oidc-client-id)
* YAML key: `oidc.clientID`

### Client key file [#client-key-file-1]

Pem encoded RSA private key to use for oauth2 PKI/JWT authorization.
This can be used instead of oidc-client-secret if your IDP supports it.

* Type: `string`
* Environment variable: `CODER_OIDC_CLIENT_KEY_FILE`
* CLI flag: [`--oidc-client-key-file`](/beta-docs/@main/reference/cli/server/#--oidc-client-key-file)
* YAML key: `oidc.oidcClientKeyFile`

### Client secret [#client-secret-1]

Client secret to use for Login with OIDC.

* Type: `string`
* Environment variable: `CODER_OIDC_CLIENT_SECRET`
* CLI flag: [`--oidc-client-secret`](/beta-docs/@main/reference/cli/server/#--oidc-client-secret)
* Holds a secret: Coder never writes this option to a YAML configuration file.
  Set it through the environment variable above.

### Email domain [#email-domain]

Email domains that clients logging in with OIDC must match.

* Type: `string-array`
* Environment variable: `CODER_OIDC_EMAIL_DOMAIN`
* CLI flag: [`--oidc-email-domain`](/beta-docs/@main/reference/cli/server/#--oidc-email-domain)
* YAML key: `oidc.emailDomain`

### Email field [#email-field]

OIDC claim field to use as the email.

* Type: `string`
* Environment variable: `CODER_OIDC_EMAIL_FIELD`
* CLI flag: [`--oidc-email-field`](/beta-docs/@main/reference/cli/server/#--oidc-email-field)
* YAML key: `oidc.emailField`
* Default value: `email`

### Group field [#group-field]

This field must be set if using the group sync feature and the scope name is not 'groups'.
Set to the claim to be used for groups.

* Type: `string`
* Environment variable: `CODER_OIDC_GROUP_FIELD`
* CLI flag: [`--oidc-group-field`](/beta-docs/@main/reference/cli/server/#--oidc-group-field)
* YAML key: `oidc.groupField`

### Group mapping [#group-mapping]

A map of OIDC group IDs and the group in Coder it should map to.
This is useful for when OIDC providers only return group IDs.

* Type: `YAML mapping`
* Environment variable: `CODER_OIDC_GROUP_MAPPING`
* CLI flag: [`--oidc-group-mapping`](/beta-docs/@main/reference/cli/server/#--oidc-group-mapping)
* YAML key: `oidc.groupMapping`
* Default value: `{}`

### Ignore email verified [#ignore-email-verified]

Ignore the email\_verified claim from the upstream provider.

* Type: `bool`
* Environment variable: `CODER_OIDC_IGNORE_EMAIL_VERIFIED`
* CLI flag: [`--oidc-ignore-email-verified`](/beta-docs/@main/reference/cli/server/#--oidc-ignore-email-verified)
* YAML key: `oidc.ignoreEmailVerified`

### Ignore UserInfo [#ignore-userinfo]

Ignore the userinfo endpoint and only use the ID token for user information.

* Type: `bool`
* Environment variable: `CODER_OIDC_IGNORE_USERINFO`
* CLI flag: [`--oidc-ignore-userinfo`](/beta-docs/@main/reference/cli/server/#--oidc-ignore-userinfo)
* YAML key: `oidc.ignoreUserInfo`
* Default value: `false`

### Issuer URL [#issuer-url]

Issuer URL to use for Login with OIDC.

* Type: `string`
* Environment variable: `CODER_OIDC_ISSUER_URL`
* CLI flag: [`--oidc-issuer-url`](/beta-docs/@main/reference/cli/server/#--oidc-issuer-url)
* YAML key: `oidc.issuerURL`

### Name field [#name-field]

OIDC claim field to use as the name.

* Type: `string`
* Environment variable: `CODER_OIDC_NAME_FIELD`
* CLI flag: [`--oidc-name-field`](/beta-docs/@main/reference/cli/server/#--oidc-name-field)
* YAML key: `oidc.nameField`
* Default value: `name`

### Redirect URL [#redirect-url]

Optional override of the default redirect url which uses the deployment's access url.
Useful in situations where a deployment has more than 1 domain.
Using this setting can also break OIDC, so use with caution.

* Type: `url`
* Environment variable: `CODER_OIDC_REDIRECT_URL`
* CLI flag: [`--oidc-redirect-url`](/beta-docs/@main/reference/cli/server/#--oidc-redirect-url)
* YAML key: `oidc.oidc-redirect-url`

### Regex group filter [#regex-group-filter]

If provided any group name not matching the regex is ignored.
This allows for filtering out groups that are not needed.
This filter is applied after the group mapping.

* Type: `regexp`
* Environment variable: `CODER_OIDC_GROUP_REGEX_FILTER`
* CLI flag: [`--oidc-group-regex-filter`](/beta-docs/@main/reference/cli/server/#--oidc-group-regex-filter)
* YAML key: `oidc.groupRegexFilter`
* Default value: `.*`

### Scopes [#scopes]

Scopes to grant when authenticating with OIDC.

* Type: `string-array`
* Environment variable: `CODER_OIDC_SCOPES`
* CLI flag: [`--oidc-scopes`](/beta-docs/@main/reference/cli/server/#--oidc-scopes)
* YAML key: `oidc.scopes`
* Default value: `openid,profile,email`

### User role default [#user-role-default]

If user role sync is enabled, these roles are always included for all authenticated users.
The 'member' role is always assigned.

* Type: `string-array`
* Environment variable: `CODER_OIDC_USER_ROLE_DEFAULT`
* CLI flag: [`--oidc-user-role-default`](/beta-docs/@main/reference/cli/server/#--oidc-user-role-default)
* YAML key: `oidc.userRoleDefault`

### User role field [#user-role-field]

This field must be set if using the user roles sync feature.
Set this to the name of the claim used to store the user's role.
The roles should be sent as an array of strings.

* Type: `string`
* Environment variable: `CODER_OIDC_USER_ROLE_FIELD`
* CLI flag: [`--oidc-user-role-field`](/beta-docs/@main/reference/cli/server/#--oidc-user-role-field)
* YAML key: `oidc.userRoleField`

### User role mapping [#user-role-mapping]

A map of the OIDC passed in user roles and the groups in Coder it should map to.
This is useful if the group names do not match.
If mapped to the empty string, the role will ignored.

* Type: `YAML mapping`
* Environment variable: `CODER_OIDC_USER_ROLE_MAPPING`
* CLI flag: [`--oidc-user-role-mapping`](/beta-docs/@main/reference/cli/server/#--oidc-user-role-mapping)
* YAML key: `oidc.userRoleMapping`
* Default value: `{}`

### Username field [#username-field]

OIDC claim field to use as the username.

* Type: `string`
* Environment variable: `CODER_OIDC_USERNAME_FIELD`
* CLI flag: [`--oidc-username-field`](/beta-docs/@main/reference/cli/server/#--oidc-username-field)
* YAML key: `oidc.usernameField`
* Default value: `preferred_username`

### OpenID Connect sign in text [#openid-connect-sign-in-text]

The text to show on the OpenID Connect sign in button.

* Type: `string`
* Environment variable: `CODER_OIDC_SIGN_IN_TEXT`
* CLI flag: [`--oidc-sign-in-text`](/beta-docs/@main/reference/cli/server/#--oidc-sign-in-text)
* YAML key: `oidc.signInText`
* Default value: `OpenID Connect`

### OpenID Connect icon URL [#openid-connect-icon-url]

URL pointing to the icon to use on the OpenID Connect login button.

* Type: `url`
* Environment variable: `CODER_OIDC_ICON_URL`
* CLI flag: [`--oidc-icon-url`](/beta-docs/@main/reference/cli/server/#--oidc-icon-url)
* YAML key: `oidc.iconURL`

### Signups disabled text [#signups-disabled-text]

The custom text to show on the error page informing about disabled OIDC signups.
Markdown format is supported.

* Type: `string`
* Environment variable: `CODER_OIDC_SIGNUPS_DISABLED_TEXT`
* CLI flag: [`--oidc-signups-disabled-text`](/beta-docs/@main/reference/cli/server/#--oidc-signups-disabled-text)
* YAML key: `oidc.signupsDisabledText`

### Skip OIDC issuer checks (not recommended) [#skip-oidc-issuer-checks-not-recommended]

OIDC issuer urls must match in the request, the id\_token 'iss' claim, and in the well-known configuration.
This flag disables that requirement, and can lead to an insecure OIDC configuration.
It is not recommended to use this flag.

* Type: `bool`
* Environment variable: `CODER_DANGEROUS_OIDC_SKIP_ISSUER_CHECKS`
* CLI flag: [`--dangerous-oidc-skip-issuer-checks`](/beta-docs/@main/reference/cli/server/#--dangerous-oidc-skip-issuer-checks)
* YAML key: `oidc.dangerousSkipIssuerChecks`

## Provisioning [#provisioning]

Tune the behavior of the provisioner, which is responsible for creating, updating, and deleting workspace resources.

### Disable Terraform module cache [#disable-terraform-module-cache]

Disable the reuse of Terraform modules cached at template import for all templates.
Modules are re-downloaded on every workspace build.
Individual templates cannot opt back in.

* Type: `bool`
* Environment variable: `CODER_PROVISIONER_DISABLE_MODULE_CACHE`
* CLI flag: [`--provisioner-disable-module-cache`](/beta-docs/@main/reference/cli/server/#--provisioner-disable-module-cache)
* YAML key: `provisioning.disableModuleCache`
* Default value: `false`

### Force cancel interval [#force-cancel-interval]

Time to force cancel provisioning tasks that are stuck.

* Type: `duration`
* Environment variable: `CODER_PROVISIONER_FORCE_CANCEL_INTERVAL`
* CLI flag: [`--provisioner-force-cancel-interval`](/beta-docs/@main/reference/cli/server/#--provisioner-force-cancel-interval)
* YAML key: `provisioning.forceCancelInterval`
* Default value: `10m0s`

### Provisioner daemon pre-shared key (PSK) [#provisioner-daemon-pre-shared-key-psk]

Pre-shared key to authenticate external provisioner daemons to Coder server.

* Type: `string`
* Environment variable: `CODER_PROVISIONER_DAEMON_PSK`
* CLI flag: [`--provisioner-daemon-psk`](/beta-docs/@main/reference/cli/server/#--provisioner-daemon-psk)
* Holds a secret: Coder never writes this option to a YAML configuration file.
  Set it through the environment variable above.

### Provisioner daemons [#provisioner-daemons]

Number of provisioner daemons to create on start.
If builds are stuck in queued state for a long time, consider increasing this.

* Type: `int`
* Environment variable: `CODER_PROVISIONER_DAEMONS`
* CLI flag: [`--provisioner-daemons`](/beta-docs/@main/reference/cli/server/#--provisioner-daemons)
* YAML key: `provisioning.daemons`
* Default value: `3`

### Poll interval [#poll-interval]

**Deprecated** and ignored.

* Type: `duration`
* Environment variable: `CODER_PROVISIONER_DAEMON_POLL_INTERVAL`
* CLI flag: [`--provisioner-daemon-poll-interval`](/beta-docs/@main/reference/cli/server/#--provisioner-daemon-poll-interval)
* YAML key: `provisioning.daemonPollInterval`
* Default value: `1s`

### Poll jitter [#poll-jitter]

**Deprecated** and ignored.

* Type: `duration`
* Environment variable: `CODER_PROVISIONER_DAEMON_POLL_JITTER`
* CLI flag: [`--provisioner-daemon-poll-jitter`](/beta-docs/@main/reference/cli/server/#--provisioner-daemon-poll-jitter)
* YAML key: `provisioning.daemonPollJitter`
* Default value: `100ms`

## Retention [#retention]

Configure data retention policies for various database tables.
Retention policies automatically purge old data to reduce database size and improve performance.
Setting a retention duration to 0 disables automatic purging for that data type.

### API keys retention [#api-keys-retention]

How long expired API keys are retained before being deleted.
Keeping expired keys allows the backend to return a more helpful error when a user tries to use an expired key.
Set to 0 to disable automatic deletion of expired keys.

* Type: `duration`
* Environment variable: `CODER_API_KEYS_RETENTION`
* CLI flag: [`--api-keys-retention`](/beta-docs/@main/reference/cli/server/#--api-keys-retention)
* YAML key: `retention.api_keys`
* Default value: `7d`

### Audit logs retention [#audit-logs-retention]

How long audit log entries are retained.
Set to 0 to disable (keep indefinitely).
We advise keeping audit logs for at least a year, and in accordance with your compliance requirements.

* Type: `duration`
* Environment variable: `CODER_AUDIT_LOGS_RETENTION`
* CLI flag: [`--audit-logs-retention`](/beta-docs/@main/reference/cli/server/#--audit-logs-retention)
* YAML key: `retention.audit_logs`
* Default value: `0`

### Boundary log retention [#boundary-log-retention]

How long boundary audit log entries are retained.
Boundary logs record HTTP requests processed by a Boundary confinement proxy.
Set to 0 to disable automatic deletion (keep indefinitely).
Adjust to match your organization's regulatory requirements.

* Type: `duration`
* Environment variable: `CODER_BOUNDARY_LOG_RETENTION`
* CLI flag: [`--boundary-log-retention`](/beta-docs/@main/reference/cli/server/#--boundary-log-retention)
* YAML key: `retention.boundary_logs`
* Default value: `0`

### Connection logs retention [#connection-logs-retention]

How long connection log entries are retained.
Set to 0 to disable (keep indefinitely).

* Type: `duration`
* Environment variable: `CODER_CONNECTION_LOGS_RETENTION`
* CLI flag: [`--connection-logs-retention`](/beta-docs/@main/reference/cli/server/#--connection-logs-retention)
* YAML key: `retention.connection_logs`
* Default value: `0`

### Workspace agent logs retention [#workspace-agent-logs-retention]

How long workspace agent logs are retained.
Logs from non-latest builds are deleted if the agent hasn't connected within this period.
Logs from the latest build are always retained.
Set to 0 to disable automatic deletion.

* Type: `duration`
* Environment variable: `CODER_WORKSPACE_AGENT_LOGS_RETENTION`
* CLI flag: [`--workspace-agent-logs-retention`](/beta-docs/@main/reference/cli/server/#--workspace-agent-logs-retention)
* YAML key: `retention.workspace_agent_logs`
* Default value: `7d`

## Telemetry [#telemetry]

Telemetry is critical to our ability to improve Coder.
We strip all personal information before sending data to our servers.
Please only disable telemetry when required by your organization's security policy.

### Enable [#enable-5]

Whether telemetry is enabled or not.
Coder collects anonymized usage data to help improve our product.

* Type: `bool`
* Environment variable: `CODER_TELEMETRY_ENABLE`
* CLI flag: [`--telemetry`](/beta-docs/@main/reference/cli/server/#--telemetry)
* YAML key: `telemetry.enable`
* Default value: `true`

## Template Builder [#template-builder]

### Disable Template Builder [#disable-template-builder]

Disable the template builder feature for guided template creation.
When disabled, all /api/v2/templatebuilder/\* endpoints return 404.

* Type: `bool`
* Environment variable: `CODER_DISABLE_TEMPLATE_BUILDER`
* CLI flag: [`--disable-template-builder`](/beta-docs/@main/reference/cli/server/#--disable-template-builder)
* YAML key: `templateBuilder.disabled`

### Registry URL [#registry-url]

The module registry host the template builder uses for module source paths (for example, "registry.coder.com" or "mirror.internal:8443").
An http(s):// scheme and trailing slash are stripped; a path, query, fragment, or credentials is rejected.

* Type: `string`
* Environment variable: `CODER_TEMPLATE_BUILDER_REGISTRY_URL`
* CLI flag: [`--template-builder-registry-url`](/beta-docs/@main/reference/cli/server/#--template-builder-registry-url)
* YAML key: `templateBuilder.registryURL`
* Default value: `registry.coder.com`

## User quiet hours schedule [#user-quiet-hours-schedule]

Allow users to set quiet hours schedules each day for workspaces to avoid workspaces stopping during the day due to template scheduling.

### Allow custom quiet hours [#allow-custom-quiet-hours]

Allow users to set their own quiet hours schedule for workspaces to stop in (depending on template autostop requirement settings).
If false, users can't change their quiet hours schedule and the site default is always used.

* Type: `bool`
* Environment variable: `CODER_ALLOW_CUSTOM_QUIET_HOURS`
* CLI flag: [`--allow-custom-quiet-hours`](/beta-docs/@main/reference/cli/server/#--allow-custom-quiet-hours)
* YAML key: `userQuietHoursSchedule.allowCustomQuietHours`
* Default value: `true`

### Default quiet hours schedule [#default-quiet-hours-schedule]

The default daily cron schedule applied to users that haven't set a custom quiet hours schedule themselves.
The quiet hours schedule determines when workspaces will be force stopped due to the template's autostop requirement, and will round the max deadline up to be within the user's quiet hours window (or default).
The format is the same as the standard cron format, but the day-of-month, month and day-of-week must be \*.
Only one hour and minute can be specified (ranges or comma separated values are not supported).

* Type: `string`
* Environment variable: `CODER_QUIET_HOURS_DEFAULT_SCHEDULE`
* CLI flag: [`--default-quiet-hours-schedule`](/beta-docs/@main/reference/cli/server/#--default-quiet-hours-schedule)
* YAML key: `userQuietHoursSchedule.defaultQuietHoursSchedule`
* Default value: `CRON_TZ=UTC 0 0 * * *`

## Workspace prebuilds [#workspace-prebuilds]

Configure how workspace prebuilds behave.

### Reconciliation interval [#reconciliation-interval]

How often to reconcile workspace prebuilds state.

* Type: `duration`
* Environment variable: `CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL`
* CLI flag: [`--workspace-prebuilds-reconciliation-interval`](/beta-docs/@main/reference/cli/server/#--workspace-prebuilds-reconciliation-interval)
* YAML key: `workspace_prebuilds.reconciliation_interval`
* Default value: `1m0s`

## Dangerous [#dangerous]

<Callout type="error" title="Caution">
  These options can break your deployment or weaken its security.
  Change them only when you understand the consequences.
</Callout>

### Allow path app sharing [#allow-path-app-sharing]

Allow workspace apps that are not served from subdomains to be shared.
Path-based app sharing is DISABLED by default for security purposes.
Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript.
Path-based apps can be disabled entirely with --disable-path-apps for further security.

* Type: `bool`
* Environment variable: `CODER_DANGEROUS_ALLOW_PATH_APP_SHARING`
* CLI flag: [`--dangerous-allow-path-app-sharing`](/beta-docs/@main/reference/cli/server/#--dangerous-allow-path-app-sharing)

### Allow site owners to access path apps [#allow-site-owners-to-access-path-apps]

Allow site-owners to access workspace apps from workspaces they do not own.
Owners cannot access path-based apps they do not own by default.
Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript.
Path-based apps can be disabled entirely with --disable-path-apps for further security.

* Type: `bool`
* Environment variable: `CODER_DANGEROUS_ALLOW_PATH_APP_SITE_OWNER_ACCESS`
* CLI flag: [`--dangerous-allow-path-app-site-owner-access`](/beta-docs/@main/reference/cli/server/#--dangerous-allow-path-app-site-owner-access)