Skip to content
Coder Docs

coder workspace-proxy server

Start a workspace proxy server

On this page

Start a workspace proxy server

Usage

coder workspace-proxy server [flags]

Options

--access-url

Typeurl
Environment$CODER_ACCESS_URL
YAMLnetworking.accessURL

The URL that users will use to access the Coder deployment.

--wildcard-access-url

Typestring
Environment$CODER_WILDCARD_ACCESS_URL
YAMLnetworking.wildcardAccessURL

Specifies the wildcard hostname to use for workspace applications in the form "*.example.com".

--docs-url

Typeurl
Environment$CODER_DOCS_URL
YAMLnetworking.docsURL
Defaulthttps://coder.com/docs

Specifies the custom docs URL.

--http-address

Typestring
Environment$CODER_HTTP_ADDRESS
YAMLnetworking.http.httpAddress
Default127.0.0.1:3000

HTTP bind address of the server. Unset to disable the HTTP endpoint.

--tls-address

Typehost:port
Environment$CODER_TLS_ADDRESS
YAMLnetworking.tls.address
Default127.0.0.1:3443

HTTPS bind address of the server.

--tls-enable

Typebool
Environment$CODER_TLS_ENABLE
YAMLnetworking.tls.enable

Whether TLS will be enabled.

--tls-cert-file

Typestring-array
Environment$CODER_TLS_CERT_FILE
YAMLnetworking.tls.certFiles

Path to each certificate for TLS. It requires a PEM-encoded file. To configure the listener to use a CA certificate, concatenate the primary certificate and the CA certificate together. The primary certificate should appear first in the combined file.

--tls-client-ca-file

Typestring
Environment$CODER_TLS_CLIENT_CA_FILE
YAMLnetworking.tls.clientCAFile

PEM-encoded Certificate Authority file used for checking the authenticity of client.

--tls-client-auth

Typestring
Environment$CODER_TLS_CLIENT_AUTH
YAMLnetworking.tls.clientAuth
Defaultnone

Policy the server will follow for TLS Client Authentication. Accepted values are "none", "request", "require-any", "verify-if-given", or "require-and-verify".

--tls-key-file

Typestring-array
Environment$CODER_TLS_KEY_FILE
YAMLnetworking.tls.keyFiles

Paths to the private keys for each of the certificates. It requires a PEM-encoded file.

--tls-min-version

Typestring
Environment$CODER_TLS_MIN_VERSION
YAMLnetworking.tls.minVersion
Defaulttls12

Minimum supported version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13".

--tls-client-cert-file

Typestring
Environment$CODER_TLS_CLIENT_CERT_FILE
YAMLnetworking.tls.clientCertFile

Path to certificate for client TLS authentication. It requires a PEM-encoded file.

--tls-client-key-file

Typestring
Environment$CODER_TLS_CLIENT_KEY_FILE
YAMLnetworking.tls.clientKeyFile

Path to key for client TLS authentication. It requires a PEM-encoded file.

--tls-ciphers

Typestring-array
Environment$CODER_TLS_CIPHERS
YAMLnetworking.tls.tlsCiphers

Specify specific TLS ciphers that allowed to be used. See https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L53-L75.

--tls-allow-insecure-ciphers

Typebool
Environment$CODER_TLS_ALLOW_INSECURE_CIPHERS
YAMLnetworking.tls.tlsAllowInsecureCiphers
Defaultfalse

By default, only ciphers marked as 'secure' are allowed to be used. See https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L82-L95.

--derp-server-enable

Typebool
Environment$CODER_DERP_SERVER_ENABLE
YAMLnetworking.derp.enable
Defaulttrue

Whether to enable or disable the embedded DERP relay server.

--derp-server-relay-url

Typeurl
Environment$CODER_DERP_SERVER_RELAY_URL
YAMLnetworking.derp.relayURL

An HTTP URL that is accessible by other replicas to relay DERP traffic. Required for high availability.

--block-direct-connections

Typebool
Environment$CODER_BLOCK_DIRECT
YAMLnetworking.derp.blockDirect

Block peer-to-peer (aka. direct) workspace connections. All workspace connections from the CLI will be proxied through Coder (or custom configured DERP servers) and will never be peer-to-peer when enabled. Workspaces may still reach out to STUN servers to get their address until they are restarted after this change has been made, but new connections will still be proxied regardless.

--prometheus-enable

Typebool
Environment$CODER_PROMETHEUS_ENABLE
YAMLintrospection.prometheus.enable

Serve prometheus metrics on the address defined by prometheus address.

--prometheus-address

Typehost:port
Environment$CODER_PROMETHEUS_ADDRESS
YAMLintrospection.prometheus.address
Default127.0.0.1:2112

The bind address to serve prometheus metrics.

--pprof-enable

Typebool
Environment$CODER_PPROF_ENABLE
YAMLintrospection.pprof.enable

Serve pprof metrics on the address defined by pprof address.

--pprof-address

Typehost:port
Environment$CODER_PPROF_ADDRESS
YAMLintrospection.pprof.address
Default127.0.0.1:6060

The bind address to serve pprof.

--trace

Typebool
Environment$CODER_TRACE_ENABLE
YAMLintrospection.tracing.enable

Whether application tracing data is collected. It exports to a backend configured by environment variables. See: https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md.

--trace-honeycomb-api-key

Typestring
Environment$CODER_TRACE_HONEYCOMB_API_KEY

Enables trace exporting to Honeycomb.io using the provided API Key.

--trace-logs

Typebool
Environment$CODER_TRACE_LOGS
YAMLintrospection.tracing.captureLogs

Enables capturing of logs as events in traces. This is useful for debugging, but may result in a very large amount of events being sent to the tracing backend which may incur significant costs.

--log-human

Typestring
Environment$CODER_LOGGING_HUMAN
YAMLintrospection.logging.humanPath
Default/dev/stderr

Output human-readable logs to a given file.

--log-json

Typestring
Environment$CODER_LOGGING_JSON
YAMLintrospection.logging.jsonPath

Output JSON logs to a given file.

--log-stackdriver

Typestring
Environment$CODER_LOGGING_STACKDRIVER
YAMLintrospection.logging.stackdriverPath

Output Stackdriver compatible logs to a given file.

--experiments

Typestring-array
Environment$CODER_EXPERIMENTS
YAMLexperiments

Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.

--proxy-trusted-headers

Typestring-array
Environment$CODER_PROXY_TRUSTED_HEADERS
YAMLnetworking.proxyTrustedHeaders

Headers to trust for forwarding IP addresses. e.g. Cf-Connecting-Ip, True-Client-Ip, X-Forwarded-For.

--proxy-trusted-origins

Typestring-array
Environment$CODER_PROXY_TRUSTED_ORIGINS
YAMLnetworking.proxyTrustedOrigins

Origin addresses to respect "proxy-trusted-headers" and X-Forwarded-Host for subdomain app routing. e.g. 192.168.1.0/24.

--secure-auth-cookie

Typebool
Environment$CODER_SECURE_AUTH_COOKIE
YAMLnetworking.secureAuthCookie

Controls if the 'Secure' property is set on browser session cookies.

--samesite-auth-cookie

Typelax|none
Environment$CODER_SAMESITE_AUTH_COOKIE
YAMLnetworking.sameSiteAuthCookie
Defaultlax

Controls the 'SameSite' property is set on browser session cookies.

--host-prefix-cookie

Typebool
Environment$CODER_HOST_PREFIX_COOKIE
YAMLnetworking.hostPrefixCookie
Defaultfalse

Recommended to be enabled. Enables __Host- prefix for cookies to guarantee they are only set by the right domain. This change is disruptive to any workspaces built before release 2.31, requiring a workspace restart.

--strict-transport-security

Typeint
Environment$CODER_STRICT_TRANSPORT_SECURITY
YAMLnetworking.tls.strictTransportSecurity
Default0

Controls if the 'Strict-Transport-Security' header is set on all static file responses. This header should only be set if the server is accessed via HTTPS. This value is the MaxAge in seconds of the header.

--strict-transport-security-options

Typestring-array
Environment$CODER_STRICT_TRANSPORT_SECURITY_OPTIONS
YAMLnetworking.tls.strictTransportSecurityOptions

Two optional fields can be set in the Strict-Transport-Security header; 'includeSubDomains' and 'preload'. The 'strict-transport-security' flag must be set to a non-zero value for these options to be used.

--disable-path-apps

Typebool
Environment$CODER_DISABLE_PATH_APPS
YAMLdisablePathApps

Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.

--disable-owner-workspace-access

Typebool
Environment$CODER_DISABLE_OWNER_WORKSPACE_ACCESS
YAMLdisableOwnerWorkspaceAccess

Remove the permission for the 'owner' role to have workspace execution on all workspaces. This prevents the 'owner' from ssh, apps, and terminal access based on the 'owner' role. They still have their user permissions to access their own workspaces.

--write-config

Typebool


Write out the current server config as YAML to stdout.

--proxy-session-token

Typestring
Environment$CODER_PROXY_SESSION_TOKEN
YAMLexternalWorkspaceProxy.proxySessionToken

Authentication token for the workspace proxy to communicate with coderd.

--primary-access-url

Typeurl
Environment$CODER_PRIMARY_ACCESS_URL
YAMLexternalWorkspaceProxy.primaryAccessURL

URL to communicate with coderd. This should match the access URL of the Coder deployment.

--derp-only

Typebool
Environment$CODER_PROXY_DERP_ONLY
YAMLexternalWorkspaceProxy.derpOnly

Run a proxy server that only supports DERP connections and does not proxy workspace app/terminal traffic.

Edit on GitHub