coder workspace-proxy server

Start a workspace proxy server

Usage

Options

--access-url

The URL that users will use to access the Coder deployment.

--wildcard-access-url

Specifies the wildcard hostname to use for workspace applications in the form "*.example.com".

--docs-url

Specifies the custom docs URL.

--http-address

HTTP bind address of the server. Unset to disable the HTTP endpoint.

--tls-address

HTTPS bind address of the server.

--tls-enable

Whether TLS will be enabled.

--tls-cert-file

Path to each certificate for TLS. It requires a PEM-encoded file. To configure the listener to use a CA certificate, concatenate the primary certificate and the CA certificate together. The primary certificate should appear first in the combined file.

--tls-client-ca-file

PEM-encoded Certificate Authority file used for checking the authenticity of client.

--tls-client-auth

Policy the server will follow for TLS Client Authentication. Accepted values are "none", "request", "require-any", "verify-if-given", or "require-and-verify".

--tls-key-file

Paths to the private keys for each of the certificates. It requires a PEM-encoded file.

--tls-min-version

Minimum supported version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13".

--tls-client-cert-file

Path to certificate for client TLS authentication. It requires a PEM-encoded file.

--tls-client-key-file

Path to key for client TLS authentication. It requires a PEM-encoded file.

--tls-ciphers

Specify specific TLS ciphers that allowed to be used. See https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L53-L75.

--tls-allow-insecure-ciphers

By default, only ciphers marked as 'secure' are allowed to be used. See https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L82-L95.

--derp-server-enable

Whether to enable or disable the embedded DERP relay server.

--derp-server-relay-url

An HTTP URL that is accessible by other replicas to relay DERP traffic. Required for high availability.

--block-direct-connections

Block peer-to-peer (aka. direct) workspace connections. All workspace connections from the CLI will be proxied through Coder (or custom configured DERP servers) and will never be peer-to-peer when enabled. Workspaces may still reach out to STUN servers to get their address until they are restarted after this change has been made, but new connections will still be proxied regardless.

--prometheus-enable

Serve prometheus metrics on the address defined by prometheus address.

--prometheus-address

The bind address to serve prometheus metrics.

--pprof-enable

Serve pprof metrics on the address defined by pprof address.

--pprof-address

The bind address to serve pprof.

--trace

Whether application tracing data is collected. It exports to a backend configured by environment variables. See: https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md.

--trace-honeycomb-api-key

Enables trace exporting to Honeycomb.io using the provided API Key.

--trace-logs

Enables capturing of logs as events in traces. This is useful for debugging, but may result in a very large amount of events being sent to the tracing backend which may incur significant costs.

--log-human

Output human-readable logs to a given file.

--log-json

Output JSON logs to a given file.

--log-stackdriver

Output Stackdriver compatible logs to a given file.

--experiments

Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.

--proxy-trusted-headers

Headers to trust for forwarding IP addresses. e.g. Cf-Connecting-Ip, True-Client-Ip, X-Forwarded-For.

--proxy-trusted-origins

Origin addresses to respect "proxy-trusted-headers" and X-Forwarded-Host for subdomain app routing. e.g. 192.168.1.0/24.

--secure-auth-cookie

Controls if the 'Secure' property is set on browser session cookies.

--samesite-auth-cookie

Controls the 'SameSite' property is set on browser session cookies.

--host-prefix-cookie

Recommended to be enabled. Enables __Host- prefix for cookies to guarantee they are only set by the right domain. This change is disruptive to any workspaces built before release 2.31, requiring a workspace restart.

--strict-transport-security

Controls if the 'Strict-Transport-Security' header is set on all static file responses. This header should only be set if the server is accessed via HTTPS. This value is the MaxAge in seconds of the header.

--strict-transport-security-options

Two optional fields can be set in the Strict-Transport-Security header; 'includeSubDomains' and 'preload'. The 'strict-transport-security' flag must be set to a non-zero value for these options to be used.

--disable-path-apps

Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.

--disable-owner-workspace-access

Remove the permission for the 'owner' role to have workspace execution on all workspaces. This prevents the 'owner' from ssh, apps, and terminal access based on the 'owner' role. They still have their user permissions to access their own workspaces.

--write-config

Write out the current server config as YAML to stdout.

--proxy-session-token

Authentication token for the workspace proxy to communicate with coderd.

--primary-access-url

URL to communicate with coderd. This should match the access URL of the Coder deployment.

--derp-only

Run a proxy server that only supports DERP connections and does not proxy workspace app/terminal traffic.