Developer (Dev) URLs allow users to access the ports of services they develop within their workspace. However, before individual developers can set up dev URLs, an administrator must configure and enable dev URL usage.

Before you proceed

You must own a wildcard DNS record for your custom domain name to enable and use dev URLs with Coder.

Enabling the use of dev URLs

Dev URLs is an opt-in feature. To enable dev URLs in your cluster, you'll need to modify your:

1. Helm chart
2. Wildcard DNS record

Step 1: Modify the Helm chart

Set devurls.host to a wildcard domain:

helm upgrade coder coder/coder --set coderd.devurlsHost="*.my-custom-domain.io"

Note: If you are providing an ingress controller, then you will need to add the rule manually to the ingress.

 - host: "*.my-custom-domain.io"
    http:
      paths:
      - path: /
        backend:
          serviceName: coderd
          servicePort: 8080

Step 2: Modify the wildcard DNS record

The final step to enabling dev URLs is to update your wildcard DNS record. Get the LoadBalancer IP address using kubectl --namespace coder get svc and point your wildcard DNS record (e.g., *.my-custom-domain.io) to the external-IP value found in the ingress-nginx or the coderd lines.

Step 3 (Optional): Add a TLS certificate

For secure (HTTPS) dev URLs, you can add (or generate) a TLS certificate for the wildcard domain.

• See our guide for creating a TLS certificate using LetsEncrypt
• To add a custom certificate, refer to our Helm chart

Setting dev URL access permissions

Once you've enabled dev URLs for users, you can set the maximum access level. To do so, go to Manage > Admin. On the Infrastructure tab, scroll down to Dev URL Access Permissions.

You can set the maximum access level, but developers may choose to restrict access further.

For example, if you set the maximum access level as Authenticated, then all dev URLs created for workspaces in your Coder deployment will be accessible to any authenticated Coder user.

The developer, however, can choose to set a stricter permission level (e.g., allowing only those in their organization to use the dev URL). Developers cannot choose a more permissive option.

Authentication with apps requiring a single callback URL

If you're using GitHub credentials to sign in to an application, and your GitHub OAuth app has the authorization callback URL set to localhost, you will need to work around the fact that GitHub enforces a single callback URL (since each workspace gets a unique dev URL).

To do so, you can either:

• Use SSH tunneling to tunnel the web app to individual developers' localhost instead of dev URLs (this is also an out-of-the-box feature included with VS Code Remote)
• Use this workaround for multiple callback sub-URLs