Add a git credential helper for Gitea, backed by tea's own login

Coder's GIT_ASKPASS only knows about github.com; for git.octoturge.com it falls through to a broken interactive prompt, so `git push`/`pull` over HTTPS hangs or fails even after `tea login add` succeeds. A credential helper answering `git credential fill` runs before GIT_ASKPASS is consulted, so wire one up (gated on the wizard's existing DID_GITEA check) that reads the live OAuth token straight out of tea's own credentials.json - verified end-to-end against a running workspace (git ls-remote over HTTPS authenticated successfully). Bump every template's VERSION to publish it.
Bump every template's VERSION to publish the git.octoturge.com fix
2026-08-31 09:17:55 +02:00 · 2026-08-28 18:04:51 +02:00 · 2026-08-28 18:02:34 +02:00 · 2026-08-27 12:12:27 +02:00 · 2026-08-27 11:14:36 +02:00 · 2026-08-27 09:32:30 +02:00
25 changed files with 1661 additions and 127 deletions
@@ -2,17 +2,52 @@ name: Provision Coder Templates
 # Keeps Coder templates in sync with templates/*/ in this repo:
 #   - every push to main pushes a new version of each templates/<env>/ dir
-#     (coder templates push creates it if it doesn't exist yet, so adding a
+#     whose VERSION file names a version not already pushed (coder templates
-#     new templates/<env>/ directory is enough to provision a new one)
+#     push creates the template if it doesn't exist yet, so adding a new
 #     templates/<env>/ directory - with a VERSION file - is enough to
 #     provision a new one). This workflow triggers on any change under
 #     templates/**, not just a specific template's own directory, so VERSION
 #     is what keeps an edit to one template from generating a no-op new
 #     version for every other, unchanged template.
 #   - if a templates/<env>/ directory is removed on main, its template is
 #     deleted from Coder. `coder templates delete` refuses to delete a
 #     template that still has active workspaces, so this can't silently
 #     orphan running workspaces - it just fails loudly and needs a human.
 #
-# Requires two repo/org secrets (Settings > Actions > Secrets):
+# Requires three repo/org secrets (Settings > Actions > Secrets):
-#   CODER_URL             e.g. https://code.octoturge.com
+#   CODER_URL              e.g. https://code.octoturge.com
-#   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
+#   CODER_SESSION_TOKEN    a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
 #   PACKAGE_REGISTRY_TOKEN a Gitea access token (user Settings > Applications)
 #                          with write:package scope, for pushing each
 #                          Dockerfile-having template's image to this
 #                          instance's container registry.
 #
 # Not secrets.GITEA_TOKEN (Gitea Actions' built-in token): as of this
 # writing it cannot authenticate to the container registry in any shipped
 # Gitea version - `permissions: packages: write` is a no-op because the
 # Actions token's package scope isn't wired up server-side yet (open since
 # Gitea 1.19: https://github.com/go-gitea/gitea/issues/23642; fix in
 # https://github.com/go-gitea/gitea/pull/39070, not yet merged). Every
 # attempt fails at docker login with a plain "unauthorized", regardless of
 # the permissions: block or which account triggered the workflow. A
 # manually-created PAT is the only thing that currently works. Named
 # without a GITEA_ prefix because Gitea Actions reserves that prefix for
 # its own built-in secrets and rejects creating one with that name.
 #
 # Any templates/<env>/ that has its own Dockerfile gets its image built and
 # pushed here (build-images, on the dedicated "docker-build" runner - see
 # templates/web/main.tf for why: that runner is scoped to this repo only and
 # has host Docker socket access that the shared runner-1 deliberately
 # doesn't). provision then just pulls the tag build-images produced, instead
 # of building it itself at `terraform apply` time - keeps a slow toolchain
 # compile off of "someone is waiting to create a workspace".
 #
 # Each template's image is built independently - one Dockerfile failing to
 # build doesn't stop the others from building, and provision skips pushing
 # only the specific template(s) whose image build failed this run (leaving
 # their previous, already-working Coder template version in place) rather
 # than skipping every template or pushing one with no matching image.
 on:
  push:
@@ -23,11 +58,83 @@ on:
  workflow_dispatch: {}
 jobs:
  build-images:
    # The docker-build runner's docker_host: "" setting already auto-injects
    # /var/run/docker.sock into job containers - an explicit
    # container.volumes mount for the same path here fails at container
    # creation with "Duplicate mount point: /var/run/docker.sock".
    runs-on: docker-build
    # Currently a no-op (see the PACKAGE_REGISTRY_TOKEN note above) but
    # harmless to declare now - once go-gitea/gitea#39070 ships, GITEA_TOKEN
    # will need this to get package write access, so this is one less thing
    # to remember when PACKAGE_REGISTRY_TOKEN can eventually be retired.
    permissions:
      packages: write
    outputs:
      failed_templates: ${{ steps.build.outputs.failed_templates }}
    # docker:27-cli (Alpine) has no bash - only the POSIX /bin/sh (busybox
    # ash) - but run: steps default to bash, which fails with "exec: bash:
    # executable file not found in $PATH". Both run: steps below are plain
    # POSIX shell already, so just run them under sh.
    defaults:
      run:
        shell: sh
    steps:
      # actions/checkout is a JS action and needs Node in the job container -
      # this job runs in docker:27-cli (Alpine, just the Docker CLI) so it has
      # no Node, and actions/checkout fails immediately with "exec: node:
      # executable file not found in $PATH". Alpine does have apk/git though,
      # so clone directly instead.
      - name: Checkout
        run: |
          set -e
          apk add --no-cache git
          git clone --depth 1 --branch "${{ github.ref_name }}" "${{ github.server_url }}/${{ github.repository }}.git" .
      - name: Build and push every template's image (skips a tag that's already in the registry)
        id: build
        run: |
          set -e
          echo "${{ secrets.PACKAGE_REGISTRY_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
          FAILED=""
          for dockerfile in templates/*/Dockerfile; do
            [ -e "$dockerfile" ] || continue
            dir="$(dirname "$dockerfile")"
            name="$(basename "$dir")"
            TAG="$(sha1sum "$dockerfile" | cut -d' ' -f1)"
            IMAGE="git.octoturge.com/octo-tech/profiles-${name}:${TAG}"
            echo "::group::${name}"
            if docker manifest inspect "$IMAGE" >/dev/null 2>&1; then
              echo "$IMAGE already in the registry (Dockerfile unchanged), skipping build."
            elif docker build -t "$IMAGE" "$dir" && docker push "$IMAGE"; then
              echo "Built and pushed $IMAGE"
            else
              echo "::warning::Failed to build/push $IMAGE - templates/$name will be skipped this run."
              FAILED="$FAILED $name"
            fi
            echo "::endgroup::"
          done
          echo "failed_templates=${FAILED# }" >> "$GITHUB_OUTPUT"
  provision:
    # needs: build-images orders this after the image builds (so a fresh
    # template push never points at a tag that isn't in the registry yet)
    # without making every template's reprovisioning depend on ALL builds
    # succeeding - if:always() overrides the default "skip if a dependency
    # failed" behavior, since build-images only fails outright on an
    # infra-level problem (e.g. registry login); a single template's build
    # failure is reported via failed_templates instead and only skips that
    # one template below.
    needs: build-images
    if: always()
    runs-on: ubuntu-latest
    env:
      CODER_URL: ${{ secrets.CODER_URL }}
      CODER_SESSION_TOKEN: ${{ secrets.CODER_SESSION_TOKEN }}
      FAILED_TEMPLATES: ${{ needs.build-images.outputs.failed_templates }}
    steps:
      - name: Checkout (full history, needed to detect removed templates)
        uses: actions/checkout@v4
@@ -44,10 +151,50 @@ jobs:
        run: |
          set -e
          for dir in templates/*/; do
-            name="profiles-$(basename "$dir")"
+            name="$(basename "$dir")"
-            echo "::group::Pushing $name from $dir"
+            full="profiles-$name"
-            coder templates push "$name" -d "$dir" --yes \
+            case " $FAILED_TEMPLATES " in
-              -m "auto-provisioned from ${GITHUB_SHA:0:12}"
+              *" $name "*)
                echo "::warning::Skipping $full - its Docker image failed to build this run (see build-images), leaving the previous template version in place."
                continue
                ;;
            esac
            # templates/<name>/VERSION lets a template opt out of being
            # reprovisioned on every push: bump it and coder templates push
            # names the new version "v<N>". This is a manual contract, not a
            # content hash - editing a template without bumping its VERSION
            # means the change won't go out until someone does. paths: on
            # this workflow's trigger is templates/** as a whole, so without
            # this every template gets a new (identical) version on any push
            # under templates/, even ones whose own directory didn't change.
            #
            # Rather than pre-checking `coder templates versions list` for
            # whether v<N> already exists (fragile - depends on its exact
            # JSON shape matching what we expect), just attempt the push and
            # treat its specific "version already exists" failure as the
            # skip signal instead.
            version=""
            if [ -f "$dir/VERSION" ]; then
              version="$(tr -d '[:space:]' < "$dir/VERSION")"
            fi
            args=(-d "$dir" --yes -m "auto-provisioned from ${GITHUB_SHA:0:12}")
            [ -n "$version" ] && args+=(--name "v$version")
            echo "::group::Pushing $full from $dir"
            if push_output="$(coder templates push "$full" "${args[@]}" 2>&1)"; then
              echo "$push_output"
            else
              push_status=$?
              echo "$push_output"
              if [ -n "$version" ] && printf '%s' "$push_output" | grep -qF "A template version with name \"v$version\" already exists"; then
                echo "Version v$version (templates/$name/VERSION) is already pushed - nothing to do. Bump the VERSION file to push a new one."
              else
                echo "::endgroup::"
                exit "$push_status"
              fi
            fi
            echo "::endgroup::"
          done
@@ -47,8 +47,8 @@ extra `coder_script` needed, matching how the `/etc/skel` copy in every
 template's `startup_script` already relies on that same mechanism.
 Each `templates/<env>/` is a complete, independent Coder template (agent,
-docker container, code-server, JetBrains) with its own copy of everything
+docker container, code-server) with its own copy of everything `main.tf`
-`main.tf` needs. They're deliberately not built from a shared Terraform
+needs. They're deliberately not built from a shared Terraform
 module or shared files elsewhere in the repo: `coder templates push -d
 templates/<env>` only uploads that one directory to the Coder server, so any
 `file()` reference reaching outside it (e.g. the old shared
@@ -114,6 +114,21 @@ finishes it - and offers to install + log into:
 - **GitHub Copilot CLI** (`bun install -g @github/copilot`, then `copilot login`)
 - **Google Antigravity CLI** (`curl -fsSL https://antigravity.google/cli/install.sh | bash`, binary `agy`)
 - **Claude Code CLI** (`bun install -g @anthropic-ai/claude-code`, then `claude`)
 - **GitHub CLI** (`gh`, via the official apt repo, then `gh auth login`)
 - **Gitea CLI** (`tea`, official binary release downloaded to `~/.local/bin`, then `tea login add`)
 `git` and `gnupg` themselves aren't part of this opt-in flow - every
 template's `coder_agent` startup script installs them unconditionally as
 base packages (a no-op where they're already present, e.g. baked into
 `templates/web`'s image). If the wizard just authenticated GitHub and/or
 Gitea above (skipped entirely for "local git only" - neither set up), it
 asks once more whether to auto-generate an ed25519 SSH key and an ed25519
 GPG signing key and register them with whichever host(s) got set up: `gh
 ssh-key add` / `gh gpg-key add` for GitHub, a direct call against Gitea's
 `/api/v1/user/keys` and `/api/v1/user/gpg_keys` (using the token `tea
 login add` already stored) for Gitea. Either upload failing just prints
 the manual command/URL to finish it yourself - never blocks the rest of
 the wizard.
 It does **not** ask about VS Code extensions, since those are handled by
 Terraform (see above). Once the user confirms completion it writes a
@@ -0,0 +1 @@
 3
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1
 # Tracks whether the user actually ended up authenticated against GitHub
 # and/or Gitea below, so the SSH/GPG key step can ask about exactly the
 # host(s) in play (and stay silent - "local git only" - if neither).
 DID_GITHUB=0
 DID_GITEA=0
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
@@ -96,6 +102,198 @@ else
  echo "Skipping Claude Code CLI: bun not found on this workspace image."
 fi
 # --- GitHub CLI (gh) ---
 if command -v gh >/dev/null 2>&1; then
  echo "GitHub CLI already installed, skipping."
 else
  if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
    if (sudo mkdir -p -m 755 /etc/apt/keyrings \
        && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
        && sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
        && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
        && sudo apt-get update -qq && sudo apt-get install -y gh); then
      gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
    else
      echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
    fi
  fi
 fi
 command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
  echo "Gitea CLI already installed, skipping."
 else
  if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
    TEA_ARCH="$(uname -m)"
    case "$TEA_ARCH" in
      x86_64) TEA_ARCH="amd64" ;;
      aarch64) TEA_ARCH="arm64" ;;
    esac
    TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
    mkdir -p "$HOME/.local/bin"
    if [ -n "$TEA_VERSION" ] \
        && curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
        && chmod +x "$HOME/.local/bin/tea"; then
      echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
      tea login add || echo "Login didn't complete. Retry any time with: tea login add"
    else
      echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
      rm -f "$HOME/.local/bin/tea"
    fi
  fi
 fi
 # `tea whoami` succeeds regardless of how the login was done (personal
 # access token or OAuth) - more reliable than parsing tea's own
 # config.yml, whose indentation and fields (no plaintext `token:` at all
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 # --- Git credential helper for Gitea, backed by tea's own login ---
 # Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
 # only recognizes external auth providers it knows about (github.com is
 # configured on the Coder deployment itself) - for any other host it falls
 # through to a broken interactive prompt that just hangs a non-interactive
 # git subprocess. A credential helper that successfully answers
 # `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
 # registering one for git.octoturge.com sidesteps that broken path
 # entirely, without touching how Coder handles github.com.
 #
 # The token itself lives in tea's own store
 # (~/.config/tea/credentials.json), which tea keeps fresh (via its
 # refresh_token) as a side effect of any authenticated call - this helper
 # never keeps its own copy, just re-reads tea's live value every time git
 # asks.
 if [ "$DID_GITEA" -eq 1 ]; then
  GITEA_LOGIN_NAME="$(awk '
    /^[[:space:]]*- name:/ { name = $NF }
    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
  if [ -n "$GITEA_LOGIN_NAME" ]; then
    mkdir -p "$HOME/.local/bin"
    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
    cat > "$HELPER" <<'HELPER_EOT'
 #!/bin/sh
 # Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
 # regenerate this after logging into a different Gitea account.
 LOGIN_NAME="__GITEA_LOGIN_NAME__"
 CRED_FILE="$HOME/.config/tea/credentials.json"
 case "$1" in
  get)
    # Authenticated no-op call: gives tea a chance to refresh and persist
    # an expired access_token before we read it below.
    tea whoami >/dev/null 2>&1
    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
    if [ -n "$token" ]; then
      echo "username=oauth2"
      echo "password=$token"
    fi
    ;;
  store|erase)
    # No-op: credentials.json (managed by tea) is the single source of
    # truth, nothing for git to persist or clear on this end.
    ;;
 esac
 HELPER_EOT
    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
    chmod +x "$HELPER"
    git config --global credential."https://git.octoturge.com".helper "$HELPER"
    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
  fi
 fi
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
 if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub and Gitea"
  elif [ "$DID_GITHUB" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub"
  else
    KEY_HOSTS_DESC="Gitea"
  fi
  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
    # add one manually afterwards with `ssh-keygen -p` if you want one).
    SSH_KEY="$HOME/.ssh/id_ed25519"
    if [ ! -f "$SSH_KEY" ]; then
      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
      echo "Generated SSH key: ${SSH_KEY}.pub"
    else
      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
    fi
    if [ "$DID_GITHUB" -eq 1 ]; then
      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
        echo "SSH key added to GitHub."
      else
        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
      fi
    fi
    if [ "$DID_GITEA" -eq 1 ]; then
      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi
    # GPG key: ed25519 signing key, no passphrase, no expiry.
    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
      echo "GPG key for $KEY_EMAIL already exists, reusing it."
    else
      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
      gpgconf --kill gpg-agent 2>/dev/null
      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
        echo "Generated GPG signing key for $KEY_EMAIL."
      else
        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
      fi
    fi
    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
    if [ -n "$GPG_KEY_ID" ]; then
      git config --global user.signingkey "$GPG_KEY_ID"
      git config --global commit.gpgsign true
      echo "Configured git to sign commits with this key."
      if [ "$DID_GITHUB" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
          echo "GPG key added to GitHub."
        else
          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
        fi
      fi
      if [ "$DID_GITEA" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
 elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
  # gh and/or tea are installed but neither is actually logged in yet (login
  # was declined, failed, or never completed) - say why the key-generation
  # question above got skipped instead of just silently not asking.
  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi
 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
  touch "$WIZARD_DONE_FILE"
@@ -6,6 +6,16 @@ terraform {
    docker = {
      source = "kreuzwerker/docker"
    }
    # Not used directly in this config. Existing workspace state from before
    # the jetbrains module was removed still has resources tagged under this
    # provider (the module used it internally to fetch IDE metadata) -
    # terraform init only installs providers the current config declares, so
    # without this, plan/apply fails with "Missing required provider" while
    # trying to reconcile/destroy those leftover state entries. Safe to drop
    # once every workspace has updated past the jetbrains-module version.
    http = {
      source = "hashicorp/http"
    }
  }
 }
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi
    # Ensure git and gnupg (commit signing) are present as base packages -
    # not every base image ships gnupg by default. No-op once both are
    # present (e.g. templates/web already bakes them into its image).
    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
      sudo apt-get update -qq
      sudo apt-get install -y --no-install-recommends git gnupg
    fi
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT
@@ -141,17 +159,6 @@ module "code-server" {
  order      = 1
 }
 # See https://registry.coder.com/modules/coder/jetbrains
 module "jetbrains" {
  count      = data.coder_workspace.me.start_count
  source     = "registry.coder.com/coder/jetbrains/coder"
  version    = "~> 1.1"
  agent_id   = coder_agent.main.id
  agent_name = "main"
  folder     = "/home/coder"
  tooltip    = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
 }
 resource "docker_volume" "home_volume" {
  name = "coder-${data.coder_workspace.me.id}-home"
  # Protect the volume from being deleted due to changes in attributes.
@@ -197,6 +204,13 @@ resource "docker_container" "workspace" {
    host = "code.octoturge.com"
    ip   = "host-gateway"
  }
  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
  # without this the workspace's public DNS answer for git.octoturge.com
  # NAT-hairpins back to the LAN and times out (curl: (28)).
  host {
    host = "git.octoturge.com"
    ip   = "host-gateway"
  }
  volumes {
    container_path = "/home/coder"
    volume_name    = docker_volume.home_volume.name
@@ -251,7 +265,8 @@ resource "coder_script" "cli_setup_wizard" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
    chmod +x /opt/coder/cli-setup-wizard.sh
@@ -306,7 +321,8 @@ resource "coder_script" "install_skills" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
    chmod +x /opt/coder/install-skills.sh
    SPECIALTY_SKILLS="openscad-parametric" /opt/coder/install-skills.sh
@@ -0,0 +1 @@
 3
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1
 # Tracks whether the user actually ended up authenticated against GitHub
 # and/or Gitea below, so the SSH/GPG key step can ask about exactly the
 # host(s) in play (and stay silent - "local git only" - if neither).
 DID_GITHUB=0
 DID_GITEA=0
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
@@ -96,6 +102,198 @@ else
  echo "Skipping Claude Code CLI: bun not found on this workspace image."
 fi
 # --- GitHub CLI (gh) ---
 if command -v gh >/dev/null 2>&1; then
  echo "GitHub CLI already installed, skipping."
 else
  if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
    if (sudo mkdir -p -m 755 /etc/apt/keyrings \
        && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
        && sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
        && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
        && sudo apt-get update -qq && sudo apt-get install -y gh); then
      gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
    else
      echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
    fi
  fi
 fi
 command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
  echo "Gitea CLI already installed, skipping."
 else
  if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
    TEA_ARCH="$(uname -m)"
    case "$TEA_ARCH" in
      x86_64) TEA_ARCH="amd64" ;;
      aarch64) TEA_ARCH="arm64" ;;
    esac
    TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
    mkdir -p "$HOME/.local/bin"
    if [ -n "$TEA_VERSION" ] \
        && curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
        && chmod +x "$HOME/.local/bin/tea"; then
      echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
      tea login add || echo "Login didn't complete. Retry any time with: tea login add"
    else
      echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
      rm -f "$HOME/.local/bin/tea"
    fi
  fi
 fi
 # `tea whoami` succeeds regardless of how the login was done (personal
 # access token or OAuth) - more reliable than parsing tea's own
 # config.yml, whose indentation and fields (no plaintext `token:` at all
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 # --- Git credential helper for Gitea, backed by tea's own login ---
 # Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
 # only recognizes external auth providers it knows about (github.com is
 # configured on the Coder deployment itself) - for any other host it falls
 # through to a broken interactive prompt that just hangs a non-interactive
 # git subprocess. A credential helper that successfully answers
 # `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
 # registering one for git.octoturge.com sidesteps that broken path
 # entirely, without touching how Coder handles github.com.
 #
 # The token itself lives in tea's own store
 # (~/.config/tea/credentials.json), which tea keeps fresh (via its
 # refresh_token) as a side effect of any authenticated call - this helper
 # never keeps its own copy, just re-reads tea's live value every time git
 # asks.
 if [ "$DID_GITEA" -eq 1 ]; then
  GITEA_LOGIN_NAME="$(awk '
    /^[[:space:]]*- name:/ { name = $NF }
    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
  if [ -n "$GITEA_LOGIN_NAME" ]; then
    mkdir -p "$HOME/.local/bin"
    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
    cat > "$HELPER" <<'HELPER_EOT'
 #!/bin/sh
 # Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
 # regenerate this after logging into a different Gitea account.
 LOGIN_NAME="__GITEA_LOGIN_NAME__"
 CRED_FILE="$HOME/.config/tea/credentials.json"
 case "$1" in
  get)
    # Authenticated no-op call: gives tea a chance to refresh and persist
    # an expired access_token before we read it below.
    tea whoami >/dev/null 2>&1
    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
    if [ -n "$token" ]; then
      echo "username=oauth2"
      echo "password=$token"
    fi
    ;;
  store|erase)
    # No-op: credentials.json (managed by tea) is the single source of
    # truth, nothing for git to persist or clear on this end.
    ;;
 esac
 HELPER_EOT
    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
    chmod +x "$HELPER"
    git config --global credential."https://git.octoturge.com".helper "$HELPER"
    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
  fi
 fi
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
 if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub and Gitea"
  elif [ "$DID_GITHUB" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub"
  else
    KEY_HOSTS_DESC="Gitea"
  fi
  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
    # add one manually afterwards with `ssh-keygen -p` if you want one).
    SSH_KEY="$HOME/.ssh/id_ed25519"
    if [ ! -f "$SSH_KEY" ]; then
      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
      echo "Generated SSH key: ${SSH_KEY}.pub"
    else
      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
    fi
    if [ "$DID_GITHUB" -eq 1 ]; then
      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
        echo "SSH key added to GitHub."
      else
        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
      fi
    fi
    if [ "$DID_GITEA" -eq 1 ]; then
      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi
    # GPG key: ed25519 signing key, no passphrase, no expiry.
    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
      echo "GPG key for $KEY_EMAIL already exists, reusing it."
    else
      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
      gpgconf --kill gpg-agent 2>/dev/null
      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
        echo "Generated GPG signing key for $KEY_EMAIL."
      else
        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
      fi
    fi
    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
    if [ -n "$GPG_KEY_ID" ]; then
      git config --global user.signingkey "$GPG_KEY_ID"
      git config --global commit.gpgsign true
      echo "Configured git to sign commits with this key."
      if [ "$DID_GITHUB" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
          echo "GPG key added to GitHub."
        else
          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
        fi
      fi
      if [ "$DID_GITEA" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
 elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
  # gh and/or tea are installed but neither is actually logged in yet (login
  # was declined, failed, or never completed) - say why the key-generation
  # question above got skipped instead of just silently not asking.
  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi
 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
  touch "$WIZARD_DONE_FILE"
@@ -6,6 +6,16 @@ terraform {
    docker = {
      source = "kreuzwerker/docker"
    }
    # Not used directly in this config. Existing workspace state from before
    # the jetbrains module was removed still has resources tagged under this
    # provider (the module used it internally to fetch IDE metadata) -
    # terraform init only installs providers the current config declares, so
    # without this, plan/apply fails with "Missing required provider" while
    # trying to reconcile/destroy those leftover state entries. Safe to drop
    # once every workspace has updated past the jetbrains-module version.
    http = {
      source = "hashicorp/http"
    }
  }
 }
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi
    # Ensure git and gnupg (commit signing) are present as base packages -
    # not every base image ships gnupg by default. No-op once both are
    # present (e.g. templates/web already bakes them into its image).
    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
      sudo apt-get update -qq
      sudo apt-get install -y --no-install-recommends git gnupg
    fi
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT
@@ -141,17 +159,6 @@ module "code-server" {
  order      = 1
 }
 # See https://registry.coder.com/modules/coder/jetbrains
 module "jetbrains" {
  count      = data.coder_workspace.me.start_count
  source     = "registry.coder.com/coder/jetbrains/coder"
  version    = "~> 1.1"
  agent_id   = coder_agent.main.id
  agent_name = "main"
  folder     = "/home/coder"
  tooltip    = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
 }
 resource "docker_volume" "home_volume" {
  name = "coder-${data.coder_workspace.me.id}-home"
  # Protect the volume from being deleted due to changes in attributes.
@@ -197,6 +204,13 @@ resource "docker_container" "workspace" {
    host = "code.octoturge.com"
    ip   = "host-gateway"
  }
  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
  # without this the workspace's public DNS answer for git.octoturge.com
  # NAT-hairpins back to the LAN and times out (curl: (28)).
  host {
    host = "git.octoturge.com"
    ip   = "host-gateway"
  }
  volumes {
    container_path = "/home/coder"
    volume_name    = docker_volume.home_volume.name
@@ -251,7 +265,8 @@ resource "coder_script" "cli_setup_wizard" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
    chmod +x /opt/coder/cli-setup-wizard.sh
@@ -306,7 +321,8 @@ resource "coder_script" "install_skills" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
    chmod +x /opt/coder/install-skills.sh
    SPECIALTY_SKILLS="cobol-teacher" /opt/coder/install-skills.sh
@@ -0,0 +1 @@
 3
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1
 # Tracks whether the user actually ended up authenticated against GitHub
 # and/or Gitea below, so the SSH/GPG key step can ask about exactly the
 # host(s) in play (and stay silent - "local git only" - if neither).
 DID_GITHUB=0
 DID_GITEA=0
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
@@ -96,6 +102,198 @@ else
  echo "Skipping Claude Code CLI: bun not found on this workspace image."
 fi
 # --- GitHub CLI (gh) ---
 if command -v gh >/dev/null 2>&1; then
  echo "GitHub CLI already installed, skipping."
 else
  if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
    if (sudo mkdir -p -m 755 /etc/apt/keyrings \
        && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
        && sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
        && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
        && sudo apt-get update -qq && sudo apt-get install -y gh); then
      gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
    else
      echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
    fi
  fi
 fi
 command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
  echo "Gitea CLI already installed, skipping."
 else
  if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
    TEA_ARCH="$(uname -m)"
    case "$TEA_ARCH" in
      x86_64) TEA_ARCH="amd64" ;;
      aarch64) TEA_ARCH="arm64" ;;
    esac
    TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
    mkdir -p "$HOME/.local/bin"
    if [ -n "$TEA_VERSION" ] \
        && curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
        && chmod +x "$HOME/.local/bin/tea"; then
      echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
      tea login add || echo "Login didn't complete. Retry any time with: tea login add"
    else
      echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
      rm -f "$HOME/.local/bin/tea"
    fi
  fi
 fi
 # `tea whoami` succeeds regardless of how the login was done (personal
 # access token or OAuth) - more reliable than parsing tea's own
 # config.yml, whose indentation and fields (no plaintext `token:` at all
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 # --- Git credential helper for Gitea, backed by tea's own login ---
 # Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
 # only recognizes external auth providers it knows about (github.com is
 # configured on the Coder deployment itself) - for any other host it falls
 # through to a broken interactive prompt that just hangs a non-interactive
 # git subprocess. A credential helper that successfully answers
 # `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
 # registering one for git.octoturge.com sidesteps that broken path
 # entirely, without touching how Coder handles github.com.
 #
 # The token itself lives in tea's own store
 # (~/.config/tea/credentials.json), which tea keeps fresh (via its
 # refresh_token) as a side effect of any authenticated call - this helper
 # never keeps its own copy, just re-reads tea's live value every time git
 # asks.
 if [ "$DID_GITEA" -eq 1 ]; then
  GITEA_LOGIN_NAME="$(awk '
    /^[[:space:]]*- name:/ { name = $NF }
    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
  if [ -n "$GITEA_LOGIN_NAME" ]; then
    mkdir -p "$HOME/.local/bin"
    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
    cat > "$HELPER" <<'HELPER_EOT'
 #!/bin/sh
 # Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
 # regenerate this after logging into a different Gitea account.
 LOGIN_NAME="__GITEA_LOGIN_NAME__"
 CRED_FILE="$HOME/.config/tea/credentials.json"
 case "$1" in
  get)
    # Authenticated no-op call: gives tea a chance to refresh and persist
    # an expired access_token before we read it below.
    tea whoami >/dev/null 2>&1
    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
    if [ -n "$token" ]; then
      echo "username=oauth2"
      echo "password=$token"
    fi
    ;;
  store|erase)
    # No-op: credentials.json (managed by tea) is the single source of
    # truth, nothing for git to persist or clear on this end.
    ;;
 esac
 HELPER_EOT
    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
    chmod +x "$HELPER"
    git config --global credential."https://git.octoturge.com".helper "$HELPER"
    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
  fi
 fi
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
 if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub and Gitea"
  elif [ "$DID_GITHUB" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub"
  else
    KEY_HOSTS_DESC="Gitea"
  fi
  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
    # add one manually afterwards with `ssh-keygen -p` if you want one).
    SSH_KEY="$HOME/.ssh/id_ed25519"
    if [ ! -f "$SSH_KEY" ]; then
      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
      echo "Generated SSH key: ${SSH_KEY}.pub"
    else
      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
    fi
    if [ "$DID_GITHUB" -eq 1 ]; then
      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
        echo "SSH key added to GitHub."
      else
        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
      fi
    fi
    if [ "$DID_GITEA" -eq 1 ]; then
      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi
    # GPG key: ed25519 signing key, no passphrase, no expiry.
    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
      echo "GPG key for $KEY_EMAIL already exists, reusing it."
    else
      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
      gpgconf --kill gpg-agent 2>/dev/null
      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
        echo "Generated GPG signing key for $KEY_EMAIL."
      else
        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
      fi
    fi
    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
    if [ -n "$GPG_KEY_ID" ]; then
      git config --global user.signingkey "$GPG_KEY_ID"
      git config --global commit.gpgsign true
      echo "Configured git to sign commits with this key."
      if [ "$DID_GITHUB" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
          echo "GPG key added to GitHub."
        else
          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
        fi
      fi
      if [ "$DID_GITEA" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
 elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
  # gh and/or tea are installed but neither is actually logged in yet (login
  # was declined, failed, or never completed) - say why the key-generation
  # question above got skipped instead of just silently not asking.
  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi
 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
  touch "$WIZARD_DONE_FILE"
@@ -6,6 +6,16 @@ terraform {
    docker = {
      source = "kreuzwerker/docker"
    }
    # Not used directly in this config. Existing workspace state from before
    # the jetbrains module was removed still has resources tagged under this
    # provider (the module used it internally to fetch IDE metadata) -
    # terraform init only installs providers the current config declares, so
    # without this, plan/apply fails with "Missing required provider" while
    # trying to reconcile/destroy those leftover state entries. Safe to drop
    # once every workspace has updated past the jetbrains-module version.
    http = {
      source = "hashicorp/http"
    }
  }
 }
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi
    # Ensure git and gnupg (commit signing) are present as base packages -
    # not every base image ships gnupg by default. No-op once both are
    # present (e.g. templates/web already bakes them into its image).
    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
      sudo apt-get update -qq
      sudo apt-get install -y --no-install-recommends git gnupg
    fi
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT
@@ -141,17 +159,6 @@ module "code-server" {
  order      = 1
 }
 # See https://registry.coder.com/modules/coder/jetbrains
 module "jetbrains" {
  count      = data.coder_workspace.me.start_count
  source     = "registry.coder.com/coder/jetbrains/coder"
  version    = "~> 1.1"
  agent_id   = coder_agent.main.id
  agent_name = "main"
  folder     = "/home/coder"
  tooltip    = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
 }
 resource "docker_volume" "home_volume" {
  name = "coder-${data.coder_workspace.me.id}-home"
  # Protect the volume from being deleted due to changes in attributes.
@@ -197,6 +204,13 @@ resource "docker_container" "workspace" {
    host = "code.octoturge.com"
    ip   = "host-gateway"
  }
  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
  # without this the workspace's public DNS answer for git.octoturge.com
  # NAT-hairpins back to the LAN and times out (curl: (28)).
  host {
    host = "git.octoturge.com"
    ip   = "host-gateway"
  }
  volumes {
    container_path = "/home/coder"
    volume_name    = docker_volume.home_volume.name
@@ -251,7 +265,8 @@ resource "coder_script" "cli_setup_wizard" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
    chmod +x /opt/coder/cli-setup-wizard.sh
@@ -307,7 +322,8 @@ resource "coder_script" "install_skills" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
    chmod +x /opt/coder/install-skills.sh
    SPECIALTY_SKILLS="" /opt/coder/install-skills.sh
@@ -0,0 +1 @@
 3
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1
 # Tracks whether the user actually ended up authenticated against GitHub
 # and/or Gitea below, so the SSH/GPG key step can ask about exactly the
 # host(s) in play (and stay silent - "local git only" - if neither).
 DID_GITHUB=0
 DID_GITEA=0
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
@@ -96,6 +102,198 @@ else
  echo "Skipping Claude Code CLI: bun not found on this workspace image."
 fi
 # --- GitHub CLI (gh) ---
 if command -v gh >/dev/null 2>&1; then
  echo "GitHub CLI already installed, skipping."
 else
  if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
    if (sudo mkdir -p -m 755 /etc/apt/keyrings \
        && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
        && sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
        && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
        && sudo apt-get update -qq && sudo apt-get install -y gh); then
      gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
    else
      echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
    fi
  fi
 fi
 command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
  echo "Gitea CLI already installed, skipping."
 else
  if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
    TEA_ARCH="$(uname -m)"
    case "$TEA_ARCH" in
      x86_64) TEA_ARCH="amd64" ;;
      aarch64) TEA_ARCH="arm64" ;;
    esac
    TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
    mkdir -p "$HOME/.local/bin"
    if [ -n "$TEA_VERSION" ] \
        && curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
        && chmod +x "$HOME/.local/bin/tea"; then
      echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
      tea login add || echo "Login didn't complete. Retry any time with: tea login add"
    else
      echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
      rm -f "$HOME/.local/bin/tea"
    fi
  fi
 fi
 # `tea whoami` succeeds regardless of how the login was done (personal
 # access token or OAuth) - more reliable than parsing tea's own
 # config.yml, whose indentation and fields (no plaintext `token:` at all
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 # --- Git credential helper for Gitea, backed by tea's own login ---
 # Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
 # only recognizes external auth providers it knows about (github.com is
 # configured on the Coder deployment itself) - for any other host it falls
 # through to a broken interactive prompt that just hangs a non-interactive
 # git subprocess. A credential helper that successfully answers
 # `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
 # registering one for git.octoturge.com sidesteps that broken path
 # entirely, without touching how Coder handles github.com.
 #
 # The token itself lives in tea's own store
 # (~/.config/tea/credentials.json), which tea keeps fresh (via its
 # refresh_token) as a side effect of any authenticated call - this helper
 # never keeps its own copy, just re-reads tea's live value every time git
 # asks.
 if [ "$DID_GITEA" -eq 1 ]; then
  GITEA_LOGIN_NAME="$(awk '
    /^[[:space:]]*- name:/ { name = $NF }
    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
  if [ -n "$GITEA_LOGIN_NAME" ]; then
    mkdir -p "$HOME/.local/bin"
    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
    cat > "$HELPER" <<'HELPER_EOT'
 #!/bin/sh
 # Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
 # regenerate this after logging into a different Gitea account.
 LOGIN_NAME="__GITEA_LOGIN_NAME__"
 CRED_FILE="$HOME/.config/tea/credentials.json"
 case "$1" in
  get)
    # Authenticated no-op call: gives tea a chance to refresh and persist
    # an expired access_token before we read it below.
    tea whoami >/dev/null 2>&1
    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
    if [ -n "$token" ]; then
      echo "username=oauth2"
      echo "password=$token"
    fi
    ;;
  store|erase)
    # No-op: credentials.json (managed by tea) is the single source of
    # truth, nothing for git to persist or clear on this end.
    ;;
 esac
 HELPER_EOT
    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
    chmod +x "$HELPER"
    git config --global credential."https://git.octoturge.com".helper "$HELPER"
    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
  fi
 fi
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
 if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub and Gitea"
  elif [ "$DID_GITHUB" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub"
  else
    KEY_HOSTS_DESC="Gitea"
  fi
  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
    # add one manually afterwards with `ssh-keygen -p` if you want one).
    SSH_KEY="$HOME/.ssh/id_ed25519"
    if [ ! -f "$SSH_KEY" ]; then
      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
      echo "Generated SSH key: ${SSH_KEY}.pub"
    else
      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
    fi
    if [ "$DID_GITHUB" -eq 1 ]; then
      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
        echo "SSH key added to GitHub."
      else
        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
      fi
    fi
    if [ "$DID_GITEA" -eq 1 ]; then
      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi
    # GPG key: ed25519 signing key, no passphrase, no expiry.
    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
      echo "GPG key for $KEY_EMAIL already exists, reusing it."
    else
      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
      gpgconf --kill gpg-agent 2>/dev/null
      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
        echo "Generated GPG signing key for $KEY_EMAIL."
      else
        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
      fi
    fi
    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
    if [ -n "$GPG_KEY_ID" ]; then
      git config --global user.signingkey "$GPG_KEY_ID"
      git config --global commit.gpgsign true
      echo "Configured git to sign commits with this key."
      if [ "$DID_GITHUB" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
          echo "GPG key added to GitHub."
        else
          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
        fi
      fi
      if [ "$DID_GITEA" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
 elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
  # gh and/or tea are installed but neither is actually logged in yet (login
  # was declined, failed, or never completed) - say why the key-generation
  # question above got skipped instead of just silently not asking.
  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi
 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
  touch "$WIZARD_DONE_FILE"
@@ -6,6 +6,16 @@ terraform {
    docker = {
      source = "kreuzwerker/docker"
    }
    # Not used directly in this config. Existing workspace state from before
    # the jetbrains module was removed still has resources tagged under this
    # provider (the module used it internally to fetch IDE metadata) -
    # terraform init only installs providers the current config declares, so
    # without this, plan/apply fails with "Missing required provider" while
    # trying to reconcile/destroy those leftover state entries. Safe to drop
    # once every workspace has updated past the jetbrains-module version.
    http = {
      source = "hashicorp/http"
    }
  }
 }
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi
    # Ensure git and gnupg (commit signing) are present as base packages -
    # not every base image ships gnupg by default. No-op once both are
    # present (e.g. templates/web already bakes them into its image).
    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
      sudo apt-get update -qq
      sudo apt-get install -y --no-install-recommends git gnupg
    fi
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT
@@ -141,17 +159,6 @@ module "code-server" {
  order      = 1
 }
 # See https://registry.coder.com/modules/coder/jetbrains
 module "jetbrains" {
  count      = data.coder_workspace.me.start_count
  source     = "registry.coder.com/coder/jetbrains/coder"
  version    = "~> 1.1"
  agent_id   = coder_agent.main.id
  agent_name = "main"
  folder     = "/home/coder"
  tooltip    = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
 }
 resource "docker_volume" "home_volume" {
  name = "coder-${data.coder_workspace.me.id}-home"
  # Protect the volume from being deleted due to changes in attributes.
@@ -197,6 +204,13 @@ resource "docker_container" "workspace" {
    host = "code.octoturge.com"
    ip   = "host-gateway"
  }
  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
  # without this the workspace's public DNS answer for git.octoturge.com
  # NAT-hairpins back to the LAN and times out (curl: (28)).
  host {
    host = "git.octoturge.com"
    ip   = "host-gateway"
  }
  volumes {
    container_path = "/home/coder"
    volume_name    = docker_volume.home_volume.name
@@ -251,7 +265,8 @@ resource "coder_script" "cli_setup_wizard" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
    chmod +x /opt/coder/cli-setup-wizard.sh
@@ -307,7 +322,8 @@ resource "coder_script" "install_skills" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
    chmod +x /opt/coder/install-skills.sh
    SPECIALTY_SKILLS="" /opt/coder/install-skills.sh
@@ -0,0 +1 @@
 3
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1
 # Tracks whether the user actually ended up authenticated against GitHub
 # and/or Gitea below, so the SSH/GPG key step can ask about exactly the
 # host(s) in play (and stay silent - "local git only" - if neither).
 DID_GITHUB=0
 DID_GITEA=0
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
@@ -96,6 +102,198 @@ else
  echo "Skipping Claude Code CLI: bun not found on this workspace image."
 fi
 # --- GitHub CLI (gh) ---
 if command -v gh >/dev/null 2>&1; then
  echo "GitHub CLI already installed, skipping."
 else
  if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
    if (sudo mkdir -p -m 755 /etc/apt/keyrings \
        && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
        && sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
        && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
        && sudo apt-get update -qq && sudo apt-get install -y gh); then
      gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
    else
      echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
    fi
  fi
 fi
 command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
  echo "Gitea CLI already installed, skipping."
 else
  if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
    TEA_ARCH="$(uname -m)"
    case "$TEA_ARCH" in
      x86_64) TEA_ARCH="amd64" ;;
      aarch64) TEA_ARCH="arm64" ;;
    esac
    TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
    mkdir -p "$HOME/.local/bin"
    if [ -n "$TEA_VERSION" ] \
        && curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
        && chmod +x "$HOME/.local/bin/tea"; then
      echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
      tea login add || echo "Login didn't complete. Retry any time with: tea login add"
    else
      echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
      rm -f "$HOME/.local/bin/tea"
    fi
  fi
 fi
 # `tea whoami` succeeds regardless of how the login was done (personal
 # access token or OAuth) - more reliable than parsing tea's own
 # config.yml, whose indentation and fields (no plaintext `token:` at all
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 # --- Git credential helper for Gitea, backed by tea's own login ---
 # Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
 # only recognizes external auth providers it knows about (github.com is
 # configured on the Coder deployment itself) - for any other host it falls
 # through to a broken interactive prompt that just hangs a non-interactive
 # git subprocess. A credential helper that successfully answers
 # `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
 # registering one for git.octoturge.com sidesteps that broken path
 # entirely, without touching how Coder handles github.com.
 #
 # The token itself lives in tea's own store
 # (~/.config/tea/credentials.json), which tea keeps fresh (via its
 # refresh_token) as a side effect of any authenticated call - this helper
 # never keeps its own copy, just re-reads tea's live value every time git
 # asks.
 if [ "$DID_GITEA" -eq 1 ]; then
  GITEA_LOGIN_NAME="$(awk '
    /^[[:space:]]*- name:/ { name = $NF }
    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
  if [ -n "$GITEA_LOGIN_NAME" ]; then
    mkdir -p "$HOME/.local/bin"
    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
    cat > "$HELPER" <<'HELPER_EOT'
 #!/bin/sh
 # Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
 # regenerate this after logging into a different Gitea account.
 LOGIN_NAME="__GITEA_LOGIN_NAME__"
 CRED_FILE="$HOME/.config/tea/credentials.json"
 case "$1" in
  get)
    # Authenticated no-op call: gives tea a chance to refresh and persist
    # an expired access_token before we read it below.
    tea whoami >/dev/null 2>&1
    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
    if [ -n "$token" ]; then
      echo "username=oauth2"
      echo "password=$token"
    fi
    ;;
  store|erase)
    # No-op: credentials.json (managed by tea) is the single source of
    # truth, nothing for git to persist or clear on this end.
    ;;
 esac
 HELPER_EOT
    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
    chmod +x "$HELPER"
    git config --global credential."https://git.octoturge.com".helper "$HELPER"
    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
  fi
 fi
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
 if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub and Gitea"
  elif [ "$DID_GITHUB" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub"
  else
    KEY_HOSTS_DESC="Gitea"
  fi
  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
    # add one manually afterwards with `ssh-keygen -p` if you want one).
    SSH_KEY="$HOME/.ssh/id_ed25519"
    if [ ! -f "$SSH_KEY" ]; then
      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
      echo "Generated SSH key: ${SSH_KEY}.pub"
    else
      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
    fi
    if [ "$DID_GITHUB" -eq 1 ]; then
      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
        echo "SSH key added to GitHub."
      else
        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
      fi
    fi
    if [ "$DID_GITEA" -eq 1 ]; then
      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi
    # GPG key: ed25519 signing key, no passphrase, no expiry.
    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
      echo "GPG key for $KEY_EMAIL already exists, reusing it."
    else
      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
      gpgconf --kill gpg-agent 2>/dev/null
      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
        echo "Generated GPG signing key for $KEY_EMAIL."
      else
        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
      fi
    fi
    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
    if [ -n "$GPG_KEY_ID" ]; then
      git config --global user.signingkey "$GPG_KEY_ID"
      git config --global commit.gpgsign true
      echo "Configured git to sign commits with this key."
      if [ "$DID_GITHUB" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
          echo "GPG key added to GitHub."
        else
          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
        fi
      fi
      if [ "$DID_GITEA" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
 elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
  # gh and/or tea are installed but neither is actually logged in yet (login
  # was declined, failed, or never completed) - say why the key-generation
  # question above got skipped instead of just silently not asking.
  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi
 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
  touch "$WIZARD_DONE_FILE"
@@ -6,6 +6,16 @@ terraform {
    docker = {
      source = "kreuzwerker/docker"
    }
    # Not used directly in this config. Existing workspace state from before
    # the jetbrains module was removed still has resources tagged under this
    # provider (the module used it internally to fetch IDE metadata) -
    # terraform init only installs providers the current config declares, so
    # without this, plan/apply fails with "Missing required provider" while
    # trying to reconcile/destroy those leftover state entries. Safe to drop
    # once every workspace has updated past the jetbrains-module version.
    http = {
      source = "hashicorp/http"
    }
  }
 }
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi
    # Ensure git and gnupg (commit signing) are present as base packages -
    # not every base image ships gnupg by default. No-op once both are
    # present (e.g. templates/web already bakes them into its image).
    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
      sudo apt-get update -qq
      sudo apt-get install -y --no-install-recommends git gnupg
    fi
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT
@@ -141,17 +159,6 @@ module "code-server" {
  order      = 1
 }
 # See https://registry.coder.com/modules/coder/jetbrains
 module "jetbrains" {
  count      = data.coder_workspace.me.start_count
  source     = "registry.coder.com/coder/jetbrains/coder"
  version    = "~> 1.1"
  agent_id   = coder_agent.main.id
  agent_name = "main"
  folder     = "/home/coder"
  tooltip    = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
 }
 resource "docker_volume" "home_volume" {
  name = "coder-${data.coder_workspace.me.id}-home"
  # Protect the volume from being deleted due to changes in attributes.
@@ -197,6 +204,13 @@ resource "docker_container" "workspace" {
    host = "code.octoturge.com"
    ip   = "host-gateway"
  }
  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
  # without this the workspace's public DNS answer for git.octoturge.com
  # NAT-hairpins back to the LAN and times out (curl: (28)).
  host {
    host = "git.octoturge.com"
    ip   = "host-gateway"
  }
  volumes {
    container_path = "/home/coder"
    volume_name    = docker_volume.home_volume.name
@@ -251,7 +265,8 @@ resource "coder_script" "cli_setup_wizard" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
    chmod +x /opt/coder/cli-setup-wizard.sh
@@ -307,7 +322,8 @@ resource "coder_script" "install_skills" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
    chmod +x /opt/coder/install-skills.sh
    SPECIALTY_SKILLS="foundryvtt-modding ttrpg-lore-weaver" /opt/coder/install-skills.sh
@@ -11,47 +11,113 @@ ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install -y --no-install-recommends \
        locales sudo ca-certificates gnupg curl wget \
    && locale-gen en_US.UTF-8 \
-    && rm -rf /var/lib/apt/lists/*
+    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 ENV LANG=en_US.UTF-8 \
    LANGUAGE=en_US:en \
    LC_ALL=en_US.UTF-8
 # Google Chrome (stable), for the Browse Lite VS Code extension's embedded
 # browser preview. Ubuntu's own `chromium-browser` apt package is just a
 # snap wrapper and doesn't work in a container (no snapd) - Google's own
 # .deb is the reliable way to get a real Chrome binary here. amd64 only
 # (Google doesn't publish a Chrome .deb for arm64), which matches this
 # repo's single x86_64 Docker host.
 RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
        | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg \
    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
        > /etc/apt/sources.list.d/google-chrome.list \
    && apt-get update && apt-get install -y google-chrome-stable \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 # Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
 # X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
 #
 # Split into several RUN steps (rather than one big apt-get install) so no
 # single resulting layer is too large to push to the registry - it sits
 # behind a reverse proxy with a request body size cap, and a couple of these
 # packages (llvm, libopencv-dev, libwebkit2gtk-4.1-dev) are individually
 # large enough to blow past it if lumped together with everything else.
 RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential pkg-config cmake \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 RUN apt-get update && apt-get install -y --no-install-recommends \
        clang llvm \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential pkg-config cmake clang llvm \
        git git-lfs jq unzip tar file htop tree tmux zsh openssh-client \
    && git lfs install --system \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 RUN apt-get update && apt-get install -y --no-install-recommends \
        libssl-dev libpq-dev libsqlite3-dev \
        postgresql-client redis-tools sqlite3 \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 RUN apt-get update && apt-get install -y --no-install-recommends \
        libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev \
        libgtk-3-dev libsoup-3.0-dev \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 RUN apt-get update && apt-get install -y --no-install-recommends \
        libx11-dev libxext-dev libxrender-dev libxtst-dev libxi-dev \
-        postgresql-client redis-tools sqlite3 \
+    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 RUN apt-get update && apt-get install -y --no-install-recommends \
        python3 python3-pip python3-venv python3-dev \
        libopencv-dev \
        protobuf-compiler \
-    && git lfs install --system \
+    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 RUN apt-get update && apt-get install -y --no-install-recommends \
        libopencv-dev \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 # Node.js LTS (22.x) plus npm/pnpm/yarn as root so global bins land on the
 # system PATH for every user.
 RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
    && apt-get install -y --no-install-recommends nodejs \
-    && npm install -g pnpm yarn \
+    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
 RUN npm install -g pnpm yarn
 # Global Python prototyping packages: CV, ONNX runtime, CPU-only torch wheel.
 # Ubuntu 24.04's system Python is PEP 668 externally-managed; this is a
 # throwaway container image, so --break-system-packages is the right call
-# instead of forcing every user into a venv for basic prototyping.
+# instead of forcing every user into a venv for basic prototyping. Not
-RUN python3 -m pip install --break-system-packages --no-cache-dir --upgrade pip \
+# upgrading pip itself first: the Debian-packaged pip 24.0 has no RECORD
-    && python3 -m pip install --break-system-packages --no-cache-dir \
+# file (dpkg-installed, not pip-installed), so `pip install --upgrade pip`
-        numpy opencv-python-headless onnxruntime \
+# fails trying to uninstall it in place - and it's unneeded anyway, the
-    && python3 -m pip install --break-system-packages --no-cache-dir \
+# packages below install fine under the stock version.
 #
 # Each package gets its own RUN/layer for the same reverse-proxy body-size
 # reason as the apt-get split above - torch's CPU wheel and opencv-python's
 # wheel are each large enough on their own to be worth isolating.
 RUN python3 -m pip install --break-system-packages --no-cache-dir numpy
 RUN python3 -m pip install --break-system-packages --no-cache-dir opencv-python-headless
 RUN python3 -m pip install --break-system-packages --no-cache-dir onnxruntime
 RUN python3 -m pip install --break-system-packages --no-cache-dir \
        torch --index-url https://download.pytorch.org/whl/cpu
-# Standard non-root dev user with passwordless sudo.
+# Standard non-root dev user with passwordless sudo. Ubuntu 24.04's base
-RUN useradd --uid 1000 --create-home --shell /bin/bash coder \
+# image already ships a default `ubuntu` user/group at uid/gid 1000, which
 # collides with the explicit --uid 1000 below - drop it first so `coder`
 # can take that uid.
 RUN userdel -r ubuntu 2>/dev/null; \
    groupdel ubuntu 2>/dev/null; \
    useradd --uid 1000 --create-home --shell /bin/bash coder \
    && echo "coder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder \
    && chmod 0440 /etc/sudoers.d/coder
@@ -67,21 +133,35 @@ WORKDIR /home/coder
 # Rust via rustup: stable toolchain, rust-analyzer/clippy/rustfmt/rust-src,
 # native + musl targets for x86_64/aarch64, and cargo helper utilities.
 #
 # Split into one RUN per target/tool (rather than one big chained command) so
 # no single layer is too large to push to the registry, for the same
 # reverse-proxy body-size reason as the apt-get split above - the base
 # toolchain and each additional target's std library are each sizeable, and
 # `cargo install` leaves a build/registry cache behind that needs clearing
 # inside its own RUN, or it would just bloat that same layer instead.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
        --default-toolchain stable --profile default \
-    && rustup component add rustfmt clippy rust-analyzer rust-src \
+    && rm -rf "$RUSTUP_HOME"/tmp "$RUSTUP_HOME"/downloads
-    && rustup target add \
+
-        x86_64-unknown-linux-gnu \
+RUN rustup component add rustfmt clippy rust-analyzer rust-src
-        x86_64-unknown-linux-musl \
+
-        aarch64-unknown-linux-gnu \
+RUN rustup target add x86_64-unknown-linux-gnu
-        aarch64-unknown-linux-musl \
+RUN rustup target add x86_64-unknown-linux-musl
-    && cargo install --locked cargo-watch cargo-edit cross bacon
+RUN rustup target add aarch64-unknown-linux-gnu
 RUN rustup target add aarch64-unknown-linux-musl
 RUN cargo install --locked cargo-watch \
    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
 RUN cargo install --locked cargo-edit \
    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
 RUN cargo install --locked cross \
    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
 RUN cargo install --locked bacon \
    && rm -rf "$CARGO_HOME"/registry "$CARGO_HOME"/git
 # Bun: global runtime for the ElysiaJS backend and fast scripting.
 RUN curl -fsSL https://bun.sh/install | bash
 # Prime the pnpm content-addressable store dir referenced by PNPM_HOME.
 RUN pnpm setup || true
 RUN mkdir -p /home/coder/workspace
 WORKDIR /home/coder/workspace
@@ -0,0 +1 @@
 3
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1
 # Tracks whether the user actually ended up authenticated against GitHub
 # and/or Gitea below, so the SSH/GPG key step can ask about exactly the
 # host(s) in play (and stay silent - "local git only" - if neither).
 DID_GITHUB=0
 DID_GITEA=0
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
@@ -96,6 +102,198 @@ else
  echo "Skipping Claude Code CLI: bun not found on this workspace image."
 fi
 # --- GitHub CLI (gh) ---
 if command -v gh >/dev/null 2>&1; then
  echo "GitHub CLI already installed, skipping."
 else
  if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
    if (sudo mkdir -p -m 755 /etc/apt/keyrings \
        && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
        && sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
        && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
        && sudo apt-get update -qq && sudo apt-get install -y gh); then
      gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
    else
      echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
    fi
  fi
 fi
 command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
  echo "Gitea CLI already installed, skipping."
 else
  if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
    TEA_ARCH="$(uname -m)"
    case "$TEA_ARCH" in
      x86_64) TEA_ARCH="amd64" ;;
      aarch64) TEA_ARCH="arm64" ;;
    esac
    TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
    mkdir -p "$HOME/.local/bin"
    if [ -n "$TEA_VERSION" ] \
        && curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
        && chmod +x "$HOME/.local/bin/tea"; then
      echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
      tea login add || echo "Login didn't complete. Retry any time with: tea login add"
    else
      echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
      rm -f "$HOME/.local/bin/tea"
    fi
  fi
 fi
 # `tea whoami` succeeds regardless of how the login was done (personal
 # access token or OAuth) - more reliable than parsing tea's own
 # config.yml, whose indentation and fields (no plaintext `token:` at all
 # for an OAuth login) vary by auth method.
 command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
 # --- Git credential helper for Gitea, backed by tea's own login ---
 # Coder injects GIT_ASKPASS to answer git's own credential prompts, but it
 # only recognizes external auth providers it knows about (github.com is
 # configured on the Coder deployment itself) - for any other host it falls
 # through to a broken interactive prompt that just hangs a non-interactive
 # git subprocess. A credential helper that successfully answers
 # `git credential fill` runs *before* GIT_ASKPASS is ever consulted, so
 # registering one for git.octoturge.com sidesteps that broken path
 # entirely, without touching how Coder handles github.com.
 #
 # The token itself lives in tea's own store
 # (~/.config/tea/credentials.json), which tea keeps fresh (via its
 # refresh_token) as a side effect of any authenticated call - this helper
 # never keeps its own copy, just re-reads tea's live value every time git
 # asks.
 if [ "$DID_GITEA" -eq 1 ]; then
  GITEA_LOGIN_NAME="$(awk '
    /^[[:space:]]*- name:/ { name = $NF }
    /url: https:\/\/git\.octoturge\.com/ { print name; exit }
  ' "$HOME/.config/tea/config.yml" 2>/dev/null)"
  if [ -n "$GITEA_LOGIN_NAME" ]; then
    mkdir -p "$HOME/.local/bin"
    HELPER="$HOME/.local/bin/git-credential-gitea-tea"
    cat > "$HELPER" <<'HELPER_EOT'
 #!/bin/sh
 # Auto-generated by cli-setup-wizard.sh - re-run the wizard with --force to
 # regenerate this after logging into a different Gitea account.
 LOGIN_NAME="__GITEA_LOGIN_NAME__"
 CRED_FILE="$HOME/.config/tea/credentials.json"
 case "$1" in
  get)
    # Authenticated no-op call: gives tea a chance to refresh and persist
    # an expired access_token before we read it below.
    tea whoami >/dev/null 2>&1
    token="$(grep -oP "(?<=\"$LOGIN_NAME\":).*" "$CRED_FILE" 2>/dev/null \
      | grep -oP '(?<=access_token\\":\\")[^\\"]*' | head -n1)"
    if [ -n "$token" ]; then
      echo "username=oauth2"
      echo "password=$token"
    fi
    ;;
  store|erase)
    # No-op: credentials.json (managed by tea) is the single source of
    # truth, nothing for git to persist or clear on this end.
    ;;
 esac
 HELPER_EOT
    sed -i "s/__GITEA_LOGIN_NAME__/$GITEA_LOGIN_NAME/" "$HELPER"
    chmod +x "$HELPER"
    git config --global credential."https://git.octoturge.com".helper "$HELPER"
    echo "Configured git to push/pull https://git.octoturge.com using your tea login."
  fi
 fi
 # --- SSH + GPG keys for the external git host(s) selected above ---
 # Only asks if the user actually set up GitHub and/or Gitea just now -
 # stays silent for "local git only" (neither was set up).
 if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub and Gitea"
  elif [ "$DID_GITHUB" -eq 1 ]; then
    KEY_HOSTS_DESC="GitHub"
  else
    KEY_HOSTS_DESC="Gitea"
  fi
  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
    # add one manually afterwards with `ssh-keygen -p` if you want one).
    SSH_KEY="$HOME/.ssh/id_ed25519"
    if [ ! -f "$SSH_KEY" ]; then
      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
      echo "Generated SSH key: ${SSH_KEY}.pub"
    else
      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
    fi
    if [ "$DID_GITHUB" -eq 1 ]; then
      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
        echo "SSH key added to GitHub."
      else
        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
      fi
    fi
    if [ "$DID_GITEA" -eq 1 ]; then
      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
        echo "SSH key added to Gitea."
      else
        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
      fi
    fi
    # GPG key: ed25519 signing key, no passphrase, no expiry.
    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
      echo "GPG key for $KEY_EMAIL already exists, reusing it."
    else
      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
      gpgconf --kill gpg-agent 2>/dev/null
      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
        echo "Generated GPG signing key for $KEY_EMAIL."
      else
        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
      fi
    fi
    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
    if [ -n "$GPG_KEY_ID" ]; then
      git config --global user.signingkey "$GPG_KEY_ID"
      git config --global commit.gpgsign true
      echo "Configured git to sign commits with this key."
      if [ "$DID_GITHUB" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
          echo "GPG key added to GitHub."
        else
          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
        fi
      fi
      if [ "$DID_GITEA" -eq 1 ]; then
        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
          echo "GPG key added to Gitea."
        else
          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
        fi
      fi
    fi
  fi
 elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
  # gh and/or tea are installed but neither is actually logged in yet (login
  # was declined, failed, or never completed) - say why the key-generation
  # question above got skipped instead of just silently not asking.
  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
 fi
 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
  touch "$WIZARD_DONE_FILE"
@@ -6,6 +6,16 @@ terraform {
    docker = {
      source = "kreuzwerker/docker"
    }
    # Not used directly in this config. Existing workspace state from before
    # the jetbrains module was removed still has resources tagged under this
    # provider (the module used it internally to fetch IDE metadata) -
    # terraform init only installs providers the current config declares, so
    # without this, plan/apply fails with "Missing required provider" while
    # trying to reconcile/destroy those leftover state entries. Safe to drop
    # once every workspace has updated past the jetbrains-module version.
    http = {
      source = "hashicorp/http"
    }
  }
 }
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi
    # Ensure git and gnupg (commit signing) are present as base packages -
    # not every base image ships gnupg by default. No-op once both are
    # present (e.g. templates/web already bakes them into its image).
    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
      sudo apt-get update -qq
      sudo apt-get install -y --no-install-recommends git gnupg
    fi
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT
@@ -148,17 +166,6 @@ module "code-server" {
  order      = 1
 }
 # See https://registry.coder.com/modules/coder/jetbrains
 module "jetbrains" {
  count      = data.coder_workspace.me.start_count
  source     = "registry.coder.com/coder/jetbrains/coder"
  version    = "~> 1.1"
  agent_id   = coder_agent.main.id
  agent_name = "main"
  folder     = "/home/coder"
  tooltip    = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
 }
 resource "docker_volume" "home_volume" {
  name = "coder-${data.coder_workspace.me.id}-home"
  # Protect the volume from being deleted due to changes in attributes.
@@ -186,16 +193,18 @@ resource "docker_volume" "home_volume" {
  }
 }
-# Builds the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
+# Pulls the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
-# Python CV/ONNX, DB clients - see ./Dockerfile) from this template's own
+# Python CV/ONNX, DB clients - see ./Dockerfile) instead of building it here.
-# directory, so no external registry push is required. The tag embeds the
+# The image is built and pushed by .gitea/workflows/coder-templates.yml's
-# Dockerfile's hash so a Dockerfile edit forces a rebuild on next apply/push,
+# build-web-image job, tagged with the same Dockerfile hash this resource
-# while an unchanged Dockerfile reuses the cached image.
+# computes - so a Dockerfile edit always resolves to the matching image, and
 # an unchanged Dockerfile resolves to one already built (CI skips rebuilding
 # it, and this pull is normally a same-host cache hit rather than a real
 # network pull, since CI and this Coder deployment share one Docker daemon).
 # Moves the ~15-20min Rust toolchain compile off of "someone is waiting to
 # create a workspace" and onto CI, where it runs once per Dockerfile change.
 resource "docker_image" "web" {
-  name = "coder-profiles-web:${filesha1("${path.module}/Dockerfile")}"
+  name         = "git.octoturge.com/octo-tech/profiles-web:${filesha1("${path.module}/Dockerfile")}"
  build {
    context = path.module
  }
  keep_locally = true
 }
@@ -217,6 +226,13 @@ resource "docker_container" "workspace" {
    host = "code.octoturge.com"
    ip   = "host-gateway"
  }
  # install-skills.sh curls this at startup to pull the repo's Agent Skills;
  # without this the workspace's public DNS answer for git.octoturge.com
  # NAT-hairpins back to the LAN and times out (curl: (28)).
  host {
    host = "git.octoturge.com"
    ip   = "host-gateway"
  }
  volumes {
    container_path = "/home/coder"
    volume_name    = docker_volume.home_volume.name
@@ -271,7 +287,8 @@ resource "coder_script" "cli_setup_wizard" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
    chmod +x /opt/coder/cli-setup-wizard.sh
@@ -308,7 +325,8 @@ resource "coder_script" "install_skills" {
  script       = <<-EOT
    #!/bin/bash
    set -e
-    mkdir -p /opt/coder
+    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
    chmod +x /opt/coder/install-skills.sh
    SPECIALTY_SKILLS="" /opt/coder/install-skills.sh