Compare commits
8 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 octoturge
|
93721b9096 | ||
|
octoturge
|
013567f02a | ||
|
octoturge
|
e8a8f93f9d | ||
|
octoturge
|
557d6a3d84 | ||
|
octoturge
|
354536dad5 | ||
|
octoturge
|
1be7c00b84 | ||
|
octoturge
|
52cc84650a | ||
|
octoturge
|
0c53bb6554 |
@@ -47,8 +47,8 @@ extra `coder_script` needed, matching how the `/etc/skel` copy in every
|
||||
template's `startup_script` already relies on that same mechanism.
|
||||
|
||||
Each `templates/<env>/` is a complete, independent Coder template (agent,
|
||||
docker container, code-server, JetBrains) with its own copy of everything
|
||||
`main.tf` needs. They're deliberately not built from a shared Terraform
|
||||
docker container, code-server) with its own copy of everything `main.tf`
|
||||
needs. They're deliberately not built from a shared Terraform
|
||||
module or shared files elsewhere in the repo: `coder templates push -d
|
||||
templates/<env>` only uploads that one directory to the Coder server, so any
|
||||
`file()` reference reaching outside it (e.g. the old shared
|
||||
@@ -114,6 +114,21 @@ finishes it - and offers to install + log into:
|
||||
- **GitHub Copilot CLI** (`bun install -g @github/copilot`, then `copilot login`)
|
||||
- **Google Antigravity CLI** (`curl -fsSL https://antigravity.google/cli/install.sh | bash`, binary `agy`)
|
||||
- **Claude Code CLI** (`bun install -g @anthropic-ai/claude-code`, then `claude`)
|
||||
- **GitHub CLI** (`gh`, via the official apt repo, then `gh auth login`)
|
||||
- **Gitea CLI** (`tea`, official binary release downloaded to `~/.local/bin`, then `tea login add`)
|
||||
|
||||
`git` and `gnupg` themselves aren't part of this opt-in flow - every
|
||||
template's `coder_agent` startup script installs them unconditionally as
|
||||
base packages (a no-op where they're already present, e.g. baked into
|
||||
`templates/web`'s image). If the wizard just authenticated GitHub and/or
|
||||
Gitea above (skipped entirely for "local git only" - neither set up), it
|
||||
asks once more whether to auto-generate an ed25519 SSH key and an ed25519
|
||||
GPG signing key and register them with whichever host(s) got set up: `gh
|
||||
ssh-key add` / `gh gpg-key add` for GitHub, a direct call against Gitea's
|
||||
`/api/v1/user/keys` and `/api/v1/user/gpg_keys` (using the token `tea
|
||||
login add` already stored) for Gitea. Either upload failing just prints
|
||||
the manual command/URL to finish it yourself - never blocks the rest of
|
||||
the wizard.
|
||||
|
||||
It does **not** ask about VS Code extensions, since those are handled by
|
||||
Terraform (see above). Once the user confirms completion it writes a
|
||||
|
||||
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
|
||||
FORCE=0
|
||||
[ "${1:-}" = "--force" ] && FORCE=1
|
||||
|
||||
# Tracks whether the user actually ended up authenticated against GitHub
|
||||
# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
|
||||
# host(s) in play (and stay silent - "local git only" - if neither).
|
||||
DID_GITHUB=0
|
||||
DID_GITEA=0
|
||||
|
||||
export BUN_INSTALL="${HOME}/.bun"
|
||||
export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
|
||||
|
||||
@@ -96,6 +102,143 @@ else
|
||||
echo "Skipping Claude Code CLI: bun not found on this workspace image."
|
||||
fi
|
||||
|
||||
# --- GitHub CLI (gh) ---
|
||||
if command -v gh >/dev/null 2>&1; then
|
||||
echo "GitHub CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
|
||||
if (sudo mkdir -p -m 755 /etc/apt/keyrings \
|
||||
&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
|
||||
&& sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
|
||||
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
|
||||
&& sudo apt-get update -qq && sudo apt-get install -y gh); then
|
||||
gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
|
||||
else
|
||||
echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
|
||||
|
||||
# --- Gitea CLI (tea) ---
|
||||
if command -v tea >/dev/null 2>&1; then
|
||||
echo "Gitea CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
|
||||
TEA_ARCH="$(uname -m)"
|
||||
case "$TEA_ARCH" in
|
||||
x86_64) TEA_ARCH="amd64" ;;
|
||||
aarch64) TEA_ARCH="arm64" ;;
|
||||
esac
|
||||
TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
|
||||
mkdir -p "$HOME/.local/bin"
|
||||
if [ -n "$TEA_VERSION" ] \
|
||||
&& curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
|
||||
&& chmod +x "$HOME/.local/bin/tea"; then
|
||||
echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
|
||||
tea login add || echo "Login didn't complete. Retry any time with: tea login add"
|
||||
else
|
||||
echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
|
||||
rm -f "$HOME/.local/bin/tea"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
|
||||
if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
|
||||
TEA_URL="$(awk '/^logins:/{f=1} f && /^ url:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^ token:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
[ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
|
||||
fi
|
||||
|
||||
# --- SSH + GPG keys for the external git host(s) selected above ---
|
||||
# Only asks if the user actually set up GitHub and/or Gitea just now -
|
||||
# stays silent for "local git only" (neither was set up).
|
||||
if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
|
||||
if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub and Gitea"
|
||||
elif [ "$DID_GITHUB" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub"
|
||||
else
|
||||
KEY_HOSTS_DESC="Gitea"
|
||||
fi
|
||||
|
||||
if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
|
||||
KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
|
||||
KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
|
||||
|
||||
# SSH key: ed25519, no passphrase (disposable dev workspace convenience;
|
||||
# add one manually afterwards with `ssh-keygen -p` if you want one).
|
||||
SSH_KEY="$HOME/.ssh/id_ed25519"
|
||||
if [ ! -f "$SSH_KEY" ]; then
|
||||
mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
|
||||
ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
|
||||
echo "Generated SSH key: ${SSH_KEY}.pub"
|
||||
else
|
||||
echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
|
||||
fi
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
|
||||
echo "SSH key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "SSH key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
|
||||
# GPG key: ed25519 signing key, no passphrase, no expiry.
|
||||
if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
|
||||
echo "GPG key for $KEY_EMAIL already exists, reusing it."
|
||||
else
|
||||
mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
|
||||
grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
|
||||
|| echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
|
||||
gpgconf --kill gpg-agent 2>/dev/null
|
||||
if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
|
||||
echo "Generated GPG signing key for $KEY_EMAIL."
|
||||
else
|
||||
echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
|
||||
fi
|
||||
fi
|
||||
GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
|
||||
|
||||
if [ -n "$GPG_KEY_ID" ]; then
|
||||
git config --global user.signingkey "$GPG_KEY_ID"
|
||||
git config --global commit.gpgsign true
|
||||
echo "Configured git to sign commits with this key."
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
|
||||
echo "GPG key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "GPG key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
|
||||
touch "$WIZARD_DONE_FILE"
|
||||
|
||||
@@ -6,6 +6,16 @@ terraform {
|
||||
docker = {
|
||||
source = "kreuzwerker/docker"
|
||||
}
|
||||
# Not used directly in this config. Existing workspace state from before
|
||||
# the jetbrains module was removed still has resources tagged under this
|
||||
# provider (the module used it internally to fetch IDE metadata) -
|
||||
# terraform init only installs providers the current config declares, so
|
||||
# without this, plan/apply fails with "Missing required provider" while
|
||||
# trying to reconcile/destroy those leftover state entries. Safe to drop
|
||||
# once every workspace has updated past the jetbrains-module version.
|
||||
http = {
|
||||
source = "hashicorp/http"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
|
||||
touch ~/.init_done
|
||||
fi
|
||||
|
||||
# Ensure git and gnupg (commit signing) are present as base packages -
|
||||
# not every base image ships gnupg by default. No-op once both are
|
||||
# present (e.g. templates/web already bakes them into its image).
|
||||
if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
|
||||
sudo apt-get update -qq
|
||||
sudo apt-get install -y --no-install-recommends git gnupg
|
||||
fi
|
||||
|
||||
# Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
|
||||
EOT
|
||||
|
||||
@@ -141,17 +159,6 @@ module "code-server" {
|
||||
order = 1
|
||||
}
|
||||
|
||||
# See https://registry.coder.com/modules/coder/jetbrains
|
||||
module "jetbrains" {
|
||||
count = data.coder_workspace.me.start_count
|
||||
source = "registry.coder.com/coder/jetbrains/coder"
|
||||
version = "~> 1.1"
|
||||
agent_id = coder_agent.main.id
|
||||
agent_name = "main"
|
||||
folder = "/home/coder"
|
||||
tooltip = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
|
||||
}
|
||||
|
||||
resource "docker_volume" "home_volume" {
|
||||
name = "coder-${data.coder_workspace.me.id}-home"
|
||||
# Protect the volume from being deleted due to changes in attributes.
|
||||
@@ -251,7 +258,8 @@ resource "coder_script" "cli_setup_wizard" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
|
||||
chmod +x /opt/coder/cli-setup-wizard.sh
|
||||
|
||||
@@ -306,7 +314,8 @@ resource "coder_script" "install_skills" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
|
||||
chmod +x /opt/coder/install-skills.sh
|
||||
SPECIALTY_SKILLS="openscad-parametric" /opt/coder/install-skills.sh
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
|
||||
FORCE=0
|
||||
[ "${1:-}" = "--force" ] && FORCE=1
|
||||
|
||||
# Tracks whether the user actually ended up authenticated against GitHub
|
||||
# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
|
||||
# host(s) in play (and stay silent - "local git only" - if neither).
|
||||
DID_GITHUB=0
|
||||
DID_GITEA=0
|
||||
|
||||
export BUN_INSTALL="${HOME}/.bun"
|
||||
export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
|
||||
|
||||
@@ -96,6 +102,143 @@ else
|
||||
echo "Skipping Claude Code CLI: bun not found on this workspace image."
|
||||
fi
|
||||
|
||||
# --- GitHub CLI (gh) ---
|
||||
if command -v gh >/dev/null 2>&1; then
|
||||
echo "GitHub CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
|
||||
if (sudo mkdir -p -m 755 /etc/apt/keyrings \
|
||||
&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
|
||||
&& sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
|
||||
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
|
||||
&& sudo apt-get update -qq && sudo apt-get install -y gh); then
|
||||
gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
|
||||
else
|
||||
echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
|
||||
|
||||
# --- Gitea CLI (tea) ---
|
||||
if command -v tea >/dev/null 2>&1; then
|
||||
echo "Gitea CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
|
||||
TEA_ARCH="$(uname -m)"
|
||||
case "$TEA_ARCH" in
|
||||
x86_64) TEA_ARCH="amd64" ;;
|
||||
aarch64) TEA_ARCH="arm64" ;;
|
||||
esac
|
||||
TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
|
||||
mkdir -p "$HOME/.local/bin"
|
||||
if [ -n "$TEA_VERSION" ] \
|
||||
&& curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
|
||||
&& chmod +x "$HOME/.local/bin/tea"; then
|
||||
echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
|
||||
tea login add || echo "Login didn't complete. Retry any time with: tea login add"
|
||||
else
|
||||
echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
|
||||
rm -f "$HOME/.local/bin/tea"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
|
||||
if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
|
||||
TEA_URL="$(awk '/^logins:/{f=1} f && /^ url:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^ token:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
[ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
|
||||
fi
|
||||
|
||||
# --- SSH + GPG keys for the external git host(s) selected above ---
|
||||
# Only asks if the user actually set up GitHub and/or Gitea just now -
|
||||
# stays silent for "local git only" (neither was set up).
|
||||
if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
|
||||
if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub and Gitea"
|
||||
elif [ "$DID_GITHUB" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub"
|
||||
else
|
||||
KEY_HOSTS_DESC="Gitea"
|
||||
fi
|
||||
|
||||
if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
|
||||
KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
|
||||
KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
|
||||
|
||||
# SSH key: ed25519, no passphrase (disposable dev workspace convenience;
|
||||
# add one manually afterwards with `ssh-keygen -p` if you want one).
|
||||
SSH_KEY="$HOME/.ssh/id_ed25519"
|
||||
if [ ! -f "$SSH_KEY" ]; then
|
||||
mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
|
||||
ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
|
||||
echo "Generated SSH key: ${SSH_KEY}.pub"
|
||||
else
|
||||
echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
|
||||
fi
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
|
||||
echo "SSH key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "SSH key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
|
||||
# GPG key: ed25519 signing key, no passphrase, no expiry.
|
||||
if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
|
||||
echo "GPG key for $KEY_EMAIL already exists, reusing it."
|
||||
else
|
||||
mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
|
||||
grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
|
||||
|| echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
|
||||
gpgconf --kill gpg-agent 2>/dev/null
|
||||
if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
|
||||
echo "Generated GPG signing key for $KEY_EMAIL."
|
||||
else
|
||||
echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
|
||||
fi
|
||||
fi
|
||||
GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
|
||||
|
||||
if [ -n "$GPG_KEY_ID" ]; then
|
||||
git config --global user.signingkey "$GPG_KEY_ID"
|
||||
git config --global commit.gpgsign true
|
||||
echo "Configured git to sign commits with this key."
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
|
||||
echo "GPG key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "GPG key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
|
||||
touch "$WIZARD_DONE_FILE"
|
||||
|
||||
+22
-13
@@ -6,6 +6,16 @@ terraform {
|
||||
docker = {
|
||||
source = "kreuzwerker/docker"
|
||||
}
|
||||
# Not used directly in this config. Existing workspace state from before
|
||||
# the jetbrains module was removed still has resources tagged under this
|
||||
# provider (the module used it internally to fetch IDE metadata) -
|
||||
# terraform init only installs providers the current config declares, so
|
||||
# without this, plan/apply fails with "Missing required provider" while
|
||||
# trying to reconcile/destroy those leftover state entries. Safe to drop
|
||||
# once every workspace has updated past the jetbrains-module version.
|
||||
http = {
|
||||
source = "hashicorp/http"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
|
||||
touch ~/.init_done
|
||||
fi
|
||||
|
||||
# Ensure git and gnupg (commit signing) are present as base packages -
|
||||
# not every base image ships gnupg by default. No-op once both are
|
||||
# present (e.g. templates/web already bakes them into its image).
|
||||
if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
|
||||
sudo apt-get update -qq
|
||||
sudo apt-get install -y --no-install-recommends git gnupg
|
||||
fi
|
||||
|
||||
# Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
|
||||
EOT
|
||||
|
||||
@@ -141,17 +159,6 @@ module "code-server" {
|
||||
order = 1
|
||||
}
|
||||
|
||||
# See https://registry.coder.com/modules/coder/jetbrains
|
||||
module "jetbrains" {
|
||||
count = data.coder_workspace.me.start_count
|
||||
source = "registry.coder.com/coder/jetbrains/coder"
|
||||
version = "~> 1.1"
|
||||
agent_id = coder_agent.main.id
|
||||
agent_name = "main"
|
||||
folder = "/home/coder"
|
||||
tooltip = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
|
||||
}
|
||||
|
||||
resource "docker_volume" "home_volume" {
|
||||
name = "coder-${data.coder_workspace.me.id}-home"
|
||||
# Protect the volume from being deleted due to changes in attributes.
|
||||
@@ -251,7 +258,8 @@ resource "coder_script" "cli_setup_wizard" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
|
||||
chmod +x /opt/coder/cli-setup-wizard.sh
|
||||
|
||||
@@ -306,7 +314,8 @@ resource "coder_script" "install_skills" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
|
||||
chmod +x /opt/coder/install-skills.sh
|
||||
SPECIALTY_SKILLS="cobol-teacher" /opt/coder/install-skills.sh
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
|
||||
FORCE=0
|
||||
[ "${1:-}" = "--force" ] && FORCE=1
|
||||
|
||||
# Tracks whether the user actually ended up authenticated against GitHub
|
||||
# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
|
||||
# host(s) in play (and stay silent - "local git only" - if neither).
|
||||
DID_GITHUB=0
|
||||
DID_GITEA=0
|
||||
|
||||
export BUN_INSTALL="${HOME}/.bun"
|
||||
export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
|
||||
|
||||
@@ -96,6 +102,143 @@ else
|
||||
echo "Skipping Claude Code CLI: bun not found on this workspace image."
|
||||
fi
|
||||
|
||||
# --- GitHub CLI (gh) ---
|
||||
if command -v gh >/dev/null 2>&1; then
|
||||
echo "GitHub CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
|
||||
if (sudo mkdir -p -m 755 /etc/apt/keyrings \
|
||||
&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
|
||||
&& sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
|
||||
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
|
||||
&& sudo apt-get update -qq && sudo apt-get install -y gh); then
|
||||
gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
|
||||
else
|
||||
echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
|
||||
|
||||
# --- Gitea CLI (tea) ---
|
||||
if command -v tea >/dev/null 2>&1; then
|
||||
echo "Gitea CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
|
||||
TEA_ARCH="$(uname -m)"
|
||||
case "$TEA_ARCH" in
|
||||
x86_64) TEA_ARCH="amd64" ;;
|
||||
aarch64) TEA_ARCH="arm64" ;;
|
||||
esac
|
||||
TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
|
||||
mkdir -p "$HOME/.local/bin"
|
||||
if [ -n "$TEA_VERSION" ] \
|
||||
&& curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
|
||||
&& chmod +x "$HOME/.local/bin/tea"; then
|
||||
echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
|
||||
tea login add || echo "Login didn't complete. Retry any time with: tea login add"
|
||||
else
|
||||
echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
|
||||
rm -f "$HOME/.local/bin/tea"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
|
||||
if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
|
||||
TEA_URL="$(awk '/^logins:/{f=1} f && /^ url:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^ token:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
[ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
|
||||
fi
|
||||
|
||||
# --- SSH + GPG keys for the external git host(s) selected above ---
|
||||
# Only asks if the user actually set up GitHub and/or Gitea just now -
|
||||
# stays silent for "local git only" (neither was set up).
|
||||
if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
|
||||
if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub and Gitea"
|
||||
elif [ "$DID_GITHUB" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub"
|
||||
else
|
||||
KEY_HOSTS_DESC="Gitea"
|
||||
fi
|
||||
|
||||
if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
|
||||
KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
|
||||
KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
|
||||
|
||||
# SSH key: ed25519, no passphrase (disposable dev workspace convenience;
|
||||
# add one manually afterwards with `ssh-keygen -p` if you want one).
|
||||
SSH_KEY="$HOME/.ssh/id_ed25519"
|
||||
if [ ! -f "$SSH_KEY" ]; then
|
||||
mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
|
||||
ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
|
||||
echo "Generated SSH key: ${SSH_KEY}.pub"
|
||||
else
|
||||
echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
|
||||
fi
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
|
||||
echo "SSH key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "SSH key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
|
||||
# GPG key: ed25519 signing key, no passphrase, no expiry.
|
||||
if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
|
||||
echo "GPG key for $KEY_EMAIL already exists, reusing it."
|
||||
else
|
||||
mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
|
||||
grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
|
||||
|| echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
|
||||
gpgconf --kill gpg-agent 2>/dev/null
|
||||
if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
|
||||
echo "Generated GPG signing key for $KEY_EMAIL."
|
||||
else
|
||||
echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
|
||||
fi
|
||||
fi
|
||||
GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
|
||||
|
||||
if [ -n "$GPG_KEY_ID" ]; then
|
||||
git config --global user.signingkey "$GPG_KEY_ID"
|
||||
git config --global commit.gpgsign true
|
||||
echo "Configured git to sign commits with this key."
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
|
||||
echo "GPG key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "GPG key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
|
||||
touch "$WIZARD_DONE_FILE"
|
||||
|
||||
+22
-13
@@ -6,6 +6,16 @@ terraform {
|
||||
docker = {
|
||||
source = "kreuzwerker/docker"
|
||||
}
|
||||
# Not used directly in this config. Existing workspace state from before
|
||||
# the jetbrains module was removed still has resources tagged under this
|
||||
# provider (the module used it internally to fetch IDE metadata) -
|
||||
# terraform init only installs providers the current config declares, so
|
||||
# without this, plan/apply fails with "Missing required provider" while
|
||||
# trying to reconcile/destroy those leftover state entries. Safe to drop
|
||||
# once every workspace has updated past the jetbrains-module version.
|
||||
http = {
|
||||
source = "hashicorp/http"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
|
||||
touch ~/.init_done
|
||||
fi
|
||||
|
||||
# Ensure git and gnupg (commit signing) are present as base packages -
|
||||
# not every base image ships gnupg by default. No-op once both are
|
||||
# present (e.g. templates/web already bakes them into its image).
|
||||
if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
|
||||
sudo apt-get update -qq
|
||||
sudo apt-get install -y --no-install-recommends git gnupg
|
||||
fi
|
||||
|
||||
# Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
|
||||
EOT
|
||||
|
||||
@@ -141,17 +159,6 @@ module "code-server" {
|
||||
order = 1
|
||||
}
|
||||
|
||||
# See https://registry.coder.com/modules/coder/jetbrains
|
||||
module "jetbrains" {
|
||||
count = data.coder_workspace.me.start_count
|
||||
source = "registry.coder.com/coder/jetbrains/coder"
|
||||
version = "~> 1.1"
|
||||
agent_id = coder_agent.main.id
|
||||
agent_name = "main"
|
||||
folder = "/home/coder"
|
||||
tooltip = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
|
||||
}
|
||||
|
||||
resource "docker_volume" "home_volume" {
|
||||
name = "coder-${data.coder_workspace.me.id}-home"
|
||||
# Protect the volume from being deleted due to changes in attributes.
|
||||
@@ -251,7 +258,8 @@ resource "coder_script" "cli_setup_wizard" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
|
||||
chmod +x /opt/coder/cli-setup-wizard.sh
|
||||
|
||||
@@ -307,7 +315,8 @@ resource "coder_script" "install_skills" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
|
||||
chmod +x /opt/coder/install-skills.sh
|
||||
SPECIALTY_SKILLS="" /opt/coder/install-skills.sh
|
||||
|
||||
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
|
||||
FORCE=0
|
||||
[ "${1:-}" = "--force" ] && FORCE=1
|
||||
|
||||
# Tracks whether the user actually ended up authenticated against GitHub
|
||||
# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
|
||||
# host(s) in play (and stay silent - "local git only" - if neither).
|
||||
DID_GITHUB=0
|
||||
DID_GITEA=0
|
||||
|
||||
export BUN_INSTALL="${HOME}/.bun"
|
||||
export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
|
||||
|
||||
@@ -96,6 +102,143 @@ else
|
||||
echo "Skipping Claude Code CLI: bun not found on this workspace image."
|
||||
fi
|
||||
|
||||
# --- GitHub CLI (gh) ---
|
||||
if command -v gh >/dev/null 2>&1; then
|
||||
echo "GitHub CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
|
||||
if (sudo mkdir -p -m 755 /etc/apt/keyrings \
|
||||
&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
|
||||
&& sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
|
||||
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
|
||||
&& sudo apt-get update -qq && sudo apt-get install -y gh); then
|
||||
gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
|
||||
else
|
||||
echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
|
||||
|
||||
# --- Gitea CLI (tea) ---
|
||||
if command -v tea >/dev/null 2>&1; then
|
||||
echo "Gitea CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
|
||||
TEA_ARCH="$(uname -m)"
|
||||
case "$TEA_ARCH" in
|
||||
x86_64) TEA_ARCH="amd64" ;;
|
||||
aarch64) TEA_ARCH="arm64" ;;
|
||||
esac
|
||||
TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
|
||||
mkdir -p "$HOME/.local/bin"
|
||||
if [ -n "$TEA_VERSION" ] \
|
||||
&& curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
|
||||
&& chmod +x "$HOME/.local/bin/tea"; then
|
||||
echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
|
||||
tea login add || echo "Login didn't complete. Retry any time with: tea login add"
|
||||
else
|
||||
echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
|
||||
rm -f "$HOME/.local/bin/tea"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
|
||||
if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
|
||||
TEA_URL="$(awk '/^logins:/{f=1} f && /^ url:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^ token:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
[ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
|
||||
fi
|
||||
|
||||
# --- SSH + GPG keys for the external git host(s) selected above ---
|
||||
# Only asks if the user actually set up GitHub and/or Gitea just now -
|
||||
# stays silent for "local git only" (neither was set up).
|
||||
if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
|
||||
if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub and Gitea"
|
||||
elif [ "$DID_GITHUB" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub"
|
||||
else
|
||||
KEY_HOSTS_DESC="Gitea"
|
||||
fi
|
||||
|
||||
if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
|
||||
KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
|
||||
KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
|
||||
|
||||
# SSH key: ed25519, no passphrase (disposable dev workspace convenience;
|
||||
# add one manually afterwards with `ssh-keygen -p` if you want one).
|
||||
SSH_KEY="$HOME/.ssh/id_ed25519"
|
||||
if [ ! -f "$SSH_KEY" ]; then
|
||||
mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
|
||||
ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
|
||||
echo "Generated SSH key: ${SSH_KEY}.pub"
|
||||
else
|
||||
echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
|
||||
fi
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
|
||||
echo "SSH key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "SSH key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
|
||||
# GPG key: ed25519 signing key, no passphrase, no expiry.
|
||||
if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
|
||||
echo "GPG key for $KEY_EMAIL already exists, reusing it."
|
||||
else
|
||||
mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
|
||||
grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
|
||||
|| echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
|
||||
gpgconf --kill gpg-agent 2>/dev/null
|
||||
if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
|
||||
echo "Generated GPG signing key for $KEY_EMAIL."
|
||||
else
|
||||
echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
|
||||
fi
|
||||
fi
|
||||
GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
|
||||
|
||||
if [ -n "$GPG_KEY_ID" ]; then
|
||||
git config --global user.signingkey "$GPG_KEY_ID"
|
||||
git config --global commit.gpgsign true
|
||||
echo "Configured git to sign commits with this key."
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
|
||||
echo "GPG key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "GPG key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
|
||||
touch "$WIZARD_DONE_FILE"
|
||||
|
||||
+22
-13
@@ -6,6 +6,16 @@ terraform {
|
||||
docker = {
|
||||
source = "kreuzwerker/docker"
|
||||
}
|
||||
# Not used directly in this config. Existing workspace state from before
|
||||
# the jetbrains module was removed still has resources tagged under this
|
||||
# provider (the module used it internally to fetch IDE metadata) -
|
||||
# terraform init only installs providers the current config declares, so
|
||||
# without this, plan/apply fails with "Missing required provider" while
|
||||
# trying to reconcile/destroy those leftover state entries. Safe to drop
|
||||
# once every workspace has updated past the jetbrains-module version.
|
||||
http = {
|
||||
source = "hashicorp/http"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
|
||||
touch ~/.init_done
|
||||
fi
|
||||
|
||||
# Ensure git and gnupg (commit signing) are present as base packages -
|
||||
# not every base image ships gnupg by default. No-op once both are
|
||||
# present (e.g. templates/web already bakes them into its image).
|
||||
if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
|
||||
sudo apt-get update -qq
|
||||
sudo apt-get install -y --no-install-recommends git gnupg
|
||||
fi
|
||||
|
||||
# Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
|
||||
EOT
|
||||
|
||||
@@ -141,17 +159,6 @@ module "code-server" {
|
||||
order = 1
|
||||
}
|
||||
|
||||
# See https://registry.coder.com/modules/coder/jetbrains
|
||||
module "jetbrains" {
|
||||
count = data.coder_workspace.me.start_count
|
||||
source = "registry.coder.com/coder/jetbrains/coder"
|
||||
version = "~> 1.1"
|
||||
agent_id = coder_agent.main.id
|
||||
agent_name = "main"
|
||||
folder = "/home/coder"
|
||||
tooltip = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
|
||||
}
|
||||
|
||||
resource "docker_volume" "home_volume" {
|
||||
name = "coder-${data.coder_workspace.me.id}-home"
|
||||
# Protect the volume from being deleted due to changes in attributes.
|
||||
@@ -251,7 +258,8 @@ resource "coder_script" "cli_setup_wizard" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
|
||||
chmod +x /opt/coder/cli-setup-wizard.sh
|
||||
|
||||
@@ -307,7 +315,8 @@ resource "coder_script" "install_skills" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
|
||||
chmod +x /opt/coder/install-skills.sh
|
||||
SPECIALTY_SKILLS="" /opt/coder/install-skills.sh
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
|
||||
FORCE=0
|
||||
[ "${1:-}" = "--force" ] && FORCE=1
|
||||
|
||||
# Tracks whether the user actually ended up authenticated against GitHub
|
||||
# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
|
||||
# host(s) in play (and stay silent - "local git only" - if neither).
|
||||
DID_GITHUB=0
|
||||
DID_GITEA=0
|
||||
|
||||
export BUN_INSTALL="${HOME}/.bun"
|
||||
export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
|
||||
|
||||
@@ -96,6 +102,143 @@ else
|
||||
echo "Skipping Claude Code CLI: bun not found on this workspace image."
|
||||
fi
|
||||
|
||||
# --- GitHub CLI (gh) ---
|
||||
if command -v gh >/dev/null 2>&1; then
|
||||
echo "GitHub CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
|
||||
if (sudo mkdir -p -m 755 /etc/apt/keyrings \
|
||||
&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
|
||||
&& sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
|
||||
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
|
||||
&& sudo apt-get update -qq && sudo apt-get install -y gh); then
|
||||
gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
|
||||
else
|
||||
echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
|
||||
|
||||
# --- Gitea CLI (tea) ---
|
||||
if command -v tea >/dev/null 2>&1; then
|
||||
echo "Gitea CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
|
||||
TEA_ARCH="$(uname -m)"
|
||||
case "$TEA_ARCH" in
|
||||
x86_64) TEA_ARCH="amd64" ;;
|
||||
aarch64) TEA_ARCH="arm64" ;;
|
||||
esac
|
||||
TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
|
||||
mkdir -p "$HOME/.local/bin"
|
||||
if [ -n "$TEA_VERSION" ] \
|
||||
&& curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
|
||||
&& chmod +x "$HOME/.local/bin/tea"; then
|
||||
echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
|
||||
tea login add || echo "Login didn't complete. Retry any time with: tea login add"
|
||||
else
|
||||
echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
|
||||
rm -f "$HOME/.local/bin/tea"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
|
||||
if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
|
||||
TEA_URL="$(awk '/^logins:/{f=1} f && /^ url:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^ token:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
[ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
|
||||
fi
|
||||
|
||||
# --- SSH + GPG keys for the external git host(s) selected above ---
|
||||
# Only asks if the user actually set up GitHub and/or Gitea just now -
|
||||
# stays silent for "local git only" (neither was set up).
|
||||
if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
|
||||
if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub and Gitea"
|
||||
elif [ "$DID_GITHUB" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub"
|
||||
else
|
||||
KEY_HOSTS_DESC="Gitea"
|
||||
fi
|
||||
|
||||
if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
|
||||
KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
|
||||
KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
|
||||
|
||||
# SSH key: ed25519, no passphrase (disposable dev workspace convenience;
|
||||
# add one manually afterwards with `ssh-keygen -p` if you want one).
|
||||
SSH_KEY="$HOME/.ssh/id_ed25519"
|
||||
if [ ! -f "$SSH_KEY" ]; then
|
||||
mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
|
||||
ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
|
||||
echo "Generated SSH key: ${SSH_KEY}.pub"
|
||||
else
|
||||
echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
|
||||
fi
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
|
||||
echo "SSH key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "SSH key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
|
||||
# GPG key: ed25519 signing key, no passphrase, no expiry.
|
||||
if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
|
||||
echo "GPG key for $KEY_EMAIL already exists, reusing it."
|
||||
else
|
||||
mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
|
||||
grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
|
||||
|| echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
|
||||
gpgconf --kill gpg-agent 2>/dev/null
|
||||
if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
|
||||
echo "Generated GPG signing key for $KEY_EMAIL."
|
||||
else
|
||||
echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
|
||||
fi
|
||||
fi
|
||||
GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
|
||||
|
||||
if [ -n "$GPG_KEY_ID" ]; then
|
||||
git config --global user.signingkey "$GPG_KEY_ID"
|
||||
git config --global commit.gpgsign true
|
||||
echo "Configured git to sign commits with this key."
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
|
||||
echo "GPG key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "GPG key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
|
||||
touch "$WIZARD_DONE_FILE"
|
||||
|
||||
+22
-13
@@ -6,6 +6,16 @@ terraform {
|
||||
docker = {
|
||||
source = "kreuzwerker/docker"
|
||||
}
|
||||
# Not used directly in this config. Existing workspace state from before
|
||||
# the jetbrains module was removed still has resources tagged under this
|
||||
# provider (the module used it internally to fetch IDE metadata) -
|
||||
# terraform init only installs providers the current config declares, so
|
||||
# without this, plan/apply fails with "Missing required provider" while
|
||||
# trying to reconcile/destroy those leftover state entries. Safe to drop
|
||||
# once every workspace has updated past the jetbrains-module version.
|
||||
http = {
|
||||
source = "hashicorp/http"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
|
||||
touch ~/.init_done
|
||||
fi
|
||||
|
||||
# Ensure git and gnupg (commit signing) are present as base packages -
|
||||
# not every base image ships gnupg by default. No-op once both are
|
||||
# present (e.g. templates/web already bakes them into its image).
|
||||
if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
|
||||
sudo apt-get update -qq
|
||||
sudo apt-get install -y --no-install-recommends git gnupg
|
||||
fi
|
||||
|
||||
# Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
|
||||
EOT
|
||||
|
||||
@@ -141,17 +159,6 @@ module "code-server" {
|
||||
order = 1
|
||||
}
|
||||
|
||||
# See https://registry.coder.com/modules/coder/jetbrains
|
||||
module "jetbrains" {
|
||||
count = data.coder_workspace.me.start_count
|
||||
source = "registry.coder.com/coder/jetbrains/coder"
|
||||
version = "~> 1.1"
|
||||
agent_id = coder_agent.main.id
|
||||
agent_name = "main"
|
||||
folder = "/home/coder"
|
||||
tooltip = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
|
||||
}
|
||||
|
||||
resource "docker_volume" "home_volume" {
|
||||
name = "coder-${data.coder_workspace.me.id}-home"
|
||||
# Protect the volume from being deleted due to changes in attributes.
|
||||
@@ -251,7 +258,8 @@ resource "coder_script" "cli_setup_wizard" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
|
||||
chmod +x /opt/coder/cli-setup-wizard.sh
|
||||
|
||||
@@ -307,7 +315,8 @@ resource "coder_script" "install_skills" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
|
||||
chmod +x /opt/coder/install-skills.sh
|
||||
SPECIALTY_SKILLS="foundryvtt-modding ttrpg-lore-weaver" /opt/coder/install-skills.sh
|
||||
|
||||
@@ -17,6 +17,19 @@ ENV LANG=en_US.UTF-8 \
|
||||
LANGUAGE=en_US:en \
|
||||
LC_ALL=en_US.UTF-8
|
||||
|
||||
# Google Chrome (stable), for the Browse Lite VS Code extension's embedded
|
||||
# browser preview. Ubuntu's own `chromium-browser` apt package is just a
|
||||
# snap wrapper and doesn't work in a container (no snapd) - Google's own
|
||||
# .deb is the reliable way to get a real Chrome binary here. amd64 only
|
||||
# (Google doesn't publish a Chrome .deb for arm64), which matches this
|
||||
# repo's single x86_64 Docker host.
|
||||
RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
|
||||
| gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg \
|
||||
&& echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
|
||||
> /etc/apt/sources.list.d/google-chrome.list \
|
||||
&& apt-get update && apt-get install -y google-chrome-stable \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
|
||||
# X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
@@ -43,15 +56,23 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
|
||||
# Global Python prototyping packages: CV, ONNX runtime, CPU-only torch wheel.
|
||||
# Ubuntu 24.04's system Python is PEP 668 externally-managed; this is a
|
||||
# throwaway container image, so --break-system-packages is the right call
|
||||
# instead of forcing every user into a venv for basic prototyping.
|
||||
RUN python3 -m pip install --break-system-packages --no-cache-dir --upgrade pip \
|
||||
&& python3 -m pip install --break-system-packages --no-cache-dir \
|
||||
# instead of forcing every user into a venv for basic prototyping. Not
|
||||
# upgrading pip itself first: the Debian-packaged pip 24.0 has no RECORD
|
||||
# file (dpkg-installed, not pip-installed), so `pip install --upgrade pip`
|
||||
# fails trying to uninstall it in place - and it's unneeded anyway, the
|
||||
# packages below install fine under the stock version.
|
||||
RUN python3 -m pip install --break-system-packages --no-cache-dir \
|
||||
numpy opencv-python-headless onnxruntime \
|
||||
&& python3 -m pip install --break-system-packages --no-cache-dir \
|
||||
torch --index-url https://download.pytorch.org/whl/cpu
|
||||
|
||||
# Standard non-root dev user with passwordless sudo.
|
||||
RUN useradd --uid 1000 --create-home --shell /bin/bash coder \
|
||||
# Standard non-root dev user with passwordless sudo. Ubuntu 24.04's base
|
||||
# image already ships a default `ubuntu` user/group at uid/gid 1000, which
|
||||
# collides with the explicit --uid 1000 below - drop it first so `coder`
|
||||
# can take that uid.
|
||||
RUN userdel -r ubuntu 2>/dev/null; \
|
||||
groupdel ubuntu 2>/dev/null; \
|
||||
useradd --uid 1000 --create-home --shell /bin/bash coder \
|
||||
&& echo "coder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder \
|
||||
&& chmod 0440 /etc/sudoers.d/coder
|
||||
|
||||
@@ -80,8 +101,5 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
|
||||
# Bun: global runtime for the ElysiaJS backend and fast scripting.
|
||||
RUN curl -fsSL https://bun.sh/install | bash
|
||||
|
||||
# Prime the pnpm content-addressable store dir referenced by PNPM_HOME.
|
||||
RUN pnpm setup || true
|
||||
|
||||
RUN mkdir -p /home/coder/workspace
|
||||
WORKDIR /home/coder/workspace
|
||||
|
||||
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
|
||||
FORCE=0
|
||||
[ "${1:-}" = "--force" ] && FORCE=1
|
||||
|
||||
# Tracks whether the user actually ended up authenticated against GitHub
|
||||
# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
|
||||
# host(s) in play (and stay silent - "local git only" - if neither).
|
||||
DID_GITHUB=0
|
||||
DID_GITEA=0
|
||||
|
||||
export BUN_INSTALL="${HOME}/.bun"
|
||||
export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"
|
||||
|
||||
@@ -96,6 +102,143 @@ else
|
||||
echo "Skipping Claude Code CLI: bun not found on this workspace image."
|
||||
fi
|
||||
|
||||
# --- GitHub CLI (gh) ---
|
||||
if command -v gh >/dev/null 2>&1; then
|
||||
echo "GitHub CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install GitHub CLI (gh) and log in?"; then
|
||||
if (sudo mkdir -p -m 755 /etc/apt/keyrings \
|
||||
&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
|
||||
&& sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
|
||||
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list >/dev/null \
|
||||
&& sudo apt-get update -qq && sudo apt-get install -y gh); then
|
||||
gh auth login || echo "Install succeeded but login didn't complete. Retry any time with: gh auth login"
|
||||
else
|
||||
echo "GitHub CLI install failed. Retry later with: gh auth login (once gh is installed)"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1
|
||||
|
||||
# --- Gitea CLI (tea) ---
|
||||
if command -v tea >/dev/null 2>&1; then
|
||||
echo "Gitea CLI already installed, skipping."
|
||||
else
|
||||
if ask_yes_no "Install Gitea CLI (tea) and log in?"; then
|
||||
TEA_ARCH="$(uname -m)"
|
||||
case "$TEA_ARCH" in
|
||||
x86_64) TEA_ARCH="amd64" ;;
|
||||
aarch64) TEA_ARCH="arm64" ;;
|
||||
esac
|
||||
TEA_VERSION="$(curl -fsSL https://gitea.com/api/v1/repos/gitea/tea/releases/latest | grep -o '"tag_name":[^,]*' | grep -o 'v[0-9][^"]*')"
|
||||
mkdir -p "$HOME/.local/bin"
|
||||
if [ -n "$TEA_VERSION" ] \
|
||||
&& curl -fsSL "https://gitea.com/gitea/tea/releases/download/${TEA_VERSION}/tea-${TEA_VERSION#v}-linux-${TEA_ARCH}" -o "$HOME/.local/bin/tea" \
|
||||
&& chmod +x "$HOME/.local/bin/tea"; then
|
||||
echo "Add this Gitea instance now (e.g. https://git.octoturge.com)..."
|
||||
tea login add || echo "Login didn't complete. Retry any time with: tea login add"
|
||||
else
|
||||
echo "Gitea CLI install failed. Retry later from: https://gitea.com/gitea/tea/releases"
|
||||
rm -f "$HOME/.local/bin/tea"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
TEA_CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/tea/config.yml"
|
||||
if command -v tea >/dev/null 2>&1 && [ -f "$TEA_CONFIG" ]; then
|
||||
TEA_URL="$(awk '/^logins:/{f=1} f && /^ url:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
TEA_TOKEN="$(awk '/^logins:/{f=1} f && /^ token:/{print $2; exit}' "$TEA_CONFIG")"
|
||||
[ -n "$TEA_URL" ] && [ -n "$TEA_TOKEN" ] && DID_GITEA=1
|
||||
fi
|
||||
|
||||
# --- SSH + GPG keys for the external git host(s) selected above ---
|
||||
# Only asks if the user actually set up GitHub and/or Gitea just now -
|
||||
# stays silent for "local git only" (neither was set up).
|
||||
if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
|
||||
if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub and Gitea"
|
||||
elif [ "$DID_GITHUB" -eq 1 ]; then
|
||||
KEY_HOSTS_DESC="GitHub"
|
||||
else
|
||||
KEY_HOSTS_DESC="Gitea"
|
||||
fi
|
||||
|
||||
if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
|
||||
KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
|
||||
KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
|
||||
|
||||
# SSH key: ed25519, no passphrase (disposable dev workspace convenience;
|
||||
# add one manually afterwards with `ssh-keygen -p` if you want one).
|
||||
SSH_KEY="$HOME/.ssh/id_ed25519"
|
||||
if [ ! -f "$SSH_KEY" ]; then
|
||||
mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
|
||||
ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
|
||||
echo "Generated SSH key: ${SSH_KEY}.pub"
|
||||
else
|
||||
echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
|
||||
fi
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
|
||||
echo "SSH key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
SSH_PUB_JSON="$(sed 's/\\/\\\\/g; s/"/\\"/g' "${SSH_KEY}.pub")"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"title\":\"coder-$(hostname)\",\"key\":\"${SSH_PUB_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "SSH key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
|
||||
# GPG key: ed25519 signing key, no passphrase, no expiry.
|
||||
if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
|
||||
echo "GPG key for $KEY_EMAIL already exists, reusing it."
|
||||
else
|
||||
mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
|
||||
grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
|
||||
|| echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
|
||||
gpgconf --kill gpg-agent 2>/dev/null
|
||||
if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
|
||||
echo "Generated GPG signing key for $KEY_EMAIL."
|
||||
else
|
||||
echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
|
||||
fi
|
||||
fi
|
||||
GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
|
||||
|
||||
if [ -n "$GPG_KEY_ID" ]; then
|
||||
git config --global user.signingkey "$GPG_KEY_ID"
|
||||
git config --global commit.gpgsign true
|
||||
echo "Configured git to sign commits with this key."
|
||||
|
||||
if [ "$DID_GITHUB" -eq 1 ]; then
|
||||
if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
|
||||
echo "GPG key added to GitHub."
|
||||
else
|
||||
echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$DID_GITEA" -eq 1 ]; then
|
||||
GPG_ARMORED_JSON="$(gpg --armor --export "$GPG_KEY_ID" | awk '{printf "%s\\n", $0}')"
|
||||
if curl -fsS -X POST "${TEA_URL%/}/api/v1/user/gpg_keys" \
|
||||
-H "Authorization: token ${TEA_TOKEN}" -H "Content-Type: application/json" \
|
||||
-d "{\"armored_public_key\":\"${GPG_ARMORED_JSON}\"}" >/dev/null 2>&1; then
|
||||
echo "GPG key added to Gitea."
|
||||
else
|
||||
echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually at: ${TEA_URL%/}/user/settings/keys"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
|
||||
touch "$WIZARD_DONE_FILE"
|
||||
|
||||
+22
-13
@@ -6,6 +6,16 @@ terraform {
|
||||
docker = {
|
||||
source = "kreuzwerker/docker"
|
||||
}
|
||||
# Not used directly in this config. Existing workspace state from before
|
||||
# the jetbrains module was removed still has resources tagged under this
|
||||
# provider (the module used it internally to fetch IDE metadata) -
|
||||
# terraform init only installs providers the current config declares, so
|
||||
# without this, plan/apply fails with "Missing required provider" while
|
||||
# trying to reconcile/destroy those leftover state entries. Safe to drop
|
||||
# once every workspace has updated past the jetbrains-module version.
|
||||
http = {
|
||||
source = "hashicorp/http"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -43,6 +53,14 @@ resource "coder_agent" "main" {
|
||||
touch ~/.init_done
|
||||
fi
|
||||
|
||||
# Ensure git and gnupg (commit signing) are present as base packages -
|
||||
# not every base image ships gnupg by default. No-op once both are
|
||||
# present (e.g. templates/web already bakes them into its image).
|
||||
if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
|
||||
sudo apt-get update -qq
|
||||
sudo apt-get install -y --no-install-recommends git gnupg
|
||||
fi
|
||||
|
||||
# Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
|
||||
EOT
|
||||
|
||||
@@ -148,17 +166,6 @@ module "code-server" {
|
||||
order = 1
|
||||
}
|
||||
|
||||
# See https://registry.coder.com/modules/coder/jetbrains
|
||||
module "jetbrains" {
|
||||
count = data.coder_workspace.me.start_count
|
||||
source = "registry.coder.com/coder/jetbrains/coder"
|
||||
version = "~> 1.1"
|
||||
agent_id = coder_agent.main.id
|
||||
agent_name = "main"
|
||||
folder = "/home/coder"
|
||||
tooltip = "You need to [install JetBrains Toolbox](https://coder.com/docs/user-guides/workspace-access/jetbrains/toolbox) to use this app."
|
||||
}
|
||||
|
||||
resource "docker_volume" "home_volume" {
|
||||
name = "coder-${data.coder_workspace.me.id}-home"
|
||||
# Protect the volume from being deleted due to changes in attributes.
|
||||
@@ -271,7 +278,8 @@ resource "coder_script" "cli_setup_wizard" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
|
||||
chmod +x /opt/coder/cli-setup-wizard.sh
|
||||
|
||||
@@ -308,7 +316,8 @@ resource "coder_script" "install_skills" {
|
||||
script = <<-EOT
|
||||
#!/bin/bash
|
||||
set -e
|
||||
mkdir -p /opt/coder
|
||||
sudo mkdir -p /opt/coder
|
||||
sudo chown "$(id -u):$(id -g)" /opt/coder
|
||||
echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
|
||||
chmod +x /opt/coder/install-skills.sh
|
||||
SPECIALTY_SKILLS="" /opt/coder/install-skills.sh
|
||||
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user