web: build image in CI, pull it in Terraform instead of building locally

templates/web's docker_image resource used a `build` block, so every first-use of a new Dockerfile hash triggered a from-scratch build (including the ~15-20min Rust toolchain compile) right at `terraform apply` time - i.e. while someone was waiting to create a workspace. Adds a build-web-image job to coder-templates.yml that builds and pushes git.octoturge.com/octo-tech/profiles-web:<dockerfile-sha1> to this instance's container registry, tagged identically to what docker_image.web now computes and pulls (no build block). provision now depends on build-web-image so a template never gets pushed pointing at an image that isn't there yet. Skips the build entirely if that tag's already in the registry, so an unrelated templates/* change doesn't pay any cost. Runs on a new dedicated "docker-build" runner (profiles-web-build), scoped to just this repo via a repo-level registration token, with host Docker socket access - deliberately not added to the existing shared runner-1, which has no such access and stays untouched. Repo is public, so the pulled image needs no registry auth; the push does, via a new GITEA_PACKAGE_TOKEN repo secret (write:package scope). Since CI and this Coder deployment share the same Docker daemon, the "pull" is normally a same-host cache hit, not a real network pull. Verified: `terraform validate` passes against the updated templates/web/main.tf (run directly inside the coder-server container, which has terraform embedded).
cli-setup-wizard: stop parsing tea's config.yml, use tea itself
2026-08-27 01:10:58 +02:00 · 2026-08-27 00:49:20 +02:00 · 2026-08-27 00:14:11 +02:00 · 2026-08-26 23:57:51 +02:00 · 2026-08-26 23:16:25 +02:00
16 changed files with 728 additions and 10 deletions
@@ -13,6 +13,19 @@ name: Provision Coder Templates
 #   CODER_URL             e.g. https://code.octoturge.com
 #   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
+#   GITEA_PACKAGE_TOKEN   a Gitea access token (user Settings > Applications)
+#                          with write:package scope, for pushing templates/web's
+#                          image to this instance's container registry. Only
+#                          the octoturge account's own token is used - login()
+#                          hardcodes that username to match.
+#
+# templates/web builds its Docker image here (build-web-image, on the
+# dedicated "docker-build" runner - see templates/web/main.tf for why: that
+# runner is scoped to this repo only and has host Docker socket access that
+# the shared runner-1 deliberately doesn't). provision then just pulls the
+# tag build-web-image produced, instead of building it itself at
+# `terraform apply` time - keeps the slow Rust toolchain compile off of
+# "someone is waiting to create a workspace".

 on:
  push:
@@ -23,7 +36,30 @@ on:
  workflow_dispatch: {}

 jobs:
+  build-web-image:
+    runs-on: docker-build
+    container:
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build and push templates/web's image (skips if the tag already exists)
+        run: |
+          set -e
+          TAG="$(sha1sum templates/web/Dockerfile | cut -d' ' -f1)"
+          IMAGE="git.octoturge.com/octo-tech/profiles-web:${TAG}"
+          echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
+          if docker manifest inspect "$IMAGE" >/dev/null 2>&1; then
+            echo "$IMAGE already in the registry (Dockerfile unchanged), skipping build."
+            exit 0
+          fi
+          docker build -t "$IMAGE" templates/web
+          docker push "$IMAGE"
+
  provision:
+    needs: build-web-image
    runs-on: ubuntu-latest
    env:
      CODER_URL: ${{ secrets.CODER_URL }}
@@ -117,6 +117,19 @@ finishes it - and offers to install + log into:
 - **GitHub CLI** (`gh`, via the official apt repo, then `gh auth login`)
 - **Gitea CLI** (`tea`, official binary release downloaded to `~/.local/bin`, then `tea login add`)

+`git` and `gnupg` themselves aren't part of this opt-in flow - every
+template's `coder_agent` startup script installs them unconditionally as
+base packages (a no-op where they're already present, e.g. baked into
+`templates/web`'s image). If the wizard just authenticated GitHub and/or
+Gitea above (skipped entirely for "local git only" - neither set up), it
+asks once more whether to auto-generate an ed25519 SSH key and an ed25519
+GPG signing key and register them with whichever host(s) got set up: `gh
+ssh-key add` / `gh gpg-key add` for GitHub, a direct call against Gitea's
+`/api/v1/user/keys` and `/api/v1/user/gpg_keys` (using the token `tea
+login add` already stored) for Gitea. Either upload failing just prints
+the manual command/URL to finish it yourself - never blocks the rest of
+the wizard.
+
 It does **not** ask about VS Code extensions, since those are handled by
 Terraform (see above). Once the user confirms completion it writes a
 sentinel file (`~/.cache/coder-cli-wizard/done`) and stops prompting. It can
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1

+# Tracks whether the user actually ended up authenticated against GitHub
+# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
+# host(s) in play (and stay silent - "local git only" - if neither).
+DID_GITHUB=0
+DID_GITEA=0
+
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"

@@ -112,6 +118,7 @@ else
    fi
  fi
 fi
+command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1

 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
@@ -136,6 +143,100 @@ else
    fi
  fi
 fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+
+# --- SSH + GPG keys for the external git host(s) selected above ---
+# Only asks if the user actually set up GitHub and/or Gitea just now -
+# stays silent for "local git only" (neither was set up).
+if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
+  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub and Gitea"
+  elif [ "$DID_GITHUB" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub"
+  else
+    KEY_HOSTS_DESC="Gitea"
+  fi
+
+  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
+    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
+    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
+
+    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
+    # add one manually afterwards with `ssh-keygen -p` if you want one).
+    SSH_KEY="$HOME/.ssh/id_ed25519"
+    if [ ! -f "$SSH_KEY" ]; then
+      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
+      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
+      echo "Generated SSH key: ${SSH_KEY}.pub"
+    else
+      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
+    fi
+
+    if [ "$DID_GITHUB" -eq 1 ]; then
+      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
+        echo "SSH key added to GitHub."
+      else
+        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    if [ "$DID_GITEA" -eq 1 ]; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+        echo "SSH key added to Gitea."
+      else
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    # GPG key: ed25519 signing key, no passphrase, no expiry.
+    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
+      echo "GPG key for $KEY_EMAIL already exists, reusing it."
+    else
+      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
+      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
+        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
+      gpgconf --kill gpg-agent 2>/dev/null
+      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
+        echo "Generated GPG signing key for $KEY_EMAIL."
+      else
+        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
+      fi
+    fi
+    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
+
+    if [ -n "$GPG_KEY_ID" ]; then
+      git config --global user.signingkey "$GPG_KEY_ID"
+      git config --global commit.gpgsign true
+      echo "Configured git to sign commits with this key."
+
+      if [ "$DID_GITHUB" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
+          echo "GPG key added to GitHub."
+        else
+          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
+        fi
+      fi
+
+      if [ "$DID_GITEA" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+          echo "GPG key added to Gitea."
+        else
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+        fi
+      fi
+    fi
+  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
+fi

 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
@@ -53,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi

+    # Ensure git and gnupg (commit signing) are present as base packages -
+    # not every base image ships gnupg by default. No-op once both are
+    # present (e.g. templates/web already bakes them into its image).
+    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
+      sudo apt-get update -qq
+      sudo apt-get install -y --no-install-recommends git gnupg
+    fi
+
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT

@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1

+# Tracks whether the user actually ended up authenticated against GitHub
+# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
+# host(s) in play (and stay silent - "local git only" - if neither).
+DID_GITHUB=0
+DID_GITEA=0
+
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"

@@ -112,6 +118,7 @@ else
    fi
  fi
 fi
+command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1

 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
@@ -136,6 +143,100 @@ else
    fi
  fi
 fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+
+# --- SSH + GPG keys for the external git host(s) selected above ---
+# Only asks if the user actually set up GitHub and/or Gitea just now -
+# stays silent for "local git only" (neither was set up).
+if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
+  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub and Gitea"
+  elif [ "$DID_GITHUB" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub"
+  else
+    KEY_HOSTS_DESC="Gitea"
+  fi
+
+  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
+    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
+    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
+
+    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
+    # add one manually afterwards with `ssh-keygen -p` if you want one).
+    SSH_KEY="$HOME/.ssh/id_ed25519"
+    if [ ! -f "$SSH_KEY" ]; then
+      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
+      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
+      echo "Generated SSH key: ${SSH_KEY}.pub"
+    else
+      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
+    fi
+
+    if [ "$DID_GITHUB" -eq 1 ]; then
+      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
+        echo "SSH key added to GitHub."
+      else
+        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    if [ "$DID_GITEA" -eq 1 ]; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+        echo "SSH key added to Gitea."
+      else
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    # GPG key: ed25519 signing key, no passphrase, no expiry.
+    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
+      echo "GPG key for $KEY_EMAIL already exists, reusing it."
+    else
+      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
+      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
+        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
+      gpgconf --kill gpg-agent 2>/dev/null
+      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
+        echo "Generated GPG signing key for $KEY_EMAIL."
+      else
+        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
+      fi
+    fi
+    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
+
+    if [ -n "$GPG_KEY_ID" ]; then
+      git config --global user.signingkey "$GPG_KEY_ID"
+      git config --global commit.gpgsign true
+      echo "Configured git to sign commits with this key."
+
+      if [ "$DID_GITHUB" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
+          echo "GPG key added to GitHub."
+        else
+          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
+        fi
+      fi
+
+      if [ "$DID_GITEA" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+          echo "GPG key added to Gitea."
+        else
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+        fi
+      fi
+    fi
+  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
+fi

 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
@@ -53,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi

+    # Ensure git and gnupg (commit signing) are present as base packages -
+    # not every base image ships gnupg by default. No-op once both are
+    # present (e.g. templates/web already bakes them into its image).
+    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
+      sudo apt-get update -qq
+      sudo apt-get install -y --no-install-recommends git gnupg
+    fi
+
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT

@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1

+# Tracks whether the user actually ended up authenticated against GitHub
+# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
+# host(s) in play (and stay silent - "local git only" - if neither).
+DID_GITHUB=0
+DID_GITEA=0
+
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"

@@ -112,6 +118,7 @@ else
    fi
  fi
 fi
+command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1

 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
@@ -136,6 +143,100 @@ else
    fi
  fi
 fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+
+# --- SSH + GPG keys for the external git host(s) selected above ---
+# Only asks if the user actually set up GitHub and/or Gitea just now -
+# stays silent for "local git only" (neither was set up).
+if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
+  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub and Gitea"
+  elif [ "$DID_GITHUB" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub"
+  else
+    KEY_HOSTS_DESC="Gitea"
+  fi
+
+  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
+    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
+    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
+
+    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
+    # add one manually afterwards with `ssh-keygen -p` if you want one).
+    SSH_KEY="$HOME/.ssh/id_ed25519"
+    if [ ! -f "$SSH_KEY" ]; then
+      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
+      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
+      echo "Generated SSH key: ${SSH_KEY}.pub"
+    else
+      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
+    fi
+
+    if [ "$DID_GITHUB" -eq 1 ]; then
+      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
+        echo "SSH key added to GitHub."
+      else
+        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    if [ "$DID_GITEA" -eq 1 ]; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+        echo "SSH key added to Gitea."
+      else
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    # GPG key: ed25519 signing key, no passphrase, no expiry.
+    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
+      echo "GPG key for $KEY_EMAIL already exists, reusing it."
+    else
+      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
+      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
+        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
+      gpgconf --kill gpg-agent 2>/dev/null
+      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
+        echo "Generated GPG signing key for $KEY_EMAIL."
+      else
+        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
+      fi
+    fi
+    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
+
+    if [ -n "$GPG_KEY_ID" ]; then
+      git config --global user.signingkey "$GPG_KEY_ID"
+      git config --global commit.gpgsign true
+      echo "Configured git to sign commits with this key."
+
+      if [ "$DID_GITHUB" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
+          echo "GPG key added to GitHub."
+        else
+          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
+        fi
+      fi
+
+      if [ "$DID_GITEA" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+          echo "GPG key added to Gitea."
+        else
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+        fi
+      fi
+    fi
+  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
+fi

 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
@@ -53,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi

+    # Ensure git and gnupg (commit signing) are present as base packages -
+    # not every base image ships gnupg by default. No-op once both are
+    # present (e.g. templates/web already bakes them into its image).
+    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
+      sudo apt-get update -qq
+      sudo apt-get install -y --no-install-recommends git gnupg
+    fi
+
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT

@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1

+# Tracks whether the user actually ended up authenticated against GitHub
+# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
+# host(s) in play (and stay silent - "local git only" - if neither).
+DID_GITHUB=0
+DID_GITEA=0
+
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"

@@ -112,6 +118,7 @@ else
    fi
  fi
 fi
+command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1

 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
@@ -136,6 +143,100 @@ else
    fi
  fi
 fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+
+# --- SSH + GPG keys for the external git host(s) selected above ---
+# Only asks if the user actually set up GitHub and/or Gitea just now -
+# stays silent for "local git only" (neither was set up).
+if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
+  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub and Gitea"
+  elif [ "$DID_GITHUB" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub"
+  else
+    KEY_HOSTS_DESC="Gitea"
+  fi
+
+  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
+    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
+    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
+
+    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
+    # add one manually afterwards with `ssh-keygen -p` if you want one).
+    SSH_KEY="$HOME/.ssh/id_ed25519"
+    if [ ! -f "$SSH_KEY" ]; then
+      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
+      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
+      echo "Generated SSH key: ${SSH_KEY}.pub"
+    else
+      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
+    fi
+
+    if [ "$DID_GITHUB" -eq 1 ]; then
+      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
+        echo "SSH key added to GitHub."
+      else
+        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    if [ "$DID_GITEA" -eq 1 ]; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+        echo "SSH key added to Gitea."
+      else
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    # GPG key: ed25519 signing key, no passphrase, no expiry.
+    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
+      echo "GPG key for $KEY_EMAIL already exists, reusing it."
+    else
+      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
+      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
+        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
+      gpgconf --kill gpg-agent 2>/dev/null
+      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
+        echo "Generated GPG signing key for $KEY_EMAIL."
+      else
+        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
+      fi
+    fi
+    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
+
+    if [ -n "$GPG_KEY_ID" ]; then
+      git config --global user.signingkey "$GPG_KEY_ID"
+      git config --global commit.gpgsign true
+      echo "Configured git to sign commits with this key."
+
+      if [ "$DID_GITHUB" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
+          echo "GPG key added to GitHub."
+        else
+          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
+        fi
+      fi
+
+      if [ "$DID_GITEA" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+          echo "GPG key added to Gitea."
+        else
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+        fi
+      fi
+    fi
+  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
+fi

 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
@@ -53,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi

+    # Ensure git and gnupg (commit signing) are present as base packages -
+    # not every base image ships gnupg by default. No-op once both are
+    # present (e.g. templates/web already bakes them into its image).
+    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
+      sudo apt-get update -qq
+      sudo apt-get install -y --no-install-recommends git gnupg
+    fi
+
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT

@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1

+# Tracks whether the user actually ended up authenticated against GitHub
+# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
+# host(s) in play (and stay silent - "local git only" - if neither).
+DID_GITHUB=0
+DID_GITEA=0
+
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"

@@ -112,6 +118,7 @@ else
    fi
  fi
 fi
+command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1

 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
@@ -136,6 +143,100 @@ else
    fi
  fi
 fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+
+# --- SSH + GPG keys for the external git host(s) selected above ---
+# Only asks if the user actually set up GitHub and/or Gitea just now -
+# stays silent for "local git only" (neither was set up).
+if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
+  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub and Gitea"
+  elif [ "$DID_GITHUB" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub"
+  else
+    KEY_HOSTS_DESC="Gitea"
+  fi
+
+  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
+    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
+    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
+
+    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
+    # add one manually afterwards with `ssh-keygen -p` if you want one).
+    SSH_KEY="$HOME/.ssh/id_ed25519"
+    if [ ! -f "$SSH_KEY" ]; then
+      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
+      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
+      echo "Generated SSH key: ${SSH_KEY}.pub"
+    else
+      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
+    fi
+
+    if [ "$DID_GITHUB" -eq 1 ]; then
+      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
+        echo "SSH key added to GitHub."
+      else
+        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    if [ "$DID_GITEA" -eq 1 ]; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+        echo "SSH key added to Gitea."
+      else
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    # GPG key: ed25519 signing key, no passphrase, no expiry.
+    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
+      echo "GPG key for $KEY_EMAIL already exists, reusing it."
+    else
+      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
+      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
+        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
+      gpgconf --kill gpg-agent 2>/dev/null
+      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
+        echo "Generated GPG signing key for $KEY_EMAIL."
+      else
+        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
+      fi
+    fi
+    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
+
+    if [ -n "$GPG_KEY_ID" ]; then
+      git config --global user.signingkey "$GPG_KEY_ID"
+      git config --global commit.gpgsign true
+      echo "Configured git to sign commits with this key."
+
+      if [ "$DID_GITHUB" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
+          echo "GPG key added to GitHub."
+        else
+          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
+        fi
+      fi
+
+      if [ "$DID_GITEA" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+          echo "GPG key added to Gitea."
+        else
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+        fi
+      fi
+    fi
+  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
+fi

 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
@@ -53,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi

+    # Ensure git and gnupg (commit signing) are present as base packages -
+    # not every base image ships gnupg by default. No-op once both are
+    # present (e.g. templates/web already bakes them into its image).
+    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
+      sudo apt-get update -qq
+      sudo apt-get install -y --no-install-recommends git gnupg
+    fi
+
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT

@@ -17,6 +17,19 @@ ENV LANG=en_US.UTF-8 \
    LANGUAGE=en_US:en \
    LC_ALL=en_US.UTF-8

+# Google Chrome (stable), for the Browse Lite VS Code extension's embedded
+# browser preview. Ubuntu's own `chromium-browser` apt package is just a
+# snap wrapper and doesn't work in a container (no snapd) - Google's own
+# .deb is the reliable way to get a real Chrome binary here. amd64 only
+# (Google doesn't publish a Chrome .deb for arm64), which matches this
+# repo's single x86_64 Docker host.
+RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
+        | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg \
+    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
+        > /etc/apt/sources.list.d/google-chrome.list \
+    && apt-get update && apt-get install -y google-chrome-stable \
+    && rm -rf /var/lib/apt/lists/*
+
 # Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
 # X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -19,6 +19,12 @@ WIZARD_DONE_FILE="${HOME}/.cache/coder-cli-wizard/done"
 FORCE=0
 [ "${1:-}" = "--force" ] && FORCE=1

+# Tracks whether the user actually ended up authenticated against GitHub
+# and/or Gitea below, so the SSH/GPG key step can ask about exactly the
+# host(s) in play (and stay silent - "local git only" - if neither).
+DID_GITHUB=0
+DID_GITEA=0
+
 export BUN_INSTALL="${HOME}/.bun"
 export PATH="${BUN_INSTALL}/bin:${HOME}/.local/bin:${PATH}"

@@ -112,6 +118,7 @@ else
    fi
  fi
 fi
+command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1 && DID_GITHUB=1

 # --- Gitea CLI (tea) ---
 if command -v tea >/dev/null 2>&1; then
@@ -136,6 +143,100 @@ else
    fi
  fi
 fi
+# `tea whoami` succeeds regardless of how the login was done (personal
+# access token or OAuth) - more reliable than parsing tea's own
+# config.yml, whose indentation and fields (no plaintext `token:` at all
+# for an OAuth login) vary by auth method.
+command -v tea >/dev/null 2>&1 && tea whoami >/dev/null 2>&1 && DID_GITEA=1
+
+# --- SSH + GPG keys for the external git host(s) selected above ---
+# Only asks if the user actually set up GitHub and/or Gitea just now -
+# stays silent for "local git only" (neither was set up).
+if [ "$DID_GITHUB" -eq 1 ] || [ "$DID_GITEA" -eq 1 ]; then
+  if [ "$DID_GITHUB" -eq 1 ] && [ "$DID_GITEA" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub and Gitea"
+  elif [ "$DID_GITHUB" -eq 1 ]; then
+    KEY_HOSTS_DESC="GitHub"
+  else
+    KEY_HOSTS_DESC="Gitea"
+  fi
+
+  if ask_yes_no "Auto-generate an SSH key and a GPG signing key, and register them with $KEY_HOSTS_DESC?"; then
+    KEY_NAME="${GIT_AUTHOR_NAME:-$(whoami)}"
+    KEY_EMAIL="${GIT_AUTHOR_EMAIL:-$(whoami)@$(hostname)}"
+
+    # SSH key: ed25519, no passphrase (disposable dev workspace convenience;
+    # add one manually afterwards with `ssh-keygen -p` if you want one).
+    SSH_KEY="$HOME/.ssh/id_ed25519"
+    if [ ! -f "$SSH_KEY" ]; then
+      mkdir -p "$HOME/.ssh" && chmod 700 "$HOME/.ssh"
+      ssh-keygen -t ed25519 -N "" -C "$KEY_EMAIL" -f "$SSH_KEY" -q
+      echo "Generated SSH key: ${SSH_KEY}.pub"
+    else
+      echo "SSH key already exists at ${SSH_KEY}.pub, reusing it."
+    fi
+
+    if [ "$DID_GITHUB" -eq 1 ]; then
+      if gh ssh-key add "${SSH_KEY}.pub" --title "coder-$(hostname)" 2>/dev/null; then
+        echo "SSH key added to GitHub."
+      else
+        echo "Couldn't add the SSH key to GitHub automatically (may already be added). Add manually: gh ssh-key add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    if [ "$DID_GITEA" -eq 1 ]; then
+      if tea ssh-keys add "${SSH_KEY}.pub" --title "coder-$(hostname)" >/dev/null 2>&1; then
+        echo "SSH key added to Gitea."
+      else
+        echo "Couldn't add the SSH key to Gitea automatically (may already be added). Add manually with: tea ssh-keys add ${SSH_KEY}.pub"
+      fi
+    fi
+
+    # GPG key: ed25519 signing key, no passphrase, no expiry.
+    if gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | grep -q '^sec'; then
+      echo "GPG key for $KEY_EMAIL already exists, reusing it."
+    else
+      mkdir -p "$HOME/.gnupg" && chmod 700 "$HOME/.gnupg"
+      grep -qF "allow-loopback-pinentry" "$HOME/.gnupg/gpg-agent.conf" 2>/dev/null \
+        || echo "allow-loopback-pinentry" >> "$HOME/.gnupg/gpg-agent.conf"
+      gpgconf --kill gpg-agent 2>/dev/null
+      if gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "$KEY_NAME <$KEY_EMAIL>" ed25519 sign 0 2>/dev/null; then
+        echo "Generated GPG signing key for $KEY_EMAIL."
+      else
+        echo "GPG key generation failed. Generate manually with: gpg --quick-gen-key \"$KEY_NAME <$KEY_EMAIL>\" ed25519 sign 0"
+      fi
+    fi
+    GPG_KEY_ID="$(gpg --list-secret-keys --with-colons "$KEY_EMAIL" 2>/dev/null | awk -F: '/^sec/{print $5; exit}')"
+
+    if [ -n "$GPG_KEY_ID" ]; then
+      git config --global user.signingkey "$GPG_KEY_ID"
+      git config --global commit.gpgsign true
+      echo "Configured git to sign commits with this key."
+
+      if [ "$DID_GITHUB" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | gh gpg-key add - 2>/dev/null; then
+          echo "GPG key added to GitHub."
+        else
+          echo "Couldn't add the GPG key to GitHub automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | gh gpg-key add -"
+        fi
+      fi
+
+      if [ "$DID_GITEA" -eq 1 ]; then
+        if gpg --armor --export "$GPG_KEY_ID" | tea api -X POST /user/gpg_keys -F armored_public_key=@- >/dev/null 2>&1; then
+          echo "GPG key added to Gitea."
+        else
+          echo "Couldn't add the GPG key to Gitea automatically (may already be added). Add manually: gpg --armor --export $GPG_KEY_ID | tea api -X POST /user/gpg_keys -F armored_public_key=@-"
+        fi
+      fi
+    fi
+  fi
+elif command -v gh >/dev/null 2>&1 || command -v tea >/dev/null 2>&1; then
+  # gh and/or tea are installed but neither is actually logged in yet (login
+  # was declined, failed, or never completed) - say why the key-generation
+  # question above got skipped instead of just silently not asking.
+  echo "Skipping SSH/GPG key setup: not logged in to GitHub or Gitea yet."
+  echo "Log in (gh auth login / tea login add) then re-run: bash /opt/coder/cli-setup-wizard.sh --force"
+fi

 echo ""
 if ask_yes_no "Mark setup wizard as complete so it stops asking on new terminals?"; then
@@ -53,6 +53,14 @@ resource "coder_agent" "main" {
      touch ~/.init_done
    fi

+    # Ensure git and gnupg (commit signing) are present as base packages -
+    # not every base image ships gnupg by default. No-op once both are
+    # present (e.g. templates/web already bakes them into its image).
+    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
+      sudo apt-get update -qq
+      sudo apt-get install -y --no-install-recommends git gnupg
+    fi
+
    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT

@@ -185,16 +193,18 @@ resource "docker_volume" "home_volume" {
  }
 }

-# Builds the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
-# Python CV/ONNX, DB clients - see ./Dockerfile) from this template's own
-# directory, so no external registry push is required. The tag embeds the
-# Dockerfile's hash so a Dockerfile edit forces a rebuild on next apply/push,
-# while an unchanged Dockerfile reuses the cached image.
+# Pulls the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
+# Python CV/ONNX, DB clients - see ./Dockerfile) instead of building it here.
+# The image is built and pushed by .gitea/workflows/coder-templates.yml's
+# build-web-image job, tagged with the same Dockerfile hash this resource
+# computes - so a Dockerfile edit always resolves to the matching image, and
+# an unchanged Dockerfile resolves to one already built (CI skips rebuilding
+# it, and this pull is normally a same-host cache hit rather than a real
+# network pull, since CI and this Coder deployment share one Docker daemon).
+# Moves the ~15-20min Rust toolchain compile off of "someone is waiting to
+# create a workspace" and onto CI, where it runs once per Dockerfile change.
 resource "docker_image" "web" {
-  name = "coder-profiles-web:${filesha1("${path.module}/Dockerfile")}"
-  build {
-    context = path.module
-  }
+  name         = "git.octoturge.com/octo-tech/profiles-web:${filesha1("${path.module}/Dockerfile")}"
  keep_locally = true
 }
Author	SHA1	Message	Date
octoturge	6de3196faa	web: build image in CI, pull it in Terraform instead of building locally Provision Coder Templates / build-web-image (push) Failing after 17s Details Provision Coder Templates / provision (push) Has been skipped Details templates/web's docker_image resource used a `build` block, so every first-use of a new Dockerfile hash triggered a from-scratch build (including the ~15-20min Rust toolchain compile) right at `terraform apply` time - i.e. while someone was waiting to create a workspace. Adds a build-web-image job to coder-templates.yml that builds and pushes git.octoturge.com/octo-tech/profiles-web:<dockerfile-sha1> to this instance's container registry, tagged identically to what docker_image.web now computes and pulls (no build block). provision now depends on build-web-image so a template never gets pushed pointing at an image that isn't there yet. Skips the build entirely if that tag's already in the registry, so an unrelated templates/* change doesn't pay any cost. Runs on a new dedicated "docker-build" runner (profiles-web-build), scoped to just this repo via a repo-level registration token, with host Docker socket access - deliberately not added to the existing shared runner-1, which has no such access and stays untouched. Repo is public, so the pulled image needs no registry auth; the push does, via a new GITEA_PACKAGE_TOKEN repo secret (write:package scope). Since CI and this Coder deployment share the same Docker daemon, the "pull" is normally a same-host cache hit, not a real network pull. Verified: `terraform validate` passes against the updated templates/web/main.tf (run directly inside the coder-server container, which has terraform embedded).	2026-08-27 01:10:58 +02:00
octoturge	730af0a335	cli-setup-wizard: stop parsing tea's config.yml, use tea itself Provision Coder Templates / provision (push) Successful in 2m4s Details DID_GITEA detection and the SSH/GPG key uploads to Gitea were reading tea's config.yml directly with awk, assuming 2-space indentation and a plaintext `token:` field. Neither holds: the real format uses 6-space indentation for fields under each login, and a login done via OAuth (tea's default flow) has no token field in the file at all - it's held elsewhere. Confirmed live: a workspace with a genuinely active `tea` OAuth login was still reporting "not logged in" and skipping the whole key-setup step because of this. Replaced with tea's own subcommands, which handle auth internally regardless of method: - detection: `tea whoami` - SSH key upload: `tea ssh-keys add` - GPG key upload: `tea api -X POST /user/gpg_keys -F armored_public_key=@-` Verified all three directly against the live account (disposable test SSH + GPG keys, added then removed) - SSH upload succeeded; the GPG upload correctly failed for an unrelated, expected reason (Gitea requires the key's email to match a verified account email, and the test key used a throwaway address), confirming the request itself is well-formed.	2026-08-27 00:49:20 +02:00
octoturge	d60e44508a	cli-setup-wizard: explain why SSH/GPG key setup got skipped Provision Coder Templates / provision (push) Successful in 2m7s Details The SSH/GPG key-generation question only fires when gh/tea are actually logged in (DID_GITHUB/DID_GITEA), which is correct - but if login was declined, failed, or never completed, the section was skipped with zero explanation. From the user's side that looked like a missing feature rather than an unfinished login. Confirmed on a live workspace: gh was never installed, and tea was installed but `tea login add` never actually completed (no ~/.config/tea/config.yml), so the gate correctly stayed closed - the user just had no way to know why. Now prints a one-line hint (only when gh or tea is installed at all) pointing at the login command and the --force re-run.	2026-08-27 00:14:11 +02:00
octoturge	93721b9096	web: install Google Chrome for the Browse Lite extension Provision Coder Templates / provision (push) Successful in 2m22s Details Browse Lite (antfu.browse-lite, kept in the earlier Open VSX audit) launches an embedded browser preview via a real Chrome/Chromium binary, which templates/web's image never provided - it failed with "No Chrome installation found, or no Chrome executable set in the settings". Ubuntu's own chromium-browser apt package is a snap wrapper and doesn't work in a container, so this installs Google Chrome's official .deb instead (amd64 only, matching this repo's single x86_64 Docker host). Also points browse-lite.chromeExecutable at it explicitly rather than relying on auto-detection. Verified the new apt-key/repo/install layer builds cleanly in isolation on octo-winsrv (google-chrome-stable 152.0.7977.64).	2026-08-26 23:57:51 +02:00
octoturge	013567f02a	feat: base git/gnupg install + auto SSH/GPG key setup for external git Provision Coder Templates / provision (push) Successful in 2m11s Details - Every template's coder_agent startup script now unconditionally installs git and gnupg as base packages (guarded on `command -v`, so it's a fast no-op where already present, e.g. templates/web's baked image). Not every base image ships gnupg by default. - cli-setup-wizard.sh (all 6 templates) now tracks whether the user actually ended up authenticated against GitHub and/or Gitea via the existing gh/tea install-and-login prompts. If at least one succeeded, it asks once more whether to auto-generate an SSH key (ed25519) and a GPG signing key (ed25519, quick-gen) and register them with whichever host(s) are in play - stays completely silent for "local git only" (neither gh nor tea set up). - GitHub: `gh ssh-key add` / `gh gpg-key add` (official gh CLI subcommands). - Gitea: direct calls against `/api/v1/user/keys` and `/api/v1/user/gpg_keys`, reusing the token `tea login add` already stored in tea's config.yml (parsed with a small awk extractor). - Either upload failing (already added, API shape mismatch, etc.) just prints the manual command/URL and moves on - never blocks the rest of the wizard, consistent with every other step's style. - git is configured to sign commits with the new key (user.signingkey + commit.gpgsign) once a GPG key exists, whether freshly generated or already present from a prior run. README updated to document both additions.	2026-08-26 23:16:25 +02:00