Profiles-for-Coder/templates/web/main.tf

terraform {
  required_providers {
    coder = {
      source = "coder/coder"
    }
    docker = {
      source = "kreuzwerker/docker"
    }
    # Not used directly in this config. Existing workspace state from before
    # the jetbrains module was removed still has resources tagged under this
    # provider (the module used it internally to fetch IDE metadata) -
    # terraform init only installs providers the current config declares, so
    # without this, plan/apply fails with "Missing required provider" while
    # trying to reconcile/destroy those leftover state entries. Safe to drop
    # once every workspace has updated past the jetbrains-module version.
    http = {
      source = "hashicorp/http"
    }
  }
}

locals {
  env_name     = "Web Applications"
  profile      = jsondecode(file("${path.module}/profile.code-profile"))
  settings_raw = jsondecode(local.profile.settings).settings
  extensions   = [for e in jsondecode(local.profile.extensions) : e.identifier.id]
}

variable "docker_socket" {
  default     = ""
  description = "(Optional) Docker socket URI"
  type        = string
}

provider "docker" {
  # Defaulting to null if the variable is an empty string lets us have an optional variable without having to set our own default
  host = var.docker_socket != "" ? var.docker_socket : null
}

data "coder_provisioner" "me" {}
data "coder_workspace" "me" {}
data "coder_workspace_owner" "me" {}

resource "coder_agent" "main" {
  arch           = data.coder_provisioner.me.arch
  os             = "linux"
  startup_script = <<-EOT
    set -e

    # Prepare user home with default files on first start.
    if [ ! -f ~/.init_done ]; then
      cp -rT /etc/skel ~
      touch ~/.init_done
    fi

    # Ensure git and gnupg (commit signing) are present as base packages -
    # not every base image ships gnupg by default. No-op once both are
    # present (e.g. templates/web already bakes them into its image).
    if ! command -v git >/dev/null 2>&1 || ! command -v gpg >/dev/null 2>&1; then
      sudo apt-get update -qq
      sudo apt-get install -y --no-install-recommends git gnupg
    fi

    # Add any commands that should be executed at workspace startup (e.g install requirements, start a program, etc) here
  EOT

  # These environment variables allow you to make Git commits right away after creating a
  # workspace. Note that they take precedence over configuration defined in ~/.gitconfig!
  # You can remove this block if you'd prefer to configure Git manually or using
  # dotfiles. (see docs/dotfiles.md)
  #
  # RUST_BACKTRACE/PNPM_HOME/BUN_INSTALL are also baked in as image ENV (see
  # Dockerfile) so every process picks them up; restated here so they surface
  # on the workspace dashboard too.
  env = {
    GIT_AUTHOR_NAME     = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
    GIT_AUTHOR_EMAIL    = "${data.coder_workspace_owner.me.email}"
    GIT_COMMITTER_NAME  = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
    GIT_COMMITTER_EMAIL = "${data.coder_workspace_owner.me.email}"
    RUST_BACKTRACE      = "1"
    PNPM_HOME           = "/home/coder/.local/share/pnpm"
    BUN_INSTALL         = "/home/coder/.bun"
  }

  # The following metadata blocks are optional. They are used to display
  # information about your workspace in the dashboard. You can remove them
  # if you don't want to display any information.
  # For basic resources, you can use the `coder stat` command.
  # If you need more control, you can write your own script.
  metadata {
    display_name = "CPU Usage"
    key          = "0_cpu_usage"
    script       = "coder stat cpu"
    interval     = 10
    timeout      = 1
  }

  metadata {
    display_name = "RAM Usage"
    key          = "1_ram_usage"
    script       = "coder stat mem"
    interval     = 10
    timeout      = 1
  }

  metadata {
    display_name = "Home Disk"
    key          = "3_home_disk"
    script       = "coder stat disk --path $${HOME}"
    interval     = 60
    timeout      = 1
  }

  metadata {
    display_name = "CPU Usage (Host)"
    key          = "4_cpu_usage_host"
    script       = "coder stat cpu --host"
    interval     = 10
    timeout      = 1
  }

  metadata {
    display_name = "Memory Usage (Host)"
    key          = "5_mem_usage_host"
    script       = "coder stat mem --host"
    interval     = 10
    timeout      = 1
  }

  metadata {
    display_name = "Load Average (Host)"
    key          = "6_load_host"
    # get load avg scaled by number of cores
    script   = <<EOT
      echo "`cat /proc/loadavg | awk '{ print $1 }'` `nproc`" | awk '{ printf "%0.2f", $1/$2 }'
    EOT
    interval = 60
    timeout  = 1
  }

  metadata {
    display_name = "Swap Usage (Host)"
    key          = "7_swap_host"
    script       = <<EOT
      free -b | awk '/^Swap/ { printf("%.1f/%.1f", $3/1024.0/1024.0/1024.0, $2/1024.0/1024.0/1024.0) }'
    EOT
    interval     = 10
    timeout      = 1
  }
}

# See https://registry.coder.com/modules/coder/code-server
# `extensions` is populated at template-push time from this env's
# profile-templates/*.code-profile file, so no interactive prompt is
# needed for VS Code extensions - Terraform handles it declaratively.
module "code-server" {
  count    = data.coder_workspace.me.start_count
  source   = "registry.coder.com/coder/code-server/coder"
  version  = "~> 1.0"
  agent_id = coder_agent.main.id

  # Pass the target folder here natively
  folder = "/home/coder/workspace"

  extensions = local.extensions
  order      = 1
}

resource "docker_volume" "home_volume" {
  name = "coder-${data.coder_workspace.me.id}-home"
  # Protect the volume from being deleted due to changes in attributes.
  lifecycle {
    ignore_changes = all
  }
  # Add labels in Docker to keep track of orphan resources.
  labels {
    label = "coder.owner"
    value = data.coder_workspace_owner.me.name
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace_owner.me.id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  # This field becomes outdated if the workspace is renamed but can
  # be useful for debugging or cleaning out dangling volumes.
  labels {
    label = "coder.workspace_name_at_creation"
    value = data.coder_workspace.me.name
  }
}

# Pulls the full Web Applications toolchain (Rust/Tauri 2, Bun/Node/pnpm,
# Python CV/ONNX, DB clients - see ./Dockerfile) instead of building it here.
# The image is built and pushed by .gitea/workflows/coder-templates.yml's
# build-web-image job, tagged with the same Dockerfile hash this resource
# computes - so a Dockerfile edit always resolves to the matching image, and
# an unchanged Dockerfile resolves to one already built (CI skips rebuilding
# it, and this pull is normally a same-host cache hit rather than a real
# network pull, since CI and this Coder deployment share one Docker daemon).
# Moves the ~15-20min Rust toolchain compile off of "someone is waiting to
# create a workspace" and onto CI, where it runs once per Dockerfile change.
resource "docker_image" "web" {
  name         = "git.octoturge.com/octo-tech/profiles-web:${filesha1("${path.module}/Dockerfile")}"
  keep_locally = true
}

resource "docker_container" "workspace" {
  count = data.coder_workspace.me.start_count
  image = docker_image.web.image_id
  # Uses lower() to avoid Docker restriction on container names.
  name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
  # Hostname makes the shell more user friendly: coder@my-workspace:~$
  hostname = data.coder_workspace.me.name
  # Use the docker gateway if the access URL is 127.0.0.1
  entrypoint = ["sh", "-c", replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")]
  env        = ["CODER_AGENT_TOKEN=${coder_agent.main.token}"]
  host {
    host = "host.docker.internal"
    ip   = "host-gateway"
  }
  host {
    host = "code.octoturge.com"
    ip   = "host-gateway"
  }
  volumes {
    container_path = "/home/coder"
    volume_name    = docker_volume.home_volume.name
    read_only      = false
  }

  # Add labels in Docker to keep track of orphan resources.
  labels {
    label = "coder.owner"
    value = data.coder_workspace_owner.me.name
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace_owner.me.id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  labels {
    label = "coder.workspace_name"
    value = data.coder_workspace.me.name
  }
  labels {
    label = "coder.profile"
    value = local.env_name
  }
}

# Writes this env's VS Code settings.json, sourced straight from the
# matching profile-templates/*.code-profile file at template-push time.
resource "coder_script" "apply_settings" {
  agent_id     = coder_agent.main.id
  display_name = "Apply ${local.env_name} VS Code Settings"
  run_on_start = true
  script       = <<-EOT
    #!/bin/bash
    set -e
    mkdir -p "$HOME/workspace"
    mkdir -p "$HOME/.local/share/code-server/User"
    echo '${base64encode(local.settings_raw)}' | base64 -d > "$HOME/.local/share/code-server/User/settings.json"
  EOT
}

# Drops the shared CLI setup wizard onto the workspace and hooks it into
# every new interactive shell (via .bashrc) until the user completes it.
# See ./cli-setup-wizard.sh for what it actually asks.
resource "coder_script" "cli_setup_wizard" {
  agent_id     = coder_agent.main.id
  display_name = "Install CLI Setup Wizard"
  run_on_start = true
  script       = <<-EOT
    #!/bin/bash
    set -e
    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/cli-setup-wizard.sh"))}' | base64 -d > /opt/coder/cli-setup-wizard.sh
    chmod +x /opt/coder/cli-setup-wizard.sh

    MARKER="# >>> coder cli setup wizard >>>"
    if ! grep -qF "$MARKER" "$HOME/.bashrc" 2>/dev/null; then
      {
        echo ""
        echo "$MARKER"
        echo 'export PATH="$HOME/.local/bin:$PATH"'
        echo 'source /opt/coder/cli-setup-wizard.sh'
        echo "# <<< coder cli setup wizard <<<"
      } >> "$HOME/.bashrc"
    fi
  EOT
}

# Bun (and the rest of the toolchain - Rust, Node/pnpm/yarn, Python CV/ONNX
# packages, DB clients) is baked into the workspace image at build time (see
# Dockerfile) rather than installed here on every start. Docker populates a
# fresh, empty named volume from the image's directory contents on first
# mount, so $HOME/.bun, $HOME/.cargo, $HOME/.rustup etc. land in the
# persistent home_volume automatically the first time a workspace boots -
# same mechanism the /etc/skel copy above relies on. BUN_INSTALL and PATH
# are set as image ENV plus restated on coder_agent.env above.

# Installs this repo's Agent Skills into Claude Code, GitHub Copilot CLI, and
# Antigravity CLI's skills directories. See ./install-skills.sh.
# Web has no matching entry in extensions/custom-specialty-plugin/skills,
# so it only gets the common awesome-skills-plugin bundle.
resource "coder_script" "install_skills" {
  agent_id     = coder_agent.main.id
  display_name = "Install Agent Skills"
  run_on_start = true
  script       = <<-EOT
    #!/bin/bash
    set -e
    sudo mkdir -p /opt/coder
    sudo chown "$(id -u):$(id -g)" /opt/coder
    echo '${base64encode(file("${path.module}/install-skills.sh"))}' | base64 -d > /opt/coder/install-skills.sh
    chmod +x /opt/coder/install-skills.sh
    SPECIALTY_SKILLS="" /opt/coder/install-skills.sh
  EOT
}