coder/cli/server.go at main · bamhm182/coder

Repository navigation

8000

//go:build !slim

package cli

import (

"context"

"crypto/ecdsa"

"crypto/elliptic"

"crypto/rand"

"crypto/tls"

"crypto/x509"

"database/sql"

"encoding/hex"

"errors"

"flag"

"fmt"

"io"

"log"

"math/big"

"net"

"net/http"

"net/http/pprof"

"net/url"

"os"

"os/user"

"path/filepath"

"regexp"

"sort"

"strconv"

"strings"

"sync"

"sync/atomic"

"time"

"github.com/coreos/go-oidc/v3/oidc"

"github.com/coreos/go-systemd/daemon"

embeddedpostgres "github.com/fergusstrange/embedded-postgres"

"github.com/google/go-github/v43/github"

"github.com/google/uuid"

"github.com/prometheus/client_golang/prometheus"

"github.com/prometheus/client_golang/prometheus/collectors"

"github.com/prometheus/client_golang/prometheus/promhttp"

"go.opentelemetry.io/otel"

"go.opentelemetry.io/otel/propagation"

"go.opentelemetry.io/otel/trace"

"golang.org/x/mod/semver"

"golang.org/x/oauth2"

xgithub "golang.org/x/oauth2/github"

"golang.org/x/sync/errgroup"

"golang.org/x/xerrors"

"google.golang.org/api/idtoken"

"google.golang.org/api/option"

"gopkg.in/yaml.v3"

"tailscale.com/tailcfg"

"github.com/coder/pretty"

"cdr.dev/slog"

"cdr.dev/slog/sloggers/sloghuman"

"github.com/coder/coder/v2/buildinfo"

"github.com/coder/coder/v2/cli/clibase"

"github.com/coder/coder/v2/cli/clilog"

"github.com/coder/coder/v2/cli/cliui"

"github.com/coder/coder/v2/cli/cliutil"

"github.com/coder/coder/v2/cli/config"

"github.com/coder/coder/v2/coderd"

"github.com/coder/coder/v2/coderd/autobuild"

"github.com/coder/coder/v2/coderd/batchstats"

"github.com/coder/coder/v2/coderd/database"

"github.com/coder/coder/v2/coderd/database/dbmem"

"github.com/coder/coder/v2/coderd/database/dbmetrics"

"github.com/coder/coder/v2/coderd/database/dbpurge"

"github.com/coder/coder/v2/coderd/database/migrations"

"github.com/coder/coder/v2/coderd/database/pubsub"

"github.com/coder/coder/v2/coderd/devtunnel"

"github.com/coder/coder/v2/coderd/externalauth"

"github.com/coder/coder/v2/coderd/gitsshkey"

"github.com/coder/coder/v2/coderd/httpapi"

"github.com/coder/coder/v2/coderd/httpmw"

"github.com/coder/coder/v2/coderd/oauthpki"

"github.com/coder/coder/v2/coderd/prometheusmetrics"

"github.com/coder/coder/v2/coderd/prometheusmetrics/insights"

"github.com/coder/coder/v2/coderd/schedule"

"github.com/coder/coder/v2/coderd/telemetry"

"github.com/coder/coder/v2/coderd/tracing"

"github.com/coder/coder/v2/coderd/unhanger"

"github.com/coder/coder/v2/coderd/updatecheck"

"github.com/coder/coder/v2/coderd/util/slice"

stringutil "github.com/coder/coder/v2/coderd/util/strings"

"github.com/coder/coder/v2/coderd/workspaceapps"

"github.com/coder/coder/v2/codersdk"

"github.com/coder/coder/v2/codersdk/drpc"

"github.com/coder/coder/v2/cryptorand"

"github.com/coder/coder/v2/provisioner/echo"

"github.com/coder/coder/v2/provisioner/terraform"

"github.com/coder/coder/v2/provisionerd"

"github.com/coder/coder/v2/provisionerd/proto"

"github.com/coder/coder/v2/provisionersdk"

sdkproto "github.com/coder/coder/v2/provisionersdk/proto"

"github.com/coder/coder/v2/tailnet"

"github.com/coder/retry"

"github.com/coder/wgtunnel/tunnelsdk"

)

func createOIDCConfig(ctx context.Context, vals *codersdk.DeploymentValues) (*coderd.OIDCConfig, error) {

if vals.OIDC.ClientID == "" {

return nil, xerrors.Errorf("OIDC client ID must be set!")

}

if vals.OIDC.IssuerURL == "" {

return nil, xerrors.Errorf("OIDC issuer URL must be set!")

}

oidcProvider, err := oidc.NewProvider(

ctx, vals.OIDC.IssuerURL.String(),

)

if err != nil {

return nil, xerrors.Errorf("configure oidc provider: %w", err)

}

redirectURL, err := vals.AccessURL.Value().Parse("/api/v2/users/oidc/callback")

if err != nil {

return nil, xerrors.Errorf("parse oidc oauth callback url: %w", err)

}

// If the scopes contain 'groups', we enable group support.

// Do not override any custom value set by the user.

if slice.Contains(vals.OIDC.Scopes, "groups") && vals.OIDC.GroupField == "" {

vals.OIDC.GroupField = "groups"

}

oauthCfg := &oauth2.Config{

ClientID: vals.OIDC.ClientID.String(),

ClientSecret: vals.OIDC.ClientSecret.String(),

RedirectURL: redirectURL.String(),

Endpoint: oidcProvider.Endpoint(),

Scopes: vals.OIDC.Scopes,

}

var useCfg httpmw.OAuth2Config = oauthCfg

if vals.OIDC.ClientKeyFile != "" {

// PKI authentication is done in the params. If a

// counter example is found, we can add a config option to

// change this.

oauthCfg.Endpoint.AuthStyle = oauth2.AuthStyleInParams

if vals.OIDC.ClientSecret != "" {

return nil, xerrors.Errorf("cannot specify both oidc client secret and oidc client key file")

}

pkiCfg, err := configureOIDCPKI(oauthCfg, vals.OIDC.ClientKeyFile.Value(), vals.OIDC.ClientCertFile.Value())

if err != nil {

return nil, xerrors.Errorf("configure oauth pki authentication: %w", err)

}

useCfg = pkiCfg

}

if len(vals.OIDC.GroupAllowList) > 0 && vals.OIDC.GroupField == "" {

return nil, xerrors.Errorf("'oidc-group-field' must be set if 'oidc-allowed-groups' is set. Either unset 'oidc-allowed-groups' or set 'oidc-group-field'")

}

groupAllowList := make(map[string]bool)

for _, group := range vals.OIDC.GroupAllowList.Value() {

groupAllowList[group] = true

}

return &coderd.OIDCConfig{

OAuth2Config: useCfg,

Provider: oidcProvider,

Verifier: oidcProvider.Verifier(&oidc.Config{

ClientID: vals.OIDC.ClientID.String(),

}),

EmailDomain: vals.OIDC.EmailDomain,

AllowSignups: vals.OIDC.AllowSignups.Value(),

UsernameField: vals.OIDC.UsernameField.String(),

EmailField: vals.OIDC.EmailField.String(),

AuthURLParams: vals.OIDC.AuthURLParams.Value,

IgnoreUserInfo: vals.OIDC.IgnoreUserInfo.Value(),

GroupField: vals.OIDC.GroupField.String(),

GroupFilter: vals.OIDC.GroupRegexFilter.Value(),

GroupAllowList: groupAllowList,

CreateMissingGroups: vals.OIDC.GroupAutoCreate.Value(),

GroupMapping: vals.OIDC.GroupMapping.Value,

UserRoleField: vals.OIDC.UserRoleField.String(),

UserRoleMapping: vals.OIDC.UserRoleMapping.Value,

UserRolesDefault: vals.OIDC.UserRolesDefault.GetSlice(),

SignInText: vals.OIDC.SignInText.String(),

IconURL: vals.OIDC.IconURL.String(),

IgnoreEmailVerified: vals.OIDC.IgnoreEmailVerified.Value(),

}, nil

}

func afterCtx(ctx context.Context, fn func()) {

go func() {

<-ctx.Done()

fn()

}()

}

func enablePrometheus(

ctx context.Context,

logger slog.Logger,

vals *codersdk.DeploymentValues,

options *coderd.Options,

) (closeFn func(), err error) {

options.PrometheusRegistry.MustRegister(collectors.NewGoCollector())

options.PrometheusRegistry.MustRegister(collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}))

closeUsersFunc, err := prometheusmetrics.ActiveUsers(ctx, options.PrometheusRegistry, options.Database, 0)

if err != nil {

return nil, xerrors.Errorf("register active users prometheus metric: %w", err)

}

afterCtx(ctx, closeUsersFunc)

closeWorkspacesFunc, err := prometheusmetrics.Workspaces(ctx, options.PrometheusRegistry, options.Database, 0)

if err != nil {

return nil, xerrors.Errorf("register workspaces prometheus metric: %w", err)

}

afterCtx(ctx, closeWorkspacesFunc)

insightsMetricsCollector, err := insights.NewMetricsCollector(options.Database, options.Logger, 0, 0)

if err != nil {

return nil, xerrors.Errorf("unable to initialize insights metrics collector: %w", err)

}

err = options.PrometheusRegistry.Register(insightsMetricsCollector)

if err != nil {

return nil, xerrors.Errorf("unable to register insights metrics collector: %w", err)

}

closeInsightsMetricsCollector, err := insightsMetricsCollector.Run(ctx)

if err != nil {

return nil, xerrors.Errorf("unable to run insights metrics collector: %w", err)

}

afterCtx(ctx, closeInsightsMetricsCollector)

if vals.Prometheus.CollectAgentStats {

closeAgentStatsFunc, err := prometheusmetrics.AgentStats(ctx, logger, options.PrometheusRegistry, options.Database, time.Now(), 0)

if err != nil {

return nil, xerrors.Errorf("register agent stats prometheus metric: %w", err)

}

afterCtx(ctx, closeAgentStatsFunc)

metricsAggregator, err := prometheusmetrics.NewMetricsAggregator(logger, options.PrometheusRegistry, 0)

if err != nil {

return nil, xerrors.Errorf("can't initialize metrics aggregator: %w", err)

}

cancelMetricsAggregator := metricsAggregator.Run(ctx)

afterCtx(ctx, cancelMetricsAggregator)

options.UpdateAgentMetrics = metricsAggregator.Update

err = options.PrometheusRegistry.Register(metricsAggregator)

if err != nil {

return nil, xerrors.Errorf("can't register metrics aggregator as collector: %w", err)

}

//nolint:revive

return ServeHandler(

ctx, logger, promhttp.InstrumentMetricHandler(

options.PrometheusRegistry, promhttp.HandlerFor(options.PrometheusRegistry, promhttp.HandlerOpts{}),

), vals.Prometheus.Address.String(), "prometheus",

), nil

}

func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.API, io.Closer, error)) *clibase.Cmd {

if newAPI == nil {

newAPI = func(_ context.Context, o *coderd.Options) (*coderd.API, io.Closer, error) {

api := coderd.New(o)

return api, api, nil

}

var (

vals = new(codersdk.DeploymentValues)

opts = vals.Options()

)

serverCmd := &clibase.Cmd{

Use: "server",

Short: "Start a Coder server",

Options: opts,

Middleware: clibase.Chain(

WriteConfigMW(vals),

PrintDeprecatedOptions(),

clibase.RequireNArgs(0),

Handler: func(inv *clibase.Invocation) error {

// Main command context for managing cancellation of running

// services.

ctx, cancel := context.WithCancel(inv.Context())

defer cancel()

if vals.Config != "" {

cliui.Warnf(inv.Stderr, "YAML support is experimental and offers no compatibility guarantees.")

}

go DumpHandler(ctx)

// Validate bind addresses.

if vals.Address.String() != "" {

if vals.TLS.Enable {

vals.HTTPAddress = ""

vals.TLS.Address = vals.Address

} else {

_ = vals.HTTPAddress.Set(vals.Address.String())

vals.TLS.Address.Host = ""

vals.TLS.Address.Port = ""

}

if vals.TLS.Enable && vals.TLS.Address.String() == "" {

return xerrors.Errorf("TLS address must be set if TLS is enabled")

}

if !vals.TLS.Enable && vals.HTTPAddress.String() == "" {

return xerrors.Errorf("TLS is disabled. Enable with --tls-enable or specify a HTTP address")

}

if vals.AccessURL.String() != "" &&

!(vals.AccessURL.Scheme == "http" || vals.AccessURL.Scheme == "https") {

return xerrors.Errorf("access-url must include a scheme (e.g. 'http://' or 'https://)")

}

// Disable rate limits if the `--dangerous-disable-rate-limits` flag

// was specified.

loginRateLimit := 60

filesRateLimit := 12

if vals.RateLimit.DisableAll {

vals.RateLimit.API = -1

loginRateLimit = -1

filesRateLimit = -1

}

PrintLogo(inv, "Coder")

logger, logCloser, err := clilog.New(clilog.FromDeploymentValues(vals)).Build(inv)

if err != nil {

return xerrors.Errorf("make logger: %w", err)

}

defer logCloser()

// This line is helpful in tests.

logger.Debug(ctx, "started debug logging")

logger.Sync()

// Register signals early on so that graceful shutdown can't

// be interrupted by additional signals. Note that we avoid

// shadowing cancel() (from above) here because notifyStop()

// restores default behavior for the signals. This protects

// the shutdown sequence from abruptly terminating things

// like: database migrations, provisioner work, workspace

// cleanup in dev-mode, etc.

// To get out of a graceful shutdown, the user can send

// SIGQUIT with ctrl+\ or SIGKILL with `kill -9`.

notifyCtx, notifyStop := inv.SignalNotifyContext(ctx, InterruptSignals...)

defer notifyStop()

cacheDir := vals.CacheDir.String()

err = os.MkdirAll(cacheDir, 0o700)

if err != nil {

return xerrors.Errorf("create cache directory: %w", err)

}

// Clean up idle connections at the end, e.g.

// embedded-postgres can leave an idle connection

// which is caught by goleaks.

defer http.DefaultClient.CloseIdleConnections()

tracerProvider, sqlDriver, closeTracing := ConfigureTraceProvider(ctx, logger, vals)

defer func() {

logger.Debug(ctx, "closing tracing")

traceCloseErr := shutdownWithTimeout(closeTracing, 5*time.Second)

logger.Debug(ctx, "tracing closed", slog.Error(traceCloseErr))

}()

httpServers, err := ConfigureHTTPServers(logger, inv, vals)

if err != nil {

return xerrors.Errorf("configure http(s): %w", err)

}

defer httpServers.Close()

config := r.createConfig()

builtinPostgres := false

// Only use built-in if PostgreSQL URL isn't specified!

if !vals.InMemoryDatabase && vals.PostgresURL == "" {

var closeFunc func() error

cliui.Infof(inv.Stdout, "Using built-in PostgreSQL (%s)", config.PostgresPath())

pgURL, closeFunc, err := startBuiltinPostgres(ctx, config, logger)

if err != nil {

return err

}

err = vals.PostgresURL.Set(pgURL)

if err != nil {

return err

}

builtinPostgres = true

defer func() {

cliui.Infof(inv.Stdout, "Stopping built-in PostgreSQL...")

// Gracefully shut PostgreSQL down!

if err := closeFunc(); err != nil {

cliui.Errorf(inv.Stderr, "Failed to stop built-in PostgreSQL: %v", err)

} else {

cliui.Infof(inv.Stdout, "Stopped built-in PostgreSQL")

}

}()

}

// Prefer HTTP because it's less prone to TLS errors over localhost.

localURL := httpServers.TLSUrl

if httpServers.HTTPUrl != nil {

localURL = httpServers.HTTPUrl

}

ctx, httpClient, err := ConfigureHTTPClient(

ctx,

vals.TLS.ClientCertFile.String(),

vals.TLS.ClientKeyFile.String(),

vals.TLS.ClientCAFile.String(),

)

if err != nil {

return xerrors.Errorf("configure http client: %w", err)

}

// If the access URL is empty, we attempt to run a reverse-proxy

// tunnel to make the initial setup really simple.

var (

tunnel *tunnelsdk.Tunnel

tunnelDone <-chan struct{} = make(chan struct{}, 1)

)

if vals.AccessURL.String() == "" {

cliui.Infof(inv.Stderr, "Opening tunnel so workspaces can connect to your deployment. For production scenarios, specify an external access URL")

tunnel, err = devtunnel.New(ctx, logger.Named("net.devtunnel"), vals.WgtunnelHost.String())

if err != nil {

return xerrors.Errorf("create tunnel: %w", err)

}

defer tunnel.Close()

tunnelDone = tunnel.Wait()

vals.AccessURL = clibase.URL(*tunnel.URL)

if vals.WildcardAccessURL.String() == "" {

// Suffixed wildcard access URL.

u, err := url.Parse(fmt.Sprintf("*--%s", tunnel.URL.Hostname()))

if err != nil {

return xerrors.Errorf("parse wildcard url: %w", err)

}

vals.WildcardAccessURL = clibase.URL(*u)

}

_, accessURLPortRaw, _ := net.SplitHostPort(vals.AccessURL.Host)

if accessURLPortRaw == "" {

accessURLPortRaw = "80"

if vals.AccessURL.Scheme == "https" {

accessURLPortRaw = "443"

}

accessURLPort, err := strconv.Atoi(accessURLPortRaw)

if err != nil {

return xerrors.Errorf("parse access URL port: %w", err)

}

// Warn the user if the access URL is loopback or unresolvable.

isLocal, err := IsLocalURL(ctx, vals.AccessURL.Value())

if isLocal || err != nil {

reason := "could not be resolved"

if isLocal {

reason = "isn't externally reachable"

}

cliui.Warnf(

inv.Stderr,

"The access URL %s %s, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\n",

pretty.Sprint(cliui.DefaultStyles.Field, vals.AccessURL.String()), reason,

)

}

// A newline is added before for visibility in terminal output.

cliui.Infof(inv.Stdout, "\nView the Web UI: %s", vals.AccessURL.String())

// Used for zero-trust instance identity with Google Cloud.

googleTokenValidator, err := idtoken.NewValidator(ctx, option.WithoutAuthentication())

if err != nil {

return err

}

sshKeygenAlgorithm, err := gitsshkey.ParseAlgorithm(vals.SSHKeygenAlgorithm.String())

if err != nil {

return xerrors.Errorf("parse ssh keygen algorithm %s: %w", vals.SSHKeygenAlgorithm, err)

}

defaultRegion := &tailcfg.DERPRegion{

EmbeddedRelay: true,

RegionID: int(vals.DERP.Server.RegionID.Value()),

RegionCode: vals.DERP.Server.RegionCode.String(),

10BC8

RegionName: vals.DERP.Server.RegionName.String(),

Nodes: []*tailcfg.DERPNode{{

Name: fmt.Sprintf("%db", vals.DERP.Server.RegionID),

RegionID: int(vals.DERP.Server.RegionID.Value()),

HostName: vals.AccessURL.Value().Hostname(),

DERPPort: accessURLPort,

STUNPort: -1,

ForceHTTP: vals.AccessURL.Scheme == "http",

}},

}

if !vals.DERP.Server.Enable {

defaultRegion = nil

}

derpMap, err := tailnet.NewDERPMap(

ctx, defaultRegion, vals.DERP.Server.STUNAddresses,

vals.DERP.Config.URL.String(), vals.DERP.Config.Path.String(),

vals.DERP.Config.BlockDirect.Value(),

)

if err != nil {

return xerrors.Errorf("create derp map: %w", err)

}

appHostname := vals.WildcardAccessURL.String()

var appHostnameRegex *regexp.Regexp

if appHostname != "" {

appHostnameRegex, err = httpapi.CompileHostnamePattern(appHostname)

if err != nil {

return xerrors.Errorf("parse wildcard access URL %q: %w", appHostname, err)

}

extAuthEnv, err := ReadExternalAuthProvidersFromEnv(os.Environ())

if err != nil {

return xerrors.Errorf("read external auth providers from env: %w", err)

}

vals.ExternalAuthConfigs.Value = append(vals.ExternalAuthConfigs.Value, extAuthEnv...)

externalAuthConfigs, err := externalauth.ConvertConfig(

vals.ExternalAuthConfigs.Value,

vals.AccessURL.Value(),

)

if err != nil {

return xerrors.Errorf("convert external auth config: %w", err)

}

for _, c := range externalAuthConfigs {

logger.Debug(

ctx, "loaded external auth config",

slog.F("id", c.ID),

)

}

realIPConfig, err := httpmw.ParseRealIPConfig(vals.ProxyTrustedHeaders, vals.ProxyTrustedOrigins)

if err != nil {

return xerrors.Errorf("parse real ip config: %w", err)

}

configSSHOptions, err := vals.SSHConfig.ParseOptions()

if err != nil {

return xerrors.Errorf("parse ssh config options %q: %w", vals.SSHConfig.SSHConfigOptions.String(), err)

}

options := &coderd.Options{

AccessURL: vals.AccessURL.Value(),

AppHostname: appHostname,

AppHostnameRegex: appHostnameRegex,

Logger: logger.Named("coderd"),

Database: dbmem.New(),

BaseDERPMap: derpMap,

Pubsub: pubsub.NewInMemory(),

CacheDir: cacheDir,

GoogleTokenValidator: googleTokenValidator,

ExternalAuthConfigs: externalAuthConfigs,

RealIPConfig: realIPConfig,

SecureAuthCookie: vals.SecureAuthCookie.Value(),

SSHKeygenAlgorithm: sshKeygenAlgorithm,

TracerProvider: tracerProvider,

Telemetry: telemetry.NewNoop(),

MetricsCacheRefreshInterval: vals.MetricsCacheRefreshInterval.Value(),

AgentStatsRefreshInterval: vals.AgentStatRefreshInterval.Value(),

DeploymentValues: vals,

// Do not pass secret values to DeploymentOptions. All values should be read from

// the DeploymentValues instead, this just serves to indicate the source of each

// option. This is just defensive to prevent accidentally leaking.

DeploymentOptions: codersdk.DeploymentOptionsWithoutSecrets(opts),

PrometheusRegistry: prometheus.NewRegistry(),

APIRateLimit: int(vals.RateLimit.API.Value()),

LoginRateLimit: loginRateLimit,

FilesRateLimit: filesRateLimit,

HTTPClient: httpClient,

TemplateScheduleStore: &atomic.Pointer[schedule.TemplateScheduleStore]{},

UserQuietHoursScheduleStore: &atomic.Pointer[schedule.UserQuietHoursScheduleStore]{},

SSHConfig: codersdk.SSHConfigResponse{

HostnamePrefix: vals.SSHConfig.DeploymentName.String(),

SSHConfigOptions: configSSHOptions,

AllowWorkspaceRenames: vals.AllowWorkspaceRenames.Value(),

}

if httpServers.TLSConfig != nil {

options.TLSCertificates = httpServers.TLSConfig.Certificates

}

if vals.StrictTransportSecurity > 0 {

options.StrictTransportSecurityCfg, err = httpmw.HSTSConfigOptions(

int(vals.StrictTransportSecurity.Value()), vals.StrictTransportSecurityOptions,

)

if err != nil {

return xerrors.Errorf("coderd: setting hsts header failed (options: %v): %w", vals.StrictTransportSecurityOptions, err)

}

if vals.UpdateCheck {

options.UpdateCheckOptions = &updatecheck.Options{

// Avoid spamming GitHub API checking for updates.

Interval: 24 * time.Hour,

// Inform server admins of new versions.

Notify: func(r updatecheck.Result) {

if semver.Compare(r.Version, buildinfo.Version()) > 0 {

options.Logger.Info(

context.Background(),

"new version of coder available",

slog.F("new_version", r.Version),

slog.F("url", r.URL),

slog.F("upgrade_instructions", "https://coder.com/docs/coder-oss/latest/admin/upgrade"),

)

}

if vals.OAuth2.Github.ClientSecret != "" {

options.GithubOAuth2Config, err = configureGithubOAuth2(vals.AccessURL.Value(),

vals.OAuth2.Github.ClientID.String(),

vals.OAuth2.Github.ClientSecret.String(),

vals.OAuth2.Github.AllowSignups.Value(),

vals.OAuth2.Github.AllowEveryone.Value(),

vals.OAuth2.Github.AllowedOrgs,

vals.OAuth2.Github.AllowedTeams,

vals.OAuth2.Github.EnterpriseBaseURL.String(),

)

if err != nil {

return xerrors.Errorf("configure github oauth2: %w", err)

}

if vals.OIDC.ClientKeyFile != "" || vals.OIDC.ClientSecret != "" {

if vals.OIDC.IgnoreEmailVerified {

logger.Warn(ctx, "coder will not check email_verified for OIDC logins")

}

oc, err := createOIDCConfig(ctx, vals)

if err != nil {

return xerrors.Errorf("create oidc config: %w", err)

}

options.OIDCConfig = oc

}

if vals.InMemoryDatabase {

// This is only used for testing.

options.Database = dbmem.New()

options.Pubsub = pubsub.NewInMemory()

} else {

dbURL, err := escapePostgresURLUserInfo(vals.PostgresURL.String())

if err != nil {

return xerrors.Errorf("escaping postgres URL: %w", err)

}

sqlDB, err := ConnectToPostgres(ctx, logger, sqlDriver, dbURL)

if err != nil {

return xerrors.Errorf("connect to postgres: %w", err)

}

defer func() {

_ = sqlDB.Close()

}()

options.Database = database.New(sqlDB)

options.Pubsub, err = pubsub.New(ctx, sqlDB, dbURL)

if err != nil {

return xerrors.Errorf("create pubsub: %w", err)

}

defer options.Pubsub.Close()

}

if options.DeploymentValues.Prometheus.Enable && options.DeploymentValues.Prometheus.CollectDBMetrics {

options.Database = dbmetrics.New(options.Database, options.PrometheusRegistry)

}

var deploymentID string

err = options.Database.InTx(func(tx database.Store) error {

// This will block until the lock is acquired, and will be

// automatically released when the transaction ends.

err := tx.AcquireLock(ctx, database.LockIDDeploymentSetup)

if err != nil {

return xerrors.Errorf("acquire lock: %w", err)

}

deploymentID, err = tx.GetDeploymentID(ctx)

if err != nil && !xerrors.Is(err, sql.ErrNoRows) {

return xerrors.Errorf("get deployment id: %w", err)

}

if deploymentID == "" {

deploymentID = uuid.NewString()

err = tx.InsertDeploymentID(ctx, deploymentID)

if err != nil {

return xerrors.Errorf("set deployment id: %w", err)

}

// Read the app signing key from the DB. We store it hex encoded

// since the config table uses strings for the value and we

// don't want to deal with automatic encoding issues.

appSecurityKeyStr, err := tx.GetAppSecurityKey(ctx)

if err != nil && !xerrors.Is(err, sql.ErrNoRows) {

return xerrors.Errorf("get app signing key: %w", err)

}

// If the string in the DB is an invalid hex string or the

// length is not equal to the current key length, generate a new

// one.

// If the key is regenerated, old signed tokens and encrypted

// strings will become invalid. New signed app tokens will be

// generated automatically on failure. Any workspace app token

// smuggling operations in progress may fail, although with a

// helpful error.

if decoded, err := hex.DecodeString(appSecurityKeyStr); err != nil || len(decoded) != len(workspaceapps.SecurityKey{}) {

b := make([]byte, len(workspaceapps.SecurityKey{}))

_, err := rand.Read(b)

if err != nil {

return xerrors.Errorf("generate fresh app signing key: %w", err)

}

appSecurityKeyStr = hex.EncodeToString(b)

err = tx.UpsertAppSecurityKey(ctx, appSecurityKeyStr)

if err != nil {

return xerrors.Errorf("insert freshly generated app signing key to database: %w", err)

}

appSecurityKey, err := workspaceapps.KeyFromString(appSecurityKeyStr)

if err != nil {

return xerrors.Errorf("decode app signing key from database: %w", err)

}

options.AppSecurityKey = appSecurityKey

// Read the oauth signing key from the database. Like the app security, generate a new one

// if it is invalid for any reason.

oauthSigningKeyStr, err := tx.GetOAuthSigningKey(ctx)

if err != nil && !xerrors.Is(err, sql.ErrNoRows) {

return xerrors.Errorf("get app oauth signing key: %w", err)

}

if decoded, err := hex.DecodeString(oauthSigningKeyStr); err != nil || len(decoded) != len(options.OAuthSigningKey) {

b := make([]byte, len(options.OAuthSigningKey))

_, err := rand.Read(b)

if err != nil {

return xerrors.Errorf("generate fresh oauth signing key: %w", err)

}

oauthSigningKeyStr = hex.EncodeToString(b)

err = tx.UpsertOAuthSigningKey(ctx, oauthSigningKeyStr)

if err != nil {

return xerrors.Errorf("insert freshly generated oauth signing key to database: %w", err)

}

keyBytes, err := hex.DecodeString(oauthSigningKeyStr)

if err != nil {

return xerrors.Errorf("decode oauth signing key from database: %w", err)

}

if len(keyBytes) != len(options.OAuthSigningKey) {

return xerrors.Errorf("oauth signing key in database is not the correct length, expect %d got %d", len(options.OAuthSigningKey), len(keyBytes))

}

copy(options.OAuthSigningKey[:], keyBytes)

if options.OAuthSigningKey == [32]byte{} {

return xerrors.Errorf("oauth signing key in database is empty")

}

return nil

}, nil)

if err != nil {

return err

}

if vals.Telemetry.Enable {

gitAuth := make([]telemetry.GitAuth, 0)

// TODO:

var gitAuthConfigs []codersdk.ExternalAuthConfig

for _, cfg := range gitAuthConfigs {

gitAuth = append(gitAuth, telemetry.GitAuth{

Type: cfg.Type,

})

}

options.Telemetry, err = telemetry.New(telemetry.Options{

BuiltinPostgres: builtinPostgres,

DeploymentID: deploymentID,

Database: options.Database,

Logger: logger.Named("telemetry"),

URL: vals.Telemetry.URL.Value(),

Wildcard: vals.WildcardAccessURL.String() != "",

DERPServerRelayURL: vals.DERP.Server.RelayURL.String(),

GitAuth: gitAuth,

GitHubOAuth: vals.OAuth2.Github.ClientID != "",

OIDCAuth: vals.OIDC.ClientID != "",

OIDCIssuerURL: vals.OIDC.IssuerURL.String(),

Prometheus: vals.Prometheus.Enable.Value(),

STUN: len(vals.DERP.Server.STUNAddresses) != 0,

Tunnel: tunnel != nil,

ParseLicenseJWT: func(lic *telemetry.License) error {

// This will be nil when running in AGPL-only mode.

if options.ParseLicenseClaims == nil {

return nil

}

email, trial, err := options.ParseLicenseClaims(lic.JWT)

if err != nil {

return err

}

if email != "" {

lic.Email = &email

}

lic.Trial = &trial

return nil

})

if err != nil {

return xerrors.Errorf("create telemetry reporter: %w", err)

}

defer options.Telemetry.Close()

} else {

logger.Warn(ctx, `telemetry disabled, unable to notify of security issues. Read more: https://coder.com/docs/v2/latest/admin/telemetry`)

}

// This prevents the pprof import from being accidentally deleted.

_ = pprof.Handler

if vals.Pprof.Enable {

//nolint:revive

defer ServeHandler(ctx, logger, nil, vals.Pprof.Address.String(), "pprof")()

}

if vals.Prometheus.Enable {

closeFn, err := enablePrometheus(

ctx,

logger.Named("prometheus"),

vals,

options,

)

if err != nil {

return xerrors.Errorf("enable prometheus: %w", err)

}

defer closeFn()

}

if vals.Swagger.Enable {

options.SwaggerEndpoint = vals.Swagger.Enable.Value()

}

batcher, closeBatcher, err := batchstats.New(ctx,

batchstats.WithLogger(options.Logger.Named("batchstats")),

batchstats.WithStore(options.Database),

)

if err != nil {

return xerrors.Errorf("failed to create agent stats batcher: %w", err)

}

options.StatsBatcher = batcher

defer closeBatcher()

// We use a separate coderAPICloser so the Enterprise API

// can have its own close functions. This is cleaner

// than abstracting the Coder API itself.

coderAPI, coderAPICloser, err := newAPI(ctx, options)

if err != nil {

return xerrors.Errorf("create coder API: %w", err)

}

if vals.Prometheus.Enable {

// Agent metrics require reference to the tailnet coordinator, so must be initiated after Coder API.

closeAgentsFunc, err := prometheusmetrics.Agents(ctx, logger, options.PrometheusRegistry, coderAPI.Database, &coderAPI.TailnetCoordinator, coderAPI.DERPMap, coderAPI.Options.AgentInactiveDisconnectTimeout, 0)

if err != nil {

return xerrors.Errorf("register agents prometheus metric: %w", err)

}

defer closeAgentsFunc()

}

client := codersdk.New(localURL)

if localURL.Scheme == "https" && IsLocalhost(localURL.Hostname()) {

// The certificate will likely be self-signed or for a different

// hostname, so we need to skip verification.

client.HTTPClient.Transport = &http.Transport{

TLSClientConfig: &tls.Config{

//nolint:gosec

InsecureSkipVerify: true,

}

defer client.HTTPClient.CloseIdleConnections()

// This is helpful for tests, but can be silently ignored.

// Coder may be ran as users that don't have permission to write in the homedir,

// such as via the systemd service.

err = config.URL().Write(client.URL.String())

if err != nil && flag.Lookup("test.v") != nil {

return xerrors.Errorf("write config url: %w", err)

}

// Since errCh only has one buffered slot, all routines

// sending on it must be wrapped in a select/default to

// avoid leaving dangling goroutines waiting for the

// channel to be consumed.

errCh := make(chan error, 1)

provisionerDaemons := make([]*provisionerd.Server, 0)

defer func() {

// We have no graceful shutdown of provisionerDaemons

// here because that's handled at the end of main, this

// is here in case the program exits early.

for _, daemon := range provisionerDaemons {

_ = daemon.Close()

}

}()

var provisionerdWaitGroup sync.WaitGroup

defer provisionerdWaitGroup.Wait()

provisionerdMetrics := provisionerd.NewMetrics(options.PrometheusRegistry)

for i := int64(0); i < vals.Provisioner.Daemons.Value(); i++ {

suffix := fmt.Sprintf("%d", i)

// The suffix is added to the hostname, so we may need to trim to fit into

// the 64 character limit.

hostname := stringutil.Truncate(cliutil.Hostname(), 63-len(suffix))

name := fmt.Sprintf("%s-%s", hostname, suffix)

daemonCacheDir := filepath.Join(cacheDir, fmt.Sprintf("provisioner-%d", i))

daemon, err := newProvisionerDaemon(

ctx, coderAPI, provisionerdMetrics, logger, vals, daemonCacheDir, errCh, &provisionerdWaitGroup, name,

)

if err != nil {

return xerrors.Errorf("create provisioner daemon: %w", err)

}

provisionerDaemons = append(provisionerDaemons, daemon)

}

provisionerdMetrics.Runner.NumDaemons.Set(float64(len(provisionerDaemons)))

shutdownConnsCtx, shutdownConns := context.WithCancel(ctx)

defer shutdownConns()

// Ensures that old database entries are cleaned up over time!

purger := dbpurge.New(ctx, logger, options.Database)

defer purger.Close()

// Wrap the server in middleware that redirects to the access URL if

// the request is not to a local IP.

var handler http.Handler = coderAPI.RootHandler

if vals.RedirectToAccessURL {

handler = redirectToAccessURL(handler, vals.AccessURL.Value(), tunnel != nil, appHostnameRegex)

}

// ReadHeaderTimeout is purposefully not enabled. It caused some

// issues with websockets over the dev tunnel.

// See: https://github.com/coder/coder/pull/3730

//nolint:gosec

httpServer := &http.Server{

// These errors are typically noise like "TLS: EOF". Vault does

// similar:

// https://github.com/hashicorp/vault/blob/e2490059d0711635e529a4efcbaa1b26998d6e1c/command/server.go#L2714

ErrorLog: log.New(io.Discard, "", 0),

Handler: handler,

BaseContext: func(_ net.Listener) context.Context {

return shutdownConnsCtx

}

defer func() {

_ = shutdownWithTimeout(httpServer.Shutdown, 5*time.Second)

}()

// We call this in the routine so we can kill the other listeners if

// one of them fails.

closeListenersNow := func() {

httpServers.Close()

if tunnel != nil {

_ = tunnel.Listener.Close()

}

eg := errgroup.Group{}

eg.Go(func() error {

defer closeListenersNow()

return httpServers.Serve(httpServer)

})

if tunnel != nil {

eg.Go(func() error {

defer closeListenersNow()

return httpServer.Serve(tunnel.Listener)

})

}

go func() {

select {

case errCh <- eg.Wait():

default:

}

}()

cliui.Infof(inv.Stdout, "\n==> Logs will stream in below (press ctrl+c to gracefully exit):")

// Updates the systemd status from activating to activated.

_, err = daemon.SdNotify(false, daemon.SdNotifyReady)

if err != nil {

return xerrors.Errorf("notify systemd: %w", err)

}

autobuildTicker := time.NewTicker(vals.AutobuildPollInterval.Value())

defer autobuildTicker.Stop()

autobuildExecutor := autobuild.NewExecutor(

ctx, options.Database, options.Pubsub, coderAPI.TemplateScheduleStore, &coderAPI.Auditor, coderAPI.AccessControlStore, logger, autobuildTicker.C)

autobuildExecutor.Run()

View remainder of file in raw view

FilesExpand file tree

server.go

Latest commit

History

server.go

File metadata and controls