feat: Implement experiment gated CRUD for workspace proxies (#6928)

* feat: Implement basic moon crud
* chore: Implement enterprise endpoints for moons

coderd/apidoc/docs.go

@@ -4995,6 +4995,71 @@ const docTemplate = `{
                 }
             }
         },
+        "/workspaceproxies": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Enterprise"
+                ],
+                "summary": "Get workspace proxies",
+                "operationId": "get-workspace-proxies",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "type": "array",
+                            "items": {
+                                "$ref": "#/definitions/codersdk.WorkspaceProxy"
+                            }
+                        }
+                    }
+                }
+            },
+            "post": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Templates"
+                ],
+                "summary": "Create workspace proxy",
+                "operationId": "create-workspace-proxy",
+                "parameters": [
+                    {
+                        "description": "Create workspace proxy request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.CreateWorkspaceProxyRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "201": {
+                        "description": "Created",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.WorkspaceProxy"
+                        }
+                    }
+                }
+            }
+        },
         "/workspaces": {
             "get": {
                 "security": [
@@ -6706,6 +6771,26 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.CreateWorkspaceProxyRequest": {
+            "type": "object",
+            "properties": {
+                "display_name": {
+                    "type": "string"
+                },
+                "icon": {
+                    "type": "string"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "url": {
+                    "type": "string"
+                },
+                "wildcard_hostname": {
+                    "type": "string"
+                }
+            }
+        },
         "codersdk.CreateWorkspaceRequest": {
             "type": "object",
             "required": [
@@ -7086,10 +7171,12 @@ const docTemplate = `{
         "codersdk.Experiment": {
             "type": "string",
             "enum": [
-                "template_editor"
+                "template_editor",
+                "moons"
             ],
             "x-enum-varnames": [
-                "ExperimentTemplateEditor"
+                "ExperimentTemplateEditor",
+                "ExperimentMoons"
             ]
         },
         "codersdk.Feature": {
@@ -9355,6 +9442,44 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.WorkspaceProxy": {
+            "type": "object",
+            "properties": {
+                "created_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "deleted": {
+                    "type": "boolean"
+                },
+                "icon": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "organization_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "updated_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "url": {
+                    "description": "Full url including scheme of the proxy api url: https://us.example.com",
+                    "type": "string"
+                },
+                "wildcard_hostname": {
+                    "description": "WildcardHostname with the wildcard for subdomain based app hosting: *.us.example.com",
+                    "type": "string"
+                }
+            }
+        },
         "codersdk.WorkspaceQuota": {
             "type": "object",
             "properties": {

coderd/apidoc/swagger.json

@@ -4399,6 +4399,61 @@
         }
       }
     },
+    "/workspaceproxies": {
+      "get": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "produces": ["application/json"],
+        "tags": ["Enterprise"],
+        "summary": "Get workspace proxies",
+        "operationId": "get-workspace-proxies",
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/codersdk.WorkspaceProxy"
+              }
+            }
+          }
+        }
+      },
+      "post": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "consumes": ["application/json"],
+        "produces": ["application/json"],
+        "tags": ["Templates"],
+        "summary": "Create workspace proxy",
+        "operationId": "create-workspace-proxy",
+        "parameters": [
+          {
+            "description": "Create workspace proxy request",
+            "name": "request",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/codersdk.CreateWorkspaceProxyRequest"
+            }
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "Created",
+            "schema": {
+              "$ref": "#/definitions/codersdk.WorkspaceProxy"
+            }
+          }
+        }
+      }
+    },
     "/workspaces": {
       "get": {
         "security": [
@@ -5973,6 +6028,26 @@
         }
       }
     },
+    "codersdk.CreateWorkspaceProxyRequest": {
+      "type": "object",
+      "properties": {
+        "display_name": {
+          "type": "string"
+        },
+        "icon": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        },
+        "url": {
+          "type": "string"
+        },
+        "wildcard_hostname": {
+          "type": "string"
+        }
+      }
+    },
     "codersdk.CreateWorkspaceRequest": {
       "type": "object",
       "required": ["name", "template_id"],
@@ -6345,8 +6420,8 @@
     },
     "codersdk.Experiment": {
       "type": "string",
-      "enum": ["template_editor"],
-      "x-enum-varnames": ["ExperimentTemplateEditor"]
+      "enum": ["template_editor", "moons"],
+      "x-enum-varnames": ["ExperimentTemplateEditor", "ExperimentMoons"]
     },
     "codersdk.Feature": {
       "type": "object",
@@ -8447,6 +8522,44 @@
         }
       }
     },
+    "codersdk.WorkspaceProxy": {
+      "type": "object",
+      "properties": {
+        "created_at": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "deleted": {
+          "type": "boolean"
+        },
+        "icon": {
+          "type": "string"
+        },
+        "id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "name": {
+          "type": "string"
+        },
+        "organization_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "updated_at": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "url": {
+          "description": "Full url including scheme of the proxy api url: https://us.example.com",
+          "type": "string"
+        },
+        "wildcard_hostname": {
+          "description": "WildcardHostname with the wildcard for subdomain based app hosting: *.us.example.com",
+          "type": "string"
+        }
+      }
+    },
     "codersdk.WorkspaceQuota": {
       "type": "object",
       "properties": {

coderd/audit/diff.go

@@ -16,7 +16,8 @@ type Auditable interface {
 		database.GitSSHKey |
 		database.WorkspaceBuild |
 		database.AuditableGroup |
-		database.License
+		database.License |
+		database.WorkspaceProxy
 }
 
 // Map is a map of changed fields in an audited resource. It maps field names to

coderd/database/dbauthz/querier.go

@@ -1685,6 +1685,34 @@ func (q *querier) GetWorkspaceByWorkspaceAppID(ctx context.Context, workspaceApp
 	return fetch(q.log, q.auth, q.db.GetWorkspaceByWorkspaceAppID)(ctx, workspaceAppID)
 }
 
+func (q *querier) GetWorkspaceProxies(ctx context.Context) ([]database.WorkspaceProxy, error) {
+	return fetchWithPostFilter(q.auth, func(ctx context.Context, _ interface{}) ([]database.WorkspaceProxy, error) {
+		return q.db.GetWorkspaceProxies(ctx)
+	})(ctx, nil)
+}
+
+func (q *querier) GetWorkspaceProxyByID(ctx context.Context, id uuid.UUID) (database.WorkspaceProxy, error) {
+	return fetch(q.log, q.auth, q.db.GetWorkspaceProxyByID)(ctx, id)
+}
+
+func (q *querier) InsertWorkspaceProxy(ctx context.Context, arg database.InsertWorkspaceProxyParams) (database.WorkspaceProxy, error) {
+	return insert(q.log, q.auth, rbac.ResourceWorkspaceProxy, q.db.InsertWorkspaceProxy)(ctx, arg)
+}
+
+func (q *querier) UpdateWorkspaceProxy(ctx context.Context, arg database.UpdateWorkspaceProxyParams) (database.WorkspaceProxy, error) {
+	fetch := func(ctx context.Context, arg database.UpdateWorkspaceProxyParams) (database.WorkspaceProxy, error) {
+		return q.db.GetWorkspaceProxyByID(ctx, arg.ID)
+	}
+	return updateWithReturn(q.log, q.auth, fetch, q.db.UpdateWorkspaceProxy)(ctx, arg)
+}
+
+func (q *querier) UpdateWorkspaceProxyDeleted(ctx context.Context, arg database.UpdateWorkspaceProxyDeletedParams) error {
+	fetch := func(ctx context.Context, arg database.UpdateWorkspaceProxyDeletedParams) (database.WorkspaceProxy, error) {
+		return q.db.GetWorkspaceProxyByID(ctx, arg.ID)
+	}
+	return deleteQ(q.log, q.auth, fetch, q.db.UpdateWorkspaceProxyDeleted)(ctx, arg)
+}
+
 func authorizedTemplateVersionFromJob(ctx context.Context, q *querier, job database.ProvisionerJob) (database.TemplateVersion, error) {
 	switch job.Type {
 	case database.ProvisionerJobTypeTemplateVersionDryRun:

coderd/database/dbauthz/querier_test.go

@@ -438,6 +438,36 @@ func (s *MethodTestSuite) TestOrganization() {
 	}))
 }
 
+func (s *MethodTestSuite) TestWorkspaceProxy() {
+	s.Run("InsertWorkspaceProxy", s.Subtest(func(db database.Store, check *expects) {
+		check.Args(database.InsertWorkspaceProxyParams{
+			ID: uuid.New(),
+		}).Asserts(rbac.ResourceWorkspaceProxy, rbac.ActionCreate)
+	}))
+	s.Run("UpdateWorkspaceProxy", s.Subtest(func(db database.Store, check *expects) {
+		p := dbgen.WorkspaceProxy(s.T(), db, database.WorkspaceProxy{})
+		check.Args(database.UpdateWorkspaceProxyParams{
+			ID: p.ID,
+		}).Asserts(p, rbac.ActionUpdate)
+	}))
+	s.Run("GetWorkspaceProxyByID", s.Subtest(func(db database.Store, check *expects) {
+		p := dbgen.WorkspaceProxy(s.T(), db, database.WorkspaceProxy{})
+		check.Args(p.ID).Asserts(p, rbac.ActionRead).Returns(p)
+	}))
+	s.Run("UpdateWorkspaceProxyDeleted", s.Subtest(func(db database.Store, check *expects) {
+		p := dbgen.WorkspaceProxy(s.T(), db, database.WorkspaceProxy{})
+		check.Args(database.UpdateWorkspaceProxyDeletedParams{
+			ID:      p.ID,
+			Deleted: true,
+		}).Asserts(p, rbac.ActionDelete)
+	}))
+	s.Run("GetWorkspaceProxies", s.Subtest(func(db database.Store, check *expects) {
+		p1 := dbgen.WorkspaceProxy(s.T(), db, database.WorkspaceProxy{})
+		p2 := dbgen.WorkspaceProxy(s.T(), db, database.WorkspaceProxy{})
+		check.Args().Asserts(p1, rbac.ActionRead, p2, rbac.ActionRead).Returns(slice.New(p1, p2))
+	}))
+}
+
 func (s *MethodTestSuite) TestParameters() {
 	s.Run("Workspace/InsertParameterValue", s.Subtest(func(db database.Store, check *expects) {
 		w := dbgen.Workspace(s.T(), db, database.Workspace{})

coderd/database/dbfake/databasefake.go

@@ -65,6 +65,7 @@ func New() database.Store {
 			workspaceApps:             make([]database.WorkspaceApp, 0),
 			workspaces:                make([]database.Workspace, 0),
 			licenses:                  make([]database.License, 0),
+			workspaceProxies:          make([]database.WorkspaceProxy, 0),
 			locks:                     map[int64]struct{}{},
 		},
 	}
@@ -132,6 +133,7 @@ type data struct {
 	workspaceResourceMetadata []database.WorkspaceResourceMetadatum
 	workspaceResources        []database.WorkspaceResource
 	workspaces                []database.Workspace
+	workspaceProxies          []database.WorkspaceProxy
 
 	// Locks is a map of lock names. Any keys within the map are currently
 	// locked.
@@ -4979,3 +4981,86 @@ func (q *fakeQuerier) UpdateWorkspaceAgentStartupLogOverflowByID(_ context.Conte
 	}
 	return sql.ErrNoRows
 }
+
+func (q *fakeQuerier) GetWorkspaceProxies(_ context.Context) ([]database.WorkspaceProxy, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	cpy := make([]database.WorkspaceProxy, 0, len(q.workspaceProxies))
+
+	for _, p := range q.workspaceProxies {
+		if !p.Deleted {
+			cpy = append(cpy, p)
+		}
+	}
+	return cpy, nil
+}
+
+func (q *fakeQuerier) GetWorkspaceProxyByID(_ context.Context, id uuid.UUID) (database.WorkspaceProxy, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for _, proxy := range q.workspaceProxies {
+		if proxy.ID == id {
+			return proxy, nil
+		}
+	}
+	return database.WorkspaceProxy{}, sql.ErrNoRows
+}
+
+func (q *fakeQuerier) InsertWorkspaceProxy(_ context.Context, arg database.InsertWorkspaceProxyParams) (database.WorkspaceProxy, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for _, p := range q.workspaceProxies {
+		if !p.Deleted && p.Name == arg.Name {
+			return database.WorkspaceProxy{}, errDuplicateKey
+		}
+	}
+
+	p := database.WorkspaceProxy{
+		ID:               arg.ID,
+		Name:             arg.Name,
+		Icon:             arg.Icon,
+		Url:              arg.Url,
+		WildcardHostname: arg.WildcardHostname,
+		CreatedAt:        arg.CreatedAt,
+		UpdatedAt:        arg.UpdatedAt,
+		Deleted:          false,
+	}
+	q.workspaceProxies = append(q.workspaceProxies, p)
+	return p, nil
+}
+
+func (q *fakeQuerier) UpdateWorkspaceProxy(_ context.Context, arg database.UpdateWorkspaceProxyParams) (database.WorkspaceProxy, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, p := range q.workspaceProxies {
+		if p.ID == arg.ID {
+			p.Name = arg.Name
+			p.Icon = arg.Icon
+			p.Url = arg.Url
+			p.WildcardHostname = arg.WildcardHostname
+			p.UpdatedAt = database.Now()
+			q.workspaceProxies[i] = p
+			return p, nil
+		}
+	}
+	return database.WorkspaceProxy{}, sql.ErrNoRows
+}
+
+func (q *fakeQuerier) UpdateWorkspaceProxyDeleted(_ context.Context, arg database.UpdateWorkspaceProxyDeletedParams) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, p := range q.workspaceProxies {
+		if p.ID == arg.ID {
+			p.Deleted = arg.Deleted
+			p.UpdatedAt = database.Now()
+			q.workspaceProxies[i] = p
+			return nil
+		}
+	}
+	return sql.ErrNoRows
+}

coderd/database/dbgen/generator.go

@@ -327,6 +327,21 @@ func WorkspaceResourceMetadatums(t testing.TB, db database.Store, seed database.
 	return meta
 }
 
+func WorkspaceProxy(t testing.TB, db database.Store, orig database.WorkspaceProxy) database.WorkspaceProxy {
+	resource, err := db.InsertWorkspaceProxy(context.Background(), database.InsertWorkspaceProxyParams{
+		ID:               takeFirst(orig.ID, uuid.New()),
+		Name:             takeFirst(orig.Name, namesgenerator.GetRandomName(1)),
+		DisplayName:      takeFirst(orig.DisplayName, namesgenerator.GetRandomName(1)),
+		Icon:             takeFirst(orig.Icon, namesgenerator.GetRandomName(1)),
+		Url:              takeFirst(orig.Url, fmt.Sprintf("https://%s.com", namesgenerator.GetRandomName(1))),
+		WildcardHostname: takeFirst(orig.WildcardHostname, fmt.Sprintf(".%s.com", namesgenerator.GetRandomName(1))),
+		CreatedAt:        takeFirst(orig.CreatedAt, database.Now()),
+		UpdatedAt:        takeFirst(orig.UpdatedAt, database.Now()),
+	})
+	require.NoError(t, err, "insert app")
+	return resource
+}
+
 func File(t testing.TB, db database.Store, orig database.File) database.File {
 	file, err := db.InsertFile(context.Background(), database.InsertFileParams{
 		ID:        takeFirst(orig.ID, uuid.New()),

coderd/database/dbgen/generator_test.go

@@ -75,6 +75,13 @@ func TestGenerator(t *testing.T) {
 		require.Equal(t, exp, must(db.GetWorkspaceResourceMetadataByResourceIDs(context.Background(), []uuid.UUID{exp[0].WorkspaceResourceID})))
 	})
 
+	t.Run("WorkspaceProxy", func(t *testing.T) {
+		t.Parallel()
+		db := dbfake.New()
+		exp := dbgen.WorkspaceProxy(t, db, database.WorkspaceProxy{})
+		require.Equal(t, exp, must(db.GetWorkspaceProxyByID(context.Background(), exp.ID)))
+	})
+
 	t.Run("Job", func(t *testing.T) {
 		t.Parallel()
 		db := dbfake.New()

coderd/database/dump.sql

@@ -635,6 +635,22 @@ CREATE TABLE workspace_builds (
     max_deadline timestamp with time zone DEFAULT '0001-01-01 00:00:00+00'::timestamp with time zone NOT NULL
 );
 
+CREATE TABLE workspace_proxies (
+    id uuid NOT NULL,
+    name text NOT NULL,
+    display_name text NOT NULL,
+    icon text NOT NULL,
+    url text NOT NULL,
+    wildcard_hostname text NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    deleted boolean NOT NULL
+);
+
+COMMENT ON COLUMN workspace_proxies.url IS 'Full url including scheme of the proxy api url: https://us.example.com';
+
+COMMENT ON COLUMN workspace_proxies.wildcard_hostname IS 'Hostname with the wildcard for subdomain based app hosting: *.us.example.com';
+
 CREATE TABLE workspace_resource_metadata (
     workspace_resource_id uuid NOT NULL,
     key character varying(1024) NOT NULL,
@@ -804,6 +820,9 @@ ALTER TABLE ONLY workspace_builds
 ALTER TABLE ONLY workspace_builds
     ADD CONSTRAINT workspace_builds_workspace_id_build_number_key UNIQUE (workspace_id, build_number);
 
+ALTER TABLE ONLY workspace_proxies
+    ADD CONSTRAINT workspace_proxies_pkey PRIMARY KEY (id);
+
 ALTER TABLE ONLY workspace_resource_metadata
     ADD CONSTRAINT workspace_resource_metadata_name UNIQUE (workspace_resource_id, key);
 
@@ -860,6 +879,8 @@ CREATE INDEX workspace_agents_auth_token_idx ON workspace_agents USING btree (au
 
 CREATE INDEX workspace_agents_resource_id_idx ON workspace_agents USING btree (resource_id);
 
+CREATE UNIQUE INDEX workspace_proxies_name_idx ON workspace_proxies USING btree (name) WHERE (deleted = false);
+
 CREATE INDEX workspace_resources_job_id_idx ON workspace_resources USING btree (job_id);
 
 CREATE UNIQUE INDEX workspaces_owner_id_lower_idx ON workspaces USING btree (owner_id, lower((name)::text)) WHERE (deleted = false);

coderd/database/migrations/000114_workspace_proxy.down.sql

@@ -0,0 +1,4 @@
+BEGIN;
+DROP TABLE workspace_proxies;
+
+COMMIT;

coderd/database/migrations/000114_workspace_proxy.up.sql

@@ -0,0 +1,23 @@
+BEGIN;
+CREATE TABLE workspace_proxies (
+    id uuid NOT NULL,
+    name text NOT NULL,
+    display_name text NOT NULL,
+    icon text NOT NULL,
+    url text NOT NULL,
+	wildcard_hostname text NOT NULL,
+	created_at timestamp with time zone NOT NULL,
+	updated_at timestamp with time zone NOT NULL,
+	deleted boolean NOT NULL,
+
+    PRIMARY KEY (id)
+);
+
+COMMENT ON COLUMN workspace_proxies.url IS 'Full url including scheme of the proxy api url: https://us.example.com';
+COMMENT ON COLUMN workspace_proxies.wildcard_hostname IS 'Hostname with the wildcard for subdomain based app hosting: *.us.example.com';
+
+
+-- Enforces no active proxies have the same name.
+CREATE UNIQUE INDEX ON workspace_proxies (name) WHERE deleted = FALSE;
+
+COMMIT;

coderd/database/migrations/testdata/fixtures/000114_workspace_proxy.up.sql

@@ -0,0 +1,14 @@
+INSERT INTO workspace_proxies
+	(id, name, display_name, icon, url, wildcard_hostname, created_at, updated_at, deleted)
+VALUES
+	(
+		 'cf8ede8c-ff47-441f-a738-d92e4e34a657',
+	 	 'us',
+	 	 'United States',
+		 '/emojis/us.png',
+		 'https://us.coder.com',
+		 '*.us.coder.com',
+		'2023-03-30 12:00:00.000+02',
+		'2023-03-30 12:00:00.000+02',
+		 false
+	);

coderd/database/modelmethods.go

@@ -181,6 +181,11 @@ func (p ProvisionerDaemon) RBACObject() rbac.Object {
 	return rbac.ResourceProvisionerDaemon.WithID(p.ID)
 }
 
+func (w WorkspaceProxy) RBACObject() rbac.Object {
+	return rbac.ResourceWorkspaceProxy.
+		WithID(w.ID)
+}
+
 func (f File) RBACObject() rbac.Object {
 	return rbac.ResourceFile.
 		WithID(f.ID).

coderd/database/models.go

@@ -1663,6 +1663,20 @@ type WorkspaceBuildParameter struct {
 	Value string `db:"value" json:"value"`
 }
 
+type WorkspaceProxy struct {
+	ID          uuid.UUID `db:"id" json:"id"`
+	Name        string    `db:"name" json:"name"`
+	DisplayName string    `db:"display_name" json:"display_name"`
+	Icon        string    `db:"icon" json:"icon"`
+	// Full url including scheme of the proxy api url: https://us.example.com
+	Url string `db:"url" json:"url"`
+	// Hostname with the wildcard for subdomain based app hosting: *.us.example.com
+	WildcardHostname string    `db:"wildcard_hostname" json:"wildcard_hostname"`
+	CreatedAt        time.Time `db:"created_at" json:"created_at"`
+	UpdatedAt        time.Time `db:"updated_at" json:"updated_at"`
+	Deleted          bool      `db:"deleted" json:"deleted"`
+}
+
 type WorkspaceResource struct {
 	ID           uuid.UUID           `db:"id" json:"id"`
 	CreatedAt    time.Time           `db:"created_at" json:"created_at"`

coderd/database/querier.go

@@ -146,6 +146,8 @@ type sqlcQuerier interface {
 	GetWorkspaceByID(ctx context.Context, id uuid.UUID) (Workspace, error)
 	GetWorkspaceByOwnerIDAndName(ctx context.Context, arg GetWorkspaceByOwnerIDAndNameParams) (Workspace, error)
 	GetWorkspaceByWorkspaceAppID(ctx context.Context, workspaceAppID uuid.UUID) (Workspace, error)
+	GetWorkspaceProxies(ctx context.Context) ([]WorkspaceProxy, error)
+	GetWorkspaceProxyByID(ctx context.Context, id uuid.UUID) (WorkspaceProxy, error)
 	GetWorkspaceResourceByID(ctx context.Context, id uuid.UUID) (WorkspaceResource, error)
 	GetWorkspaceResourceMetadataByResourceIDs(ctx context.Context, ids []uuid.UUID) ([]WorkspaceResourceMetadatum, error)
 	GetWorkspaceResourceMetadataCreatedAfter(ctx context.Context, createdAt time.Time) ([]WorkspaceResourceMetadatum, error)
@@ -193,6 +195,7 @@ type sqlcQuerier interface {
 	InsertWorkspaceApp(ctx context.Context, arg InsertWorkspaceAppParams) (WorkspaceApp, error)
 	InsertWorkspaceBuild(ctx context.Context, arg InsertWorkspaceBuildParams) (WorkspaceBuild, error)
 	InsertWorkspaceBuildParameters(ctx context.Context, arg InsertWorkspaceBuildParametersParams) error
+	InsertWorkspaceProxy(ctx context.Context, arg InsertWorkspaceProxyParams) (WorkspaceProxy, error)
 	InsertWorkspaceResource(ctx context.Context, arg InsertWorkspaceResourceParams) (WorkspaceResource, error)
 	InsertWorkspaceResourceMetadata(ctx context.Context, arg InsertWorkspaceResourceMetadataParams) ([]WorkspaceResourceMetadatum, error)
 	ParameterValue(ctx context.Context, id uuid.UUID) (ParameterValue, error)
@@ -241,6 +244,8 @@ type sqlcQuerier interface {
 	UpdateWorkspaceBuildCostByID(ctx context.Context, arg UpdateWorkspaceBuildCostByIDParams) (WorkspaceBuild, error)
 	UpdateWorkspaceDeletedByID(ctx context.Context, arg UpdateWorkspaceDeletedByIDParams) error
 	UpdateWorkspaceLastUsedAt(ctx context.Context, arg UpdateWorkspaceLastUsedAtParams) error
+	UpdateWorkspaceProxy(ctx context.Context, arg UpdateWorkspaceProxyParams) (WorkspaceProxy, error)
+	UpdateWorkspaceProxyDeleted(ctx context.Context, arg UpdateWorkspaceProxyDeletedParams) error
 	UpdateWorkspaceTTL(ctx context.Context, arg UpdateWorkspaceTTLParams) error
 	UpdateWorkspaceTTLToBeWithinTemplateMax(ctx context.Context, arg UpdateWorkspaceTTLToBeWithinTemplateMaxParams) error
 	UpsertLastUpdateCheck(ctx context.Context, value string) error

coderd/database/queries.sql.go

@@ -2803,6 +2803,198 @@ func (q *sqlQuerier) UpdateProvisionerJobWithCompleteByID(ctx context.Context, a
 	return err
 }
 
+const getWorkspaceProxies = `-- name: GetWorkspaceProxies :many
+SELECT
+	id, name, display_name, icon, url, wildcard_hostname, created_at, updated_at, deleted
+FROM
+	workspace_proxies
+WHERE
+	deleted = false
+`
+
+func (q *sqlQuerier) GetWorkspaceProxies(ctx context.Context) ([]WorkspaceProxy, error) {
+	rows, err := q.db.QueryContext(ctx, getWorkspaceProxies)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []WorkspaceProxy
+	for rows.Next() {
+		var i WorkspaceProxy
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.DisplayName,
+			&i.Icon,
+			&i.Url,
+			&i.WildcardHostname,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.Deleted,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getWorkspaceProxyByID = `-- name: GetWorkspaceProxyByID :one
+SELECT
+	id, name, display_name, icon, url, wildcard_hostname, created_at, updated_at, deleted
+FROM
+	workspace_proxies
+WHERE
+	id = $1
+LIMIT
+	1
+`
+
+func (q *sqlQuerier) GetWorkspaceProxyByID(ctx context.Context, id uuid.UUID) (WorkspaceProxy, error) {
+	row := q.db.QueryRowContext(ctx, getWorkspaceProxyByID, id)
+	var i WorkspaceProxy
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.DisplayName,
+		&i.Icon,
+		&i.Url,
+		&i.WildcardHostname,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.Deleted,
+	)
+	return i, err
+}
+
+const insertWorkspaceProxy = `-- name: InsertWorkspaceProxy :one
+INSERT INTO
+	workspace_proxies (
+		id,
+		name,
+		display_name,
+		icon,
+		url,
+		wildcard_hostname,
+		created_at,
+		updated_at,
+		deleted
+	)
+VALUES
+	($1, $2, $3, $4, $5, $6, $7, $8, false) RETURNING id, name, display_name, icon, url, wildcard_hostname, created_at, updated_at, deleted
+`
+
+type InsertWorkspaceProxyParams struct {
+	ID               uuid.UUID `db:"id" json:"id"`
+	Name             string    `db:"name" json:"name"`
+	DisplayName      string    `db:"display_name" json:"display_name"`
+	Icon             string    `db:"icon" json:"icon"`
+	Url              string    `db:"url" json:"url"`
+	WildcardHostname string    `db:"wildcard_hostname" json:"wildcard_hostname"`
+	CreatedAt        time.Time `db:"created_at" json:"created_at"`
+	UpdatedAt        time.Time `db:"updated_at" json:"updated_at"`
+}
+
+func (q *sqlQuerier) InsertWorkspaceProxy(ctx context.Context, arg InsertWorkspaceProxyParams) (WorkspaceProxy, error) {
+	row := q.db.QueryRowContext(ctx, insertWorkspaceProxy,
+		arg.ID,
+		arg.Name,
+		arg.DisplayName,
+		arg.Icon,
+		arg.Url,
+		arg.WildcardHostname,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+	)
+	var i WorkspaceProxy
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.DisplayName,
+		&i.Icon,
+		&i.Url,
+		&i.WildcardHostname,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.Deleted,
+	)
+	return i, err
+}
+
+const updateWorkspaceProxy = `-- name: UpdateWorkspaceProxy :one
+UPDATE
+	workspace_proxies
+SET
+	name = $1,
+	display_name = $2,
+	url = $3,
+	wildcard_hostname = $4,
+	icon = $5,
+	updated_at = Now()
+WHERE
+	id = $6
+RETURNING id, name, display_name, icon, url, wildcard_hostname, created_at, updated_at, deleted
+`
+
+type UpdateWorkspaceProxyParams struct {
+	Name             string    `db:"name" json:"name"`
+	DisplayName      string    `db:"display_name" json:"display_name"`
+	Url              string    `db:"url" json:"url"`
+	WildcardHostname string    `db:"wildcard_hostname" json:"wildcard_hostname"`
+	Icon             string    `db:"icon" json:"icon"`
+	ID               uuid.UUID `db:"id" json:"id"`
+}
+
+func (q *sqlQuerier) UpdateWorkspaceProxy(ctx context.Context, arg UpdateWorkspaceProxyParams) (WorkspaceProxy, error) {
+	row := q.db.QueryRowContext(ctx, updateWorkspaceProxy,
+		arg.Name,
+		arg.DisplayName,
+		arg.Url,
+		arg.WildcardHostname,
+		arg.Icon,
+		arg.ID,
+	)
+	var i WorkspaceProxy
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.DisplayName,
+		&i.Icon,
+		&i.Url,
+		&i.WildcardHostname,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.Deleted,
+	)
+	return i, err
+}
+
+const updateWorkspaceProxyDeleted = `-- name: UpdateWorkspaceProxyDeleted :exec
+UPDATE
+	workspace_proxies
+SET
+	updated_at = Now(),
+	deleted = $1
+WHERE
+	id = $2
+`
+
+type UpdateWorkspaceProxyDeletedParams struct {
+	Deleted bool      `db:"deleted" json:"deleted"`
+	ID      uuid.UUID `db:"id" json:"id"`
+}
+
+func (q *sqlQuerier) UpdateWorkspaceProxyDeleted(ctx context.Context, arg UpdateWorkspaceProxyDeletedParams) error {
+	_, err := q.db.ExecContext(ctx, updateWorkspaceProxyDeleted, arg.Deleted, arg.ID)
+	return err
+}
+
 const getQuotaAllowanceForUser = `-- name: GetQuotaAllowanceForUser :one
 SELECT
 	coalesce(SUM(quota_allowance), 0)::BIGINT

coderd/database/queries/proxies.sql

@@ -0,0 +1,57 @@
+-- name: InsertWorkspaceProxy :one
+INSERT INTO
+	workspace_proxies (
+		id,
+		name,
+		display_name,
+		icon,
+		url,
+		wildcard_hostname,
+		created_at,
+		updated_at,
+		deleted
+	)
+VALUES
+	($1, $2, $3, $4, $5, $6, $7, $8, false) RETURNING *;
+
+-- name: UpdateWorkspaceProxy :one
+UPDATE
+	workspace_proxies
+SET
+	name = @name,
+	display_name = @display_name,
+	url = @url,
+	wildcard_hostname = @wildcard_hostname,
+	icon = @icon,
+	updated_at = Now()
+WHERE
+	id = @id
+RETURNING *;
+
+
+-- name: UpdateWorkspaceProxyDeleted :exec
+UPDATE
+	workspace_proxies
+SET
+	updated_at = Now(),
+	deleted = @deleted
+WHERE
+	id = @id;
+
+-- name: GetWorkspaceProxyByID :one
+SELECT
+	*
+FROM
+	workspace_proxies
+WHERE
+	id = $1
+LIMIT
+	1;
+
+-- name: GetWorkspaceProxies :many
+SELECT
+	*
+FROM
+	workspace_proxies
+WHERE
+	deleted = false;

coderd/database/unique_constraint.go

@@ -31,5 +31,6 @@ const (
 	UniqueTemplatesOrganizationIDNameIndex                  UniqueConstraint = "templates_organization_id_name_idx"                       // CREATE UNIQUE INDEX templates_organization_id_name_idx ON templates USING btree (organization_id, lower((name)::text)) WHERE (deleted = false);
 	UniqueUsersEmailLowerIndex                              UniqueConstraint = "users_email_lower_idx"                                    // CREATE UNIQUE INDEX users_email_lower_idx ON users USING btree (lower(email)) WHERE (deleted = false);
 	UniqueUsersUsernameLowerIndex                           UniqueConstraint = "users_username_lower_idx"                                 // CREATE UNIQUE INDEX users_username_lower_idx ON users USING btree (lower(username)) WHERE (deleted = false);
+	UniqueWorkspaceProxiesNameIndex                         UniqueConstraint = "workspace_proxies_name_idx"                               // CREATE UNIQUE INDEX workspace_proxies_name_idx ON workspace_proxies USING btree (name) WHERE (deleted = false);
 	UniqueWorkspacesOwnerIDLowerIndex                       UniqueConstraint = "workspaces_owner_id_lower_idx"                            // CREATE UNIQUE INDEX workspaces_owner_id_lower_idx ON workspaces USING btree (owner_id, lower((name)::text)) WHERE (deleted = false);
 )

coderd/rbac/object.go

@@ -22,6 +22,14 @@ var (
 		Type: "workspace",
 	}
 
+	// ResourceWorkspaceProxy CRUD. Org
+	//	create/delete = make or delete proxies
+	// 	read = read proxy urls
+	//	update = edit workspace proxy fields
+	ResourceWorkspaceProxy = Object{
+		Type: "workspace_proxy",
+	}
+
 	// ResourceWorkspaceExecution CRUD. Org + User owner
 	//	create = workspace remote execution
 	// 	read = ?