coder/docs/cli/coder_server.md

coder server

Start a Coder server

Usage

coder server [flags]

Subcommands

Name	Purpose
create-admin-user	Create a new admin user with the given username, email and password and adds it to every organization.
postgres-builtin-serve	Run the built-in PostgreSQL deployment.
postgres-builtin-url	Output the connection URL for the built-in PostgreSQL deployment.

Flags

--access-url

External URL to access your deployment. This must be accessible by all provisioned workspaces.

Consumes	$CODER_ACCESS_URL

--api-rate-limit

Maximum number of requests per minute allowed to the API per user, or per IP address for unauthenticated users. Negative values mean no rate limit. Some API endpoints have separate strict rate limits regardless of this value to prevent denial-of-service or brute force attacks.

Consumes	$CODER_API_RATE_LIMIT
Default	512

--cache-dir

The directory to cache temporary files. If unspecified and $CACHE_DIRECTORY is set, it will be used for compatibility with systemd.

Consumes	$CODER_CACHE_DIRECTORY
Default	~/.cache/coder

--dangerous-allow-path-app-sharing

Allow workspace apps that are not served from subdomains to be shared. Path-based app sharing is DISABLED by default for security purposes. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.

Consumes	$CODER_DANGEROUS_ALLOW_PATH_APP_SHARING
Default	false

--dangerous-allow-path-app-site-owner-access

Allow site-owners to access workspace apps from workspaces they do not own. Owners cannot access path-based apps they do not own by default. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.

Consumes	$CODER_DANGEROUS_ALLOW_PATH_APP_SITE_OWNER_ACCESS
Default	false

--dangerous-disable-rate-limits

Disables all rate limits. This is not recommended in production.

Consumes	$CODER_RATE_LIMIT_DISABLE_ALL
Default	false

--derp-config-path

Path to read a DERP mapping from. See: https://tailscale.com/kb/1118/custom-derp-servers/

Consumes	$CODER_DERP_CONFIG_PATH

--derp-config-url

URL to fetch a DERP mapping on startup. See: https://tailscale.com/kb/1118/custom-derp-servers/

Consumes	$CODER_DERP_CONFIG_URL

--derp-server-enable

Whether to enable or disable the embedded DERP relay server.

Consumes	$CODER_DERP_SERVER_ENABLE
Default	true

--derp-server-region-code

Region code to use for the embedded DERP server.

Consumes	$CODER_DERP_SERVER_REGION_CODE
Default	coder

--derp-server-region-id

Region ID to use for the embedded DERP server.

Consumes	$CODER_DERP_SERVER_REGION_ID
Default	999

--derp-server-region-name

Region name that for the embedded DERP server.

Consumes	$CODER_DERP_SERVER_REGION_NAME
Default	Coder Embedded Relay

--derp-server-stun-addresses

Addresses for STUN servers to establish P2P connections. Set empty to disable P2P connections.

Consumes	$CODER_DERP_SERVER_STUN_ADDRESSES
Default	[stun.l.google.com:19302]

--disable-password-auth

Disable password authentication. This is recommended for security purposes in production deployments that rely on an identity provider. Any user with the owner role will be able to sign in with their password regardless of this setting to avoid potential lock out. If you are locked out of your account, you can use the coder server create-admin command to create a new admin user directly in the database.

Consumes	$CODER_DISABLE_PASSWORD_AUTH
Default	false

--disable-path-apps

Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.

Consumes	$CODER_DISABLE_PATH_APPS
Default	false

--disable-session-expiry-refresh

Disable automatic session expiry bumping due to activity. This forces all sessions to become invalid after the session expiry duration has been reached.

Consumes	$CODER_DISABLE_SESSION_EXPIRY_REFRESH
Default	false

--experiments

Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.

Consumes	$CODER_EXPERIMENTS
Default	[]

--http-address

HTTP bind address of the server. Unset to disable the HTTP endpoint.

Consumes	$CODER_HTTP_ADDRESS
Default	127.0.0.1:3000

--log-human

Output human-readable logs to a given file.

Consumes	$CODER_LOGGING_HUMAN
Default	/dev/stderr

--log-json

Output JSON logs to a given file.

Consumes	$CODER_LOGGING_JSON

--log-stackdriver

Output Stackdriver compatible logs to a given file.

Consumes	$CODER_LOGGING_STACKDRIVER

--max-token-lifetime

The maximum lifetime duration users can specify when creating an API token.

Consumes	$CODER_MAX_TOKEN_LIFETIME
Default	2540400h0m0s

--oauth2-github-allow-everyone

Allow all logins, setting this option means allowed orgs and teams must be empty.

Consumes	$CODER_OAUTH2_GITHUB_ALLOW_EVERYONE
Default	false

--oauth2-github-allow-signups

Whether new users can sign up with GitHub.

Consumes	$CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS
Default	false

--oauth2-github-allowed-orgs

Organizations the user must be a member of to Login with GitHub.

Consumes	$CODER_OAUTH2_GITHUB_ALLOWED_ORGS
Default	[]

--oauth2-github-allowed-teams

Teams inside organizations the user must be a member of to Login with GitHub. Structured as: /.

Consumes	$CODER_OAUTH2_GITHUB_ALLOWED_TEAMS
Default	[]

--oauth2-github-client-id

Client ID for Login with GitHub.

Consumes	$CODER_OAUTH2_GITHUB_CLIENT_ID

--oauth2-github-client-secret

Client secret for Login with GitHub.

Consumes	$CODER_OAUTH2_GITHUB_CLIENT_SECRET

--oauth2-github-enterprise-base-url

Base URL of a GitHub Enterprise deployment to use for Login with GitHub.

Consumes	$CODER_OAUTH2_GITHUB_ENTERPRISE_BASE_URL

--oidc-allow-signups

Whether new users can sign up with OIDC.

Consumes	$CODER_OIDC_ALLOW_SIGNUPS
Default	true

--oidc-client-id

Client ID to use for Login with OIDC.

Consumes	$CODER_OIDC_CLIENT_ID

--oidc-client-secret

Client secret to use for Login with OIDC.

Consumes	$CODER_OIDC_CLIENT_SECRET

--oidc-email-domain

Email domains that clients logging in with OIDC must match.

Consumes	$CODER_OIDC_EMAIL_DOMAIN
Default	[]

--oidc-icon-url

URL pointing to the icon to use on the OepnID Connect login button

Consumes	$CODER_OIDC_ICON_URL

--oidc-ignore-email-verified

Ignore the email_verified claim from the upstream provider.

Consumes	$CODER_OIDC_IGNORE_EMAIL_VERIFIED
Default	false

--oidc-issuer-url

Issuer URL to use for Login with OIDC.

Consumes	$CODER_OIDC_ISSUER_URL

--oidc-scopes

Scopes to grant when authenticating with OIDC.

Consumes	$CODER_OIDC_SCOPES
Default	[openid,profile,email]

--oidc-sign-in-text

The text to show on the OpenID Connect sign in button

Consumes	$CODER_OIDC_SIGN_IN_TEXT
Default	OpenID Connect

--oidc-username-field

OIDC claim field to use as the username.

Consumes	$CODER_OIDC_USERNAME_FIELD
Default	preferred_username

--postgres-url

URL of a PostgreSQL database. If empty, PostgreSQL binaries will be downloaded from Maven (https://repo1.maven.org/maven2) and store all data in the config root. Access the built-in database with "coder server postgres-builtin-url".

Consumes	$CODER_PG_CONNECTION_URL

--pprof-address

The bind address to serve pprof.

Consumes	$CODER_PPROF_ADDRESS
Default	127.0.0.1:6060

--pprof-enable

Serve pprof metrics on the address defined by pprof address.

Consumes	$CODER_PPROF_ENABLE
Default	false

--prometheus-address

The bind address to serve prometheus metrics.

Consumes	$CODER_PROMETHEUS_ADDRESS
Default	127.0.0.1:2112

--prometheus-enable

Serve prometheus metrics on the address defined by prometheus address.

Consumes	$CODER_PROMETHEUS_ENABLE
Default	false

--provisioner-daemon-poll-interval

Time to wait before polling for a new job.

Consumes	$CODER_PROVISIONER_DAEMON_POLL_INTERVAL
Default	1s

--provisioner-daemon-poll-jitter

Random jitter added to the poll interval.

Consumes	$CODER_PROVISIONER_DAEMON_POLL_JITTER
Default	100ms

--provisioner-daemons

Number of provisioner daemons to create on start. If builds are stuck in queued state for a long time, consider increasing this.

Consumes	$CODER_PROVISIONER_DAEMONS
Default	3

--provisioner-force-cancel-interval

Time to force cancel provisioning tasks that are stuck.

Consumes	$CODER_PROVISIONER_FORCE_CANCEL_INTERVAL
Default	10m0s

--proxy-trusted-headers

Headers to trust for forwarding IP addresses. e.g. Cf-Connecting-Ip, True-Client-Ip, X-Forwarded-For

Consumes	$CODER_PROXY_TRUSTED_HEADERS
Default	[]

--proxy-trusted-origins

Origin addresses to respect "proxy-trusted-headers". e.g. 192.168.1.0/24

Consumes	$CODER_PROXY_TRUSTED_ORIGINS
Default	[]

--redirect-to-access-url

Specifies whether to redirect requests that do not match the access URL host.

Consumes	$CODER_REDIRECT_TO_ACCESS_URL
Default	false

--secure-auth-cookie

Controls if the 'Secure' property is set on browser session cookies.

Consumes	$CODER_SECURE_AUTH_COOKIE
Default	false

--session-duration

The token expiry duration for browser sessions. Sessions may last longer if they are actively making requests, but this functionality can be disabled via --disable-session-expiry-refresh.

Consumes	$CODER_MAX_SESSION_EXPIRY
Default	24h0m0s

--ssh-keygen-algorithm

The algorithm to use for generating ssh keys. Accepted values are "ed25519", "ecdsa", or "rsa4096".

Consumes	$CODER_SSH_KEYGEN_ALGORITHM
Default	ed25519

--strict-transport-security

Controls if the 'Strict-Transport-Security' header is set on all static file responses. This header should only be set if the server is accessed via HTTPS. This value is the MaxAge in seconds of the header.

Consumes	$CODER_STRICT_TRANSPORT_SECURITY
Default	0

--strict-transport-security-options

Two optional fields can be set in the Strict-Transport-Security header; 'includeSubDomains' and 'preload'. The 'strict-transport-security' flag must be set to a non-zero value for these options to be used.

Consumes	$CODER_STRICT_TRANSPORT_SECURITY_OPTIONS
Default	[]

--swagger-enable

Expose the swagger endpoint via /swagger.

Consumes	$CODER_SWAGGER_ENABLE
Default	false

--telemetry

Whether telemetry is enabled or not. Coder collects anonymized usage data to help improve our product.

Consumes	$CODER_TELEMETRY_ENABLE
Default	true

--telemetry-trace

Whether Opentelemetry traces are sent to Coder. Coder collects anonymized application tracing to help improve our product. Disabling telemetry also disables this option.

Consumes	$CODER_TELEMETRY_TRACE
Default	true

--tls-address

HTTPS bind address of the server.

Consumes	$CODER_TLS_ADDRESS
Default	127.0.0.1:3443

--tls-cert-file

Path to each certificate for TLS. It requires a PEM-encoded file. To configure the listener to use a CA certificate, concatenate the primary certificate and the CA certificate together. The primary certificate should appear first in the combined file.

Consumes	$CODER_TLS_CERT_FILE
Default	[]

--tls-client-auth

Policy the server will follow for TLS Client Authentication. Accepted values are "none", "request", "require-any", "verify-if-given", or "require-and-verify".

Consumes	$CODER_TLS_CLIENT_AUTH
Default	none

--tls-client-ca-file

PEM-encoded Certificate Authority file used for checking the authenticity of client

Consumes	$CODER_TLS_CLIENT_CA_FILE

--tls-client-cert-file

Path to certificate for client TLS authentication. It requires a PEM-encoded file.

Consumes	$CODER_TLS_CLIENT_CERT_FILE

--tls-client-key-file

Path to key for client TLS authentication. It requires a PEM-encoded file.

Consumes	$CODER_TLS_CLIENT_KEY_FILE

--tls-enable

Whether TLS will be enabled.

Consumes	$CODER_TLS_ENABLE
Default	false

--tls-key-file

Paths to the private keys for each of the certificates. It requires a PEM-encoded file.

Consumes	$CODER_TLS_KEY_FILE
Default	[]

--tls-min-version

Minimum supported version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13"

Consumes	$CODER_TLS_MIN_VERSION
Default	tls12

--trace

Whether application tracing data is collected. It exports to a backend configured by environment variables. See: https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md

Consumes	$CODER_TRACE_ENABLE
Default	false

--trace-honeycomb-api-key

Enables trace exporting to Honeycomb.io using the provided API Key.

Consumes	$CODER_TRACE_HONEYCOMB_API_KEY

--trace-logs

Enables capturing of logs as events in traces. This is useful for debugging, but may result in a very large amount of events being sent to the tracing backend which may incur significant costs. If the verbose flag was supplied, debug-level logs will be included.

Consumes	$CODER_TRACE_CAPTURE_LOGS
Default	false

--update-check

Periodically check for new releases of Coder and inform the owner. The check is performed once per day.

Consumes	$CODER_UPDATE_CHECK
Default	false

--wildcard-access-url

Specifies the wildcard hostname to use for workspace applications in the form "*.example.com".

Consumes	$CODER_WILDCARD_ACCESS_URL