coder: initial import of deployed stack (v2.35.3 compose, docker template, SSOT vault)

q5vault/architecture/index.md

@@ -0,0 +1,30 @@
+---
+title: "🧱 Architecture"
+description: "How the Coder control plane, its private postgres, its provisioner and its two traffic planes fit together on the loca operator host."
+source: "verified deployment on the loca operator host, 2026-08-19"
+reviewed: 2026-08-19
+---
+
+# 🧱 Architecture
+
+The deployed shape in one paragraph: nginx terminates TLS for `code.loca.zone` and proxies everything to a loopback-published Coder container, which stores all state in a private postgres container and builds workspaces by talking to the host docker socket. No component of this stack is reachable from the network except through the two nginx vhosts.
+
+## 🧭 Two traffic planes, one vhost
+
+- human plane: browser to dashboard, web terminal and path-based workspace apps, authenticated by the host-scoped `coder_session_token` cookie
+- machine plane: the `coder` CLI, workspace agents and DERP relay traffic, authenticated by the `Coder-Session-Token` header over long-lived websockets
+- both planes enter through the same `code.loca.zone:443` server block, which is exactly why an `auth_request` gate cannot be applied to only one of them; see [[operations/auth-model]]
+
+## 🗺️ Pages
+
+| Need | Page |
+| --- | --- |
+| Diagram, exact container, volume and port wiring | [[architecture/runtime-topology]] |
+| Path, port and env var lookup table | [[reference/config-paths]] |
+| What is deliberately not enabled | [[reference/limits]] |
+| Operational commands | [[operations/index]] |
+
+## 📚 Sources
+
+- https://coder.com/docs/admin/networking
+- https://coder.com/docs/reference/api/authentication