# Coder workspace template: Docker workspaces on the loca operator host.
#
# The provisioner is the `coder` server container itself (compose project
# /home/loca/dev/coder), which is the only thing on this host that holds
# /var/run/docker.sock. Workspaces created here are plain Docker containers on
# that same daemon.
#
# Every construct below is derived from sources cited in README.md, not from
# memory. Read that file before changing anything.

terraform {
  required_version = ">= 1.0"

  required_providers {
    # coder/coder 2.x requires Coder Server >= v2.18.0 (provider "Version 2
    # Upgrade Guide"). This deployment runs v2.35.3, so the 2.x line applies.
    # 2.18.0 is the latest release published on registry.terraform.io.
    coder = {
      source  = "coder/coder"
      version = "~> 2.18"
    }

    # 4.5.0 is the latest release published on registry.terraform.io.
    docker = {
      source  = "kreuzwerker/docker"
      version = "~> 4.5"
    }
  }
}

provider "coder" {}

# No `host` argument: the provisioner runs inside the `coder` container, which
# already has /var/run/docker.sock bind-mounted, so the provider's default
# socket is the right one. Nothing needs to be exposed over TCP.
provider "docker" {}

data "coder_provisioner" "me" {}
data "coder_workspace" "me" {}
data "coder_workspace_owner" "me" {}

# ---------------------------------------------------------------------------
# Parameters
#
# The upstream Docker example ships no parameters; the upstream Kubernetes
# example does, and this follows that idiom. Defaults are deliberately modest:
# the host has 10 cores and ~22 GiB available RAM, but its 15 GiB of swap is
# already ~97% consumed, so workspaces must not be sized to lean on swap.
#
# There is intentionally NO disk-size parameter. The home volume uses Docker's
# `local` driver on an overlay2/extfs root (verified with `docker info`), which
# cannot enforce a size quota without XFS project quotas. A disk parameter here
# would be decorative and would mislead the operator; home disk usage is
# reported through agent metadata instead.
# ---------------------------------------------------------------------------

data "coder_parameter" "cpu" {
  name         = "cpu"
  display_name = "CPU"
  description  = "CPU cores available to the workspace. This is a hard ceiling, not a reservation."
  type         = "number"
  default      = "2"
  icon         = "/icon/memory.svg"
  mutable      = true
  order        = 1

  option {
    name  = "1 core"
    value = "1"
  }
  option {
    name  = "2 cores (default)"
    value = "2"
  }
  option {
    name  = "4 cores"
    value = "4"
  }
}

data "coder_parameter" "memory" {
  name         = "memory"
  display_name = "Memory (GB)"
  description  = "Memory ceiling in GB. Container swap is pinned to this value, so a workspace can never push the host further into swap."
  type         = "number"
  default      = "2"
  icon         = "/icon/memory.svg"
  mutable      = true
  order        = 2

  option {
    name  = "2 GB (default)"
    value = "2"
  }
  option {
    name  = "4 GB"
    value = "4"
  }
  option {
    name  = "8 GB"
    value = "8"
  }
}

locals {
  username = data.coder_workspace_owner.me.name

  # Matches the image used by the upstream Docker example at the tag this
  # server runs (v2.35.3). Upstream `main` has since renamed the same image to
  # codercom/example-base:ubuntu.
  workspace_image = "codercom/enterprise-base:ubuntu"

  memory_mb = tonumber(data.coder_parameter.memory.value) * 1024

  # Hostname the workspace must reach to find the Coder server, read from the
  # access URL (https://code.loca.zone on this deployment) instead of hardcoded.
  # regexall, not regex: regex throws a build-time error on no match, and an
  # unset access URL must degrade to "don't add a host entry", not fail.
  access_url_match = regexall("^[a-zA-Z][a-zA-Z0-9+.-]*://([^/:]+)", data.coder_workspace.me.access_url)
  access_host      = length(local.access_url_match) > 0 ? local.access_url_match[0][0] : ""

  # Pin that hostname to the Docker gateway so agent -> server traffic reaches
  # the host's nginx directly rather than depending on hairpin NAT out to the
  # public IP and back. Verified reachable: an HTTPS request to /healthz with
  # code.loca.zone resolved to 172.17.0.1 returns 200 OK with a valid
  # certificate. Skipped for a bare IPv4 access URL, which the entrypoint
  # rewrite further down already handles.
  pin_access_host = local.access_host != "" && length(regexall("^[0-9]+(\\.[0-9]+){3}$", local.access_host)) == 0
}

# ---------------------------------------------------------------------------
# Agent
# ---------------------------------------------------------------------------

resource "coder_agent" "main" {
  arch = data.coder_provisioner.me.arch
  os   = "linux"

  # "blocking" is the behaviour the provider docs recommend: the workspace is
  # not advertised as ready until the script below exits.
  startup_script_behavior = "blocking"

  # Deliberately no `set -e`. Every step here is optional, idempotent, and must
  # never fail the workspace build; failures are logged and stepped over. The
  # script ends with an explicit `exit 0` for the same reason.
  startup_script = <<-EOT
    set -u

    log() { printf '[startup] %s\n' "$*"; }

    # 1. Seed the home directory on first boot only. The home volume is
    #    persistent, so this must not clobber an existing home.
    if [ ! -f "$HOME/.init_done" ]; then
      if [ -d /etc/skel ]; then
        cp -rT /etc/skel "$HOME" 2>/dev/null || log "skel copy skipped"
      fi
      touch "$HOME/.init_done" 2>/dev/null || log "could not mark init_done"
    fi

    # 2. code-server, installed into the persistent home so a workspace restart
    #    does not re-download it. Skipped cleanly if curl or the network is
    #    unavailable; the code-server app then just reports unhealthy.
    CS_DIR="$HOME/.local/share/code-server-dist"
    CS_BIN="$CS_DIR/bin/code-server"
    if [ ! -x "$CS_BIN" ]; then
      if command -v curl >/dev/null 2>&1; then
        log "installing code-server into $CS_DIR"
        curl -fsSL --max-time 180 https://code-server.dev/install.sh \
          | sh -s -- --method=standalone --prefix="$CS_DIR" \
          || log "code-server install failed; skipping"
      else
        log "curl not present; skipping code-server install"
      fi
    fi

    # 3. Start code-server unless something is already serving that port.
    if [ -x "$CS_BIN" ] && ! curl -fsS --max-time 2 http://localhost:13337/healthz >/dev/null 2>&1; then
      "$CS_BIN" --auth none --bind-addr 127.0.0.1:13337 \
        >"$HOME/.code-server.log" 2>&1 &
      log "code-server started on 127.0.0.1:13337"
    fi

    exit 0
  EOT

  # Lets users commit immediately. These take precedence over ~/.gitconfig.
  env = {
    GIT_AUTHOR_NAME     = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
    GIT_AUTHOR_EMAIL    = data.coder_workspace_owner.me.email
    GIT_COMMITTER_NAME  = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
    GIT_COMMITTER_EMAIL = data.coder_workspace_owner.me.email
  }

  # Observability, mirroring the upstream Docker example. The host rows matter
  # on this box because the daemon, both wikis, and every workspace share it.
  metadata {
    display_name = "CPU Usage"
    key          = "0_cpu_usage"
    script       = "coder stat cpu"
    interval     = 10
    timeout      = 1
  }

  metadata {
    display_name = "RAM Usage"
    key          = "1_ram_usage"
    script       = "coder stat mem"
    interval     = 10
    timeout      = 1
  }

  metadata {
    display_name = "Home Disk"
    key          = "2_home_disk"
    script       = "coder stat disk --path $${HOME}"
    interval     = 60
    timeout      = 1
  }

  metadata {
    display_name = "CPU Usage (Host)"
    key          = "3_cpu_usage_host"
    script       = "coder stat cpu --host"
    interval     = 10
    timeout      = 1
  }

  metadata {
    display_name = "Memory Usage (Host)"
    key          = "4_mem_usage_host"
    script       = "coder stat mem --host"
    interval     = 10
    timeout      = 1
  }

  metadata {
    display_name = "Swap Usage (Host)"
    key          = "5_swap_host"
    script       = <<-EOT
      free -b | awk '/^Swap/ { printf("%.1f/%.1f GiB", $3/1024/1024/1024, $2/1024/1024/1024) }'
    EOT
    interval     = 30
    timeout      = 1
  }
}

# ---------------------------------------------------------------------------
# Apps
#
# CRITICAL: every coder_app in this template MUST set `subdomain = false`.
#
# This deployment has no wildcard access URL. Nested names such as
# deep.nested.code.loca.zone do resolve, but the certbot lineage covers only
# code.loca.zone and wiki.code.loca.zone; a wildcard certificate would require
# a DNS-01 challenge with DNS-provider credentials that are not configured on
# this host. Subdomain apps would therefore be served with a name-mismatched
# certificate and fail in the browser. Path-based apps
# (/@user/workspace.main/apps/<slug>) are the only working mode here.
#
# The upstream example pulls code-server in from the
# registry.coder.com/coder/code-server/coder module. This template declares the
# app directly instead, for two reasons: a module-owned coder_app is not under
# our control and could ship subdomain = true, and modules add a provision-time
# dependency on registry.coder.com.
# ---------------------------------------------------------------------------

resource "coder_app" "code_server" {
  agent_id     = coder_agent.main.id
  slug         = "code-server"
  display_name = "code-server"
  icon         = "/icon/code.svg"
  url          = "http://localhost:13337/?folder=/home/coder"
  share        = "owner"
  order        = 1

  # See the block comment above. Do not change this to true.
  subdomain = false

  healthcheck {
    url       = "http://localhost:13337/healthz"
    interval  = 5
    threshold = 12
  }
}

# ---------------------------------------------------------------------------
# Infrastructure
# ---------------------------------------------------------------------------

resource "docker_image" "workspace" {
  name = local.workspace_image

  # Every workspace on this host shares this image. Deleting one workspace must
  # not pull it out from under the others.
  keep_locally = true
}

resource "docker_volume" "home" {
  # Keyed to the immutable workspace id rather than its name, so stopping,
  # starting, renaming, or rebuilding a workspace all reattach the same volume
  # instead of silently discarding /home/coder.
  name = "coder-${data.coder_workspace.me.id}-home"

  lifecycle {
    # Never let an attribute diff (labels, driver options) destroy user data.
    ignore_changes = all
  }

  labels {
    label = "coder.owner"
    value = data.coder_workspace_owner.me.name
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace_owner.me.id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  # Goes stale if the workspace is renamed, but useful when hunting dangling
  # volumes by hand.
  labels {
    label = "coder.workspace_name_at_creation"
    value = data.coder_workspace.me.name
  }
}

resource "docker_container" "workspace" {
  count = data.coder_workspace.me.start_count
  image = docker_image.workspace.image_id

  # lower() because Docker rejects uppercase in container names.
  name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
  # Makes the shell prompt friendly: coder@my-workspace:~$
  hostname = data.coder_workspace.me.name

  # Rewrites a loopback access URL to the Docker gateway. A no-op on this
  # deployment, where CODER_ACCESS_URL is https://code.loca.zone.
  entrypoint = ["sh", "-c", replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")]
  env        = ["CODER_AGENT_TOKEN=${coder_agent.main.token}"]

  # Hard ceilings from the parameters above. memory_swap is set equal to memory,
  # which disables container swap entirely: the host's 15 GiB swap is already
  # ~97% used, so a workspace must not be allowed to add to it.
  cpus        = tostring(data.coder_parameter.cpu.value)
  memory      = local.memory_mb
  memory_swap = local.memory_mb

  # SECURITY BOUNDARY: /var/run/docker.sock is deliberately NOT mounted here.
  # The socket stays with the `coder` server container, which needs it to
  # provision workspaces. Handing it to a workspace would give anyone inside
  # that workspace root-equivalent control of the whole host, including the
  # nginx/certbot stack, the Postgres container behind Coder, and every other
  # workspace. Docker-in-workspace, if it is ever wanted, must be done with a
  # sysbox/rootless runtime, not by exposing this socket.
  volumes {
    container_path = "/home/coder"
    volume_name    = docker_volume.home.name
    read_only      = false
  }

  host {
    host = "host.docker.internal"
    ip   = "host-gateway"
  }

  # See local.pin_access_host: keeps agent -> server traffic on the host
  # gateway instead of routing out to the public IP and back.
  dynamic "host" {
    for_each = local.pin_access_host ? [local.access_host] : []
    iterator = h
    content {
      host = h.value
      ip   = "host-gateway"
    }
  }

  labels {
    label = "coder.owner"
    value = data.coder_workspace_owner.me.name
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace_owner.me.id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  labels {
    label = "coder.workspace_name"
    value = data.coder_workspace.me.name
  }
}

# Surfaces the limits actually applied, so the dashboard does not require an
# operator to shell in and run `docker inspect` to see them.
resource "coder_metadata" "workspace" {
  count       = data.coder_workspace.me.start_count
  resource_id = docker_container.workspace[0].id

  item {
    key   = "image"
    value = local.workspace_image
  }
  item {
    key   = "cpu limit"
    value = "${data.coder_parameter.cpu.value} core(s)"
  }
  item {
    key   = "memory limit"
    value = "${data.coder_parameter.memory.value} GB (swap disabled)"
  }
  item {
    key   = "home volume"
    value = docker_volume.home.name
  }
  item {
    key   = "app routing"
    value = "path-based (`subdomain = false`); no wildcard access URL on this deployment"
  }
}