---
title: "🧱 Architecture"
description: "How the Coder control plane, its private postgres, its provisioner and its two traffic planes fit together on the loca operator host."
source: "verified deployment on the loca operator host, 2026-08-19"
reviewed: 2026-08-19
---

# 🧱 Architecture

The deployed shape in one paragraph: nginx terminates TLS for `code.loca.zone` and proxies everything to a loopback-published Coder container, which stores all state in a private postgres container and builds workspaces by talking to the host docker socket. No component of this stack is reachable from the network except through the two nginx vhosts.

## 🧭 Two traffic planes, one vhost

- human plane: browser to dashboard, web terminal and path-based workspace apps, authenticated by the host-scoped `coder_session_token` cookie
- machine plane: the `coder` CLI, workspace agents and DERP relay traffic, authenticated by the `Coder-Session-Token` header over long-lived websockets
- both planes enter through the same `code.loca.zone:443` server block, which is exactly why an `auth_request` gate cannot be applied to only one of them; see [[operations/auth-model]]

## 🗺️ Pages

| Need | Page |
| --- | --- |
| Diagram, exact container, volume and port wiring | [[architecture/runtime-topology]] |
| Path, port and env var lookup table | [[reference/config-paths]] |
| What is deliberately not enabled | [[reference/limits]] |
| Operational commands | [[operations/index]] |

## 📚 Sources

- https://coder.com/docs/admin/networking
- https://coder.com/docs/reference/api/authentication