31 lines
1.6 KiB
Markdown
31 lines
1.6 KiB
Markdown
---
|
|
title: "🧱 Architecture"
|
|
description: "How the Coder control plane, its private postgres, its provisioner and its two traffic planes fit together on the loca operator host."
|
|
source: "verified deployment on the loca operator host, 2026-08-19"
|
|
reviewed: 2026-08-19
|
|
---
|
|
|
|
# 🧱 Architecture
|
|
|
|
The deployed shape in one paragraph: nginx terminates TLS for `code.loca.zone` and proxies everything to a loopback-published Coder container, which stores all state in a private postgres container and builds workspaces by talking to the host docker socket. No component of this stack is reachable from the network except through the two nginx vhosts.
|
|
|
|
## 🧭 Two traffic planes, one vhost
|
|
|
|
- human plane: browser to dashboard, web terminal and path-based workspace apps, authenticated by the host-scoped `coder_session_token` cookie
|
|
- machine plane: the `coder` CLI, workspace agents and DERP relay traffic, authenticated by the `Coder-Session-Token` header over long-lived websockets
|
|
- both planes enter through the same `code.loca.zone:443` server block, which is exactly why an `auth_request` gate cannot be applied to only one of them; see [[operations/auth-model]]
|
|
|
|
## 🗺️ Pages
|
|
|
|
| Need | Page |
|
|
| --- | --- |
|
|
| Diagram, exact container, volume and port wiring | [[architecture/runtime-topology]] |
|
|
| Path, port and env var lookup table | [[reference/config-paths]] |
|
|
| What is deliberately not enabled | [[reference/limits]] |
|
|
| Operational commands | [[operations/index]] |
|
|
|
|
## 📚 Sources
|
|
|
|
- https://coder.com/docs/admin/networking
|
|
- https://coder.com/docs/reference/api/authentication
|