coder/q5vault/architecture/index.md

title, description, source, reviewed

title	description	source	reviewed
🧱 Architecture	How the Coder control plane, its private postgres, its provisioner and its two traffic planes fit together on the loca operator host.	verified deployment on the loca operator host, 2026-08-19	2026-08-19

🧱 Architecture

The deployed shape in one paragraph: nginx terminates TLS for code.loca.zone and proxies everything to a loopback-published Coder container, which stores all state in a private postgres container and builds workspaces by talking to the host docker socket. No component of this stack is reachable from the network except through the two nginx vhosts.

🧭 Two traffic planes, one vhost

• human plane: browser to dashboard, web terminal and path-based workspace apps, authenticated by the host-scoped coder_session_token cookie
• machine plane: the coder CLI, workspace agents and DERP relay traffic, authenticated by the Coder-Session-Token header over long-lived websockets
• both planes enter through the same code.loca.zone:443 server block, which is exactly why an auth_request gate cannot be applied to only one of them; see operations/auth-model

🗺️ Pages

Need	Page
Diagram, exact container, volume and port wiring	architecture/runtime-topology
Path, port and env var lookup table	reference/config-paths
What is deliberately not enabled	reference/limits
Operational commands	operations/index

📚 Sources

• https://coder.com/docs/admin/networking
• https://coder.com/docs/reference/api/authentication