3478e7b913
Coder ships `coder exp mcp server` and omp is an MCP client, so the two compose with no custom code. The agent stays on the host where its credentials already live and reaches into the workspace, rather than shipping secrets into a container. - scripts/coder-mcp.sh wraps the server, passing a dedicated `omp-mcp` token via `docker exec --env-file` (mode 600 temp file, shredded by an EXIT trap) so the token never appears in argv or ps - allow-list exposes 26 of 32 tools; template mutation is excluded because pushing a template is the one real path from a Coder principal to the host docker socket - scripts/coder-token-rotate.sh handles the 168h token lifetime cap: mint, verify against the API, then revoke the predecessors - .omp/mcp.json registers it project-scoped so 26 tools do not load into every unrelated omp session The docker exec must stay in the foreground: backgrounding it makes bash redirect stdin from /dev/null with job control disabled, and the MCP transport dies on EOF with "MCP tool load failed ... Transport closed". Verified: fresh omp session in this directory answered from the tools - coder_get_authenticated_user returned loca, workspace ws1 running.
2.1 KiB
2.1 KiB
title, description, source, reviewed
| title | description | source | reviewed |
|---|---|---|---|
| 🛠️ Operations | Operational entry point for the Coder stack: bring-up and upgrade, the auth model, workspace and template work, and the verification checklist. | verified deployment on the loca operator host, 2026-08-19 | 2026-08-19 |
🛠️ Operations
Every command on these pages runs from /home/loca/dev/coder and every docker invocation needs sudo -n, because loca is deliberately not a member of the docker group.
🧭 Pick a page
| Situation | Page |
|---|---|
| Stack is down, needs starting, or a new image tag is out | operations/install-upgrade |
| Someone asks why this host is not behind Authelia, or how the Owner account was bootstrapped | operations/auth-model |
| A template needs writing or pushing, a workspace app must be reached, or the omp harness should drive workspaces over MCP | operations/workspaces |
| Proving the deployment is healthy after any change | operations/verification |
| Looking up a path, container, volume, port or env var | reference/config-paths |
| Explaining a missing feature | reference/limits |
⚡ Five commands that cover most days
cd /home/loca/dev/coder && sudo -n docker compose pssudo -n docker compose logs -f codercurl -sf http://127.0.0.1:52226/healthzcurl -sf http://127.0.0.1:52226/api/v2/buildinfofree -mbefore and after anything that builds a workspace
🚨 Order of debugging when the dashboard is unreachable
- prove the container is up:
sudo -n docker compose psshowscoderrunning andcoder-databasehealthy - prove the server itself:
curl -sf http://127.0.0.1:52226/healthzreturnsOK - prove the proxy:
sudo -n nginx -t, thencurl -sSI https://code.loca.zone/ - a
302toauth.loca.zonefrom this vhost means an Authelia rule was added by mistake; remove it, see operations/auth-model - a
502with a healthy loopback means nginx lost the upstream; check the publish spec is still127.0.0.1:52226:7080