AWS EC2 (Devcontainer)

1terraform {
2  required_providers {
3    coder = {
4      source = "coder/coder"
5    }
6    aws = {
7      source = "hashicorp/aws"
8    }
9    cloudinit = {
10      source = "hashicorp/cloudinit"
11    }
12    envbuilder = {
13      source = "coder/envbuilder"
14    }
15  }
16}
17
18module "aws_region" {
19  source  = "https://registry.coder.com/modules/aws-region"
20  default = "us-east-1"
21}
22
23provider "aws" {
24  region = module.aws_region.value
25}
26
27variable "cache_repo" {
28  default     = ""
29  description = "(Optional) Use a container registry as a cache to speed up builds. Example: host.tld/path/to/repo."
30  type        = string
31}
32
33variable "cache_repo_docker_config_path" {
34  default     = ""
35  description = "(Optional) Path to a docker config.json containing credentials to the provided cache repo, if required. This will depend on your Coder setup. Example: `/home/coder/.docker/config.json`."
36  sensitive   = true
37  type        = string
38}
39
40variable "iam_instance_profile" {
41  default     = ""
42  description = "(Optional) Name of an IAM instance profile to assign to the instance."
43  type        = string
44}
45
46data "coder_workspace" "me" {}
47data "coder_workspace_owner" "me" {}
48
49data "aws_ami" "ubuntu" {
50  most_recent = true
51  filter {
52    name   = "name"
53    values = ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"]
54  }
55  filter {
56    name   = "virtualization-type"
57    values = ["hvm"]
58  }
59  owners = ["099720109477"] # Canonical
60}
61
62data "coder_parameter" "instance_type" {
63  name         = "instance_type"
64  display_name = "Instance type"
65  description  = "What instance type should your workspace use?"
66  default      = "t3.micro"
67  mutable      = false
68  option {
69    name  = "2 vCPU, 1 GiB RAM"
70    value = "t3.micro"
71  }
72  option {
73    name  = "2 vCPU, 2 GiB RAM"
74    value = "t3.small"
75  }
76  option {
77    name  = "2 vCPU, 4 GiB RAM"
78    value = "t3.medium"
79  }
80  option {
81    name  = "2 vCPU, 8 GiB RAM"
82    value = "t3.large"
83  }
84  option {
85    name  = "4 vCPU, 16 GiB RAM"
86    value = "t3.xlarge"
87  }
88  option {
89    name  = "8 vCPU, 32 GiB RAM"
90    value = "t3.2xlarge"
91  }
92}
93
94data "coder_parameter" "root_volume_size_gb" {
95  name         = "root_volume_size_gb"
96  display_name = "Root Volume Size (GB)"
97  description  = "How large should the root volume for the instance be?"
98  default      = 30
99  type         = "number"
100  mutable      = true
101  validation {
102    min       = 1
103    monotonic = "increasing"
104  }
105}
106
107data "coder_parameter" "fallback_image" {
108  default      = "codercom/enterprise-base:ubuntu"
109  description  = "This image runs if the devcontainer fails to build."
110  display_name = "Fallback Image"
111  mutable      = true
112  name         = "fallback_image"
113  order        = 3
114}
115
116data "coder_parameter" "devcontainer_builder" {
117  description  = <<-EOF
118Image that will build the devcontainer.
119Find the latest version of Envbuilder here: https://ghcr.io/coder/envbuilder
120Be aware that using the `:latest` tag may expose you to breaking changes.
121EOF
122  display_name = "Devcontainer Builder"
123  mutable      = true
124  name         = "devcontainer_builder"
125  default      = "ghcr.io/coder/envbuilder:latest"
126  order        = 4
127}
128
129data "coder_parameter" "repo_url" {
130  name         = "repo_url"
131  display_name = "Repository URL"
132  default      = "https://github.com/coder/envbuilder-starter-devcontainer"
133  description  = "Repository URL"
134  mutable      = true
135}
136
137data "coder_parameter" "ssh_pubkey" {
138  name         = "ssh_pubkey"
139  display_name = "SSH Public Key"
140  default      = ""
141  description  = "(Optional) Add an SSH public key to the `coder` user's authorized_keys. Useful for troubleshooting. You may need to add a security group to the instance."
142  mutable      = false
143}
144
145data "local_sensitive_file" "cache_repo_dockerconfigjson" {
146  count    = var.cache_repo_docker_config_path == "" ? 0 : 1
147  filename = var.cache_repo_docker_config_path
148}
149
150data "aws_iam_instance_profile" "vm_instance_profile" {
151  count = var.iam_instance_profile == "" ? 0 : 1
152  name  = var.iam_instance_profile
153}
154
155# Be careful when modifying the below locals!
156locals {
157  # TODO: provide a way to pick the availability zone.
158  aws_availability_zone = "${module.aws_region.value}a"
159
160  hostname   = lower(data.coder_workspace.me.name)
161  linux_user = "coder"
162
163  # The devcontainer builder image is the image that will build the devcontainer.
164  devcontainer_builder_image = data.coder_parameter.devcontainer_builder.value
165
166  # We may need to authenticate with a registry. If so, the user will provide a path to a docker config.json.
167  docker_config_json_base64 = try(data.local_sensitive_file.cache_repo_dockerconfigjson[0].content_base64, "")
168
169  # The envbuilder provider requires a key-value map of environment variables. Build this here.
170  envbuilder_env = {
171    # ENVBUILDER_GIT_URL and ENVBUILDER_CACHE_REPO will be overridden by the provider
172    # if the cache repo is enabled.
173    "ENVBUILDER_GIT_URL" : data.coder_parameter.repo_url.value,
174    # The agent token is required for the agent to connect to the Coder platform.
175    "CODER_AGENT_TOKEN" : try(coder_agent.dev.0.token, ""),
176    # The agent URL is required for the agent to connect to the Coder platform.
177    "CODER_AGENT_URL" : data.coder_workspace.me.access_url,
178    # The agent init script is required for the agent to start up. We base64 encode it here
179    # to avoid quoting issues.
180    "ENVBUILDER_INIT_SCRIPT" : "echo ${base64encode(try(coder_agent.dev[0].init_script, ""))} | base64 -d | sh",
181    "ENVBUILDER_DOCKER_CONFIG_BASE64" : local.docker_config_json_base64,
182    # The fallback image is the image that will run if the devcontainer fails to build.
183    "ENVBUILDER_FALLBACK_IMAGE" : data.coder_parameter.fallback_image.value,
184    # The following are used to push the image to the cache repo, if defined.
185    "ENVBUILDER_CACHE_REPO" : var.cache_repo,
186    "ENVBUILDER_PUSH_IMAGE" : var.cache_repo == "" ? "" : "true",
187    # You can add other required environment variables here.
188    # See: https://github.com/coder/envbuilder/?tab=readme-ov-file#environment-variables
189  }
190}
191
192# Check for the presence of a prebuilt image in the cache repo
193# that we can use instead.
194resource "envbuilder_cached_image" "cached" {
195  count         = var.cache_repo == "" ? 0 : data.coder_workspace.me.start_count
196  builder_image = local.devcontainer_builder_image
197  git_url       = data.coder_parameter.repo_url.value
198  cache_repo    = var.cache_repo
199  extra_env     = local.envbuilder_env
200}
201
202data "cloudinit_config" "user_data" {
203  gzip          = false
204  base64_encode = false
205
206  boundary = "//"
207
208  part {
209    filename     = "cloud-config.yaml"
210    content_type = "text/cloud-config"
211
212    content = templatefile("${path.module}/cloud-init/cloud-config.yaml.tftpl", {
213      hostname   = local.hostname
214      linux_user = local.linux_user
215
216      ssh_pubkey = data.coder_parameter.ssh_pubkey.value
217    })
218  }
219
220  part {
221    filename     = "userdata.sh"
222    content_type = "text/x-shellscript"
223
224    content = templatefile("${path.module}/cloud-init/userdata.sh.tftpl", {
225      hostname   = local.hostname
226      linux_user = local.linux_user
227
228      # If we have a cached image, use the cached image's environment variables.
229      # Otherwise, just use the environment variables we've defined in locals.
230      environment = try(envbuilder_cached_image.cached[0].env_map, local.envbuilder_env)
231
232      # Builder image will either be the builder image parameter, or the cached image, if cache is provided.
233      builder_image = try(envbuilder_cached_image.cached[0].image, data.coder_parameter.devcontainer_builder.value)
234
235      docker_config_json_base64 = local.docker_config_json_base64
236    })
237  }
238}
239
240# This is useful for debugging the startup script. Left here for reference.
241# resource local_file "startup_script" {
242#   content  = data.cloudinit_config.user_data.rendered
243#   filename = "${path.module}/user_data.txt"
244# }
245
246resource "aws_instance" "vm" {
247  ami                  = data.aws_ami.ubuntu.id
248  availability_zone    = local.aws_availability_zone
249  instance_type        = data.coder_parameter.instance_type.value
250  iam_instance_profile = try(data.aws_iam_instance_profile.vm_instance_profile[0].name, null)
251  root_block_device {
252    volume_size = data.coder_parameter.root_volume_size_gb.value
253  }
254
255  user_data = data.cloudinit_config.user_data.rendered
256  tags = {
257    Name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
258    # Required if you are using our example policy, see template README
259    Coder_Provisioned = "true"
260  }
261  lifecycle {
262    ignore_changes = [ami]
263  }
264}
265
266resource "aws_ec2_instance_state" "vm" {
267  instance_id = aws_instance.vm.id
268  state       = data.coder_workspace.me.transition == "start" ? "running" : "stopped"
269}
270
271resource "coder_agent" "dev" {
272  count              = data.coder_workspace.me.start_count
273  arch               = "amd64"
274  auth               = "token"
275  os                 = "linux"
276  dir                = "/workspaces/${trimsuffix(basename(data.coder_parameter.repo_url.value), ".git")}"
277  connection_timeout = 0
278
279  metadata {
280    key          = "cpu"
281    display_name = "CPU Usage"
282    interval     = 5
283    timeout      = 5
284    script       = "coder stat cpu"
285  }
286  metadata {
287    key          = "memory"
288    display_name = "Memory Usage"
289    interval     = 5
290    timeout      = 5
291    script       = "coder stat mem"
292  }
293}
294
295resource "coder_metadata" "info" {
296  count       = data.coder_workspace.me.start_count
297  resource_id = coder_agent.dev[0].id
298  item {
299    key   = "ami"
300    value = aws_instance.vm.ami
301  }
302  item {
303    key   = "availability_zone"
304    value = local.aws_availability_zone
305  }
306  item {
307    key   = "instance_type"
308    value = data.coder_parameter.instance_type.value
309  }
310  item {
311    key   = "ssh_pubkey"
312    value = data.coder_parameter.ssh_pubkey.value
313  }
314  item {
315    key   = "repo_url"
316    value = data.coder_parameter.repo_url.value
317  }
318  item {
319    key   = "devcontainer_builder"
320    value = data.coder_parameter.devcontainer_builder.value
321  }
322}
323
324module "code-server" {
325  count    = data.coder_workspace.me.start_count
326  source   = "registry.coder.com/modules/code-server/coder"
327  version  = "1.0.18"
328  agent_id = coder_agent.dev[0].id
329}
330