Copy and paste the following into main.tf
and run coder template push
:
1terraform {
2 required_providers {
3 coder = {
4 source = "coder/coder"
5 }
6 google = {
7 source = "hashicorp/google"
8 }
9 envbuilder = {
10 source = "coder/envbuilder"
11 }
12 }
13}
14
15provider "coder" {}
16
17provider "google" {
18 zone = data.coder_parameter.zone.value
19 project = var.project_id
20}
21
22data "google_compute_default_service_account" "default" {}
23
24data "coder_workspace" "me" {}
25data "coder_workspace_owner" "me" {}
26
27variable "project_id" {
28 description = "Which Google Compute Project should your workspace live in?"
29}
30
31variable "cache_repo" {
32 default = ""
33 description = "(Optional) Use a container registry as a cache to speed up builds. Example: host.tld/path/to/repo."
34 type = string
35}
36
37variable "cache_repo_docker_config_path" {
38 default = ""
39 description = "(Optional) Path to a docker config.json containing credentials to the provided cache repo, if required. This will depend on your Coder setup. Example: `/home/coder/.docker/config.json`."
40 sensitive = true
41 type = string
42}
43
44data "coder_parameter" "zone" {
45 name = "zone"
46 display_name = "Zone"
47 description = "Which zone should your workspace live in?"
48 type = "string"
49 icon = "/emojis/1f30e.png"
50 default = "us-central1-a"
51 mutable = false
52 order = 1
53 option {
54 name = "North America (Northeast)"
55 value = "northamerica-northeast1-a"
56 icon = "/emojis/1f1fa-1f1f8.png"
57 }
58 option {
59 name = "North America (Central)"
60 value = "us-central1-a"
61 icon = "/emojis/1f1fa-1f1f8.png"
62 }
63 option {
64 name = "North America (West)"
65 value = "us-west2-c"
66 icon = "/emojis/1f1fa-1f1f8.png"
67 }
68 option {
69 name = "Europe (West)"
70 value = "europe-west4-b"
71 icon = "/emojis/1f1ea-1f1fa.png"
72 }
73 option {
74 name = "South America (East)"
75 value = "southamerica-east1-a"
76 icon = "/emojis/1f1e7-1f1f7.png"
77 }
78}
79
80data "coder_parameter" "instance_type" {
81 name = "instance_type"
82 display_name = "Instance Type"
83 description = "Select an instance type for your workspace."
84 type = "string"
85 mutable = false
86 order = 2
87 default = "e2-micro"
88 option {
89 name = "e2-micro (2C, 1G)"
90 value = "e2-micro"
91 }
92 option {
93 name = "e2-small (2C, 2G)"
94 value = "e2-small"
95 }
96 option {
97 name = "e2-medium (2C, 2G)"
98 value = "e2-medium"
99 }
100}
101
102data "coder_parameter" "fallback_image" {
103 default = "codercom/enterprise-base:ubuntu"
104 description = "This image runs if the devcontainer fails to build."
105 display_name = "Fallback Image"
106 mutable = true
107 name = "fallback_image"
108 order = 3
109}
110
111data "coder_parameter" "devcontainer_builder" {
112 description = <<-EOF
113Image that will build the devcontainer.
114Find the latest version of Envbuilder here: https://ghcr.io/coder/envbuilder
115Be aware that using the `:latest` tag may expose you to breaking changes.
116EOF
117 display_name = "Devcontainer Builder"
118 mutable = true
119 name = "devcontainer_builder"
120 default = "ghcr.io/coder/envbuilder:latest"
121 order = 4
122}
123
124data "coder_parameter" "repo_url" {
125 name = "repo_url"
126 display_name = "Repository URL"
127 default = "https://github.com/coder/envbuilder-starter-devcontainer"
128 description = "Repository URL"
129 mutable = true
130}
131
132data "local_sensitive_file" "cache_repo_dockerconfigjson" {
133 count = var.cache_repo_docker_config_path == "" ? 0 : 1
134 filename = var.cache_repo_docker_config_path
135}
136
137# Be careful when modifying the below locals!
138locals {
139 # Ensure Coder username is a valid Linux username
140 linux_user = lower(substr(data.coder_workspace_owner.me.name, 0, 32))
141 # Name the container after the workspace and owner.
142 container_name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
143 # The devcontainer builder image is the image that will build the devcontainer.
144 devcontainer_builder_image = data.coder_parameter.devcontainer_builder.value
145 # We may need to authenticate with a registry. If so, the user will provide a path to a docker config.json.
146 docker_config_json_base64 = try(data.local_sensitive_file.cache_repo_dockerconfigjson[0].content_base64, "")
147 # The envbuilder provider requires a key-value map of environment variables. Build this here.
148 envbuilder_env = {
149 # ENVBUILDER_GIT_URL and ENVBUILDER_CACHE_REPO will be overridden by the provider
150 # if the cache repo is enabled.
151 "ENVBUILDER_GIT_URL" : data.coder_parameter.repo_url.value,
152 # The agent token is required for the agent to connect to the Coder platform.
153 "CODER_AGENT_TOKEN" : try(coder_agent.dev.0.token, ""),
154 # The agent URL is required for the agent to connect to the Coder platform.
155 "CODER_AGENT_URL" : data.coder_workspace.me.access_url,
156 # The agent init script is required for the agent to start up. We base64 encode it here
157 # to avoid quoting issues.
158 "ENVBUILDER_INIT_SCRIPT" : "echo ${base64encode(try(coder_agent.dev[0].init_script, ""))} | base64 -d | sh",
159 "ENVBUILDER_DOCKER_CONFIG_BASE64" : try(data.local_sensitive_file.cache_repo_dockerconfigjson[0].content_base64, ""),
160 # The fallback image is the image that will run if the devcontainer fails to build.
161 "ENVBUILDER_FALLBACK_IMAGE" : data.coder_parameter.fallback_image.value,
162 # The following are used to push the image to the cache repo, if defined.
163 "ENVBUILDER_CACHE_REPO" : var.cache_repo,
164 "ENVBUILDER_PUSH_IMAGE" : var.cache_repo == "" ? "" : "true",
165 # You can add other required environment variables here.
166 # See: https://github.com/coder/envbuilder/?tab=readme-ov-file#environment-variables
167 }
168 # If we have a cached image, use the cached image's environment variables. Otherwise, just use
169 # the environment variables we've defined above.
170 docker_env_input = try(envbuilder_cached_image.cached.0.env_map, local.envbuilder_env)
171 # Convert the above to the list of arguments for the Docker run command.
172 # The startup script will write this to a file, which the Docker run command will reference.
173 docker_env_list_base64 = base64encode(join("\n", [for k, v in local.docker_env_input : "${k}=${v}"]))
174
175 # Builder image will either be the builder image parameter, or the cached image, if cache is provided.
176 builder_image = try(envbuilder_cached_image.cached[0].image, data.coder_parameter.devcontainer_builder.value)
177
178 # The GCP VM needs a startup script to set up the environment and start the container. Defining this here.
179 # NOTE: make sure to test changes by uncommenting the local_file resource at the bottom of this file
180 # and running `terraform apply` to see the generated script. You should also run shellcheck on the script
181 # to ensure it is valid.
182 startup_script = <<-META
183 #!/usr/bin/env sh
184 set -eux
185
186 # If user does not exist, create it and set up passwordless sudo
187 if ! id -u "${local.linux_user}" >/dev/null 2>&1; then
188 useradd -m -s /bin/bash "${local.linux_user}"
189 echo "${local.linux_user} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder-user
190 fi
191
192 # Check for Docker, install if not present
193 if ! command -v docker >/dev/null 2>&1; then
194 echo "Docker not found, installing..."
195 curl -fsSL https://get.docker.com -o get-docker.sh && sudo sh get-docker.sh >/dev/null 2>&1
196 sudo usermod -aG docker ${local.linux_user}
197 newgrp docker
198 else
199 echo "Docker is already installed."
200 fi
201
202 # Write the Docker config JSON to disk if it is provided.
203 if [ -n "${local.docker_config_json_base64}" ]; then
204 mkdir -p "/home/${local.linux_user}/.docker"
205 printf "%s" "${local.docker_config_json_base64}" | base64 -d | tee "/home/${local.linux_user}/.docker/config.json"
206 chown -R ${local.linux_user}:${local.linux_user} "/home/${local.linux_user}/.docker"
207 fi
208
209 # Write the container env to disk.
210 printf "%s" "${local.docker_env_list_base64}" | base64 -d | tee "/home/${local.linux_user}/env.txt"
211
212 # Start envbuilder.
213 docker run \
214 --rm \
215 --net=host \
216 -h ${lower(data.coder_workspace.me.name)} \
217 -v /home/${local.linux_user}/envbuilder:/workspaces \
218 -v /var/run/docker.sock:/var/run/docker.sock \
219 --env-file /home/${local.linux_user}/env.txt \
220 ${local.builder_image}
221 META
222}
223
224# Create a persistent disk to store the workspace data.
225resource "google_compute_disk" "root" {
226 name = "coder-${data.coder_workspace.me.id}-root"
227 type = "pd-ssd"
228 image = "debian-cloud/debian-12"
229 lifecycle {
230 ignore_changes = all
231 }
232}
233
234# Check for the presence of a prebuilt image in the cache repo
235# that we can use instead.
236resource "envbuilder_cached_image" "cached" {
237 count = var.cache_repo == "" ? 0 : data.coder_workspace.me.start_count
238 builder_image = local.devcontainer_builder_image
239 git_url = data.coder_parameter.repo_url.value
240 cache_repo = var.cache_repo
241 extra_env = local.envbuilder_env
242}
243
244# This is useful for debugging the startup script. Left here for reference.
245# resource local_file "startup_script" {
246# content = local.startup_script
247# filename = "${path.module}/startup_script.sh"
248# }
249
250# Create a VM where the workspace will run.
251resource "google_compute_instance" "vm" {
252 name = "coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}-root"
253 machine_type = data.coder_parameter.instance_type.value
254 # data.coder_workspace_owner.me.name == "default" is a workaround to suppress error in the terraform plan phase while creating a new workspace.
255 desired_status = (data.coder_workspace_owner.me.name == "default" || data.coder_workspace.me.start_count == 1) ? "RUNNING" : "TERMINATED"
256
257 network_interface {
258 network = "default"
259 access_config {
260 // Ephemeral public IP
261 }
262 }
263
264 boot_disk {
265 auto_delete = false
266 source = google_compute_disk.root.name
267 }
268
269 service_account {
270 email = data.google_compute_default_service_account.default.email
271 scopes = ["cloud-platform"]
272 }
273
274 metadata = {
275 # The startup script runs as root with no $HOME environment set up, so instead of directly
276 # running the agent init script, create a user (with a homedir, default shell and sudo
277 # permissions) and execute the init script as that user.
278 startup-script = local.startup_script
279 }
280}
281
282# Create a Coder agent to manage the workspace.
283resource "coder_agent" "dev" {
284 count = data.coder_workspace.me.start_count
285 arch = "amd64"
286 auth = "token"
287 os = "linux"
288 dir = "/workspaces/${trimsuffix(basename(data.coder_parameter.repo_url.value), ".git")}"
289 connection_timeout = 0
290
291 metadata {
292 key = "cpu"
293 display_name = "CPU Usage"
294 interval = 5
295 timeout = 5
296 script = "coder stat cpu"
297 }
298 metadata {
299 key = "memory"
300 display_name = "Memory Usage"
301 interval = 5
302 timeout = 5
303 script = "coder stat mem"
304 }
305 metadata {
306 key = "disk"
307 display_name = "Disk Usage"
308 interval = 5
309 timeout = 5
310 script = "coder stat disk"
311 }
312}
313
314# Install code-server via Terraform module.
315module "code-server" {
316 count = data.coder_workspace.me.start_count
317 source = "registry.coder.com/modules/code-server/coder"
318 version = "1.0.18"
319 agent_id = coder_agent.dev[0].id
320}
321
322# Create metadata for the workspace and home disk.
323resource "coder_metadata" "workspace_info" {
324 count = data.coder_workspace.me.start_count
325 resource_id = google_compute_instance.vm.id
326
327 item {
328 key = "type"
329 value = google_compute_instance.vm.machine_type
330 }
331
332 item {
333 key = "zone"
334 value = data.coder_parameter.zone.value
335 }
336}
337
338resource "coder_metadata" "home_info" {
339 resource_id = google_compute_disk.root.id
340
341 item {
342 key = "size"
343 value = "${google_compute_disk.root.size} GiB"
344 }
345}
346