diff --git a/docs/admin/external-auth.md b/docs/admin/external-auth.md index afd370ab0f068..bbb479ecf2d00 100644 --- a/docs/admin/external-auth.md +++ b/docs/admin/external-auth.md @@ -168,8 +168,7 @@ CODER_EXTERNAL_AUTH_0_REGEX=github\.company\.org ## JFrog Artifactory -See [this](../admin/integrations/jfrog-artifactory.md) guide on instructions on -how to set up for JFrog Artifactory. +Visit the [JFrog Artifactory](../admin/integrations/jfrog-artifactory.md) guide for instructions on how to set up for JFrog Artifactory. ## Custom scopes @@ -190,6 +189,16 @@ Multiple providers is an Enterprise and Premium feature. Below is an example configuration with multiple providers: +
+ +**Note:** To support regex matching for paths like `github\.com/org`, add the following `git config` line to the [Coder agent startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script): + +```shell +git config --global credential.useHttpPath true +``` + ++ ```env # Provider 1) github.com CODER_EXTERNAL_AUTH_0_ID=primary-github @@ -208,11 +217,3 @@ CODER_EXTERNAL_AUTH_1_AUTH_URL="https://github.example.com/login/oauth/authorize CODER_EXTERNAL_AUTH_1_TOKEN_URL="https://github.example.com/login/oauth/access_token" CODER_EXTERNAL_AUTH_1_VALIDATE_URL="https://github.example.com/api/v3/user" ``` - -To support regex matching for paths (e.g. `github\.com/org`), you'll need to add -this to the -[Coder agent startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script): - -```shell -git config --global credential.useHttpPath true -``` diff --git a/docs/admin/integrations/island.md b/docs/admin/integrations/island.md index 157385376962a..d5159e9e28868 100644 --- a/docs/admin/integrations/island.md +++ b/docs/admin/integrations/island.md @@ -10,16 +10,15 @@ April 24, 2024 --- -[Island](https://www.island.io/) is an enterprise-grade browser, offering a -Chromium-based experience similar to popular web browsers like Chrome and Edge. -It includes built-in security features for corporate applications and data, -aiming to bridge the gap between consumer-focused browsers and the security -needs of the enterprise. +[Island](https://www.island.io/) is an enterprise-grade browser, offering a Chromium-based experience +similar to popular web browsers like Chrome and Edge. It includes built-in +security features for corporate applications and data, aiming to bridge the gap +between consumer-focused browsers and the security needs of the enterprise. -Coder natively integrates with Island's feature set, which include data loss -protection (DLP), application awareness, browser session recording, and single -sign-on (SSO). This guide intends to document these feature categories and how -they apply to your Coder deployment. +Coder natively integrates with Island's feature set, which include data +loss protection (DLP), application awareness, browser session recording, and +single sign-on (SSO). This guide intends to document these feature categories +and how they apply to your Coder deployment. ## General Configuration @@ -33,90 +32,85 @@ creating browser policies. ## Advanced Data Loss Protection -Integrate Island's advanced data loss prevention (DLP) capabilities with Coder's -cloud development environment (CDE), enabling you to control the “last mile” -between developers’ CDE and their local devices, ensuring that sensitive IP -remains in your centralized environment. +Integrate Island's advanced data loss prevention (DLP) capabilities with +Coder's cloud development environment (CDE), enabling you to control the +"last mile" between developers' CDE and their local devices, +ensuring that sensitive IP remains in your centralized environment. ### Block cut, copy, paste, printing, screen share -1. [Create a Data Sandbox Profile](https://documentation.island.io/docs/create-and-configure-a-data-sandbox-profile) +1. [Create a Data Sandbox Profile](https://documentation.island.io/docs/create-and-configure-a-data-sandbox-profile). 1. Configure the following actions to allow/block (based on your security - requirements): + requirements). -- Screenshot and Screen Share -- Printing -- Save Page -- Clipboard Limitations + - Screenshot and Screen Share + - Printing + - Save Page + - Clipboard Limitations -1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) - to apply the Data Sandbox Profile +1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) to apply the Data Sandbox Profile. -1. Define the Coder Application group as the Destination Object +1. Define the Coder Application group as the Destination Object. 1. Define the Data Sandbox Profile as the Action in the Last Mile Protection - section + section. ### Conditionally allow copy on Coder's CLI authentication page -1. [Create a URL Object](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) - with the following configuration: +1. [Create a URL Object](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) with the following configuration. -- **Include** -- **URL type**: Wildcard -- **URL address**: `coder.example.com/cli-auth` -- **Casing**: Insensitive + - **Include** + - **URL type**: Wildcard + - **URL address**: `coder.example.com/cli-auth` + - **Casing**: Insensitive -1. [Create a Data Sandbox Profile](https://documentation.island.io/docs/create-and-configure-a-data-sandbox-profile) +1. [Create a Data Sandbox Profile](https://documentation.island.io/docs/create-and-configure-a-data-sandbox-profile). -1. Configure action to allow copy/paste +1. Configure action to allow copy/paste. -1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) - to apply the Data Sandbox Profile +1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) to apply the Data Sandbox Profile. -1. Define the URL Object you created as the Destination Object +1. Define the URL Object you created as the Destination Object. 1. Define the Data Sandbox Profile as the Action in the Last Mile Protection - section + section. ### Prevent file upload/download from the browser -1. Create a Protection Profiles for both upload/download +1. Create a Protection Profiles for both upload/download. -- [Upload documentation](https://documentation.island.io/docs/create-and-configure-an-upload-protection-profile) -- [Download documentation](https://documentation.island.io/v1/docs/en/create-and-configure-a-download-protection-profile) + - [Upload documentation](https://documentation.island.io/docs/create-and-configure-an-upload-protection-profile) + - [Download documentation](https://documentation.island.io/v1/docs/en/create-and-configure-a-download-protection-profile) -1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) - to apply the Protection Profiles +1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) to apply the Protection Profiles. -1. Define the Coder Application group as the Destination Object +1. Define the Coder Application group as the Destination Object. 1. Define the applicable Protection Profile as the Action in the Data Protection - section + section. ### Scan files for sensitive data -1. [Create a Data Loss Prevention scanner](https://documentation.island.io/docs/create-a-data-loss-prevention-scanner) +1. [Create a Data Loss Prevention scanner](https://documentation.island.io/docs/create-a-data-loss-prevention-scanner). -1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) - to apply the DLP Scanner +1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) to apply the DLP Scanner. -1. Define the Coder Application group as the Destination Object +1. Define the Coder Application group as the Destination Object. -1. Define the DLP Scanner as the Action in the Data Protection section +1. Define the DLP Scanner as the Action in the Data Protection section. ## Application Awareness and Boundaries Ensure that Coder is only accessed through the Island browser, guaranteeing that -your browser-level DLP policies are always enforced, and developers can’t +your browser-level DLP policies are always enforced, and developers can't sidestep such policies simply by using another browser. ### Configure browser enforcement, conditional access policies -1. Create a conditional access policy for your configured identity provider. +Create a conditional access policy for your configured identity provider. -> Note: the configured IdP must be the same for both Coder and Island +Note that the configured IdP must be the same for both Coder and Island. - [Azure Active Directory/Entra ID](https://documentation.island.io/docs/configure-browser-enforcement-for-island-with-azure-ad#create-and-apply-a-conditional-access-policy) - [Okta](https://documentation.island.io/docs/configure-browser-enforcement-for-island-with-okta) @@ -129,35 +123,34 @@ screenshots, mouse clicks, and keystrokes. ### Activity Logging Module -1. [Create an Activity Logging Profile](https://documentation.island.io/docs/create-and-configure-an-activity-logging-profile) +1. [Create an Activity Logging Profile](https://documentation.island.io/docs/create-and-configure-an-activity-logging-profile). Supported browser + events include: -Supported browser events include: + - Web Navigation + - File Download + - File Upload + - Clipboard/Drag & Drop + - Print + - Save As + - Screenshots + - Mouse Clicks + - Keystrokes -- Web Navigation -- File Download -- File Upload -- Clipboard/Drag & Drop -- Print -- Save As -- Screenshots -- Mouse Clicks -- Keystrokes +1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) to apply the Activity Logging Profile. -1. [Create a Policy Rule](https://documentation.island.io/docs/create-and-configure-a-policy-rule-general) - to apply the Activity Logging Profile - -1. Define the Coder Application group as the Destination Object +1. Define the Coder Application group as the Destination Object. 1. Define the Activity Logging Profile as the Action in the Security & - Visibility section + Visibility section. ## Identity-aware logins (SSO) -Integrate Island's identity management system with Coder's authentication -mechanisms to enable identity-aware logins. +Integrate Island's identity management system with Coder's +authentication mechanisms to enable identity-aware logins. ### Configure single sign-on (SSO) seamless authentication between Coder and Island Configure the same identity provider (IdP) for both your Island and Coder -deployment. Upon initial login to the Island browser, the user's session token -will automatically be passed to Coder and authenticate their Coder session. +deployment. Upon initial login to the Island browser, the user's session +token will automatically be passed to Coder and authenticate their Coder +session. diff --git a/docs/admin/integrations/jfrog-artifactory.md b/docs/admin/integrations/jfrog-artifactory.md index 74200cf597f0b..afc94d6158b94 100644 --- a/docs/admin/integrations/jfrog-artifactory.md +++ b/docs/admin/integrations/jfrog-artifactory.md @@ -36,14 +36,11 @@ two type of modules that automate the JFrog Artifactory and Coder integration. ### JFrog-OAuth This module is usable by JFrog self-hosted (on-premises) Artifactory as it -requires configuring a custom integration. This integration benefits from -Coder's [external-auth](../../admin/external-auth.md) feature and allows each -user to authenticate with Artifactory using an OAuth flow and issues user-scoped -tokens to each user. +requires configuring a custom integration. This integration benefits from Coder's [external-auth](../../admin/external-auth.md) feature allows each user to authenticate with Artifactory using an OAuth flow and issues user-scoped tokens to each user. To set this up, follow these steps: -1. Modify your Helm chart `values.yaml` for JFrog Artifactory to add, +1. Add the following to your Helm chart `values.yaml` for JFrog Artifactory. Replace `CODER_URL` with your JFrog Artifactory base URL: ```yaml artifactory: @@ -62,17 +59,12 @@ To set this up, follow these steps: scope: "applied-permissions/user" ``` - > Note Replace `CODER_URL` with your Coder deployment URL, e.g., - >
+ The admin-level access token is used to provision user tokens and is never exposed to developers or stored in workspaces. +-If you do not want to use the official modules, you can check example template -that uses Docker as the underlying compute -[here](https://github.com/coder/coder/tree/main/examples/jfrog/docker). The same -concepts apply to all compute types. +If you don't want to use the official modules, you can read through the [example template](https://github.com/coder/coder/tree/main/examples/jfrog/docker), which uses Docker as the underlying compute. The +same concepts apply to all compute types. ## Offline Deployments -See the -[offline deployments](../templates/extending-templates/modules.md#offline-installations) -section for instructions on how to use coder-modules in an offline environment -with Artifactory. +See the [offline deployments](../templates/extending-templates/modules.md#offline-installations) section for instructions on how to use Coder modules in an offline environment with Artifactory. + +## Next Steps -## More reading +- See the [full example Docker template](https://github.com/coder/coder/tree/main/examples/jfrog/docker). -- See the full example template - [here](https://github.com/coder/coder/tree/main/examples/jfrog/docker). - To serve extensions from your own VS Code Marketplace, check out [code-marketplace](https://github.com/coder/code-marketplace#artifactory-storage). diff --git a/docs/admin/integrations/jfrog-xray.md b/docs/admin/integrations/jfrog-xray.md index 3f4fcebcba681..bb1b9db106611 100644 --- a/docs/admin/integrations/jfrog-xray.md +++ b/docs/admin/integrations/jfrog-xray.md @@ -11,61 +11,63 @@ March 17, 2024 --- -This guide will walk you through the process of adding -[JFrog Xray](https://jfrog.com/xray/) integration to Coder Kubernetes workspaces -using Coder's [JFrog Xray Integration](https://github.com/coder/coder-xray). +This guide describes the process of integrating [JFrog Xray](https://jfrog.com/xray/) to Coder Kubernetes-backed +workspaces using Coder's [JFrog Xray Integration](https://github.com/coder/coder-xray). ## Prerequisites - A self-hosted JFrog Platform instance. - Kubernetes workspaces running on Coder. -## Deploying the Coder - JFrog Xray Integration +## Deploy the **Coder - JFrog Xray** Integration -1. Create a JFrog Platform - [Access Token](https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-tokens) - with a user that has the read - [permission](https://jfrog.com/help/r/jfrog-platform-administration-documentation/permissions) +1. Create a JFrog Platform [Access Token](https://jfrog.com/help/r/jfrog-platform-administration-documentation/access-tokens) with a user that has the `read` [permission](https://jfrog.com/help/r/jfrog-platform-administration-documentation/permissions) for the repositories you want to scan. -1. Create a Coder [token](../../reference/cli/tokens_create.md#tokens-create) - with a user that has the [`owner`](../users/index.md#roles) role. + +1. Create a Coder [token](../../reference/cli/tokens_create.md#tokens-create) with a user that has the [`owner`](../users#roles) role. + 1. Create Kubernetes secrets for the JFrog Xray and Coder tokens. ```bash - kubectl create secret generic coder-token --from-literal=coder-token='
+ + To authenticate with the Artifactory registry, you may need to + create a [Docker config](https://jfrog.com/help/r/jfrog-artifactory-documentation/docker-advanced-topics) and use it in the + `imagePullSecrets` field of the Kubernetes Pod. See the [Defining ImagePullSecrets for Coder workspaces](../../tutorials/image-pull-secret.md) guide for more + information. -[`coder-xray`](https://github.com/coder/coder-xray) will scan all kubernetes -workspaces in the specified namespace. It depends on the `image` available in -Artifactory and indexed by Xray. To ensure that the images are available in -Artifactory, update the Coder template to use the Artifactory registry. +-```tf -image = "
+ +You can enable +[detailed database metrics](../../reference/cli/server.md#--prometheus-collect-db-metrics) +in Coder's Prometheus endpoint. If you have +[tracing enabled](../../reference/cli/server.md#--trace), these traces may also +contain useful information regarding Coder's database activity. + +## DERP @@ -149,8 +150,12 @@ This is not necessarily a fatal error, but a possible indication of a misconfigured reverse HTTP proxy. Additionally, while workspace users should still be able to reach their workspaces, connection performance may be degraded. -> **Note:** This may also be shown if you have -> [forced websocket connections for DERP](../../reference/cli/server.md#--derp-force-websockets). +
+ +**Note:** This may also be shown if you have +[forced websocket connections for DERP](../../reference/cli/server.md#--derp-force-websockets). + +**Solution:** ensure that any proxies you use allow connection upgrade with the `Upgrade: derp` header. @@ -300,8 +305,12 @@ that they are able to successfully connect to Coder. Otherwise, ensure [`--provisioner-daemons`](../../reference/cli/server.md#--provisioner-daemons) is set to a value greater than 0. -> Note: This may be a transient issue if you are currently in the process of -> updating your deployment. +
+ +**Note:** This may be a transient issue if you are currently in the process of +updating your deployment. + +### EPD02 @@ -315,8 +324,12 @@ of API incompatibility. **Solution:** Update the provisioner daemon to match the currently running version of Coder. -> Note: This may be a transient issue if you are currently in the process of -> updating your deployment. +
+ +**Note:** This may be a transient issue if you are currently in the process of +updating your deployment. + +### EPD03 @@ -330,8 +343,12 @@ connect to Coder. **Solution:** Update the provisioner daemon to match the currently running version of Coder. -> Note: This may be a transient issue if you are currently in the process of -> updating your deployment. +
+ +**Note:** This may be a transient issue if you are currently in the process of +updating your deployment. + +### EUNKNOWN diff --git a/docs/contributing/frontend.md b/docs/contributing/frontend.md index ea1a80aac639d..fd9d7ff0a64fe 100644 --- a/docs/contributing/frontend.md +++ b/docs/contributing/frontend.md @@ -23,14 +23,16 @@ You can run the UI and access the Coder dashboard in two ways: In both cases, you can access the dashboard on `http://localhost:8080`. If using `./scripts/develop.sh` you can log in with the default credentials. -> [!TIP] -> -> **Default Credentials:** `admin@coder.com` and `SomeSecurePassword!`. +
+ +**Default Credentials:** `admin@coder.com` and `SomeSecurePassword!`. + +## Tech Stack Overview -All our dependencies are described in `site/package.json` but the following are -the most important: +All our dependencies are described in `site/package.json`, but the following are +the most important. - [React](https://reactjs.org/) for the UI framework - [Typescript](https://www.typescriptlang.org/) to keep our sanity
Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.
Alternative Proxies: