Start a Coder server

coder server [flags]

The URL that users will use to access the Coder deployment.

Specifies the wildcard hostname to use for workspace applications in the form "*.example.com".

Specifies the custom docs URL.

Specifies whether to redirect requests that do not match the access URL host.

HTTP bind address of the server. Unset to disable the HTTP endpoint.

HTTPS bind address of the server.

Whether TLS will be enabled.

Path to each certificate for TLS. It requires a PEM-encoded file. To configure the listener to use a CA certificate, concatenate the primary certificate and the CA certificate together. The primary certificate should appear first in the combined file.

PEM-encoded Certificate Authority file used for checking the authenticity of client.

Policy the server will follow for TLS Client Authentication. Accepted values are "none", "request", "require-any", "verify-if-given", or "require-and-verify".

Paths to the private keys for each of the certificates. It requires a PEM-encoded file.

Minimum supported version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13".

Path to certificate for client TLS authentication. It requires a PEM-encoded file.

Path to key for client TLS authentication. It requires a PEM-encoded file.

Specify specific TLS ciphers that allowed to be used. See https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L53-L75.

By default, only ciphers marked as 'secure' are allowed to be used. See https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L82-L95.

Whether to enable or disable the embedded DERP relay server.

Region name that for the embedded DERP server.

Addresses for STUN servers to establish P2P connections. It's recommended to have at least two STUN servers to give users the best chance of connecting P2P to workspaces. Each STUN server will get it's own DERP region, with region IDs starting at --derp-server-region-id + 1. Use special value 'disable' to turn off STUN completely.

An HTTP URL that is accessible by other replicas to relay DERP traffic. Required for high availability.

Block peer-to-peer (aka. direct) workspace connections. All workspace connections from the CLI will be proxied through Coder (or custom configured DERP servers) and will never be peer-to-peer when enabled. Workspaces may still reach out to STUN servers to get their address until they are restarted after this change has been made, but new connections will still be proxied regardless.

Force clients and agents to always use WebSocket to connect to DERP relay servers. By default, DERP uses Upgrade: derp, which may cause issues with some reverse proxies. Clients may automatically fallback to WebSocket if they detect an issue with Upgrade: derp, but this does not work in all situations.

URL to fetch a DERP mapping on startup. See: https://tailscale.com/kb/1118/custom-derp-servers/.

Path to read a DERP mapping from. See: https://tailscale.com/kb/1118/custom-derp-servers/.

Enable the collection of application and workspace usage along with the associated API endpoints and the template insights page. Disabling this will also disable traffic and connection insights in the deployment stats shown to admins in the bottom bar of the Coder UI, and will prevent Prometheus collection of these values.

Serve prometheus metrics on the address defined by prometheus address.

The bind address to serve prometheus metrics.

Collect agent stats (may increase charges for metrics storage).

When collecting agent stats, aggregate metrics by a given set of comma-separated labels to reduce cardinality. Accepted values are agent_name, template_name, username, workspace_name.

Collect database query metrics (may increase charges for metrics storage). If set to false, a reduced set of database metrics are still collected.

Serve pprof metrics on the address defined by pprof address.

The bind address to serve pprof.

Client ID for Login with GitHub.

Client secret for Login with GitHub.

Enable device flow for Login with GitHub.

Enable the default GitHub OAuth2 provider managed by Coder.

Organizations the user must be a member of to Login with GitHub.

Teams inside organizations the user must be a member of to Login with GitHub. Structured as: <organization-name>/<team-slug>.

Whether new users can sign up with GitHub.

Allow all logins, setting this option means allowed orgs and teams must be empty.

Base URL of a GitHub Enterprise deployment to use for Login with GitHub.

Whether new users can sign up with OIDC.

Client ID to use for Login with OIDC.

Client secret to use for Login with OIDC.

Pem encoded RSA private key to use for oauth2 PKI/JWT authorization. This can be used instead of oidc-client-secret if your IDP supports it.

Pem encoded certificate file to use for oauth2 PKI/JWT authorization. The public certificate that accompanies oidc-client-key-file. A standard x509 certificate is expected.

Email domains that clients logging in with OIDC must match.

Issuer URL to use for Login with OIDC.

Scopes to grant when authenticating with OIDC.

Ignore the email_verified claim from the upstream provider.

OIDC claim field to use as the username.

OIDC claim field to use as the name.

OIDC claim field to use as the email.

OIDC auth URL parameters to pass to the upstream provider.

Ignore the userinfo endpoint and only use the ID token for user information.

This field must be set if using the group sync feature and the scope name is not 'groups'. Set to the claim to be used for groups.

A map of OIDC group IDs and the group in Coder it should map to. This is useful for when OIDC providers only return group IDs.

Automatically creates missing groups from a user's groups claim.

If provided any group name not matching the regex is ignored. This allows for filtering out groups that are not needed. This filter is applied after the group mapping.

If provided any group name not in the list will not be allowed to authenticate. This allows for restricting access to a specific set of groups. This filter is applied after the group mapping and before the regex filter.

This field must be set if using the user roles sync feature. Set this to the name of the claim used to store the user's role. The roles should be sent as an array of strings.

A map of the OIDC passed in user roles and the groups in Coder it should map to. This is useful if the group names do not match. If mapped to the empty string, the role will ignored.

If user role sync is enabled, these roles are always included for all authenticated users. The 'member' role is always assigned.

The text to show on the OpenID Connect sign in button.

URL pointing to the icon to use on the OpenID Connect login button.

The custom text to show on the error page informing about disabled OIDC signups. Markdown format is supported.

OIDC issuer urls must match in the request, the id_token 'iss' claim, and in the well-known configuration. This flag disables that requirement, and can lead to an insecure OIDC configuration. It is not recommended to use this flag.

Optional override of the default redirect url which uses the deployment's access url. Useful in situations where a deployment has more than 1 domain. Using this setting can also break OIDC, so use with caution.

Whether telemetry is enabled or not. Coder collects anonymized usage data to help improve our product.

Whether application tracing data is collected. It exports to a backend configured by environment variables. See: https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md.

Enables trace exporting to Honeycomb.io using the provided API Key.

Enables capturing of logs as events in traces. This is useful for debugging, but may result in a very large amount of events being sent to the tracing backend which may incur significant costs.

Number of provisioner daemons to create on start. If builds are stuck in queued state for a long time, consider increasing this.

Deprecated and ignored.

Deprecated and ignored.

Time to force cancel provisioning tasks that are stuck.

Pre-shared key to authenticate external provisioner daemons to Coder server.

Filter debug logs by matching against a given regex. Use .* to match all debug logs.

Output human-readable logs to a given file.

Output JSON logs to a given file.

Output Stackdriver compatible logs to a given file.

Allow administrators to enable Terraform debug output.

Coder configures a Content Security Policy (CSP) to protect against XSS attacks. This setting allows you to add additional CSP directives, which can open the attack surface of the deployment. Format matches the CSP directive format, e.g. --additional-csp-policy="script-src https://example.com".

Allow workspace apps that are not served from subdomains to be shared. Path-based app sharing is DISABLED by default for security purposes. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.

Allow site-owners to access workspace apps from workspaces they do not own. Owners cannot access path-based apps they do not own by default. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.

Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.

Periodically check for new releases of Coder and inform the owner. The check is performed once per day.

The maximum lifetime duration users can specify when creating an API token.

The maximum lifetime duration administrators can specify when creating an API token.

The default lifetime duration for API tokens. This value is used when creating a token without specifying a duration, such as when authenticating the CLI or an IDE plugin.

The default lifetime duration for OAuth2 refresh tokens. This controls how long refresh tokens remain valid after issuance or rotation.

Expose the swagger endpoint via /swagger.

Headers to trust for forwarding IP addresses. e.g. Cf-Connecting-Ip, True-Client-Ip, X-Forwarded-For.

Origin addresses to respect "proxy-trusted-headers" and X-Forwarded-Host for subdomain app routing. e.g. 192.168.1.0/24.

The directory to cache temporary files. If unspecified and $CACHE_DIRECTORY is set, it will be used for compatibility with systemd. This directory is NOT safe to be configured as a shared directory across coderd/provisionerd replicas.

URL of a PostgreSQL database. If empty, PostgreSQL binaries will be downloaded from Maven (https://repo1.maven.org/maven2) and store all data in the config root. Access the built-in database with "coder server postgres-builtin-url". Note that any special characters in the URL must be URL-encoded.

Type of auth to use when connecting to postgres. For AWS RDS, using IAM authentication (awsiamrds) is recommended.

Maximum number of open connections to the database. Defaults to 10.

Maximum number of idle connections to the database. Set to "auto" (the default) to use max open / 3. Value must be greater or equal to 0; 0 means explicitly no idle connections.

Controls if the 'Secure' property is set on browser session cookies.

Controls the 'SameSite' property is set on browser session cookies.

Recommended to be enabled. Enables __Host- prefix for cookies to guarantee they are only set by the right domain. This change is disruptive to any workspaces built before release 2.31, requiring a workspace restart.

A URL to an external Terms of Service that must be accepted by users when logging in.

Controls if the 'Strict-Transport-Security' header is set on all static file responses. This header should only be set if the server is accessed via HTTPS. This value is the MaxAge in seconds of the header.

Two optional fields can be set in the Strict-Transport-Security header; 'includeSubDomains' and 'preload'. The 'strict-transport-security' flag must be set to a non-zero value for these options to be used.

The algorithm to use for generating ssh keys. Accepted values are "ed25519", "ecdsa", or "rsa4096".

Whether Coder only allows connections to workspaces via the browser.

Hostname or (more commonly) IP to reach this replica for clustering.

Enables SCIM and sets the authentication header for the built-in SCIM server. New users are automatically created with OIDC authentication.

Use the legacy SCIM implementation instead of the SCIM 2.0 handler. This is provided for backward compatibility for existing users.

Encrypt OIDC and Git authentication tokens with AES-256-GCM in the database. The value must be a comma-separated list of base64-encoded keys. Each key, when base64-decoded, must be exactly 32 bytes in length. The first key will be used to encrypt new values. Subsequent keys will be used as a fallback when decrypting. During normal operation it is recommended to only set one key unless you are in the process of rotating keys with the coder server dbcrypt rotate command.

Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.

Remove the permission for the 'owner' role to have workspace execution on all workspaces. This prevents the 'owner' from ssh, apps, and terminal access based on the 'owner' role. They still have their user permissions to access their own workspaces.

Disable workspace sharing. Workspace ACL checking is disabled and only owners can have ssh, apps and terminal access to workspaces. Access based on the 'owner' role is also allowed unless disabled via --disable-owner-workspace-access.

Disable chat sharing. Chat ACL checking is disabled and only owners can access their chats.

The token expiry duration for browser sessions. Sessions may last longer if they are actively making requests, but this functionality can be disabled via --disable-session-expiry-refresh.

Disable automatic session expiry bumping due to activity. This forces all sessions to become invalid after the session expiry duration has been reached.

Disable password authentication. This is recommended for security purposes in production deployments that rely on an identity provider. Any user with the owner role will be able to sign in with their password regardless of this setting to avoid potential lock out. If you are locked out of your account, you can use the coder server create-admin command to create a new admin user directly in the database.

Specify a YAML file to load configuration from.

Workspace hostnames use this suffix in SSH config and Coder Connect on Coder Desktop. By default it is coder, resulting in names like myworkspace.coder. The suffix must not start with a dot, and must not contain spaces, newlines, or glob characters (* and ?).

These SSH config options will override the default SSH config options. Provide options in "key=value" or "key value" format separated by commas. Using this incorrectly can break SSH to your deployment, use cautiously. The following options are not allowed: Host, Match, Include, ProxyCommand, ProxyJump, LocalCommand, PermitLocalCommand, RemoteCommand, KnownHostsCommand, PKCS11Provider, SecurityKeyProvider, SmartcardDevice, XAuthLocation. Option values must not contain newline, carriage return, or NUL characters.

The upgrade message to display to users when a client/server mismatch is detected. By default it instructs users to update using 'curl -L https://coder.com/install.sh | sh'.

Write out the current server config as YAML to stdout.

Support links to display in the top right drop down menu.

Enable the default GitHub external auth provider managed by Coder.

The interval in which coderd should be checking the status of workspace proxies.

The default daily cron schedule applied to users that haven't set a custom quiet hours schedule themselves. The quiet hours schedule determines when workspaces will be force stopped due to the template's autostop requirement, and will round the max deadline up to be within the user's quiet hours window (or default). The format is the same as the standard cron format, but the day-of-month, month and day-of-week must be *. Only one hour and minute can be specified (ranges or comma separated values are not supported).

Allow users to set their own quiet hours schedule for workspaces to stop in (depending on template autostop requirement settings). If false, users can't change their quiet hours schedule and the site default is always used.

The renderer to use when opening a web terminal. Valid values are 'canvas', 'webgl', or 'dom'.

Allow users to rename their workspaces. WARNING: Renaming a workspace can cause Terraform resources that depend on the workspace name to be destroyed and recreated, potentially causing data loss. Only enable this if your templates do not use workspace names in resource identifiers, or if you understand the risks.

Refresh interval for healthchecks.

The threshold for the database health check. If the median latency of the database exceeds this threshold over 5 attempts, the database is considered unhealthy. The default value is 15ms.

The sender's address to use.

The intermediary SMTP host through which emails are sent.

The hostname identifying the SMTP server.

Force a TLS connection to the configured SMTP smarthost.

Identity to use with PLAIN authentication.

Username to use with PLAIN/LOGIN authentication.

Password to use with PLAIN/LOGIN authentication.

File from which to load password for use with PLAIN/LOGIN authentication.

Enable STARTTLS to upgrade insecure SMTP connections using TLS.

Server name to verify against the target certificate.

Skip verification of the target server's certificate (insecure).

CA certificate file to use.

Certificate file to use.

Certificate key file to use.

Which delivery method to use (available options: 'smtp', 'webhook').

How long to wait while a notification is being sent before giving up.

The sender's address to use.

The intermediary SMTP host through which emails are sent.

The hostname identifying the SMTP server.

Force a TLS connection to the configured SMTP smarthost.

Identity to use with PLAIN authentication.

Username to use with PLAIN/LOGIN authentication.

Password to use with PLAIN/LOGIN authentication.

File from which to load password for use with PLAIN/LOGIN authentication.

Enable STARTTLS to upgrade insecure SMTP connections using TLS.

Server name to verify against the target certificate.

Skip verification of the target server's certificate (insecure).

CA certificate file to use.

Certificate file to use.

Certificate key file to use.

The endpoint to which to send webhooks.

Enable Coder Inbox.

The upper limit of attempts to send a notification.

How often to reconcile workspace prebuilds state.

Hide AI tasks from the dashboard.

Force chat debug logging on for every chat, bypassing the runtime admin and user opt-in settings.

Whether to start an in-memory AI Gateway instance.

Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The base URL of the OpenAI API.

Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The key to authenticate against the OpenAI API.

Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The base URL of the Anthropic API.

Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The key to authenticate against the Anthropic API.

Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The base URL to use for the AWS Bedrock API. Use this setting to specify an exact URL to use. Takes precedence over CODER_AI_GATEWAY_BEDROCK_REGION.

Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The AWS Bedrock API region to use. Constructs a base URL to use for the AWS Bedrock API in the form of https://bedrock-runtime.<region>.amazonaws.com.

Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The access key to authenticate against the AWS Bedrock API.

Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The access key secret to use with the access key to authenticate against the AWS Bedrock API.

Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The model to use when making requests to the AWS Bedrock API.

Deprecated: manage AI Providers from the Coder UI or HTTP API. If set, this option seeds provider configuration at startup only exactly once. It will not be used in service runtime. The small fast model to use when making requests to the AWS Bedrock API. Claude Code uses Haiku-class models to perform background tasks. See https://docs.claude.com/en/docs/claude-code/settings#environment-variables.

Length of time to retain data such as interceptions and all related records (token, prompt, tool use).

Maximum number of concurrent AI Gateway requests per replica. Set to 0 to disable (unlimited).

Maximum number of AI Gateway requests per second per replica. Set to 0 to disable (unlimited).

Emit structured logs for AI Gateway interception records. Use this for exporting these records to external SIEM or observability systems.

Once enabled, extra headers will be added to upstream requests to identify the user (actor) making requests to AI Gateway. This is only needed if you are using a proxy between AI Gateway and an upstream AI provider. This will send X-Ai-Bridge-Actor-Id (the ID of the user making the request) and X-Ai-Bridge-Actor-Metadata-Username (their username).

Base directory for dumping AI Gateway request/response pairs to disk for debugging. When set, each provider writes under a subdirectory named after the provider. Sensitive headers are redacted. Leave empty to disable.

Allow users to provide their own LLM API keys or subscriptions. When disabled, only centralized key authentication is permitted.

Enable the circuit breaker to protect against cascading failures from upstream AI provider overload (503, 529).

Determines the effective group when a user belongs to multiple groups with AI budgets. "highest" selects the group with the largest spend limit, and is currently the only supported value.

Determines when accumulated AI spend resets to zero, aligned to UTC calendar boundaries. Only "month" is currently supported.

Enable the AI Gateway MITM Proxy for intercepting and decrypting AI provider requests.

The address the AI Gateway Proxy will listen on.

Base URL of the AI Gateway to forward intercepted requests to. Defaults to the embedded AI Gateway address at the Coder access URL plus /api/v2/ai-gateway.

Path to the TLS certificate file for the AI Gateway Proxy listener. Must be set together with AI Gateway Proxy TLS Key File.

Path to the TLS private key file for the AI Gateway Proxy listener. Must be set together with AI Gateway Proxy TLS Certificate File.

Path to the CA certificate file used to intercept (MITM) HTTPS traffic from AI clients. This CA must be trusted by AI clients for the proxy to decrypt their requests.

Path to the CA private key file used to intercept (MITM) HTTPS traffic from AI clients.

URL of an upstream HTTP proxy to chain tunneled (non-allowlisted) requests through. Format: http://[user:pass@]host:port or https://[user:pass@]host:port.

Path to a PEM-encoded CA certificate to trust for the upstream proxy's TLS connection. Only needed for HTTPS upstream proxies with certificates not trusted by the system. If not provided, the system certificate pool is used.

Comma-separated list of CIDR ranges that are permitted even though they fall within blocked private/reserved IP ranges. By default all private ranges are blocked to prevent SSRF attacks. Use this to allow access to specific internal networks.

Directory for dumping MITM request/response pairs to disk for debugging. When set, each proxied request produces .req.txt and .resp.txt files organized by provider. Sensitive headers are redacted. Leave empty to disable.

How long audit log entries are retained. Set to 0 to disable (keep indefinitely). We advise keeping audit logs for at least a year, and in accordance with your compliance requirements.

How long connection log entries are retained. Set to 0 to disable (keep indefinitely).

How long expired API keys are retained before being deleted. Keeping expired keys allows the backend to return a more helpful error when a user tries to use an expired key. Set to 0 to disable automatic deletion of expired keys.

How long workspace agent logs are retained. Logs from non-latest builds are deleted if the agent hasn't connected within this period. Logs from the latest build are always retained. Set to 0 to disable automatic deletion.

How long boundary audit log entries are retained. Boundary logs record HTTP requests processed by a Boundary confinement proxy. Set to 0 to disable automatic deletion (keep indefinitely). Adjust to match your organization's regulatory requirements.

Disable the template builder feature for guided template creation. When disabled, all /api/v2/templatebuilder/* endpoints return 404.

The base URL of the module registry used by the template builder for module source paths.