Skip to content

Commit 20a5183

Browse files
coadlercoadler
committed
Merge branch 'main' into colin/single-pgcoord
2 parents 2528a59 + 451ca04 commit 20a5183

File tree

344 files changed

+14246
-8080
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

344 files changed

+14246
-8080
lines changed

‎.github/workflows/ci.yaml

+46-11
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ jobs:
137137
138138
# Check for any typos
139139
- name: Check for typos
140-
uses: crate-ci/typos@v1.16.4
140+
uses: crate-ci/typos@v1.16.6
141141
with:
142142
config: .github/workflows/typos.toml
143143

@@ -169,14 +169,35 @@ jobs:
169169
with:
170170
fetch-depth: 1
171171

172-
- name: Install Nix
173-
uses: DeterminateSystems/nix-installer-action@v4
172+
- name: Setup Node
173+
uses: ./.github/actions/setup-node
174+
175+
- name: Setup Go
176+
uses: ./.github/actions/setup-go
174177

175-
- name: Run the Magic Nix Cache
176-
uses: DeterminateSystems/magic-nix-cache-action@v2
178+
- name: Setup sqlc
179+
uses: ./.github/actions/setup-sqlc
180+
181+
- name: go install tools
182+
run: |
183+
go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.30
184+
go install storj.io/drpc/cmd/protoc-gen-go-drpc@v0.0.33
185+
go install golang.org/x/tools/cmd/goimports@latest
186+
go install github.com/mikefarah/yq/v4@v4.30.6
187+
go install github.com/golang/mock/mockgen@v1.6.0
188+
189+
- name: Install Protoc
190+
run: |
191+
mkdir -p /tmp/proto
192+
pushd /tmp/proto
193+
curl -L -o protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v23.3/protoc-23.3-linux-x86_64.zip
194+
unzip protoc.zip
195+
cp -r ./bin/* /usr/local/bin
196+
cp -r ./include /usr/local/bin/include
197+
popd
177198
178199
- name: make gen
179-
run: "nix-shell --command 'make --output-sync -j -B gen'"
200+
run: "make --output-sync -j -B gen"
180201

181202
- name: Check for unstaged files
182203
run: ./scripts/check_unstaged.sh
@@ -508,15 +529,27 @@ jobs:
508529
- name: Setup Terraform
509530
uses: ./.github/actions/setup-tf
510531

511-
- name: Install Nix
512-
uses: DeterminateSystems/nix-installer-action@v4
532+
- name: go install tools
533+
run: |
534+
go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.30
535+
go install storj.io/drpc/cmd/protoc-gen-go-drpc@v0.0.33
536+
go install golang.org/x/tools/cmd/goimports@latest
537+
go install github.com/mikefarah/yq/v4@v4.30.6
538+
go install github.com/golang/mock/mockgen@v1.6.0
513539
514-
- name: Run the Magic Nix Cache
515-
uses: DeterminateSystems/magic-nix-cache-action@v2
540+
- name: Install Protoc
541+
run: |
542+
mkdir -p /tmp/proto
543+
pushd /tmp/proto
544+
curl -L -o protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v23.3/protoc-23.3-linux-x86_64.zip
545+
unzip protoc.zip
546+
cp -r ./bin/* /usr/local/bin
547+
cp -r ./include /usr/local/bin/include
548+
popd
516549
517550
- name: Build
518551
run: |
519-
nix-shell --command 'make -B site/out/index.html'
552+
make -B site/out/index.html
520553
521554
- run: pnpm playwright:install
522555
working-directory: site
@@ -568,6 +601,7 @@ jobs:
568601
# https://www.chromatic.com/docs/github-actions#forked-repositories
569602
projectToken: 695c25b6cb65
570603
workingDir: "./site"
604+
storybookBaseDir: "./site"
571605
# Prevent excessive build runs on minor version changes
572606
skip: "@(renovate/**|dependabot/**)"
573607
# Run TurboSnap to trace file dependencies to related stories
@@ -593,6 +627,7 @@ jobs:
593627
buildScriptName: "storybook:build"
594628
projectToken: 695c25b6cb65
595629
workingDir: "./site"
630+
storybookBaseDir: "./site"
596631
# Run TurboSnap to trace file dependencies to related stories
597632
# and tell chromatic to only take snapshots of relevent stories
598633
onlyChanged: true

‎.github/workflows/contrib.yaml

+2-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,8 @@ jobs:
4646
path-to-document: "https://github.com/coder/cla/blob/main/README.md"
4747
# branch should not be protected
4848
branch: "main"
49-
allowlist: dependabot*
49+
# Some users have signed a corporate CLA with Coder so are exempt from signing our community one.
50+
allowlist: "coryb,aaronlehmann,dependabot*"
5051

5152
release-labels:
5253
runs-on: ubuntu-latest

‎.prettierrc.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,17 @@
22
# formatting for prettier-supported files. See `.editorconfig` and
33
# `site/.editorconfig`for whitespace formatting options.
44
printWidth: 80
5+
proseWrap: always
56
semi: false
67
trailingComma: all
78
useTabs: false
89
tabWidth: 2
910
overrides:
1011
- files:
1112
- README.md
13+
- docs/api/**/*.md
14+
- docs/cli/**/*.md
15+
- .github/**/*.{yaml,yml,toml}
16+
- scripts/**/*.{yaml,yml,toml}
1217
options:
1318
proseWrap: preserve
14-
- files:
15-
- "site/**/*.yaml"
16-
- "site/**/*.yml"
17-
options:
18-
proseWrap: always

‎Makefile

+9-5
Original file line numberDiff line numberDiff line change
@@ -456,10 +456,10 @@ DB_GEN_FILES := \
456456

457457
# all gen targets should be added here and to gen/mark-fresh
458458
gen: \
459-
coderd/database/dump.sql \
460-
$(DB_GEN_FILES) \
461459
provisionersdk/proto/provisioner.pb.go \
462460
provisionerd/proto/provisionerd.pb.go \
461+
coderd/database/dump.sql \
462+
$(DB_GEN_FILES) \
463463
site/src/api/typesGenerated.ts \
464464
coderd/rbac/object_gen.go \
465465
docs/admin/prometheus.md \
@@ -478,10 +478,10 @@ gen: \
478478
# used during releases so we don't run generation scripts.
479479
gen/mark-fresh:
480480
files="\
481-
coderd/database/dump.sql \
482-
$(DB_GEN_FILES) \
483481
provisionersdk/proto/provisioner.pb.go \
484482
provisionerd/proto/provisionerd.pb.go \
483+
coderd/database/dump.sql \
484+
$(DB_GEN_FILES) \
485485
site/src/api/typesGenerated.ts \
486486
coderd/rbac/object_gen.go \
487487
docs/admin/prometheus.md \
@@ -564,7 +564,7 @@ coderd/apidoc/swagger.json: $(shell find ./scripts/apidocgen $(FIND_EXCLUSIONS)
564564
./scripts/apidocgen/generate.sh
565565
pnpm run format:write:only ./docs/api ./docs/manifest.json ./coderd/apidoc/swagger.json
566566

567-
update-golden-files: cli/testdata/.gen-golden helm/coder/tests/testdata/.gen-golden helm/provisioner/tests/testdata/.gen-golden scripts/ci-report/testdata/.gen-golden enterprise/cli/testdata/.gen-golden
567+
update-golden-files: cli/testdata/.gen-golden helm/coder/tests/testdata/.gen-golden helm/provisioner/tests/testdata/.gen-golden scripts/ci-report/testdata/.gen-golden enterprise/cli/testdata/.gen-golden coderd/.gen-golden
568568
.PHONY: update-golden-files
569569

570570
cli/testdata/.gen-golden: $(wildcard cli/testdata/*.golden) $(wildcard cli/*.tpl) $(GO_SRC_FILES) $(wildcard cli/*_test.go)
@@ -583,6 +583,10 @@ helm/provisioner/tests/testdata/.gen-golden: $(wildcard helm/provisioner/tests/t
583583
go test ./helm/provisioner/tests -run=TestUpdateGoldenFiles -update
584584
touch "$@"
585585

586+
coderd/.gen-golden: $(wildcard coderd/testdata/*/*.golden) $(GO_SRC_FILES) $(wildcard coderd/*_test.go)
587+
go test ./coderd -run="Test.*Golden$$" -update
588+
touch "$@"
589+
586590
scripts/ci-report/testdata/.gen-golden: $(wildcard scripts/ci-report/testdata/*) $(wildcard scripts/ci-report/*.go)
587591
go test ./scripts/ci-report -run=TestOutputMatchesGoldenFile -update
588592
touch "$@"

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ You can run the install script with `--dry-run` to see the commands that will be
7474
7575
Once installed, you can start a production deployment<sup>1</sup> with a single command:
7676

77-
```console
77+
```shell
7878
# Automatically sets up an external access URL on *.try.coder.app
7979
coder server
8080

‎SECURITY.md

+47-39
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Coder Security
22

3-
Coder welcomes feedback from security researchers and the general public
4-
to help improve our security. If you believe you have discovered a vulnerability,
3+
Coder welcomes feedback from security researchers and the general public to help
4+
improve our security. If you believe you have discovered a vulnerability,
55
privacy issue, exposed data, or other security issues in any of our assets, we
66
want to hear from you. This policy outlines steps for reporting vulnerabilities
77
to us, what we expect, what you can expect from us.
@@ -10,64 +10,72 @@ You can see the pretty version [here](https://coder.com/security/policy)
1010

1111
# Why Coder's security matters
1212

13-
If an attacker could fully compromise a Coder installation, they could spin
14-
up expensive workstations, steal valuable credentials, or steal proprietary
15-
source code. We take this risk very seriously and employ routine pen testing,
16-
vulnerability scanning, and code reviews. We also welcome the contributions
17-
from the community that helped make this product possible.
13+
If an attacker could fully compromise a Coder installation, they could spin up
14+
expensive workstations, steal valuable credentials, or steal proprietary source
15+
code. We take this risk very seriously and employ routine pen testing,
16+
vulnerability scanning, and code reviews. We also welcome the contributions from
17+
the community that helped make this product possible.
1818

1919
# Where should I report security issues?
2020

21-
Please report security issues to security@coder.com, providing
22-
all relevant information. The more details you provide, the easier it will be
23-
for us to triage and fix the issue.
21+
Please report security issues to security@coder.com, providing all relevant
22+
information. The more details you provide, the easier it will be for us to
23+
triage and fix the issue.
2424

2525
# Out of Scope
2626

27-
Our primary concern is around an abuse of the Coder application that allows
28-
an attacker to gain access to another users workspace, or spin up unwanted
27+
Our primary concern is around an abuse of the Coder application that allows an
28+
attacker to gain access to another users workspace, or spin up unwanted
2929
workspaces.
3030

3131
- DOS/DDOS attacks affecting availability --> While we do support rate limiting
32-
of requests, we primarily leave this to the owner of the Coder installation. Our
33-
rationale is that a DOS attack only affecting availability is not a valuable
34-
target for attackers.
32+
of requests, we primarily leave this to the owner of the Coder installation.
33+
Our rationale is that a DOS attack only affecting availability is not a
34+
valuable target for attackers.
3535
- Abuse of a compromised user credential --> If a user credential is compromised
36-
outside of the Coder ecosystem, then we consider it beyond the scope of our application.
37-
However, if an unprivileged user could escalate their permissions or gain access
38-
to another workspace, that is a cause for concern.
36+
outside of the Coder ecosystem, then we consider it beyond the scope of our
37+
application. However, if an unprivileged user could escalate their permissions
38+
or gain access to another workspace, that is a cause for concern.
3939
- Vulnerabilities in third party systems --> Vulnerabilities discovered in
40-
out-of-scope systems should be reported to the appropriate vendor or applicable authority.
40+
out-of-scope systems should be reported to the appropriate vendor or
41+
applicable authority.
4142

4243
# Our Commitments
4344

4445
When working with us, according to this policy, you can expect us to:
4546

46-
- Respond to your report promptly, and work with you to understand and validate your report;
47-
- Strive to keep you informed about the progress of a vulnerability as it is processed;
48-
- Work to remediate discovered vulnerabilities in a timely manner, within our operational constraints; and
49-
- Extend Safe Harbor for your vulnerability research that is related to this policy.
47+
- Respond to your report promptly, and work with you to understand and validate
48+
your report;
49+
- Strive to keep you informed about the progress of a vulnerability as it is
50+
processed;
51+
- Work to remediate discovered vulnerabilities in a timely manner, within our
52+
operational constraints; and
53+
- Extend Safe Harbor for your vulnerability research that is related to this
54+
policy.
5055

5156
# Our Expectations
5257

53-
In participating in our vulnerability disclosure program in good faith, we ask that you:
58+
In participating in our vulnerability disclosure program in good faith, we ask
59+
that you:
5460

55-
- Play by the rules, including following this policy and any other relevant agreements.
56-
If there is any inconsistency between this policy and any other applicable terms, the
57-
terms of this policy will prevail;
61+
- Play by the rules, including following this policy and any other relevant
62+
agreements. If there is any inconsistency between this policy and any other
63+
applicable terms, the terms of this policy will prevail;
5864
- Report any vulnerability you’ve discovered promptly;
59-
- Avoid violating the privacy of others, disrupting our systems, destroying data, and/or
60-
harming user experience;
65+
- Avoid violating the privacy of others, disrupting our systems, destroying
66+
data, and/or harming user experience;
6167
- Use only the Official Channels to discuss vulnerability information with us;
62-
- Provide us a reasonable amount of time (at least 90 days from the initial report) to
63-
resolve the issue before you disclose it publicly;
64-
- Perform testing only on in-scope systems, and respect systems and activities which
65-
are out-of-scope;
66-
- If a vulnerability provides unintended access to data: Limit the amount of data you
67-
access to the minimum required for effectively demonstrating a Proof of Concept; and
68-
cease testing and submit a report immediately if you encounter any user data during testing,
69-
such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI),
70-
credit card data, or proprietary information;
71-
- You should only interact with test accounts you own or with explicit permission from
68+
- Provide us a reasonable amount of time (at least 90 days from the initial
69+
report) to resolve the issue before you disclose it publicly;
70+
- Perform testing only on in-scope systems, and respect systems and activities
71+
which are out-of-scope;
72+
- If a vulnerability provides unintended access to data: Limit the amount of
73+
data you access to the minimum required for effectively demonstrating a Proof
74+
of Concept; and cease testing and submit a report immediately if you encounter
75+
any user data during testing, such as Personally Identifiable Information
76+
(PII), Personal Healthcare Information (PHI), credit card data, or proprietary
77+
information;
78+
- You should only interact with test accounts you own or with explicit
79+
permission from
7280
- the account holder; and
7381
- Do not engage in extortion.

‎agent/agent.go

+12-9
Original file line numberDiff line numberDiff line change
@@ -678,7 +678,7 @@ func (a *agent) run(ctx context.Context) error {
678678
network := a.network
679679
a.closeMutex.Unlock()
680680
if network == nil {
681-
network, err = a.createTailnet(ctx, manifest.AgentID, manifest.DERPMap, manifest.DisableDirectConnections)
681+
network, err = a.createTailnet(ctx, manifest.AgentID, manifest.DERPMap, manifest.DERPForceWebSockets, manifest.DisableDirectConnections)
682682
if err != nil {
683683
return xerrors.Errorf("create tailnet: %w", err)
684684
}
@@ -701,8 +701,10 @@ func (a *agent) run(ctx context.Context) error {
701701
if err != nil {
702702
a.logger.Error(ctx, "update tailnet addresses", slog.Error(err))
703703
}
704-
// Update the DERP map and allow/disallow direct connections.
704+
// Update the DERP map, force WebSocket setting and allow/disallow
705+
// direct connections.
705706
network.SetDERPMap(manifest.DERPMap)
707+
network.SetDERPForceWebSockets(manifest.DERPForceWebSockets)
706708
network.SetBlockEndpoints(manifest.DisableDirectConnections)
707709
}
708710

@@ -756,14 +758,15 @@ func (a *agent) trackConnGoroutine(fn func()) error {
756758
return nil
757759
}
758760

759-
func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *tailcfg.DERPMap, disableDirectConnections bool) (_ *tailnet.Conn, err error) {
761+
func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *tailcfg.DERPMap, derpForceWebSockets, disableDirectConnections bool) (_ *tailnet.Conn, err error) {
760762
network, err := tailnet.NewConn(&tailnet.Options{
761-
ID: agentID,
762-
Addresses: a.wireguardAddresses(agentID),
763-
DERPMap: derpMap,
764-
Logger: a.logger.Named("net.tailnet"),
765-
ListenPort: a.tailnetListenPort,
766-
BlockEndpoints: disableDirectConnections,
763+
ID: agentID,
764+
Addresses: a.wireguardAddresses(agentID),
765+
DERPMap: derpMap,
766+
DERPForceWebSockets: derpForceWebSockets,
767+
Logger: a.logger.Named("net.tailnet"),
768+
ListenPort: a.tailnetListenPort,
769+
BlockEndpoints: disableDirectConnections,
767770
})
768771
if err != nil {
769772
return nil, xerrors.Errorf("create tailnet: %w", err)

‎cli/agent_test.go

+9-9
Original file line numberDiff line numberDiff line change
@@ -75,9 +75,9 @@ func TestWorkspaceAgent(t *testing.T) {
7575
user := coderdtest.CreateFirstUser(t, client)
7676
version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
7777
Parse: echo.ParseComplete,
78-
ProvisionApply: []*proto.Provision_Response{{
79-
Type: &proto.Provision_Response_Complete{
80-
Complete: &proto.Provision_Complete{
78+
ProvisionApply: []*proto.Response{{
79+
Type: &proto.Response_Apply{
80+
Apply: &proto.ApplyComplete{
8181
Resources: []*proto.Resource{{
8282
Name: "somename",
8383
Type: "someinstance",
@@ -127,9 +127,9 @@ func TestWorkspaceAgent(t *testing.T) {
127127
user := coderdtest.CreateFirstUser(t, client)
128128
version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
129129
Parse: echo.ParseComplete,
130-
ProvisionApply: []*proto.Provision_Response{{
131-
Type: &proto.Provision_Response_Complete{
132-
Complete: &proto.Provision_Complete{
130+
ProvisionApply: []*proto.Response{{
131+
Type: &proto.Response_Apply{
132+
Apply: &proto.ApplyComplete{
133133
Resources: []*proto.Resource{{
134134
Name: "somename",
135135
Type: "someinstance",
@@ -179,9 +179,9 @@ func TestWorkspaceAgent(t *testing.T) {
179179
user := coderdtest.CreateFirstUser(t, client)
180180
version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
181181
Parse: echo.ParseComplete,
182-
ProvisionApply: []*proto.Provision_Response{{
183-
Type: &proto.Provision_Response_Complete{
184-
Complete: &proto.Provision_Complete{
182+
ProvisionApply: []*proto.Response{{
183+
Type: &proto.Response_Apply{
184+
Apply: &proto.ApplyComplete{
185185
Resources: []*proto.Resource{{
186186
Name: "somename",
187187
Type: "someinstance",

0 commit comments

Comments
 (0)