Once installed, you can start a production deployment¹ with a single command:

coder server

Example of a [human readable](../cli/server.md#--log-human) audit log entry:

Navigate to your Coder host and run the following command to start up the Coder

server:

coder server --oauth2-github-allow-signups=true --oauth2-github-allowed-orgs="your-org" --oauth2-github-client-id="8d1...e05" --oauth2-github-client-secret="57ebc9...02c24c"

same result as the command above by adding the following environment variables

to the `/etc/coder.d/coder.env` file:

**Note:** To allow everyone to signup using GitHub, set:

To upgrade Coder, run:

helm upgrade <release-name> coder-v2/coder -n <namespace> -f values.yaml

Navigate to your Coder host and run the following command to start up the Coder

server:

coder server --oidc-issuer-url="https://issuer.corp.com" --oidc-email-domain="your-domain-1,your-domain-2" --oidc-client-id="533...des" --oidc-client-secret="G0CSP...7qSM"

If you are running Coder as a system service, you can achieve the

same result as the command above by adding the following environment variables

to the `/etc/coder.d/coder.env` file:

If your upstream identity provider users a different claim, you can set

`CODER_OIDC_EMAIL_FIELD` to the desired claim.

provider, Coder will validate that its value is `true`. If needed, you can

disable this behavior with the following setting:

If you'd like to change the OpenID Connect button text and/or icon, you can

configure them like so:

To remove email and password login, set the following environment variable on your

Coder deployment:

and are not deleted. [Configure](./configure.md) your SCIM application with an

auth key and supply it the Coder server.

If your OpenID Connect provider requires client TLS certificates for authentication, you can configure them like so:

enabled, the user's groups will be controlled by the OIDC provider. This means

manual group additions/removals will be overwritten on the next login.

--oidc-scopes openid,profile,email,groups

With the `groups` scope requested, we also need to map the `groups` claim name. Coder recommends using `groups` for the claim name. This step is necessary if your **scope's name** is something other than `groups`.

--oidc-group-field groups

or you want to have different group names in Coder than in your OIDC provider,

you can configure mapping between the two.

--oidc-group-mapping '{"myOIDCGroupID": "myCoderGroupName"}'

Generate a token on your Coder deployment by visiting:

https://coder.example.com/settings/tokens

List your workspaces

coder ls \

--url https://coder.example.com \

- [Custom workspace logs](../api/agents.md#patch-workspace-agent-logs): Expose messages prior to the Coder init script running (e.g. pulling image, VM starting, restoring snapshot). [coder-logstream-kube](https://github.com/coder/coder-logstream-kube) uses this to show Kubernetes events, such as image pulls or ResourceQuota restrictions.

curl -X PATCH https://coder.example.com/api/v2/workspaceagents/me/logs \

-H "Coder-Session-Token: $CODER_AGENT_TOKEN" \

-d "{

- [Manually send workspace activity](../api/agents.md#submit-workspace-agent-stats): Keep a workspace "active," even if there is not an open connection (e.g. for a long-running machine learning job).

#!/bin/bash

# Send workspace activity as long as the job is still running

You can change which port(s) Coder listens on.

export CODER_HTTP_ADDRESS=0.0.0.0:80

1. Create the TLS secret in your Kubernetes cluster

kubectl create secret tls coder-tls -n <coder-namespace> --key="tls.key" --cert="tls.crt"

configure the server by setting the following variables in `/etc/coder.d/coder.env`:

To run Coder as a system service on the host:

To restart Coder after applying system changes:

Set the following environment variables to [configure the Coder server](./configure.md):

GitHub Enterprise requires the following authentication and token URLs:

Azure DevOps requires the following environment variables:

Custom authentication and token URLs should be

used for self-managed Git provider deployments.

Optionally, you can request custom scopes:

A custom regex can be used to match a specific repository or organization to limit auth scope. Here's a sample config:

To support regex matching for paths (e.g. github.com/orgname), you'll need to add this to the [Coder agent startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script):

git config --global credential.useHttpPath true