fix(bootstrap): define CODER_ADMIN_* on coder-init-admin, not coder.service#47
Merged
Conversation
phorcys420
force-pushed
the
admin-bootstrap-05ha
branch
from
cd80857 to
2a07285
Compare
phorcys420
added
test-installer-iso
test-appliance-iso
and removed
test-installer-iso
test-appliance-iso
labels
phorcys420
force-pushed
the
admin-bootstrap-05ha
branch
from
2a07285 to
dd7149a
Compare
…ervice Move the admin bootstrap credentials (CODER_ADMIN_EMAIL/USERNAME/PASSWORD) out of the long-running coder.service environment and onto the coder-init-admin.service (and its dependent coder-reset.service), so they are only present where the bootstrap actually needs them. coder-init-admin and coder-reset still inherit coder.service's environment for CODER_PG_CONNECTION_URL; the admin creds are merged in via systemd.services.coder-init-admin.environment in local.nix. GitHub OAuth vars remain on coder.service since the server reads them. Refs #29
phorcys420
force-pushed
the
admin-bootstrap-05ha
branch
from
dd7149a to
11ce2a8
Compare
📀 ISO build artifacts
↻ Updated for |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Move the admin bootstrap credentials (
CODER_ADMIN_EMAIL,CODER_ADMIN_USERNAME,CODER_ADMIN_PASSWORD) out of the long-runningcoder.serviceenvironment and onto thecoder-init-admin.service(the bootstrap service that actually consumes them), so they are only present where they are needed.Changes
configuration.nixcoder-init-admin.servicestill inheritscoder.service.environment(forCODER_PG_CONNECTION_URLetc.); theCODER_ADMIN_*creds are now merged in on top viasystemd.services.coder-init-admin.environmentdefined inlocal.nix(NixOS unions attrset option definitions).coder-reset.service(step 8 mints a token using the admin creds) now inherits fromcoder-init-admin.environmentinstead ofcoder.service.coder.service.local.nix.example— admin creds moved tosystemd.services.coder-init-admin.environment; GitHub OAuth block kept undersystemd.services.coder.environment(the server reads those).nixos/_images/box-turnkey.nix— turnkey image baked-in admin creds moved tocoder-init-admin.environment.hosts/incus-vm/README.md— doc updated to the new option path.Verification
Evaluated with Nix against the turnkey appliance config:
coder-init-admin.environmentcontains theCODER_ADMIN_*creds and inheritsCODER_PG_CONNECTION_URL. ✅coder.service.environmentcontains noCODER_ADMIN_*. ✅nix flake showevaluates; all edited.nixfiles parse.Refs #29