HomeAdministrationTemplatesExtending TemplatesTerraform Modules

Terraform Modules

To reuse code across different Coder templates, such as common scripts orresource definitions, we suggest usingTerraform Modules.

You can store these modules externally from your Coder deployment, like in a gitrepository or a Terraform registry. This example shows how to reference a modulefrom your template:

data "coder_workspace" "me" {}module "coder-base" {  source = "github.com/my-organization/coder-base"  # Modules take in variables and can provision infrastructure  vpc_name            = "devex-3"  subnet_tags         = { "name": data.coder_workspace.me.name }  code_server_version = 4.14.1}resource "coder_agent" "dev" {  # Modules can provide outputs, such as helper scripts  startup_script=<<EOF  #!/bin/sh  ${module.coder-base.code_server_install_command}  EOF}

Learn more aboutcreating modulesandmodule sourcesin the Terraform documentation.

Coder modules

Coder publishes plenty of modules that can be used to simplify some common tasksacross templates. Some of the modules we publish are,

For a full list of available modules please checkCoder module registry.

Offline installations

In offline and restricted deployments, there are two ways to fetch modules.

Artifactory
Private git repository

Artifactory

Air gapped users can clone thecoder/registryrepo and publish alocal terraform module repositoryto resolve modules viaArtifactory.

Create a local-terraform-repository with namecoder-modules-local
Create a virtual repository with nametf
Follow the below instructions to publish coder modules to Artifactory
git clone https://github.com/coder/registrycd registry/coder/modulesjf tfcjf tf p --namespace="coder" --provider="coder" --tag="1.0.0"
Generate a token with access to thetf repo and set anENV variableTF_TOKEN_example.jfrog.io="XXXXXXXXXXXXXXX" on the Coder provisioner.
Create a file.terraformrc with following content and mount at/home/coder/.terraformrc within the Coder provisioner.
provider_installation { direct { exclude = ["registry.terraform.io/*/*"] } network_mirror { url = "https://example.jfrog.io/artifactory/api/terraform/tf/providers/" }}
Update module source as:
module "module-name" { source = "https://example.jfrog.io/tf__coder/module-name/coder" version = "1.0.0" agent_id = coder_agent.example.id ...}
Replaceexample.jfrog.io with your Artifactory URL

Based on the instructionshere.

Example template

We have an example templateherethat uses ourJFrog Dockertemplate as the underlying module.

Private git repository

If you are importing a module from a private git repository, the Coder server orprovisioner needs git credentials. Since this tokenwill only be used for cloning your repositories with modules, it is best tocreate a token with access limited to the repository and no extra permissions.In GitHub, you can generate afine-grained tokenwith read only access to the necessary repos.

If you are running Coder on a VM, make sure that you havegit installed andthecoder user has access to the following files:

# /home/coder/.gitconfig[credential] helper = store

# /home/coder/.git-credentials# GitHub example:https://your-github-username:[email protected]

If you are running Coder on Docker or Kubernetes,git is pre-installed in theCoder image. However, you still need to mount credentials. This can be done viaa Docker volume mount or Kubernetes secrets.

Passing git credentials in Kubernetes

First, create a.gitconfig and.git-credentials file on your local machine.You might want to do this in a temporary directory to avoid conflicting withyour own git credentials.

Next, create the secret in Kubernetes. Be sure to do this in the same namespacethat Coder is installed in.

export NAMESPACE=coderkubectl apply -f - <<EOFapiVersion: v1kind: Secretmetadata:  name: git-secrets  namespace: $NAMESPACEtype: Opaquedata:  .gitconfig: $(cat .gitconfig | base64 | tr -d '\n')  .git-credentials: $(cat .git-credentials | base64 | tr -d '\n')EOF

Then, modify Coder's Helm values to mount the secret.

coder:  volumes:    - name: git-secrets      secret:        secretName: git-secrets  volumeMounts:    - name: git-secrets      mountPath: "/home/coder/.gitconfig"      subPath: .gitconfig      readOnly: true    - name: git-secrets      mountPath: "/home/coder/.git-credentials"      subPath: .git-credentials      readOnly: true

Movatterモバイル変換