options (these both take a comma separated list of files; list certificates

and their respective keys in the same order).

After you enable the wildcard access URL, you should[disable path-based apps](../../tutorials/best-practices/security-best-practices.md#disable-path-based-apps) for security.

The Coder server can directly use TLS certificates with`CODER_TLS_ENABLE` and

If a security incident with Coder does occur, audit logs are invaluable in

determining the nature and scope of the impact.

For production deployments, we recommend that you disable path-based apps after you've configured a wildcard access URL.

Path-based apps share the same origin as the Coder API, which can be convenient for trialing Coder,

but can expose the deployment to cross-site-scripting (XSS) attacks in production.

A malicious workspace could reuse Coder cookies to call the API or interact with other workspaces owned by the same user.

1.[Enable sub-domain apps with a wildcard DNS record](../../admin/setup/index.md#wildcard-access-url) (like`*.coder.example.com`)

1. Disable path-based apps:

coderd server --disable-path-apps

export CODER_DISABLE_PATH_APPS=true

By default, Coder mitigates the impact of having path-based apps enabled, but we still recommend disabling it to prevent

malicious workspaces accessing other workspaces owned by the same user or performing requests against the Coder API.

If you do keep path-based apps enabled:

- Path-based apps cannot be shared with other users unless you start the Coder server with`--dangerous-allow-path-app-sharing`.

- Users with the site`owner` role cannot use their admin privileges to access path-based apps for workspaces unless the

server is started with`--dangerous-allow-path-app-site-owner-access`.

PostgreSQL is the persistent datastore underlying the entire Coder deployment.