velero backup create coder-full-backup --include-namespaces codervelero restore create --from-backup coder-full-backup

velero backup create$BACKUP_NAME --selector com.coder.workspace.name="$WORKSPACE_NAME" --waitvelero restore create --from-backup$BACKUP_NAME --wait

connecting to coderd  run exited with error ...  error= GET https://example.com/api/v2/workspaceagents/me/rpc?version=2.4: unexpected status code 401: Workspace agent not authorized.: Try logging in using 'coder login'.  Error: The agent cannot authenticate until the workspace provision job has been completed. If the job is no longer running, this agent is invalid.  connecting to coderd

// Add to coderd/workspaceagents.go// authenticateAgent handles workspace agent authentication, with support for restored agentsfunc (api*API)authenticateAgent(r*http.Request) (*database.WorkspaceAgent,error) {token:=r.Header.Get(AgentAuthTokenHeader)iftoken=="" {returnnil,xerrors.New("no agent auth token provided")    }agent,err:=api.Database.GetWorkspaceAgentByAuthToken(r.Context(),token)iferr!=nil {if!xerrors.Is(err,sql.ErrNoRows) {returnnil,xerrors.Errorf("get agent by auth token: %w",err)        }// Check if this is a restored agent trying to reconnectrestoredAgent,restoredErr:=api.tryAuthenticateRestoredAgent(r.Context(),token)ifrestoredErr==nil&&restoredAgent!=nil {// Found a restored agent, regenerate auth token and returnreturnrestoredAgent,nil        }returnnil,xerrors.Errorf("agent auth token invalid: %w",err)    }returnagent,nil}// tryAuthenticateRestoredAgent attempts to authenticate an agent that may have been restored from backupfunc (api*API)tryAuthenticateRestoredAgent(ctx context.Context,tokenstring) (*database.WorkspaceAgent,error) {// Try to find an agent that matches the first part of the token (pre-secret portion)// This is a heuristic approach - in a real implementation you'd need a more secure methodtokenParts:=strings.Split(token,".")iflen(tokenParts)<2 {returnnil,xerrors.New("invalid token format")    }agentID:=tokenParts[0]agents,err:=api.Database.GetWorkspaceAgentsCreatedAfter(ctx,time.Now().Add(-7*24*time.Hour))iferr!=nil {returnnil,err    }// Find a potential restored agentfor_,agent:=rangeagents {ifstrings.HasPrefix(agent.ID.String(),agentID) {// Found a potential match, regenerate auth for this agentnewToken:=uuid.New().String()err=api.Database.UpdateWorkspaceAgentAuthToken(ctx, database.UpdateWorkspaceAgentAuthTokenParams{ID:agent.ID,AuthToken:newToken,            })iferr!=nil {returnnil,err            }// Log the recovery for audit purposesapi.Logger.Info(ctx,"restored workspace agent authentication",slog.F("agent_id",agent.ID),slog.F("workspace_id",agent.WorkspaceID),            )returnagent,nil        }    }returnnil,xerrors.New("no matching restored agent found")}// Also add needed database methods to coderd/database/database.go:// GetWorkspaceAgentsCreatedAfter gets all workspace agents created after the given timefunc (q*Q)GetWorkspaceAgentsCreatedAfter(ctx context.Context,after time.Time) ([]database.WorkspaceAgent,error) {// Implementation details will depend on your database schema// ...}// UpdateWorkspaceAgentAuthToken updates the auth token for a workspace agentfunc (q*Q)UpdateWorkspaceAgentAuthToken(ctx context.Context,params database.UpdateWorkspaceAgentAuthTokenParams)error {// Implementation details will depend on your database schema// ...}

// In coderd/workspaceagents.gofunc (api*API)registerAgentRecoveryHandlers(r*chi.Mux) {r.Post("/api/v2/workspaceagents/recovery",api.handleAgentRecovery)}func (api*API)handleAgentRecovery(rw http.ResponseWriter,r*http.Request) {// Extract agent identity information from requestvarreqstruct {AgentIDstring`json:"agent_id"`WorkspaceIDstring`json:"workspace_id"`RecoveryTokenstring`json:"recovery_token"`// A token derived from agent's instance data    }iferr:=json.NewDecoder(r.Body).Decode(&req);err!=nil {httpapi.Write(ctx,rw,http.StatusBadRequest, codersdk.Response{Message:"Invalid request",Detail:err.Error(),        })return    }// Validate this is a legitimate agent through instance verification// ...// Regenerate token and update database// ...// Return new auth token to the agent}