coder/docs/cli/server.md

server

Start a Coder server

Usage

coder server [flags]

Subcommands

Name	Purpose
create-admin-user	Create a new admin user with the given username, email and password and adds it to every organization.
dbcrypt	Manage database encryption.
postgres-builtin-serve	Run the built-in PostgreSQL deployment.
postgres-builtin-url	Output the connection URL for the built-in PostgreSQL deployment.

Options

--access-url

Type	url
Environment	$CODER_ACCESS_URL
YAML	networking.accessURL

The URL that users will use to access the Coder deployment.

--allow-custom-quiet-hours

Type	bool
Environment	$CODER_ALLOW_CUSTOM_QUIET_HOURS
YAML	userQuietHoursSchedule.allowCustomQuietHours
Default	true

Allow users to set their own quiet hours schedule for workspaces to stop in (depending on template autostop requirement settings). If false, users can't change their quiet hours schedule and the site default is always used.

--allow-workspace-renames

Type	bool
Environment	$CODER_ALLOW_WORKSPACE_RENAMES
YAML	allowWorkspaceRenames
Default	false

DEPRECATED: Allow users to rename their workspaces. Use only for temporary compatibility reasons, this will be removed in a future release.

--block-direct-connections

Type	bool
Environment	$CODER_BLOCK_DIRECT
YAML	networking.derp.blockDirect

Block peer-to-peer (aka. direct) workspace connections. All workspace connections from the CLI will be proxied through Coder (or custom configured DERP servers) and will never be peer-to-peer when enabled. Workspaces may still reach out to STUN servers to get their address until they are restarted after this change has been made, but new connections will still be proxied regardless.

--browser-only

Type	bool
Environment	$CODER_BROWSER_ONLY
YAML	networking.browserOnly

Whether Coder only allows connections to workspaces via the browser.

--cli-upgrade-message

Type	string
Environment	$CODER_CLI_UPGRADE_MESSAGE
YAML	client.cliUpgradeMessage

The upgrade message to display to users when a client/server mismatch is detected. By default it instructs users to update using 'curl -L https://coder.com/install.sh | sh'.

--cache-dir

Type	string
Environment	$CODER_CACHE_DIRECTORY
YAML	cacheDir
Default	~/.cache/coder

The directory to cache temporary files. If unspecified and $CACHE_DIRECTORY is set, it will be used for compatibility with systemd.

--trace-logs

Type	bool
Environment	$CODER_TRACE_LOGS
YAML	introspection.tracing.captureLogs

Enables capturing of logs as events in traces. This is useful for debugging, but may result in a very large amount of events being sent to the tracing backend which may incur significant costs.

-c, --config

Type	yaml-config-path
Environment	$CODER_CONFIG_PATH

Specify a YAML file to load configuration from.

--dangerous-allow-path-app-sharing

Type	bool
Environment	$CODER_DANGEROUS_ALLOW_PATH_APP_SHARING

Allow workspace apps that are not served from subdomains to be shared. Path-based app sharing is DISABLED by default for security purposes. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.

--dangerous-allow-path-app-site-owner-access

Type	bool
Environment	$CODER_DANGEROUS_ALLOW_PATH_APP_SITE_OWNER_ACCESS

Allow site-owners to access workspace apps from workspaces they do not own. Owners cannot access path-based apps they do not own by default. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.

--derp-config-path

Type	string
Environment	$CODER_DERP_CONFIG_PATH
YAML	networking.derp.configPath

Path to read a DERP mapping from. See: https://tailscale.com/kb/1118/custom-derp-servers/.

--derp-config-url

Type	string
Environment	$CODER_DERP_CONFIG_URL
YAML	networking.derp.url

URL to fetch a DERP mapping on startup. See: https://tailscale.com/kb/1118/custom-derp-servers/.

--derp-force-websockets

Type	bool
Environment	$CODER_DERP_FORCE_WEBSOCKETS
YAML	networking.derp.forceWebSockets

Force clients and agents to always use WebSocket to connect to DERP relay servers. By default, DERP uses Upgrade: derp, which may cause issues with some reverse proxies. Clients may automatically fallback to WebSocket if they detect an issue with Upgrade: derp, but this does not work in all situations.

--derp-server-enable

Type	bool
Environment	$CODER_DERP_SERVER_ENABLE
YAML	networking.derp.enable
Default	true

Whether to enable or disable the embedded DERP relay server.

--derp-server-region-name

Type	string
Environment	$CODER_DERP_SERVER_REGION_NAME
YAML	networking.derp.regionName
Default	Coder Embedded Relay

Region name that for the embedded DERP server.

--derp-server-relay-url

Type	url
Environment	$CODER_DERP_SERVER_RELAY_URL
YAML	networking.derp.relayURL

An HTTP URL that is accessible by other replicas to relay DERP traffic. Required for high availability.

--derp-server-stun-addresses

Type	string-array
Environment	$CODER_DERP_SERVER_STUN_ADDRESSES
YAML	networking.derp.stunAddresses
Default	stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302,stun3.l.google.com:19302,stun4.l.google.com:19302

Addresses for STUN servers to establish P2P connections. It's recommended to have at least two STUN servers to give users the best chance of connecting P2P to workspaces. Each STUN server will get it's own DERP region, with region IDs starting at --derp-server-region-id + 1. Use special value 'disable' to turn off STUN completely.

--default-quiet-hours-schedule

Type	string
Environment	$CODER_QUIET_HOURS_DEFAULT_SCHEDULE
YAML	userQuietHoursSchedule.defaultQuietHoursSchedule
Default	CRON_TZ=UTC 0 0 * * *

The default daily cron schedule applied to users that haven't set a custom quiet hours schedule themselves. The quiet hours schedule determines when workspaces will be force stopped due to the template's autostop requirement, and will round the max deadline up to be within the user's quiet hours window (or default). The format is the same as the standard cron format, but the day-of-month, month and day-of-week must be *. Only one hour and minute can be specified (ranges or comma separated values are not supported).

--disable-owner-workspace-access

Type	bool
Environment	$CODER_DISABLE_OWNER_WORKSPACE_ACCESS
YAML	disableOwnerWorkspaceAccess

Remove the permission for the 'owner' role to have workspace execution on all workspaces. This prevents the 'owner' from ssh, apps, and terminal access based on the 'owner' role. They still have their user permissions to access their own workspaces.

--disable-password-auth

Type	bool
Environment	$CODER_DISABLE_PASSWORD_AUTH
YAML	networking.http.disablePasswordAuth

Disable password authentication. This is recommended for security purposes in production deployments that rely on an identity provider. Any user with the owner role will be able to sign in with their password regardless of this setting to avoid potential lock out. If you are locked out of your account, you can use the coder server create-admin command to create a new admin user directly in the database.

--disable-path-apps

Type	bool
Environment	$CODER_DISABLE_PATH_APPS
YAML	disablePathApps

Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.

--disable-session-expiry-refresh

Type	bool
Environment	$CODER_DISABLE_SESSION_EXPIRY_REFRESH
YAML	networking.http.disableSessionExpiryRefresh

Disable automatic session expiry bumping due to activity. This forces all sessions to become invalid after the session expiry duration has been reached.

--docs-url

Type	url
Environment	$CODER_DOCS_URL
YAML	networking.docsURL

Specifies the custom docs URL.

--oidc-group-auto-create

Type	bool
Environment	$CODER_OIDC_GROUP_AUTO_CREATE
YAML	oidc.enableGroupAutoCreate
Default	false

Automatically creates missing groups from a user's groups claim.

--enable-terraform-debug-mode

Type	bool
Environment	$CODER_ENABLE_TERRAFORM_DEBUG_MODE
YAML	introspection.logging.enableTerraformDebugMode
Default	false

Allow administrators to enable Terraform debug output.

--swagger-enable

Type	bool
Environment	$CODER_SWAGGER_ENABLE
YAML	enableSwagger

Expose the swagger endpoint via /swagger.

--experiments

Type	string-array
Environment	$CODER_EXPERIMENTS
YAML	experiments

Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.

--external-token-encryption-keys

Type	string-array
Environment	$CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS

Encrypt OIDC and Git authentication tokens with AES-256-GCM in the database. The value must be a comma-separated list of base64-encoded keys. Each key, when base64-decoded, must be exactly 32 bytes in length. The first key will be used to encrypt new values. Subsequent keys will be used as a fallback when decrypting. During normal operation it is recommended to only set one key unless you are in the process of rotating keys with the coder server dbcrypt rotate command.

--provisioner-force-cancel-interval

Type	duration
Environment	$CODER_PROVISIONER_FORCE_CANCEL_INTERVAL
YAML	provisioning.forceCancelInterval
Default	10m0s

Time to force cancel provisioning tasks that are stuck.

--http-address

Type	string
Environment	$CODER_HTTP_ADDRESS
YAML	networking.http.httpAddress
Default	127.0.0.1:3000

HTTP bind address of the server. Unset to disable the HTTP endpoint.

--health-check-refresh

Type	duration
Environment	$CODER_HEALTH_CHECK_REFRESH
YAML	introspection.healthcheck.refresh
Default	10m0s

Refresh interval for healthchecks.

--health-check-threshold-database

Type	duration
Environment	$CODER_HEALTH_CHECK_THRESHOLD_DATABASE
YAML	introspection.healthcheck.thresholdDatabase
Default	15ms

The threshold for the database health check. If the median latency of the database exceeds this threshold over 5 attempts, the database is considered unhealthy. The default value is 15ms.

--log-human

Type	string
Environment	$CODER_LOGGING_HUMAN
YAML	introspection.logging.humanPath
Default	/dev/stderr

Output human-readable logs to a given file.

--log-json

Type	string
Environment	$CODER_LOGGING_JSON
YAML	introspection.logging.jsonPath

Output JSON logs to a given file.

-l, --log-filter

Type	string-array
Environment	$CODER_LOG_FILTER
YAML	introspection.logging.filter

Filter debug logs by matching against a given regex. Use .* to match all debug logs.

--max-token-lifetime

Type	duration
Environment	$CODER_MAX_TOKEN_LIFETIME
YAML	networking.http.maxTokenLifetime
Default	876600h0m0s

The maximum lifetime duration users can specify when creating an API token.

--oauth2-github-allow-everyone

Type	bool
Environment	$CODER_OAUTH2_GITHUB_ALLOW_EVERYONE
YAML	oauth2.github.allowEveryone

Allow all logins, setting this option means allowed orgs and teams must be empty.

--oauth2-github-allow-signups

Type	bool
Environment	$CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS
YAML	oauth2.github.allowSignups

Whether new users can sign up with GitHub.

--oauth2-github-allowed-orgs

Type	string-array
Environment	$CODER_OAUTH2_GITHUB_ALLOWED_ORGS
YAML	oauth2.github.allowedOrgs

Organizations the user must be a member of to Login with GitHub.

--oauth2-github-allowed-teams

Type	string-array
Environment	$CODER_OAUTH2_GITHUB_ALLOWED_TEAMS
YAML	oauth2.github.allowedTeams

Teams inside organizations the user must be a member of to Login with GitHub. Structured as: /.

--oauth2-github-client-id

Type	string
Environment	$CODER_OAUTH2_GITHUB_CLIENT_ID
YAML	oauth2.github.clientID

Client ID for Login with GitHub.

--oauth2-github-client-secret

Type	string
Environment	$CODER_OAUTH2_GITHUB_CLIENT_SECRET

Client secret for Login with GitHub.

--oauth2-github-enterprise-base-url

Type	string
Environment	$CODER_OAUTH2_GITHUB_ENTERPRISE_BASE_URL
YAML	oauth2.github.enterpriseBaseURL

Base URL of a GitHub Enterprise deployment to use for Login with GitHub.

--oidc-allow-signups

Type	bool
Environment	$CODER_OIDC_ALLOW_SIGNUPS
YAML	oidc.allowSignups
Default	true

Whether new users can sign up with OIDC.

--oidc-allowed-groups

Type	string-array
Environment	$CODER_OIDC_ALLOWED_GROUPS
YAML	oidc.groupAllowed

If provided any group name not in the list will not be allowed to authenticate. This allows for restricting access to a specific set of groups. This filter is applied after the group mapping and before the regex filter.

--oidc-auth-url-params

Type	struct[map[string]string]
Environment	$CODER_OIDC_AUTH_URL_PARAMS
YAML	oidc.authURLParams
Default	{"access_type": "offline"}

OIDC auth URL parameters to pass to the upstream provider.

--oidc-client-cert-file

Type	string
Environment	$CODER_OIDC_CLIENT_CERT_FILE
YAML	oidc.oidcClientCertFile

Pem encoded certificate file to use for oauth2 PKI/JWT authorization. The public certificate that accompanies oidc-client-key-file. A standard x509 certificate is expected.

--oidc-client-id

Type	string
Environment	$CODER_OIDC_CLIENT_ID
YAML	oidc.clientID

Client ID to use for Login with OIDC.

--oidc-client-key-file

Type	string
Environment	$CODER_OIDC_CLIENT_KEY_FILE
YAML	oidc.oidcClientKeyFile

Pem encoded RSA private key to use for oauth2 PKI/JWT authorization. This can be used instead of oidc-client-secret if your IDP supports it.

--oidc-client-secret

Type	string
Environment	$CODER_OIDC_CLIENT_SECRET

Client secret to use for Login with OIDC.

--oidc-email-domain

Type	string-array
Environment	$CODER_OIDC_EMAIL_DOMAIN
YAML	oidc.emailDomain

Email domains that clients logging in with OIDC must match.

--oidc-email-field

Type	string
Environment	$CODER_OIDC_EMAIL_FIELD
YAML	oidc.emailField
Default	email

OIDC claim field to use as the email.

--oidc-group-field

Type	string
Environment	$CODER_OIDC_GROUP_FIELD
YAML	oidc.groupField

This field must be set if using the group sync feature and the scope name is not 'groups'. Set to the claim to be used for groups.

--oidc-group-mapping

Type	struct[map[string]string]
Environment	$CODER_OIDC_GROUP_MAPPING
YAML	oidc.groupMapping
Default	{}

A map of OIDC group IDs and the group in Coder it should map to. This is useful for when OIDC providers only return group IDs.

--oidc-ignore-email-verified

Type	bool
Environment	$CODER_OIDC_IGNORE_EMAIL_VERIFIED
YAML	oidc.ignoreEmailVerified

Ignore the email_verified claim from the upstream provider.

--oidc-ignore-userinfo

Type	bool
Environment	$CODER_OIDC_IGNORE_USERINFO
YAML	oidc.ignoreUserInfo
Default	false

Ignore the userinfo endpoint and only use the ID token for user information.

--oidc-issuer-url

Type	string
Environment	$CODER_OIDC_ISSUER_URL
YAML	oidc.issuerURL

Issuer URL to use for Login with OIDC.

--oidc-group-regex-filter

Type	regexp
Environment	$CODER_OIDC_GROUP_REGEX_FILTER
YAML	oidc.groupRegexFilter
Default	.*

If provided any group name not matching the regex is ignored. This allows for filtering out groups that are not needed. This filter is applied after the group mapping.

--oidc-scopes

Type	string-array
Environment	$CODER_OIDC_SCOPES
YAML	oidc.scopes
Default	openid,profile,email

Scopes to grant when authenticating with OIDC.

--oidc-user-role-default

Type	string-array
Environment	$CODER_OIDC_USER_ROLE_DEFAULT
YAML	oidc.userRoleDefault

If user role sync is enabled, these roles are always included for all authenticated users. The 'member' role is always assigned.

--oidc-user-role-field

Type	string
Environment	$CODER_OIDC_USER_ROLE_FIELD
YAML	oidc.userRoleField

This field must be set if using the user roles sync feature. Set this to the name of the claim used to store the user's role. The roles should be sent as an array of strings.

--oidc-user-role-mapping

Type	struct[map[string][]string]
Environment	$CODER_OIDC_USER_ROLE_MAPPING
YAML	oidc.userRoleMapping
Default	{}

A map of the OIDC passed in user roles and the groups in Coder it should map to. This is useful if the group names do not match. If mapped to the empty string, the role will ignored.

--oidc-username-field

Type	string
Environment	$CODER_OIDC_USERNAME_FIELD
YAML	oidc.usernameField
Default	preferred_username

OIDC claim field to use as the username.

--oidc-sign-in-text

Type	string
Environment	$CODER_OIDC_SIGN_IN_TEXT
YAML	oidc.signInText
Default	OpenID Connect

The text to show on the OpenID Connect sign in button.

--oidc-icon-url

Type	url
Environment	$CODER_OIDC_ICON_URL
YAML	oidc.iconURL

URL pointing to the icon to use on the OpenID Connect login button.

--provisioner-daemon-poll-interval

Type	duration
Environment	$CODER_PROVISIONER_DAEMON_POLL_INTERVAL
YAML	provisioning.daemonPollInterval
Default	1s

Deprecated and ignored.

--provisioner-daemon-poll-jitter

Type	duration
Environment	$CODER_PROVISIONER_DAEMON_POLL_JITTER
YAML	provisioning.daemonPollJitter
Default	100ms

Deprecated and ignored.

--postgres-url

Type	string
Environment	$CODER_PG_CONNECTION_URL

URL of a PostgreSQL database. If empty, PostgreSQL binaries will be downloaded from Maven (https://repo1.maven.org/maven2) and store all data in the config root. Access the built-in database with "coder server postgres-builtin-url".

--prometheus-address

Type	host:port
Environment	$CODER_PROMETHEUS_ADDRESS
YAML	introspection.prometheus.address
Default	127.0.0.1:2112

The bind address to serve prometheus metrics.

--prometheus-aggregate-agent-stats-by

Type	string-array
Environment	$CODER_PROMETHEUS_AGGREGATE_AGENT_STATS_BY
YAML	introspection.prometheus.aggregate_agent_stats_by
Default	agent_name,template_name,username,workspace_name

When collecting agent stats, aggregate metrics by a given set of comma-separated labels to reduce cardinality. Accepted values are agent_name, template_name, username, workspace_name.

--prometheus-collect-agent-stats

Type	bool
Environment	$CODER_PROMETHEUS_COLLECT_AGENT_STATS
YAML	introspection.prometheus.collect_agent_stats

Collect agent stats (may increase charges for metrics storage).

--prometheus-collect-db-metrics

Type	bool
Environment	$CODER_PROMETHEUS_COLLECT_DB_METRICS
YAML	introspection.prometheus.collect_db_metrics
Default	false

Collect database metrics (may increase charges for metrics storage).

--prometheus-enable

Type	bool
Environment	$CODER_PROMETHEUS_ENABLE
YAML	introspection.prometheus.enable

Serve prometheus metrics on the address defined by prometheus address.

--provisioner-daemon-psk

Type	string
Environment	$CODER_PROVISIONER_DAEMON_PSK

Pre-shared key to authenticate external provisioner daemons to Coder server.

--provisioner-daemons

Type	int
Environment	$CODER_PROVISIONER_DAEMONS
YAML	provisioning.daemons
Default	3

Number of provisioner daemons to create on start. If builds are stuck in queued state for a long time, consider increasing this.

--proxy-health-interval

Type	duration
Environment	$CODER_PROXY_HEALTH_INTERVAL
YAML	networking.http.proxyHealthInterval
Default	1m0s

The interval in which coderd should be checking the status of workspace proxies.

--proxy-trusted-headers

Type	string-array
Environment	$CODER_PROXY_TRUSTED_HEADERS
YAML	networking.proxyTrustedHeaders

Headers to trust for forwarding IP addresses. e.g. Cf-Connecting-Ip, True-Client-Ip, X-Forwarded-For.

--proxy-trusted-origins

Type	string-array
Environment	$CODER_PROXY_TRUSTED_ORIGINS
YAML	networking.proxyTrustedOrigins

Origin addresses to respect "proxy-trusted-headers". e.g. 192.168.1.0/24.

--redirect-to-access-url

Type	bool
Environment	$CODER_REDIRECT_TO_ACCESS_URL
YAML	networking.redirectToAccessURL

Specifies whether to redirect requests that do not match the access URL host.

--scim-auth-header

Type	string
Environment	$CODER_SCIM_AUTH_HEADER

Enables SCIM and sets the authentication header for the built-in SCIM server. New users are automatically created with OIDC authentication.

--ssh-config-options

Type	string-array
Environment	$CODER_SSH_CONFIG_OPTIONS
YAML	client.sshConfigOptions

These SSH config options will override the default SSH config options. Provide options in "key=value" or "key value" format separated by commas.Using this incorrectly can break SSH to your deployment, use cautiously.

--ssh-hostname-prefix

Type	string
Environment	$CODER_SSH_HOSTNAME_PREFIX
YAML	client.sshHostnamePrefix
Default	coder.

The SSH deployment prefix is used in the Host of the ssh config.

--ssh-keygen-algorithm

Type	string
Environment	$CODER_SSH_KEYGEN_ALGORITHM
YAML	sshKeygenAlgorithm
Default	ed25519

The algorithm to use for generating ssh keys. Accepted values are "ed25519", "ecdsa", or "rsa4096".

--secure-auth-cookie

Type	bool
Environment	$CODER_SECURE_AUTH_COOKIE
YAML	networking.secureAuthCookie

Controls if the 'Secure' property is set on browser session cookies.

--session-duration

Type	duration
Environment	$CODER_SESSION_DURATION
YAML	networking.http.sessionDuration
Default	24h0m0s

The token expiry duration for browser sessions. Sessions may last longer if they are actively making requests, but this functionality can be disabled via --disable-session-expiry-refresh.

--oidc-signups-disabled-text

Type	string
Environment	$CODER_OIDC_SIGNUPS_DISABLED_TEXT
YAML	oidc.signupsDisabledText

The custom text to show on the error page informing about disabled OIDC signups. Markdown format is supported.

--log-stackdriver

Type	string
Environment	$CODER_LOGGING_STACKDRIVER
YAML	introspection.logging.stackdriverPath

Output Stackdriver compatible logs to a given file.

--strict-transport-security

Type	int
Environment	$CODER_STRICT_TRANSPORT_SECURITY
YAML	networking.tls.strictTransportSecurity
Default	0

Controls if the 'Strict-Transport-Security' header is set on all static file responses. This header should only be set if the server is accessed via HTTPS. This value is the MaxAge in seconds of the header.

--strict-transport-security-options

Type	string-array
Environment	$CODER_STRICT_TRANSPORT_SECURITY_OPTIONS
YAML	networking.tls.strictTransportSecurityOptions

Two optional fields can be set in the Strict-Transport-Security header; 'includeSubDomains' and 'preload'. The 'strict-transport-security' flag must be set to a non-zero value for these options to be used.

--support-links

Type	struct[[]codersdk.LinkConfig]
Environment	$CODER_SUPPORT_LINKS
YAML	supportLinks

Support links to display in the top right drop down menu.

--tls-address

Type	host:port
Environment	$CODER_TLS_ADDRESS
YAML	networking.tls.address
Default	127.0.0.1:3443

HTTPS bind address of the server.

--tls-allow-insecure-ciphers

Type	bool
Environment	$CODER_TLS_ALLOW_INSECURE_CIPHERS
YAML	networking.tls.tlsAllowInsecureCiphers
Default	false

By default, only ciphers marked as 'secure' are allowed to be used. See https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L82-L95.

--tls-cert-file

Type	string-array
Environment	$CODER_TLS_CERT_FILE
YAML	networking.tls.certFiles

Path to each certificate for TLS. It requires a PEM-encoded file. To configure the listener to use a CA certificate, concatenate the primary certificate and the CA certificate together. The primary certificate should appear first in the combined file.

--tls-ciphers

Type	string-array
Environment	$CODER_TLS_CIPHERS
YAML	networking.tls.tlsCiphers

Specify specific TLS ciphers that allowed to be used. See https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L53-L75.

--tls-client-auth

Type	string
Environment	$CODER_TLS_CLIENT_AUTH
YAML	networking.tls.clientAuth
Default	none

Policy the server will follow for TLS Client Authentication. Accepted values are "none", "request", "require-any", "verify-if-given", or "require-and-verify".

--tls-client-ca-file

Type	string
Environment	$CODER_TLS_CLIENT_CA_FILE
YAML	networking.tls.clientCAFile

PEM-encoded Certificate Authority file used for checking the authenticity of client.

--tls-client-cert-file

Type	string
Environment	$CODER_TLS_CLIENT_CERT_FILE
YAML	networking.tls.clientCertFile

Path to certificate for client TLS authentication. It requires a PEM-encoded file.

--tls-client-key-file

Type	string
Environment	$CODER_TLS_CLIENT_KEY_FILE
YAML	networking.tls.clientKeyFile

Path to key for client TLS authentication. It requires a PEM-encoded file.

--tls-enable

Type	bool
Environment	$CODER_TLS_ENABLE
YAML	networking.tls.enable

Whether TLS will be enabled.

--tls-key-file

Type	string-array
Environment	$CODER_TLS_KEY_FILE
YAML	networking.tls.keyFiles

Paths to the private keys for each of the certificates. It requires a PEM-encoded file.

--tls-min-version

Type	string
Environment	$CODER_TLS_MIN_VERSION
YAML	networking.tls.minVersion
Default	tls12

Minimum supported version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13".

--telemetry

Type	bool
Environment	$CODER_TELEMETRY_ENABLE
YAML	telemetry.enable
Default	true

Whether telemetry is enabled or not. Coder collects anonymized usage data to help improve our product.

--trace

Type	bool
Environment	$CODER_TRACE_ENABLE
YAML	introspection.tracing.enable

Whether application tracing data is collected. It exports to a backend configured by environment variables. See: https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md.

--trace-honeycomb-api-key

Type	string
Environment	$CODER_TRACE_HONEYCOMB_API_KEY

Enables trace exporting to Honeycomb.io using the provided API Key.

--update-check

Type	bool
Environment	$CODER_UPDATE_CHECK
YAML	updateCheck
Default	false

Periodically check for new releases of Coder and inform the owner. The check is performed once per day.

--web-terminal-renderer

Type	string
Environment	$CODER_WEB_TERMINAL_RENDERER
YAML	client.webTerminalRenderer
Default	canvas

The renderer to use when opening a web terminal. Valid values are 'canvas', 'webgl', or 'dom'.

--wildcard-access-url

Type	string
Environment	$CODER_WILDCARD_ACCESS_URL
YAML	networking.wildcardAccessURL

Specifies the wildcard hostname to use for workspace applications in the form "*.example.com".

--write-config

Type	bool

Write out the current server config as YAML to stdout.

--pprof-address

Type	host:port
Environment	$CODER_PPROF_ADDRESS
YAML	introspection.pprof.address
Default	127.0.0.1:6060

The bind address to serve pprof.

--pprof-enable

Type	bool
Environment	$CODER_PPROF_ENABLE
YAML	introspection.pprof.enable

Serve pprof metrics on the address defined by pprof address.