main.tf

terraform {
  required_providers {
    coder = {
      source = "coder/coder"
      version = ">=2.4.0"
    }
    docker = {
      source = "kreuzwerker/docker"
    }
  }
}

data "coder_provisioner" "me" {
}


data "coder_workspace" "me" {
}

data "coder_workspace_owner" "me" {}

locals {
  coder_app_subdomain = false
  coder_app_slug = "vscode-web"
  is_template = data.coder_parameter.workspace_source.value == "template"
  code_dir = local.is_template ? "code" : module.git_clone_source.folder_name
  vscode_server_base_path = local.coder_app_subdomain ? "" : "/@${data.coder_workspace_owner.me.name}/${data.coder_workspace.me.name}/apps/${local.coder_app_slug}/"
  vscode_server_args = "--server-data-dir /host/vscode/server ${local.vscode_server_base_path != "" ? format("%s %s","--server-base-path", local.vscode_server_base_path) : ""}"
  devcontainer_flag_rebuid = data.coder_parameter.force_rebuild.value ? "--remove-existing-container" : ""
  # git module has a bug that appens / infront of folder name if doesn't exist.
  project_dir = local.is_template ? "$HOME/${local.code_dir}" : replace(module.git_clone_source.folder_name, "/^~/", "$HOME")
  vscode_url_folder_arg = "/workspaces/${local.code_dir}"
  devcontainer_poststart_script = join("\\n", [
    "export VSCODE_CLI_USE_FILE_KEYCHAIN=1 && VSCODE_CLI_DISABLE_KEYCHAIN_ENCRYPT=1",
    "sudo mkdir -p /host/vscode/server /workspaces && sudo chmod 777 -R /host",
    "ln -fs /host/vscode ~/.vscode",
    "ln -fs /parent/ssh ~/.ssh",
    "sudo chown |dlr|(whoami) -R ~/.ssh /workspaces",
    "export |dlr|(xargs < /parent/env) && if [ ! -d /workspaces/|dlr|GIT_PROJ_DIR ]; then ln -s |dlr|REMOTE_WS_DIR /workspaces/|dlr|GIT_PROJ_DIR; fi"
  ])
  script_template_devc_up = <<EOF
    if [ -f "${local.project_dir}/.devcontainer/devcontainer.json" ]; then
      echo "devcontainer exists."
    else
      devcontainer templates apply --workspace-folder=${local.project_dir} ${try(data.coder_parameter.template_image[0].value, "")}
    fi
  EOF
  devcontainer_templates = flatten([
    for item in jsondecode(data.http.devcontainer_template_list.response_body): [
      for imgVar in coalesce(item.imageVariant, ["null"]): {
        id: item.id
        name: imgVar == "null" ? item.id : "${item.id}:${imgVar}"
        imageVariant: imgVar
        template_args: imgVar == "null" ? "" : "--template-args '{ \"imageVariant\": \"${imgVar}\" }'"
      }
    ]
  ])
}

variable "docker_config" {
  type        = string
  description = "Docker config. Typically contains registry credential and other information"
  default     = ""
  sensitive   = true
}

variable "docker_socket" {
  default     = ""
  description = "Docker socket URI"
  type        = string
}


provider "docker" {
  host = var.docker_socket != "" ? var.docker_socket : null
  ssh_opts = ["-o", "StrictHostKeyChecking=no", "-o", "UserKnownHostsFile=/dev/null"]
  disable_docker_daemon_check = true
}

data "http" "devcontainer_template_list" {
  url = "https://gist.githubusercontent.com/inabhi9/0473f0fce9d15576f1e97dae28d395d6/raw/output.json"
}

data "coder_parameter" "workspace_source" {
  name        = "Workspace Source"
  type        = "string"
  mutable     = false
  order       = 2
  default     = "git"

  option {
    name  = "Git repository"
    value = "git"
  }

  option {
    name  = "Template"
    value = "template"
  }
}

data "coder_parameter" "custom_repo_url" {
  count        = data.coder_parameter.workspace_source.value != "git" ? 0 : 1
  name         = "custom_repo"
  display_name = "Git Repository URL"
  order        = 3
  description  = "Git Repository URL, see [awesome-devcontainers](https://github.com/manekinekko/awesome-devcontainers)."
  mutable      = false
}

data "coder_parameter" "devcontainer_repo_url" {
  count        = data.coder_parameter.workspace_source.value == "git" ? 1 : 0
  name         = "devcontainer_repo"
  display_name = "Devcontainer repository URL"
  order        = 3
  default      = ""
  description  = "A separate repository to locate .devcontainer directory. When provided, it's cloned to temporary directory and provided during devcontainer build."
  mutable      = true
}


data coder_parameter "template_image" {
  count        = data.coder_parameter.workspace_source.value != "template" ? 0 : 1
  name        = "Template Image"
  type        = "string"
  mutable     = false
  order       = 3
  form_type   = "dropdown"

  dynamic "option" {
    for_each = local.devcontainer_templates
    content {
      name = option.value.name
      value = "--template-id ghcr.io/devcontainers/templates/${option.value.id}:latest ${option.value.template_args}"
    }
  }
}

data "coder_parameter" "force_rebuild" {
  name         = "Force rebuild"
  type         = "bool"
  description  = "Rebuild the devcontainer rather than use the cached one."
  mutable      = true
  default      = false
  ephemeral    = true
}

module "git_clone_source" {
  source   = "registry.coder.com/coder/git-clone/coder"
  agent_id = coder_agent.main.id
  url      = try(data.coder_parameter.custom_repo_url[0].value, "https://github.com/sarcasticadmin/empty-repo.git")
  base_dir = local.is_template ? "/tmp" : "~"
  # This ensures that the latest non-breaking version of the module gets
  # downloaded, you can also pin the module version to prevent breaking
  # changes in production.
  version = "~> 1.0"
}

module "git_clone_devcontainer" {
  version = "~> 1.0"
  count    = length(data.coder_parameter.devcontainer_repo_url) > 0 && data.coder_parameter.devcontainer_repo_url[0].value != "" ? 1 : 0
  source   = "registry.coder.com/coder/git-clone/coder"
  agent_id = coder_agent.main.id
  url      = data.coder_parameter.devcontainer_repo_url[0].value
  base_dir = "~"
  post_clone_script = <<EOF
  #!/bin/sh
  cp -r ${module.git_clone_devcontainer[0].repo_dir}/.devcontainer ${module.git_clone_source.repo_dir}
  git -C ${module.git_clone_source.repo_dir} config --replace-all core.excludesFile ${module.git_clone_source.repo_dir}/.git/.exclude
  echo .devcontainer > ${module.git_clone_source.repo_dir}/.git/info/exclude
  rm -fr ${module.git_clone_devcontainer[0].repo_dir}
  EOF
}

module "devcontainers_cli" {
  source   = "registry.coder.com/coder/devcontainers-cli/coder"
  version  = "1.0.32"
  agent_id = coder_agent.main.id
}

resource "coder_agent" "main" {
  arch           = "amd64"
  os             = "linux"
  startup_script_behavior = "blocking"
  startup_script = <<EOF
  #!/bin/sh
  set -e

  sudo service docker start

  git config --global user.name "${data.coder_workspace_owner.me.name}"
  git config --global user.email "${data.coder_workspace_owner.me.email}"

  mkdir -p ~/.ssh ~/parent ${local.project_dir}
  
  echo "access_path: ${local.vscode_server_base_path}. Prodject dir: ${local.project_dir},  ${local.is_template}"

  printf "Host *\n\tStrictHostKeyChecking no\n" > ~/.ssh/config
  curl -s -H "Coder-Session-Token: $CODER_AGENT_TOKEN" $${CODER_AGENT_URL}api/v2/workspaceagents/me/gitsshkey \
    | jq -r '.private_key' > ~/.ssh/id_ed25519 \
    && chmod 600 $HOME/.ssh/id_ed25519

  while ! devcontainer --version > /dev/null || pgrep git > /dev/null || ! docker info > /dev/null
  do
      echo "Waiting for everything to be ready..."
      sleep 2
  done

  ${local.script_template_devc_up}

  devcontainer up ${local.devcontainer_flag_rebuid} --workspace-folder=${local.project_dir} \
    --mount=type=bind,source=/host,target=/host \
    --mount=type=bind,source=$HOME/parent,target=/parent \
    --mount=type=bind,source=$HOME/.ssh,target=/parent/ssh \
    --mount=type=bind,source=$HOME/.gitconfig,target=/etc/gitconfig \
    --additional-features='{"ghcr.io/inabhi9/devcontainer-features/msvscode-server:1.0.12": {"vscodeServerFlags": "${local.vscode_server_args}", "postContainerStartCommand": "${local.devcontainer_poststart_script}"}}' | tee $HOME/parent/result.json
  
  # Workaround to open directory directly by vs code web
  REMOTE_WS_DIR=$(cat $HOME/parent/result.json | jq -r .remoteWorkspaceFolder)
  GIT_PROJ_DIR=${local.code_dir}
  echo REMOTE_WS_DIR=$REMOTE_WS_DIR\\nGIT_PROJ_DIR=$GIT_PROJ_DIR > ~/parent/env

  # Workaround for the first execution
  devcontainer exec --workspace-folder=${local.project_dir} /usr/local/bin/vscode-server-entrypoint >/dev/null 2>&1 & 
  EOF

  env = {
    GIT_AUTHOR_NAME = "${data.coder_workspace_owner.me.name}"
    GIT_COMMITTER_NAME = "${data.coder_workspace_owner.me.name}"
    GIT_AUTHOR_EMAIL = "${data.coder_workspace_owner.me.email}"
    GIT_COMMITTER_EMAIL = "${data.coder_workspace_owner.me.email}"
  }

  display_apps {
    vscode          = false
    vscode_insiders = false
    web_terminal    = true
    ssh_helper      = false
    port_forwarding_helper = false
  }
}


resource "coder_app" "code_server" {
  agent_id     = coder_agent.main.id
  slug         = local.coder_app_slug
  display_name = "VS Code Web"
  icon         = "/icon/code.svg"
  url          = "http://127.0.0.1:13338${local.vscode_server_base_path}?folder=${local.vscode_url_folder_arg}"
  subdomain    = local.coder_app_subdomain
  share        = "owner"

  healthcheck {
    url       = "http://127.0.0.1:13338/healthz"
    interval  = 2
    threshold = 100
  }

}

resource "docker_volume" "workspaces" {
  name = "coder-${data.coder_workspace.me.id}"
  # Protect the volume from being deleted due to changes in attributes.
  lifecycle {
    ignore_changes = all
  }
  # Add labels in Docker to keep track of orphan resources.
  labels {
    label = "coder.owner"
    value = data.coder_workspace_owner.me.name
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace_owner.me.id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  # This field becomes outdated if the workspace is renamed but can
  # be useful for debugging or cleaning out dangling volumes.
  labels {
    label = "coder.workspace_name_at_creation"
    value = data.coder_workspace.me.name
  }
}

resource "docker_volume" "docker_data_root" {
  name = "coder-docker-data-${data.coder_workspace.me.id}"
  # Protect the volume from being deleted due to changes in attributes.
  lifecycle {
    ignore_changes = all
  }
  # Add labels in Docker to keep track of orphan resources.
  labels {
    label = "coder.owner"
    value = data.coder_workspace_owner.me.name
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace_owner.me.id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  # This field becomes outdated if the workspace is renamed but can
  # be useful for debugging or cleaning out dangling volumes.
  labels {
    label = "coder.workspace_name_at_creation"
    value = data.coder_workspace.me.name
  }
}

resource "docker_container" "workspace" {
  runtime = "sysbox-runc"
  
  count = data.coder_workspace.me.start_count
  # Find the latest version here:
  # https://github.com/coder/envbuilder/tags
  image = "codercom/enterprise-node:ubuntu"
  # Uses lower() to avoid Docker restriction on container names.
  name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
  # Hostname makes the shell more user friendly: coder@my-workspace:~$
  hostname = data.coder_workspace.me.name
  # Use the docker gateway if the access URL is 127.0.0.1
  entrypoint = ["sh", "-c", replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")]
  env = [
    "CODER_AGENT_TOKEN=${coder_agent.main.token}",
    "GIT_URL=${try(data.coder_parameter.custom_repo_url[0].value, "")}",
    "INIT_SCRIPT=${replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")}",
    "DOCKER_CONFIG_JSON=${var.docker_config}"
  ]
  host {
    host = "host.docker.internal"
    ip   = "host-gateway"
  }
  volumes {
    container_path = "/home/coder"
    volume_name    = docker_volume.workspaces.name
    read_only      = false
  }
  volumes {
    container_path = "/var/lib/docker"
    volume_name    = docker_volume.docker_data_root.name
    read_only      = false
  }
  volumes {
    container_path = "/host"
    host_path = "/ddata/${lower(data.coder_workspace_owner.me.id)}"
  }

  capabilities {
    # --cap-add=NET_ADMIN and --cap-add=NET_RAW are needed for iptables
    # to forward vscode server port
    add = ["NET_RAW", "NET_ADMIN"]
  }

  # Add labels in Docker to keep track of orphan resources.
  labels {
    label = "coder.owner"
    value = data.coder_workspace_owner.me.name
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace_owner.me.id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  labels {
    label = "coder.workspace_name"
    value = data.coder_workspace.me.name
  }
}