From e08398d02a176906c04bb0a16bc66dbf456ce028 Mon Sep 17 00:00:00 2001 From: Peter Pathirana Date: Thu, 1 Oct 2026 00:26:23 +0000 Subject: [PATCH 1/4] fix(template): place filebrowser behind flag --- .../kubernetes/homelab-workspace/configmap.tf | 2 +- .../homelab-workspace/deployment.tf | 158 +++++++++--------- .../homelab-workspace/filebrowser.tf | 6 +- .../homelab-workspace/parameters.tf | 20 +++ 4 files changed, 108 insertions(+), 78 deletions(-) diff --git a/templates/kubernetes/homelab-workspace/configmap.tf b/templates/kubernetes/homelab-workspace/configmap.tf index 80ad63f4..ddd6c630 100644 --- a/templates/kubernetes/homelab-workspace/configmap.tf +++ b/templates/kubernetes/homelab-workspace/configmap.tf @@ -18,7 +18,7 @@ resource "kubernetes_config_map_v1" "workspace_scripts" { "script-start-services.sh" = file("${path.cwd}/scripts/script-start-services.sh") "supervisord.conf" = file("${path.cwd}/config/supervisord.conf") "script-vscode-server-gc.sh" = file("${path.cwd}/scripts/script-vscode-server-gc.sh") - "filebrowser-agent-init.sh" = coder_agent.filebrowser.init_script + "filebrowser-agent-init.sh" = (data.coder_parameter.filebrowser_enabled.value == "enabled") ? coder_agent.filebrowser[0].init_script : null "filebrowser.yaml" = file("${path.cwd}/config/filebrowser.yaml") "workspace-init.sh" = coder_agent.main.init_script } diff --git a/templates/kubernetes/homelab-workspace/deployment.tf b/templates/kubernetes/homelab-workspace/deployment.tf index 5887b8da..4a2cc1fb 100644 --- a/templates/kubernetes/homelab-workspace/deployment.tf +++ b/templates/kubernetes/homelab-workspace/deployment.tf @@ -141,82 +141,85 @@ resource "kubernetes_deployment_v1" "deployment" { name = "tmp" } } - container { - name = "filebrowser" - command = ["/bin/sh", "/scripts/filebrowser-agent-init.sh"] - image = "gtstef/filebrowser:1.5.6-stable@sha256:7c5d7ac8ffda31294d278063cf9d2e04303b39e6dce1f4c691342240ca7703b8" - env { - name = "CODER_AGENT_TOKEN" - value = coder_agent.filebrowser.token - } - env { - name = "FILEBROWSER_CONFIG" - value = "/config/filebrowser.yaml" - } - env { - name = "HOME" - value = "/home/filebrowser/data" - } - env { - name = "USER" - # The image's filebrowser account uses /bin/true. The agent uses - # this account only to select a shell; the Pod still enforces the - # non-root UID below. - value = "root" - } - port { - container_port = 8080 - name = "filebrowser" - protocol = "TCP" - } - liveness_probe { - http_get { - path = "/health" - port = 8080 - scheme = "HTTP" + dynamic "container" { + for_each = data.coder_parameter.filebrowser_enabled.value == "enabled" ? toset(["filebrowser"]) : [] + content { + name = "filebrowser" + command = ["/bin/sh", "/scripts/filebrowser-agent-init.sh"] + image = "gtstef/filebrowser:1.5.6-stable@sha256:7c5d7ac8ffda31294d278063cf9d2e04303b39e6dce1f4c691342240ca7703b8" + env { + name = "CODER_AGENT_TOKEN" + value = coder_agent.filebrowser.token } - initial_delay_seconds = 15 - period_seconds = 30 - timeout_seconds = 3 - failure_threshold = 3 - } - resources { - requests = { - "cpu" = "25m" - "memory" = "128Mi" + env { + name = "FILEBROWSER_CONFIG" + value = "/config/filebrowser.yaml" } - limits = { - "memory" = "256Mi" + env { + name = "HOME" + value = "/home/filebrowser/data" + } + env { + name = "USER" + # The image's filebrowser account uses /bin/true. The agent uses + # this account only to select a shell; the Pod still enforces the + # non-root UID below. + value = "root" + } + port { + container_port = 8080 + name = "filebrowser" + protocol = "TCP" + } + liveness_probe { + http_get { + path = "/health" + port = 8080 + scheme = "HTTP" + } + initial_delay_seconds = 15 + period_seconds = 30 + timeout_seconds = 3 + failure_threshold = 3 + } + resources { + requests = { + "cpu" = "25m" + "memory" = "256Mi" + } + limits = { + "memory" = "512Mi" + } + } + security_context { + allow_privilege_escalation = false + read_only_root_filesystem = false + privileged = false + run_as_user = 10001 + run_as_group = 10001 + run_as_non_root = true + } + volume_mount { + mount_path = "/srv" + name = "home" + sub_path = data.coder_workspace.me.name + } + volume_mount { + mount_path = "/scripts/filebrowser-agent-init.sh" + name = "coder-scripts" + sub_path = "filebrowser-agent-init.sh" + read_only = true + } + volume_mount { + mount_path = "/config/filebrowser.yaml" + name = "coder-scripts" + sub_path = "filebrowser.yaml" + read_only = true + } + volume_mount { + mount_path = "/home/filebrowser/data" + name = "filebrowser-data" } - } - security_context { - allow_privilege_escalation = false - read_only_root_filesystem = false - privileged = false - run_as_user = 10001 - run_as_group = 10001 - run_as_non_root = true - } - volume_mount { - mount_path = "/srv" - name = "home" - sub_path = data.coder_workspace.me.name - } - volume_mount { - mount_path = "/scripts/filebrowser-agent-init.sh" - name = "coder-scripts" - sub_path = "filebrowser-agent-init.sh" - read_only = true - } - volume_mount { - mount_path = "/config/filebrowser.yaml" - name = "coder-scripts" - sub_path = "filebrowser.yaml" - read_only = true - } - volume_mount { - mount_path = "/home/filebrowser/data" - name = "filebrowser-data" } } enable_service_links = false @@ -246,9 +249,12 @@ resource "kubernetes_deployment_v1" "deployment" { default_mode = "0750" } } - volume { - name = "filebrowser-data" - empty_dir {} + dynamic "volume" { + for_each = data.coder_parameter.filebrowser_enabled.value == "enabled" ? toset(["filebrowser"]) : [] + content { + name = "filebrowser-data" + empty_dir {} + } } # /tmp is scratch space (agent/tool tempfiles, build caches, downloaded # archives) and needs to be fast - it cannot be the NFS-backed "home" diff --git a/templates/kubernetes/homelab-workspace/filebrowser.tf b/templates/kubernetes/homelab-workspace/filebrowser.tf index 14b87891..5096e1cc 100644 --- a/templates/kubernetes/homelab-workspace/filebrowser.tf +++ b/templates/kubernetes/homelab-workspace/filebrowser.tf @@ -1,4 +1,6 @@ resource "coder_agent" "filebrowser" { + count = (data.coder_parameter.filebrowser_enabled.value == "enabled") ? 1 : 0 + arch = "amd64" os = "linux" api_key_scope = "no_user_data" @@ -16,7 +18,9 @@ resource "coder_agent" "filebrowser" { } resource "coder_app" "filebrowser" { - agent_id = coder_agent.filebrowser.id + count = (data.coder_parameter.filebrowser_enabled.value == "enabled") ? 1 : 0 + + agent_id = coder_agent.filebrowser[0].id slug = "files" display_name = "Files" icon = "/icon/folder.svg" diff --git a/templates/kubernetes/homelab-workspace/parameters.tf b/templates/kubernetes/homelab-workspace/parameters.tf index a8565d25..07cdad22 100644 --- a/templates/kubernetes/homelab-workspace/parameters.tf +++ b/templates/kubernetes/homelab-workspace/parameters.tf @@ -148,6 +148,26 @@ data "coder_parameter" "memory_watchdog_mode" { } } +data "coder_parameter" "filebrowser_enabled" { + name = "filebrowser_enabled" + + default = "disabled" + display_name = "File Browser" + description = "Whether to enable the file browser" + mutable = true + type = "bool" + form_type = "radio" + + option { + name = "Disabled" + value = "disabled" + } + option { + name = "Enabled" + value = "enabled" + } +} + locals { # Coder already constrains this to the two option values server-side, but it From 8f337d46e06420aff03666d593937ef9a4eb309c Mon Sep 17 00:00:00 2001 From: Peter Pathirana Date: Thu, 1 Oct 2026 00:31:37 +0000 Subject: [PATCH 2/4] fix(template): place filebrowser behind flag --- templates/kubernetes/homelab-workspace/configmap.tf | 2 +- templates/kubernetes/homelab-workspace/deployment.tf | 8 +++++--- templates/kubernetes/homelab-workspace/filebrowser.tf | 4 ++-- templates/kubernetes/homelab-workspace/parameters.tf | 6 +++--- 4 files changed, 11 insertions(+), 9 deletions(-) diff --git a/templates/kubernetes/homelab-workspace/configmap.tf b/templates/kubernetes/homelab-workspace/configmap.tf index ddd6c630..ef527e00 100644 --- a/templates/kubernetes/homelab-workspace/configmap.tf +++ b/templates/kubernetes/homelab-workspace/configmap.tf @@ -18,7 +18,7 @@ resource "kubernetes_config_map_v1" "workspace_scripts" { "script-start-services.sh" = file("${path.cwd}/scripts/script-start-services.sh") "supervisord.conf" = file("${path.cwd}/config/supervisord.conf") "script-vscode-server-gc.sh" = file("${path.cwd}/scripts/script-vscode-server-gc.sh") - "filebrowser-agent-init.sh" = (data.coder_parameter.filebrowser_enabled.value == "enabled") ? coder_agent.filebrowser[0].init_script : null + "filebrowser-agent-init.sh" = (data.coder_parameter.filebrowser_enabled.value == "true") ? coder_agent.filebrowser[0].init_script : "" "filebrowser.yaml" = file("${path.cwd}/config/filebrowser.yaml") "workspace-init.sh" = coder_agent.main.init_script } diff --git a/templates/kubernetes/homelab-workspace/deployment.tf b/templates/kubernetes/homelab-workspace/deployment.tf index 4a2cc1fb..0a2e47b9 100644 --- a/templates/kubernetes/homelab-workspace/deployment.tf +++ b/templates/kubernetes/homelab-workspace/deployment.tf @@ -142,7 +142,7 @@ resource "kubernetes_deployment_v1" "deployment" { } } dynamic "container" { - for_each = data.coder_parameter.filebrowser_enabled.value == "enabled" ? toset(["filebrowser"]) : [] + for_each = data.coder_parameter.filebrowser_enabled.value == "true" ? toset(["filebrowser"]) : [] content { name = "filebrowser" command = ["/bin/sh", "/scripts/filebrowser-agent-init.sh"] @@ -250,10 +250,12 @@ resource "kubernetes_deployment_v1" "deployment" { } } dynamic "volume" { - for_each = data.coder_parameter.filebrowser_enabled.value == "enabled" ? toset(["filebrowser"]) : [] + for_each = data.coder_parameter.filebrowser_enabled.value == "true" ? toset(["filebrowser"]) : [] content { name = "filebrowser-data" - empty_dir {} + empty_dir { + size_limit = "3Gi" + } } } # /tmp is scratch space (agent/tool tempfiles, build caches, downloaded diff --git a/templates/kubernetes/homelab-workspace/filebrowser.tf b/templates/kubernetes/homelab-workspace/filebrowser.tf index 5096e1cc..c2352bc3 100644 --- a/templates/kubernetes/homelab-workspace/filebrowser.tf +++ b/templates/kubernetes/homelab-workspace/filebrowser.tf @@ -1,5 +1,5 @@ resource "coder_agent" "filebrowser" { - count = (data.coder_parameter.filebrowser_enabled.value == "enabled") ? 1 : 0 + count = (data.coder_parameter.filebrowser_enabled.value == "true") ? 1 : 0 arch = "amd64" os = "linux" @@ -18,7 +18,7 @@ resource "coder_agent" "filebrowser" { } resource "coder_app" "filebrowser" { - count = (data.coder_parameter.filebrowser_enabled.value == "enabled") ? 1 : 0 + count = (data.coder_parameter.filebrowser_enabled.value == "true") ? 1 : 0 agent_id = coder_agent.filebrowser[0].id slug = "files" diff --git a/templates/kubernetes/homelab-workspace/parameters.tf b/templates/kubernetes/homelab-workspace/parameters.tf index 07cdad22..76163467 100644 --- a/templates/kubernetes/homelab-workspace/parameters.tf +++ b/templates/kubernetes/homelab-workspace/parameters.tf @@ -151,7 +151,7 @@ data "coder_parameter" "memory_watchdog_mode" { data "coder_parameter" "filebrowser_enabled" { name = "filebrowser_enabled" - default = "disabled" + default = false display_name = "File Browser" description = "Whether to enable the file browser" mutable = true @@ -160,11 +160,11 @@ data "coder_parameter" "filebrowser_enabled" { option { name = "Disabled" - value = "disabled" + value = false } option { name = "Enabled" - value = "enabled" + value = true } } From a70a201e961868efd9b43f6b6abf5f63e45e1b13 Mon Sep 17 00:00:00 2001 From: Peter Pathirana Date: Thu, 1 Oct 2026 00:35:28 +0000 Subject: [PATCH 3/4] fix(template): place filebrowser behind flag --- .github/workflows/test-template.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test-template.yaml b/.github/workflows/test-template.yaml index 8eb8ceda..d7cba3d7 100644 --- a/.github/workflows/test-template.yaml +++ b/.github/workflows/test-template.yaml @@ -170,7 +170,8 @@ jobs: --parameter dotfiles_url=https://github.com/ppat/dotfiles.git \ --parameter use_existing_home_pvc=false --parameter home_pvc_size=2 --parameter tmp_pvc_size=1 \ --parameter memory=4 --parameter preferred_nodes='[]' --parameter memory_watchdog_mode=enforce \ - --parameter "${service_parameter}" + --parameter "${service_parameter}" \ + --parameter "filebrowser_enabled=true" - name: Ping workspace agent shell: bash From 5059c51ea58cdccae654093e9637464a84337cbe Mon Sep 17 00:00:00 2001 From: Peter Pathirana Date: Thu, 1 Oct 2026 00:42:32 +0000 Subject: [PATCH 4/4] fix(template): place filebrowser behind flag --- templates/kubernetes/homelab-workspace/configmap.tf | 2 +- templates/kubernetes/homelab-workspace/deployment.tf | 4 ++-- templates/kubernetes/homelab-workspace/filebrowser.tf | 4 ++-- templates/kubernetes/homelab-workspace/parameters.tf | 11 +---------- 4 files changed, 6 insertions(+), 15 deletions(-) diff --git a/templates/kubernetes/homelab-workspace/configmap.tf b/templates/kubernetes/homelab-workspace/configmap.tf index ef527e00..c78135fa 100644 --- a/templates/kubernetes/homelab-workspace/configmap.tf +++ b/templates/kubernetes/homelab-workspace/configmap.tf @@ -18,7 +18,7 @@ resource "kubernetes_config_map_v1" "workspace_scripts" { "script-start-services.sh" = file("${path.cwd}/scripts/script-start-services.sh") "supervisord.conf" = file("${path.cwd}/config/supervisord.conf") "script-vscode-server-gc.sh" = file("${path.cwd}/scripts/script-vscode-server-gc.sh") - "filebrowser-agent-init.sh" = (data.coder_parameter.filebrowser_enabled.value == "true") ? coder_agent.filebrowser[0].init_script : "" + "filebrowser-agent-init.sh" = data.coder_parameter.filebrowser_enabled.value ? coder_agent.filebrowser[0].init_script : "" "filebrowser.yaml" = file("${path.cwd}/config/filebrowser.yaml") "workspace-init.sh" = coder_agent.main.init_script } diff --git a/templates/kubernetes/homelab-workspace/deployment.tf b/templates/kubernetes/homelab-workspace/deployment.tf index 0a2e47b9..d02fb47f 100644 --- a/templates/kubernetes/homelab-workspace/deployment.tf +++ b/templates/kubernetes/homelab-workspace/deployment.tf @@ -142,7 +142,7 @@ resource "kubernetes_deployment_v1" "deployment" { } } dynamic "container" { - for_each = data.coder_parameter.filebrowser_enabled.value == "true" ? toset(["filebrowser"]) : [] + for_each = data.coder_parameter.filebrowser_enabled.value ? toset(["filebrowser"]) : [] content { name = "filebrowser" command = ["/bin/sh", "/scripts/filebrowser-agent-init.sh"] @@ -250,7 +250,7 @@ resource "kubernetes_deployment_v1" "deployment" { } } dynamic "volume" { - for_each = data.coder_parameter.filebrowser_enabled.value == "true" ? toset(["filebrowser"]) : [] + for_each = data.coder_parameter.filebrowser_enabled.value ? toset(["filebrowser"]) : [] content { name = "filebrowser-data" empty_dir { diff --git a/templates/kubernetes/homelab-workspace/filebrowser.tf b/templates/kubernetes/homelab-workspace/filebrowser.tf index c2352bc3..7c90677b 100644 --- a/templates/kubernetes/homelab-workspace/filebrowser.tf +++ b/templates/kubernetes/homelab-workspace/filebrowser.tf @@ -1,5 +1,5 @@ resource "coder_agent" "filebrowser" { - count = (data.coder_parameter.filebrowser_enabled.value == "true") ? 1 : 0 + count = data.coder_parameter.filebrowser_enabled.value ? 1 : 0 arch = "amd64" os = "linux" @@ -18,7 +18,7 @@ resource "coder_agent" "filebrowser" { } resource "coder_app" "filebrowser" { - count = (data.coder_parameter.filebrowser_enabled.value == "true") ? 1 : 0 + count = data.coder_parameter.filebrowser_enabled.value ? 1 : 0 agent_id = coder_agent.filebrowser[0].id slug = "files" diff --git a/templates/kubernetes/homelab-workspace/parameters.tf b/templates/kubernetes/homelab-workspace/parameters.tf index 76163467..00161cdc 100644 --- a/templates/kubernetes/homelab-workspace/parameters.tf +++ b/templates/kubernetes/homelab-workspace/parameters.tf @@ -156,16 +156,7 @@ data "coder_parameter" "filebrowser_enabled" { description = "Whether to enable the file browser" mutable = true type = "bool" - form_type = "radio" - - option { - name = "Disabled" - value = false - } - option { - name = "Enabled" - value = true - } + form_type = "checkbox" }