663 lines
17 KiB
HCL
663 lines
17 KiB
HCL
# =============================================================================
|
|
# Cloudflare Worker Development - Coder Template
|
|
# =============================================================================
|
|
# Lightweight workspace for Cloudflare Workers with Hono, Drizzle, and
|
|
# Claude Code automation. Supports automated SDLC via n8n triggers.
|
|
# =============================================================================
|
|
|
|
terraform {
|
|
required_providers {
|
|
coder = {
|
|
source = "coder/coder"
|
|
}
|
|
kubernetes = {
|
|
source = "hashicorp/kubernetes"
|
|
}
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Data Sources
|
|
# =============================================================================
|
|
|
|
data "coder_workspace" "me" {}
|
|
data "coder_workspace_owner" "me" {}
|
|
data "coder_provisioner" "me" {}
|
|
|
|
data "coder_external_auth" "github" {
|
|
id = "primary-github"
|
|
}
|
|
|
|
# =============================================================================
|
|
# Parameters
|
|
# =============================================================================
|
|
|
|
data "coder_parameter" "cpu" {
|
|
name = "cpu"
|
|
display_name = "CPU Cores"
|
|
description = "Number of CPU cores"
|
|
type = "number"
|
|
default = "2"
|
|
mutable = false
|
|
|
|
option {
|
|
name = "1 Core"
|
|
value = "1"
|
|
}
|
|
option {
|
|
name = "2 Cores"
|
|
value = "2"
|
|
}
|
|
option {
|
|
name = "4 Cores"
|
|
value = "4"
|
|
}
|
|
}
|
|
|
|
data "coder_parameter" "memory" {
|
|
name = "memory"
|
|
display_name = "Memory (MB)"
|
|
description = "Amount of memory"
|
|
type = "number"
|
|
default = "4096"
|
|
mutable = false
|
|
|
|
option {
|
|
name = "2048 MB"
|
|
value = "2048"
|
|
}
|
|
option {
|
|
name = "4096 MB"
|
|
value = "4096"
|
|
}
|
|
option {
|
|
name = "8192 MB"
|
|
value = "8192"
|
|
}
|
|
}
|
|
|
|
|
|
# ─── Automation Parameters ───────────────────────────────────────────────────
|
|
|
|
data "coder_parameter" "repo_clone_url" {
|
|
name = "repo_clone_url"
|
|
display_name = "Repository Clone URL"
|
|
description = "Git repo URL to clone (leave empty for manual setup)"
|
|
type = "string"
|
|
default = ""
|
|
mutable = false
|
|
}
|
|
|
|
data "coder_parameter" "task_type" {
|
|
name = "task_type"
|
|
display_name = "Task Type"
|
|
description = "Claude Code command to run automatically (leave empty for interactive use)"
|
|
type = "string"
|
|
default = ""
|
|
mutable = false
|
|
|
|
option {
|
|
name = "None (interactive)"
|
|
value = ""
|
|
}
|
|
option {
|
|
name = "Analyse"
|
|
value = "analyse"
|
|
}
|
|
option {
|
|
name = "Architect"
|
|
value = "architect"
|
|
}
|
|
option {
|
|
name = "Develop"
|
|
value = "develop"
|
|
}
|
|
option {
|
|
name = "Review Code"
|
|
value = "review-code"
|
|
}
|
|
option {
|
|
name = "Test"
|
|
value = "test"
|
|
}
|
|
option {
|
|
name = "Fix Bug"
|
|
value = "fix-bug"
|
|
}
|
|
option {
|
|
name = "Rework PR"
|
|
value = "rework-pr"
|
|
}
|
|
option {
|
|
name = "Release"
|
|
value = "release"
|
|
}
|
|
option {
|
|
name = "DevOps"
|
|
value = "devops"
|
|
}
|
|
option {
|
|
name = "Create Migration"
|
|
value = "create-migration"
|
|
}
|
|
}
|
|
|
|
data "coder_parameter" "issue_number" {
|
|
name = "issue_number"
|
|
display_name = "Issue/PR Number"
|
|
description = "Gitea issue or PR number (for automated tasks)"
|
|
type = "string"
|
|
default = ""
|
|
mutable = false
|
|
}
|
|
|
|
data "coder_parameter" "gitea_token" {
|
|
name = "gitea_token"
|
|
display_name = "Gitea API Token"
|
|
description = "API token for reading issues and posting comments"
|
|
type = "string"
|
|
default = ""
|
|
mutable = false
|
|
}
|
|
|
|
data "coder_parameter" "gitea_org" {
|
|
name = "gitea_org"
|
|
display_name = "Gitea Organization"
|
|
description = "Gitea organization name"
|
|
type = "string"
|
|
default = "claude"
|
|
mutable = false
|
|
}
|
|
|
|
data "coder_parameter" "gitea_repo" {
|
|
name = "gitea_repo"
|
|
display_name = "Gitea Repository"
|
|
description = "Gitea repository name"
|
|
type = "string"
|
|
default = ""
|
|
mutable = false
|
|
}
|
|
|
|
data "coder_parameter" "anthropic_api_key" {
|
|
name = "anthropic_api_key"
|
|
display_name = "Anthropic API Key"
|
|
description = "API key for Claude Code"
|
|
type = "string"
|
|
default = ""
|
|
mutable = false
|
|
}
|
|
|
|
data "coder_parameter" "callback_url" {
|
|
name = "callback_url"
|
|
display_name = "Task Complete Callback URL"
|
|
description = "URL to POST when task finishes (set by orchestrator)"
|
|
type = "string"
|
|
default = ""
|
|
mutable = false
|
|
}
|
|
|
|
data "coder_parameter" "claude_oauth_token" {
|
|
name = "claude_oauth_token"
|
|
display_name = "Claude OAuth Token"
|
|
description = "OAuth token for Claude Code Max subscription"
|
|
type = "string"
|
|
default = ""
|
|
mutable = false
|
|
}
|
|
|
|
data "coder_parameter" "deploy_env" {
|
|
name = "deploy_env"
|
|
display_name = "Deploy Environment"
|
|
description = "Target environment for deploy tasks"
|
|
type = "string"
|
|
default = ""
|
|
mutable = false
|
|
|
|
option {
|
|
name = "None"
|
|
value = ""
|
|
}
|
|
option {
|
|
name = "Staging"
|
|
value = "staging"
|
|
}
|
|
option {
|
|
name = "Production"
|
|
value = "production"
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Locals
|
|
# =============================================================================
|
|
|
|
locals {
|
|
namespace = "coder-${data.coder_workspace_owner.me.name}-${data.coder_workspace.me.name}"
|
|
labels = {
|
|
"app.kubernetes.io/name" = "coder-workspace"
|
|
"app.kubernetes.io/instance" = data.coder_workspace.me.name
|
|
"app.kubernetes.io/managed-by" = "coder"
|
|
"coder.workspace.owner" = data.coder_workspace_owner.me.name
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Namespace
|
|
# =============================================================================
|
|
|
|
resource "kubernetes_namespace_v1" "workspace" {
|
|
metadata {
|
|
name = local.namespace
|
|
labels = local.labels
|
|
annotations = {
|
|
"field.cattle.io/projectId" = "local:p-w2w48"
|
|
}
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Secrets - Registry Access
|
|
# =============================================================================
|
|
|
|
data "kubernetes_secret_v1" "registry_source" {
|
|
metadata {
|
|
name = "registry-samson-media"
|
|
namespace = "registry"
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_secret_v1" "registry" {
|
|
metadata {
|
|
name = "registry-samson-media"
|
|
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
|
|
labels = local.labels
|
|
}
|
|
|
|
type = "kubernetes.io/dockerconfigjson"
|
|
|
|
data = {
|
|
".dockerconfigjson" = data.kubernetes_secret_v1.registry_source.data[".dockerconfigjson"]
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# RBAC
|
|
# =============================================================================
|
|
|
|
resource "kubernetes_service_account_v1" "workspace" {
|
|
metadata {
|
|
name = "workspace"
|
|
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
|
|
labels = local.labels
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_role_v1" "workspace" {
|
|
metadata {
|
|
name = "workspace-admin"
|
|
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
|
|
labels = local.labels
|
|
}
|
|
|
|
rule {
|
|
api_groups = ["", "apps", "batch", "networking.k8s.io"]
|
|
resources = ["*"]
|
|
verbs = ["*"]
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_role_binding_v1" "workspace" {
|
|
metadata {
|
|
name = "workspace-admin"
|
|
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
|
|
labels = local.labels
|
|
}
|
|
|
|
role_ref {
|
|
api_group = "rbac.authorization.k8s.io"
|
|
kind = "Role"
|
|
name = kubernetes_role_v1.workspace.metadata[0].name
|
|
}
|
|
|
|
subject {
|
|
kind = "ServiceAccount"
|
|
name = kubernetes_service_account_v1.workspace.metadata[0].name
|
|
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_role_binding_v1" "rancher_user_access" {
|
|
metadata {
|
|
name = "rancher-user-access"
|
|
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
|
|
labels = local.labels
|
|
}
|
|
|
|
role_ref {
|
|
api_group = "rbac.authorization.k8s.io"
|
|
kind = "ClusterRole"
|
|
name = "coder-developer"
|
|
}
|
|
|
|
subject {
|
|
api_group = "rbac.authorization.k8s.io"
|
|
kind = "User"
|
|
name = data.coder_workspace_owner.me.name
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Resource Quotas
|
|
# =============================================================================
|
|
|
|
resource "kubernetes_resource_quota_v1" "workspace" {
|
|
metadata {
|
|
name = "workspace-quota"
|
|
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
|
|
labels = local.labels
|
|
}
|
|
|
|
spec {
|
|
hard = {
|
|
"requests.cpu" = "${tonumber(data.coder_parameter.cpu.value) * 500}m"
|
|
"limits.cpu" = "${tonumber(data.coder_parameter.cpu.value) * 1000}m"
|
|
"requests.memory" = "${tonumber(data.coder_parameter.memory.value) / 2}Mi"
|
|
"limits.memory" = "${data.coder_parameter.memory.value}Mi"
|
|
}
|
|
}
|
|
}
|
|
|
|
# =============================================================================
|
|
# Coder Agent
|
|
# =============================================================================
|
|
|
|
resource "coder_agent" "main" {
|
|
arch = data.coder_provisioner.me.arch
|
|
os = "linux"
|
|
dir = "/home/coder"
|
|
startup_script_behavior = "non-blocking"
|
|
|
|
# Configure auto-stop TTL in Coder template settings:
|
|
# Settings > Auto-stop > Default TTL: 1 hour
|
|
# This ensures automated workspaces don't run indefinitely.
|
|
|
|
metadata {
|
|
display_name = "Task Type"
|
|
key = "task_type"
|
|
script = "echo $TASK_TYPE"
|
|
interval = 0
|
|
}
|
|
|
|
metadata {
|
|
display_name = "Issue Number"
|
|
key = "issue_number"
|
|
script = "echo $ISSUE_NUMBER"
|
|
interval = 0
|
|
}
|
|
|
|
display_apps {
|
|
vscode = true
|
|
vscode_insiders = false
|
|
ssh_helper = true
|
|
port_forwarding_helper = true
|
|
web_terminal = true
|
|
}
|
|
|
|
metadata {
|
|
display_name = "Task Status"
|
|
key = "task_status"
|
|
script = <<-EOS
|
|
if [ -f ~/task-output.log ]; then
|
|
if grep -q "Task completed" ~/task-output.log 2>/dev/null; then
|
|
echo "✅ Complete"
|
|
else
|
|
echo "⏳ Running ($(wc -l < ~/task-output.log) lines)"
|
|
fi
|
|
elif [ -n "$TASK_TYPE" ]; then
|
|
echo "⏳ Starting..."
|
|
else
|
|
echo "Interactive"
|
|
fi
|
|
EOS
|
|
interval = 10
|
|
}
|
|
|
|
env = {
|
|
CLAUDE_CODE_OAUTH_TOKEN = data.coder_parameter.claude_oauth_token.value
|
|
GITHUB_TOKEN = data.coder_external_auth.github.access_token
|
|
GITEA_TOKEN = data.coder_parameter.gitea_token.value
|
|
GITEA_ORG = data.coder_parameter.gitea_org.value
|
|
GITEA_REPO = data.coder_parameter.gitea_repo.value
|
|
TASK_TYPE = data.coder_parameter.task_type.value
|
|
ISSUE_NUMBER = data.coder_parameter.issue_number.value
|
|
REPO_CLONE_URL = data.coder_parameter.repo_clone_url.value
|
|
DEPLOY_ENV = data.coder_parameter.deploy_env.value
|
|
CALLBACK_URL = data.coder_parameter.callback_url.value
|
|
}
|
|
|
|
startup_script = <<-EOT
|
|
#!/bin/bash
|
|
|
|
# Always notify the orchestrator when done, even on failure
|
|
notify_complete() {
|
|
if [ -n "$CALLBACK_URL" ]; then
|
|
curl -s -X POST -H "Content-Type: application/json" \
|
|
-d "{\"status\":\"$1\"}" \
|
|
"$CALLBACK_URL" || echo "Callback failed (non-fatal)"
|
|
fi
|
|
}
|
|
trap 'notify_complete "failed"' ERR EXIT
|
|
|
|
set -e
|
|
|
|
# --- Configure git ---
|
|
git config --global user.name "${data.coder_workspace_owner.me.full_name}"
|
|
git config --global user.email "${data.coder_workspace_owner.me.email}"
|
|
|
|
# Configure git to use GITEA_TOKEN for HTTPS push/pull
|
|
if [ -n "$GITEA_TOKEN" ]; then
|
|
git config --global credential.helper 'store'
|
|
echo "https://oauth2:$GITEA_TOKEN@gitea.samson.media" > ~/.git-credentials
|
|
chmod 600 ~/.git-credentials
|
|
fi
|
|
|
|
# --- Clone repository ---
|
|
if [ -n "$REPO_CLONE_URL" ]; then
|
|
git clone "$REPO_CLONE_URL" ~/project
|
|
cd ~/project
|
|
|
|
# Switch to develop branch if it exists
|
|
git fetch origin develop 2>/dev/null && git checkout develop 2>/dev/null || true
|
|
|
|
# Lightweight stages only need the code, not a full build
|
|
LIGHT_STAGES="analyse architect release maintenance"
|
|
if echo "$LIGHT_STAGES" | grep -qw "$TASK_TYPE"; then
|
|
echo "Lightweight stage ($TASK_TYPE) — skipping build"
|
|
else
|
|
# Install deps if package.json exists
|
|
if [ -f package.json ]; then
|
|
npm ci --legacy-peer-deps || npm ci
|
|
fi
|
|
|
|
# Install frontend deps if present
|
|
if [ -f frontend/package.json ]; then
|
|
cd frontend && npm ci && cd ..
|
|
npm run build:frontend 2>/dev/null || true
|
|
fi
|
|
|
|
# Install Playwright if needed
|
|
if grep -q "playwright" package.json 2>/dev/null; then
|
|
npx playwright install chromium
|
|
fi
|
|
|
|
# Apply local migrations if script exists
|
|
if npm run --silent db:migrate:local 2>/dev/null; then
|
|
echo "Local migrations applied"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# --- Automated task execution ---
|
|
if [ -n "$TASK_TYPE" ] && [ -d ~/project ]; then
|
|
cd ~/project
|
|
|
|
ARGS="$ISSUE_NUMBER"
|
|
if [ "$TASK_TYPE" = "devops" ] && [ -n "$DEPLOY_ENV" ]; then
|
|
ARGS="$DEPLOY_ENV"
|
|
fi
|
|
|
|
# Read the slash command .md file, strip YAML frontmatter, substitute $ARGUMENTS
|
|
CMD_FILE=".claude/commands/$TASK_TYPE.md"
|
|
if [ ! -f "$CMD_FILE" ]; then
|
|
echo "ERROR: Command file not found: $CMD_FILE"
|
|
exit 1
|
|
fi
|
|
PROMPT=$(sed '1{/^---$/!q}; 1,/^---$/d' "$CMD_FILE" | sed "s/\\\$ARGUMENTS/$ARGS/g")
|
|
|
|
# Run Claude Code in non-interactive mode with tool access
|
|
claude -p --dangerously-skip-permissions --verbose "$PROMPT"
|
|
fi
|
|
|
|
# Success — override the trap
|
|
trap - ERR EXIT
|
|
notify_complete "complete"
|
|
EOT
|
|
}
|
|
|
|
# =============================================================================
|
|
# Main Workspace Deployment
|
|
# =============================================================================
|
|
|
|
resource "kubernetes_deployment_v1" "workspace" {
|
|
metadata {
|
|
name = "workspace"
|
|
namespace = kubernetes_namespace_v1.workspace.metadata[0].name
|
|
labels = local.labels
|
|
}
|
|
|
|
wait_for_rollout = false
|
|
|
|
spec {
|
|
replicas = data.coder_workspace.me.start_count
|
|
strategy {
|
|
type = "Recreate"
|
|
}
|
|
|
|
selector {
|
|
match_labels = {
|
|
app = "workspace"
|
|
}
|
|
}
|
|
|
|
template {
|
|
metadata {
|
|
labels = merge(local.labels, {
|
|
app = "workspace"
|
|
})
|
|
}
|
|
|
|
spec {
|
|
service_account_name = kubernetes_service_account_v1.workspace.metadata[0].name
|
|
|
|
security_context {
|
|
run_as_user = 1000
|
|
run_as_group = 1000
|
|
fs_group = 1000
|
|
}
|
|
|
|
image_pull_secrets {
|
|
name = kubernetes_secret_v1.registry.metadata[0].name
|
|
}
|
|
|
|
container {
|
|
name = "coder-agent"
|
|
image = "registry.samson.media/coder-workspace:latest"
|
|
|
|
command = ["sh", "-c", coder_agent.main.init_script]
|
|
|
|
env {
|
|
name = "CODER_AGENT_TOKEN"
|
|
value = coder_agent.main.token
|
|
}
|
|
|
|
env {
|
|
name = "CLAUDE_CODE_OAUTH_TOKEN"
|
|
value = data.coder_parameter.claude_oauth_token.value
|
|
}
|
|
|
|
env {
|
|
name = "GITHUB_TOKEN"
|
|
value = data.coder_external_auth.github.access_token
|
|
}
|
|
|
|
env {
|
|
name = "GITEA_TOKEN"
|
|
value = data.coder_parameter.gitea_token.value
|
|
}
|
|
|
|
env {
|
|
name = "GITEA_ORG"
|
|
value = data.coder_parameter.gitea_org.value
|
|
}
|
|
|
|
env {
|
|
name = "GITEA_REPO"
|
|
value = data.coder_parameter.gitea_repo.value
|
|
}
|
|
|
|
env {
|
|
name = "TASK_TYPE"
|
|
value = data.coder_parameter.task_type.value
|
|
}
|
|
|
|
env {
|
|
name = "ISSUE_NUMBER"
|
|
value = data.coder_parameter.issue_number.value
|
|
}
|
|
|
|
env {
|
|
name = "REPO_CLONE_URL"
|
|
value = data.coder_parameter.repo_clone_url.value
|
|
}
|
|
|
|
env {
|
|
name = "DEPLOY_ENV"
|
|
value = data.coder_parameter.deploy_env.value
|
|
}
|
|
|
|
env {
|
|
name = "CALLBACK_URL"
|
|
value = data.coder_parameter.callback_url.value
|
|
}
|
|
|
|
resources {
|
|
requests = {
|
|
cpu = "${tonumber(data.coder_parameter.cpu.value) * 500}m"
|
|
memory = "${tonumber(data.coder_parameter.memory.value) / 2}Mi"
|
|
}
|
|
limits = {
|
|
cpu = "${tonumber(data.coder_parameter.cpu.value) * 1000}m"
|
|
memory = "${data.coder_parameter.memory.value}Mi"
|
|
}
|
|
}
|
|
|
|
volume_mount {
|
|
name = "home"
|
|
mount_path = "/home/coder"
|
|
}
|
|
|
|
security_context {
|
|
run_as_user = 1000
|
|
run_as_group = 1000
|
|
}
|
|
}
|
|
|
|
volume {
|
|
name = "home"
|
|
empty_dir {}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|