code-tools/terraform/services.tf

# Data services run inside the per-workspace Docker network. They stay optional
# so light-weight workspaces can skip all of them.

resource "docker_volume" "postgres_data" {
  count = local.services_enabled ? 1 : 0
  name  = "postgres-data-${local.workspace_id}"

  labels {
    label = "coder.service"
    value = "postgres"
  }

  labels {
    label = "coder.workspace_id"
    value = local.workspace_id
  }
}

resource "docker_container" "postgres" {
  count = local.services_enabled ? 1 : 0
  image = "postgres:${var.postgres_version}-alpine"
  name  = "postgres-${local.workspace_id}"

  env = [
    "POSTGRES_DB=postgres",
    "POSTGRES_USER=postgres",
    "POSTGRES_PASSWORD=${var.postgres_password}",
    "POSTGRES_INITDB_ARGS=--auth-local=trust --auth-host=md5",
    "POSTGRES_SHARED_PRELOAD_LIBRARIES=pg_stat_statements",
    "POSTGRES_MAX_CONNECTIONS=${var.postgres_max_connections}"
  ]

  networks_advanced {
    name = docker_network.workspace.name
  }

  volumes {
    volume_name    = docker_volume.postgres_data[0].name
    container_path = "/var/lib/postgresql/data"
  }

  healthcheck {
    test         = ["CMD-SHELL", "pg_isready -U postgres"]
    interval     = "15s"
    timeout      = "5s"
    retries      = 5
    start_period = "30s"
  }

  restart = "unless-stopped"

  labels {
    label = "coder.service"
    value = "postgres"
  }

  labels {
    label = "coder.workspace_id"
    value = local.workspace_id
  }
}

resource "docker_volume" "redis_data" {
  count = local.services_enabled ? 1 : 0
  name  = "redis-data-${local.workspace_id}"

  labels {
    label = "coder.service"
    value = "redis"
  }

  labels {
    label = "coder.workspace_id"
    value = local.workspace_id
  }
}

resource "docker_container" "redis" {
  count = local.services_enabled ? 1 : 0
  image = "redis:${var.redis_version}-alpine"
  name  = "redis-${local.workspace_id}"

  command = [
    "redis-server",
    "--requirepass", var.redis_password,
    "--appendonly", "yes",
    "--appendfsync", "everysec",
    "--maxmemory", var.redis_max_memory,
    "--maxmemory-policy", "allkeys-lru"
  ]

  networks_advanced {
    name = docker_network.workspace.name
  }

  volumes {
    volume_name    = docker_volume.redis_data[0].name
    container_path = "/data"
  }

  healthcheck {
    test         = ["CMD", "redis-cli", "-a", var.redis_password, "ping"]
    interval     = "15s"
    timeout      = "3s"
    retries      = 5
    start_period = "10s"
  }

  restart = "unless-stopped"

  labels {
    label = "coder.service"
    value = "redis"
  }

  labels {
    label = "coder.workspace_id"
    value = local.workspace_id
  }
}

resource "docker_volume" "qdrant_data" {
  count = local.services_enabled ? 1 : 0
  name  = "qdrant-data-${local.workspace_id}"

  labels {
    label = "coder.service"
    value = "qdrant"
  }

  labels {
    label = "coder.workspace_id"
    value = local.workspace_id
  }
}

resource "docker_container" "qdrant" {
  count = local.services_enabled ? 1 : 0
  image = "qdrant/qdrant:${var.qdrant_version}"
  name  = "qdrant-${local.workspace_id}"

  env = [
    "QDRANT__SERVICE__HTTP_PORT=6333",
    "QDRANT__SERVICE__GRPC_PORT=6334",
    "QDRANT__SERVICE__HOST=0.0.0.0",
    "QDRANT__LOG_LEVEL=INFO",
    "QDRANT__WEB_UI__ENABLED=true"
  ]

  networks_advanced {
    name = docker_network.workspace.name
  }

  volumes {
    volume_name    = docker_volume.qdrant_data[0].name
    container_path = "/qdrant/storage"
  }

  healthcheck {
    test         = ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:6333/health || exit 1"]
    interval     = "20s"
    timeout      = "5s"
    retries      = 5
    start_period = "40s"
  }

  restart = "unless-stopped"

  labels {
    label = "coder.service"
    value = "qdrant"
  }

  labels {
    label = "coder.workspace_id"
    value = local.workspace_id
  }
}

resource "docker_volume" "pgadmin_data" {
  count = local.services_enabled && data.coder_parameter.enable_pgadmin.value ? 1 : 0
  name  = "pgadmin-data-${local.workspace_id}"

  labels {
    label = "coder.service"
    value = "pgadmin"
  }

  labels {
    label = "coder.workspace_id"
    value = local.workspace_id
  }
}

resource "docker_container" "pgadmin" {
  count = local.services_enabled && data.coder_parameter.enable_pgadmin.value ? 1 : 0
  image = "dpage/pgadmin4:latest"
  name  = "pgadmin-${local.workspace_id}"

  env = [
    "PGADMIN_DEFAULT_EMAIL=${var.pgadmin_email}",
    "PGADMIN_DEFAULT_PASSWORD=${var.pgadmin_password}",
    "PGADMIN_CONFIG_SERVER_MODE=False",
    "PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED=False",
    "PGADMIN_LISTEN_PORT=5050",
    "PGADMIN_CONFIG_GLOBALLY_DELIVERABLE=False",
    "PGADMIN_CONFIG_ALLOW_SPECIAL_EMAIL_DOMAINS=['local']"
  ]

  networks_advanced {
    name = docker_network.workspace.name
  }

  volumes {
    volume_name    = docker_volume.pgadmin_data[0].name
    container_path = "/var/lib/pgadmin"
  }

  healthcheck {
    test         = ["CMD-SHELL", "python3 -c \"import urllib.request; urllib.request.urlopen('http://localhost:5050/misc/ping', timeout=5)\" || exit 1"]
    interval     = "30s"
    timeout      = "10s"
    retries      = 3
    start_period = "90s"
  }

  restart = "unless-stopped"

  labels {
    label = "coder.service"
    value = "pgadmin"
  }

  labels {
    label = "coder.workspace_id"
    value = local.workspace_id
  }
}

# Jupyter now runs inside workspace container via startup_script

# Services now run inside the workspace container via startup_script
# No separate containers needed for code-server or jupyter