Add Coder Terraform module for web-shell

Wraps the web-shell feature's workspace-app wiring in a reusable
terraform/web-shell/ module (agent_id, port, host, auth_token,
install_version inputs) so workspace templates can drop it in without
duplicating the coder_app / install block.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: chapterjason

terraform/web-shell/main.tf

@@ -0,0 +1,135 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = ">= 2.5"
+    }
+  }
+}
+
+variable "agent_id" {
+  type        = string
+  description = "The ID of a Coder agent."
+}
+
+variable "port" {
+  type        = number
+  description = "The port to run web-shell on."
+  default     = 4000
+}
+
+variable "host" {
+  type        = string
+  description = "The bind address web-shell should listen on."
+  default     = "127.0.0.1"
+}
+
+variable "auth_token" {
+  type        = string
+  description = "Optional shared bearer token enforced by web-shell. Leave empty when fronted by Coder."
+  default     = ""
+  sensitive   = true
+}
+
+variable "install_version" {
+  type        = string
+  description = "Release tag of web-shell to install (e.g. 'v0.1.0'). Empty means latest."
+  default     = ""
+}
+
+variable "log_path" {
+  type        = string
+  description = "The path to log web-shell to."
+  default     = "/tmp/web-shell.log"
+}
+
+variable "display_name" {
+  type        = string
+  description = "The display name for the web-shell application."
+  default     = "web-shell"
+}
+
+variable "slug" {
+  type        = string
+  description = "The slug for the web-shell application."
+  default     = "web-shell"
+}
+
+variable "subdomain" {
+  type        = bool
+  description = <<-EOT
+    Serve web-shell on its own subdomain. Required for the WebSocket /ws endpoint
+    to work reliably behind path-based proxying.
+  EOT
+  default     = true
+}
+
+variable "share" {
+  type    = string
+  default = "owner"
+  validation {
+    condition     = contains(["owner", "authenticated", "public"], var.share)
+    error_message = "Incorrect value. Please set either 'owner', 'authenticated', or 'public'."
+  }
+}
+
+variable "order" {
+  type        = number
+  description = "The order determines the position of app in the UI presentation. The lowest order is shown first and apps with equal order are sorted by name (ascending order)."
+  default     = null
+}
+
+variable "group" {
+  type        = string
+  description = "The name of a group that this app belongs to."
+  default     = null
+}
+
+variable "open_in" {
+  type        = string
+  description = <<-EOT
+    Determines where the app will be opened. Valid values are `"tab"` and `"slim-window" (default)`.
+    `"tab"` opens in a new tab in the same browser window.
+    `"slim-window"` opens a new browser window without navigation controls.
+  EOT
+  default     = "slim-window"
+  validation {
+    condition     = contains(["tab", "slim-window"], var.open_in)
+    error_message = "The 'open_in' variable must be one of: 'tab', 'slim-window'."
+  }
+}
+
+resource "coder_script" "web-shell" {
+  agent_id     = var.agent_id
+  display_name = "web-shell"
+  icon         = "/icon/terminal.svg"
+  script = templatefile("${path.module}/run.sh", {
+    VERSION : var.install_version,
+    HOST : var.host,
+    PORT : var.port,
+    AUTH_TOKEN : var.auth_token,
+    LOG_PATH : var.log_path,
+  })
+  run_on_start = true
+}
+
+resource "coder_app" "web-shell" {
+  agent_id     = var.agent_id
+  slug         = var.slug
+  display_name = var.display_name
+  url          = "http://localhost:${var.port}"
+  icon         = "/icon/terminal.svg"
+  subdomain    = var.subdomain
+  share        = var.share
+  order        = var.order
+  group        = var.group
+  open_in      = var.open_in
+
+  healthcheck {
+    url       = "http://localhost:${var.port}/api/sessions"
+    interval  = 5
+    threshold = 6
+  }
+}

terraform/web-shell/run.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+BOLD='\033[0;1m'
+RESET='\033[0m'
+
+function run_web_shell() {
+  echo "👷 Running web-shell in the background..."
+  echo "Check logs at ${LOG_PATH}!"
+  HOST="${HOST}" PORT="${PORT}" AUTH_TOKEN="${AUTH_TOKEN}" \
+    web-shell > "${LOG_PATH}" 2>&1 &
+}
+
+# Resolve the version to install. Empty means latest.
+WANTED_VERSION="${VERSION}"
+if [ -z "$${WANTED_VERSION}" ]; then
+  WANTED_VERSION=$(curl -fsSL https://api.github.com/repos/SoureCode/web-shell/releases/latest \
+    | awk -F\" '/"tag_name":/ {print $4; exit}')
+fi
+WANTED_VERSION="$${WANTED_VERSION#v}"
+
+if [ -z "$${WANTED_VERSION}" ]; then
+  echo "Failed to resolve web-shell release tag."
+  exit 1
+fi
+
+# Install prereqs: tmux is required at runtime; build-essential + python3 cover
+# node-pty's native build step when a prebuilt binding isn't available.
+need=()
+for pkg in tmux build-essential python3; do
+  dpkg -s "$pkg" >/dev/null 2>&1 || need+=("$pkg")
+done
+if [ $${#need[@]} -gt 0 ]; then
+  printf "$${BOLD}Installing prereqs: $${need[*]}$${RESET}\n"
+  sudo apt-get update
+  sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$${need[@]}"
+fi
+
+# Install or upgrade web-shell if the installed version doesn't match.
+INSTALLED_VERSION=""
+if command -v web-shell >/dev/null 2>&1; then
+  INSTALLED_VERSION=$(npm ls -g --depth=0 --json web-shell 2>/dev/null \
+    | awk -F\" '/"version":/ {print $4; exit}')
+fi
+
+if [ "$${INSTALLED_VERSION}" != "$${WANTED_VERSION}" ]; then
+  printf "$${BOLD}Installing web-shell $${WANTED_VERSION}$${RESET}\n"
+  TARBALL="https://github.com/SoureCode/web-shell/releases/download/v$${WANTED_VERSION}/web-shell-$${WANTED_VERSION}.tgz"
+  if ! sudo -E env "PATH=$PATH" npm install -g "$${TARBALL}"; then
+    echo "Failed to install web-shell $${WANTED_VERSION}"
+    exit 1
+  fi
+  printf "🥳 web-shell $${WANTED_VERSION} installed\n\n"
+fi
+
+# Make web-shell available via CODER_SCRIPT_BIN_DIR too, like code-server does.
+if [ -n "$CODER_SCRIPT_BIN_DIR" ] && [ ! -e "$CODER_SCRIPT_BIN_DIR/web-shell" ]; then
+  ln -s "$(command -v web-shell)" "$CODER_SCRIPT_BIN_DIR/web-shell"
+fi
+
+run_web_shell