Persist JetBrains Gateway state, drop .idea/ via global gitignore

Add a jetbrains home-persist manifest so the IDE backend Gateway downloads
into ~/.cache/JetBrains/RemoteDev/dist/ (hundreds of MB per IDE) plus per-IDE
settings, plugins, project indexes, and JetProfile login survive workspace
restarts. Also write .idea/ to ~/.config/git/ignore in git_setup so the
per-project JetBrains dir stays out of every repo the user touches without
per-repo .gitignore edits.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: chapterjason

README.md

@@ -15,7 +15,7 @@ Images are published to GHCR under `ghcr.io/sourecode/coder-workspace`.
 
 | Tag | Base | Adds |
 |---|---|---|
-| `base` | `debian:trixie-slim` | systemd + dockerd + `nvm` + `claude-code` + `rtk` + `context-mode` + `web-shell` + `home-persist` |
+| `base` | `debian:trixie-slim` | systemd + dockerd + `nvm` + `claude-code` + `rtk` + `context-mode` + `web-shell` + `home-persist` + `jetbrains` |
 | `node` | `:base` | named variant for future Node-specific tooling — currently identical to `base` (Node comes from nvm) |
 | `cpp`  | `:base` | `llvm` (clang + toolchain), `cmake`, `sccache`, `/etc/profile.d/llvm-env.sh` exporting `CC`/`CXX` |
 
@@ -31,6 +31,7 @@ the workspace in Coder.
 | `context-mode` | [`context-mode`](https://github.com/mksglu/context-mode) Claude plugin | Installed via a post-create hook so it lands in the persisted `~/.claude/plugins` |
 | `nvm` | [nvm](https://github.com/nvm-sh/nvm) at `/usr/local/share/nvm` | Default Node = LTS, `node`/`npm`/`npx` in `/usr/local/bin` |
 | `web-shell` | [web-shell](https://github.com/SoureCode/web-shell), persistent browser terminal | systemd unit, registered as a Coder app |
+| `jetbrains` | JetBrains Gateway remote backend persistence | Headless-only: Toolbox/Gateway runs on the user's local machine, opens a `jetbrains-gateway://` URL that SSHes in and runs `remote-dev-server.sh` here. Declares `~/.cache/JetBrains/`, `~/.config/JetBrains/`, `~/.local/share/JetBrains/`, `~/.java/.userPrefs/jetbrains/` to `home-persist` so the downloaded IDE backend, per-IDE settings, plugins, project indexes and JetProfile login survive workspace restarts. |
 | `home-persist` | Manifest-driven `$HOME` persistence | Reads `/etc/home-persist.d/*.json`, symlinks declared paths under `/mnt/home-persist` (per-owner volume). Add extra per-workspace paths via the `home_persist_paths` Coder parameter. See [`docs/persistence.md`](docs/persistence.md). |
 | `llvm` (cpp) | Clang toolchain via [apt.llvm.org](https://apt.llvm.org/) | `CC=clang`, `CXX=clang++` via `/etc/profile.d/llvm-env.sh` |
 | `cmake` (cpp) | CMake from [Kitware's GitHub releases](https://cmake.org/) | latest by default |

docs/persistence.md

@@ -103,6 +103,7 @@ Properties that fall out:
 | Source        | Paths                         | Why                                  |
 | ------------- | ----------------------------- | ------------------------------------ |
 | `claude-code` | `.claude/`, `.claude.json`    | Login credentials, sessions, plugins |
+| `jetbrains`   | `.cache/JetBrains/`, `.config/JetBrains/`, `.local/share/JetBrains/`, `.java/.userPrefs/jetbrains/` | The workspace is headless — Toolbox/Gateway runs on the user's local machine. Clicking the IDE button opens a `jetbrains-gateway://` URL; Gateway SSHes in and has `remote-dev-server.sh` download the IDE backend into `~/.cache/JetBrains/RemoteDev/dist/` on first connect (hundreds of MB per IDE). The three JetBrains roots keep the downloaded backend plus per-IDE `RemoteDev-<Code>/` settings, plugins, and project indexes. `.java/.userPrefs/jetbrains/` is the Java `Preferences` store the IDEs use for JetBrains Account / JetProfile login, license activation, and non-commercial-license acceptance — persisting it avoids re-login on every restart. |
 
 Anything not declared is image-owned (or per-workspace-home-volume-owned)
 and resets on image rebuild — git config, SSH keys, bash history, caches.

main.tf

@@ -253,6 +253,13 @@ resource "coder_script" "git_setup" {
     git config --global commit.gpgsign true
     git config --global tag.gpgsign true
     git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signers
+
+    # Global gitignore. Git auto-picks $XDG_CONFIG_HOME/git/ignore as
+    # core.excludesFile on Linux — no extra config needed. Keeps IDE-local
+    # project state (JetBrains .idea/) out of every repo the user touches,
+    # without needing per-repo .gitignore edits.
+    mkdir -p ~/.config/git
+    printf '.idea/\n' > ~/.config/git/ignore
   EOT
 }
 

scripts/jetbrains/install.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# jetbrains installer.
+#
+# How the Coder JetBrains flow works: the workspace is headless. Clicking the
+# IDE button in the Coder UI opens a `jetbrains-gateway://` URL that the
+# user's *local* Toolbox/Gateway handles; Gateway then SSHes into the
+# workspace and runs remote-dev-server.sh, which downloads the IDE backend
+# (IntelliJ IDEA, PyCharm, CLion, WebStorm, GoLand, RubyMine, PhpStorm,
+# Rider, DataGrip) on-demand into $HOME. Toolbox itself never runs on the
+# workspace. Nothing to install in the image — this script only declares the
+# HOME paths the remote-dev backend writes, so Gateway doesn't redownload
+# hundreds of MB and users don't lose settings, plugins, and project indexes
+# on every restart.
+#
+# JetBrains' remote-dev backend follows the XDG scheme on Linux with a
+# RemoteDev-<Code> subdir per IDE flavor (PS = PhpStorm, PY = PyCharm, IU =
+# IDEA Ultimate, CL = CLion, ...) under these three roots:
+#
+#   ~/.cache/JetBrains/         — RemoteDev/dist/<build>/ (downloaded backend),
+#                                 RemoteDev-<Code>/ system caches, indexes,
+#                                 LocalHistory, log
+#   ~/.config/JetBrains/        — RemoteDev-<Code>/ IDE settings, keymaps,
+#                                 schemes, options, workspace, .lock
+#   ~/.local/share/JetBrains/   — RemoteDev-<Code>/ installed plugins,
+#                                 Daemon, consentOptions
+#
+# Plus the Java Preferences store the IDEs use for JetBrains Account
+# (JetProfile) login, license activation, and non-commercial-license
+# acceptance — skipping this forces re-login + re-accept every restart:
+#
+#   ~/.java/.userPrefs/jetbrains/
+set -e
+
+mkdir -p /etc/home-persist.d
+tee /etc/home-persist.d/jetbrains.json >/dev/null <<'EOF'
+{
+  "source": "jetbrains",
+  "paths": [
+    ".cache/JetBrains/",
+    ".config/JetBrains/",
+    ".local/share/JetBrains/",
+    ".java/.userPrefs/jetbrains/"
+  ]
+}
+EOF

src/base/Dockerfile

@@ -80,7 +80,7 @@ ENV _REMOTE_USER=${USERNAME}
 
 # System-wide installers run as root.
 RUN --mount=type=bind,source=scripts,target=/scripts \
-    for s in context-mode home-persist; do \
+    for s in context-mode home-persist jetbrains; do \
       bash "/scripts/$s/install.sh"; \
     done