refactor(boundary): remove BOUNDARY_CONFIG env var, use output only

Author: Jay Kumar

registry/coder/modules/boundary/README.md

@@ -16,7 +16,6 @@ This module:
 - Creates a wrapper script at `$HOME/.coder-modules/coder/boundary/scripts/boundary-wrapper.sh`
 - Writes a default boundary config to `$HOME/.coder-modules/coder/boundary/config/config.yaml` (customizable)
 - Automatically adds your Coder deployment domain to the config allowlist
-- Exports `BOUNDARY_CONFIG` as a workspace environment variable
 - Provides the wrapper path, config path, and script names via outputs
 
 ```tf
@@ -39,8 +38,9 @@ The Coder deployment domain is automatically added to the allowlist using
 `data.coder_workspace.me.access_url`.
 
 By default the config is written to
-`$HOME/.coder-modules/coder/boundary/config/config.yaml` and the
-`BOUNDARY_CONFIG` env var points there. You can override it in two ways:
+`$HOME/.coder-modules/coder/boundary/config/config.yaml`. You can
+access the resolved path via the `boundary_config_path` output. Override
+it in two ways:
 
 ### Inline config
 
@@ -68,7 +68,8 @@ module "boundary" {
 ### External config file
 
 Point to an existing config file in the workspace. The module will not
-write any config and `BOUNDARY_CONFIG` will point to your path:
+write any config and the `boundary_config_path` output will point to
+your path:
 
 ```tf
 module "boundary" {

registry/coder/modules/boundary/boundary.tftest.hcl

@@ -7,17 +7,6 @@ run "plan_with_required_vars" {
     agent_id = "test-agent-id"
   }
 
-  # Verify BOUNDARY_CONFIG env var with default config path
-  assert {
-    condition     = coder_env.boundary_config.name == "BOUNDARY_CONFIG"
-    error_message = "Environment variable name should be 'BOUNDARY_CONFIG'"
-  }
-
-  assert {
-    condition     = coder_env.boundary_config.value == "$HOME/.coder-modules/coder/boundary/config/config.yaml"
-    error_message = "BOUNDARY_CONFIG should default to module_directory/config/config.yaml"
-  }
-
   # Verify the boundary_wrapper_path output
   assert {
     condition     = output.boundary_wrapper_path == "$HOME/.coder-modules/coder/boundary/scripts/boundary-wrapper.sh"
@@ -131,13 +120,7 @@ run "plan_with_inline_boundary_config" {
     boundary_config = "allowlist:\n  - domain=example.com\nlog_level: debug\n"
   }
 
-  # BOUNDARY_CONFIG should still point to the managed path since we write
-  # the inline content there.
-  assert {
-    condition     = coder_env.boundary_config.value == "$HOME/.coder-modules/coder/boundary/config/config.yaml"
-    error_message = "BOUNDARY_CONFIG should point to managed config path when using inline config"
-  }
-
+  # Inline config should still point to the managed path.
   assert {
     condition     = output.boundary_config_path == "$HOME/.coder-modules/coder/boundary/config/config.yaml"
     error_message = "boundary_config_path output should point to managed config path"
@@ -152,12 +135,7 @@ run "plan_with_boundary_config_path" {
     boundary_config_path = "/workspace/my-boundary-config.yaml"
   }
 
-  # BOUNDARY_CONFIG should point to the user-provided path.
-  assert {
-    condition     = coder_env.boundary_config.value == "/workspace/my-boundary-config.yaml"
-    error_message = "BOUNDARY_CONFIG should point to user-provided config path"
-  }
-
+  # boundary_config_path output should point to the user-provided path.
   assert {
     condition     = output.boundary_config_path == "/workspace/my-boundary-config.yaml"
     error_message = "boundary_config_path output should point to user-provided path"

registry/coder/modules/boundary/main.test.ts

@@ -136,28 +136,14 @@ describe("boundary", async () => {
 
     const resources = state.resources;
 
-    // BOUNDARY_WRAPPER_PATH env should NOT exist (only output)
-    const wrapperEnv = resources.find(
-      (r) => r.type === "coder_env" && r.name === "boundary_wrapper_path",
-    );
-    expect(wrapperEnv).toBeUndefined();
-
-    // Verify coder_env resource for BOUNDARY_CONFIG
-    const configEnv = resources.find(
-      (r) => r.type === "coder_env" && r.name === "boundary_config",
-    );
-    expect(configEnv).toBeDefined();
-    expect(configEnv?.instances[0]?.attributes.name).toBe("BOUNDARY_CONFIG");
-    expect(configEnv?.instances[0]?.attributes.value).toBe(
-      "$HOME/.coder-modules/coder/boundary/config/config.yaml",
-    );
+    // No coder_env resources should exist
+    const envResources = resources.filter((r) => r.type === "coder_env");
+    expect(envResources).toHaveLength(0);
 
     // Verify the outputs are set correctly
     const coderEnvVars = extractCoderEnvVars(state);
     expect(coderEnvVars["BOUNDARY_WRAPPER_PATH"]).toBeUndefined();
-    expect(coderEnvVars["BOUNDARY_CONFIG"]).toBe(
-      "$HOME/.coder-modules/coder/boundary/config/config.yaml",
-    );
+    expect(coderEnvVars["BOUNDARY_CONFIG"]).toBeUndefined();
 
     // Verify boundary_config_path output
     expect(state.outputs["boundary_config_path"]?.value).toBe(
@@ -195,9 +181,8 @@ describe("boundary", async () => {
       boundary_config: inlineConfig,
     });
 
-    const coderEnvVars = extractCoderEnvVars(state);
     // Inline config still writes to the managed path.
-    expect(coderEnvVars["BOUNDARY_CONFIG"]).toBe(
+    expect(state.outputs["boundary_config_path"]?.value).toBe(
       "$HOME/.coder-modules/coder/boundary/config/config.yaml",
     );
   });
@@ -208,9 +193,10 @@ describe("boundary", async () => {
       boundary_config_path: "/workspace/my-config.yaml",
     });
 
-    const coderEnvVars = extractCoderEnvVars(state);
-    // BOUNDARY_CONFIG should point to the user-provided path.
-    expect(coderEnvVars["BOUNDARY_CONFIG"]).toBe("/workspace/my-config.yaml");
+    // boundary_config_path output should point to the user-provided path.
+    expect(state.outputs["boundary_config_path"]?.value).toBe(
+      "/workspace/my-config.yaml",
+    );
   });
 
   test("happy-path-coder-subcommand", async () => {
@@ -337,16 +323,12 @@ describe("boundary", async () => {
     expect(installLog).toContain("boundary wrapper configured");
   });
 
-  test("env-var-set-correctly", async () => {
+  test("no-env-vars", async () => {
     const { coderEnvVars } = await setup();
 
-    // BOUNDARY_WRAPPER_PATH env var should NOT exist
+    // No env vars should be exported by this module.
     expect(coderEnvVars["BOUNDARY_WRAPPER_PATH"]).toBeUndefined();
-
-    // Verify BOUNDARY_CONFIG is in the coder env vars
-    expect(coderEnvVars["BOUNDARY_CONFIG"]).toBe(
-      "$HOME/.coder-modules/coder/boundary/config/config.yaml",
-    );
+    expect(coderEnvVars["BOUNDARY_CONFIG"]).toBeUndefined();
   });
 
   test("wrapper-script-execution", async () => {

registry/coder/modules/boundary/main.tf

@@ -47,7 +47,7 @@ variable "boundary_config" {
 
 variable "boundary_config_path" {
   type        = string
-  description = "Path to an existing boundary config file in the workspace. When set, no config is written and BOUNDARY_CONFIG points to this path. Mutually exclusive with boundary_config."
+  description = "Path to an existing boundary config file in the workspace. When set, no config is written and the boundary_config_path output points to this path. Mutually exclusive with boundary_config."
   default     = null
 }
 
@@ -77,7 +77,7 @@ locals {
   coder_domain = try(regex("^https?://([^/:]+)", data.coder_workspace.me.access_url)[0], "")
 
   # Config handling: resolve which config content to write and where
-  # BOUNDARY_CONFIG points to.
+  # boundary_config_path output points to.
   default_boundary_config = templatefile("${path.module}/config.yaml.tftpl", {
     CODER_DOMAIN = local.coder_domain
   })
@@ -111,12 +111,6 @@ module "coder_utils" {
   install_script      = local.install_script
 }
 
-resource "coder_env" "boundary_config" {
-  agent_id = var.agent_id
-  name     = "BOUNDARY_CONFIG"
-  value    = local.effective_boundary_config_path
-}
-
 output "boundary_wrapper_path" {
   description = "Path to the boundary wrapper script."
   value       = local.boundary_wrapper_path