From 7d50c731f12038f8b0662b7743aacd1358ef88c2 Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Thu, 18 Jan 2024 20:31:53 +0000
Subject: [PATCH 01/39] Bump to ubuntu:mantic-20231128

---
 build/Dockerfile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/build/Dockerfile b/build/Dockerfile
index f5d049a..b737581 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:focal-20231211
+FROM ubuntu:mantic-20231128
 
 # install enough to setup apt repos
 RUN DEBIAN_FRONTEND=noninteractive \
@@ -44,7 +44,7 @@ RUN DEBIAN_FRONTEND=noninteractive \
     dpkg-dev \
     devscripts \
     language-pack-en \
-    libgccjit-10-dev \
+    libgccjit-13-dev \
     libgtk-3-bin \
     openssh-client \
     postgresql-client \
@@ -246,7 +246,7 @@ RUN sudo su -c "kubectl completion bash > /etc/bash_completion.d/kubectl"
 
 # Ensure we have the deps for building emacs from HEAD
 RUN add-apt-repository ppa:ubuntu-elisp/ppa --yes && \
-  sed -i -e 's/^#\ //' /etc/apt/sources.list.d/ubuntu-elisp-ubuntu-ppa-focal.list && \
+  sed -i -e 's/^#\ //' /etc/apt/sources.list.d/ubuntu-elisp-ubuntu-ppa-mantic.list && \
   DEBIAN_FRONTEND="noninteractive" apt-get update && \
   DEBIAN_FRONTEND="noninteractive" apt-get -y build-dep emacs-snapshot
 

From 53df3f15bf5722a5603c50fa595000d38019ff4b Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Fri, 19 Jan 2024 23:12:08 +0000
Subject: [PATCH 02/39] For WILDCARD DNS update create-zone with INGRESS_IP

---
 namedspaced.tf |  2 +-
 vars.tf        | 22 +++++++++++-----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/namedspaced.tf b/namedspaced.tf
index 52f4bed..18760c9 100644
--- a/namedspaced.tf
+++ b/namedspaced.tf
@@ -41,7 +41,7 @@ curl -L -s \
     NS2    = "ns2.ii.nz",
     ACCOUNTNAME : "${var.pdns_account}",
     KEYNAME : "${var.dns_update_keyname}",
-    IP : "${var.public_ip}"
+    INGRESS_IP : "${var.ingress_ip}"
 })}' ${var.pdns_api_url}/api/v1/servers/localhost/zones
 COMMAND
 }
diff --git a/vars.tf b/vars.tf
index ea96553..d68eb99 100644
--- a/vars.tf
+++ b/vars.tf
@@ -135,22 +135,22 @@ variable "default_org_url" {
   }
 }
 
-variable "local_ip" {
+variable "ingress_ip" {
   type        = string
   description = "Local LB IP"
   nullable    = false
   validation {
-    condition     = can(cidrhost("${var.local_ip}/32", 0))
+    condition     = can(cidrhost("${var.ingress_ip}/32", 0))
     error_message = "Must be valid IP Address"
   }
 
 }
-variable "public_ip" {
-  type        = string
-  description = "Public IP"
-  nullable    = false
-  validation {
-    condition     = can(cidrhost("${var.public_ip}/32", 0))
-    error_message = "Must be valid IP Address"
-  }
-}
+# variable "public_ip" {
+#   type        = string
+#   description = "Public IP"
+#   nullable    = false
+#   validation {
+#     condition     = can(cidrhost("${var.public_ip}/32", 0))
+#     error_message = "Must be valid IP Address"
+#   }
+# }

From 5c70f4a90a8cbd0f31be81e835ff75c720dd9bd7 Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Fri, 19 Jan 2024 23:12:40 +0000
Subject: [PATCH 03/39] Bump UID back to 1001

---
 deployment.tf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deployment.tf b/deployment.tf
index 22b6002..b8a2863 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -66,15 +66,15 @@ resource "kubernetes_deployment" "iipod" {
         hostname             = local.spacename
         service_account_name = "admin"
         security_context {
-          run_as_user = "1000"
-          fs_group    = "1000"
+          run_as_user = "1001"
+          fs_group    = "1001"
         }
         container {
           name    = "iipod"
           image   = data.coder_parameter.container-image.value
           command = ["sh", "-c", coder_agent.iipod.init_script]
           security_context {
-            run_as_user = "1000"
+            run_as_user = "1001"
           }
           env {
             name  = "CODER_AGENT_TOKEN"

From 009fefc0f697bb8b7be07d3f8f0aeeea6db7a109 Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Tue, 23 Jan 2024 16:09:17 +0000
Subject: [PATCH 04/39] Update deployment, domain, namespace - minor refactor

---
 .terraform.lock.hcl                           | 176 +++++++++---------
 agent.tf                                      | 104 ++++++++---
 build/Dockerfile                              |  93 ++++-----
 create_domain.tpl.json                        |   2 +-
 deployment.tf                                 |  30 ++-
 docs/deploy.org                               |  41 ++--
 namedspaced.tf                                |  28 +++
 demo.org => org/demo.org                      |   0
 parameters.tf                                 |  50 +++++
 persistent_manifests/user-cert.yaml           |   2 +-
 .../space-cert.yaml                           |   2 +-
 .../vcluster.yaml                             |   0
 vars.tf                                       |   8 +-
 13 files changed, 352 insertions(+), 184 deletions(-)
 rename demo.org => org/demo.org (100%)
 rename {persistent_manifests => unused_manifests}/space-cert.yaml (92%)
 rename {persistent_manifests => unused_manifests}/vcluster.yaml (100%)

diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
index 5a73164..71d9bdc 100644
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@@ -2,125 +2,125 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/coder/coder" {
-  version     = "0.11.0"
-  constraints = "0.11.0"
+  version     = "0.13.0"
+  constraints = "0.13.0"
   hashes = [
-    "h1:ciYalLx+8lwREQG6SNmJNL/SZo0sYwF1rrgjnu7hYYs=",
-    "zh:2ca19180a2c6ff9e30d9d1d6d845771c3f6771779185cd95e6f8a348abf82c4e",
-    "zh:48daf755756daf1ca72536b60513d059157967e8d8f21413e1561e6b595b13c3",
-    "zh:5b4a0e9912fd31306797ed5aa001a877f1e6884ddd2c9e55ec473252d2638646",
-    "zh:67b4dcf851e80785b2f6e94640562eb6b341791c10187a0adea454dce9b37c19",
-    "zh:7b2a044a5d08491c7ba61dda13a0dc1607702def1ee84a9f286c327004141a20",
-    "zh:872e8f8e6e4d304e6905f1a13ccaaef36facec5d8c09ef943880fcfc5651dfdc",
-    "zh:98b772bfed4a7c2790ea2ff3ebfd6a9efa652b71d6b0bfc86e99e7ce2a19838b",
-    "zh:a69dc2718a546514897198a85e0f5a667e04c1c93f8772f33c2925a75579a23d",
-    "zh:ad2dab5e0fb9b98e34565339ed1fe0e3756163516ba40ee4bf6fb3ecd5417827",
-    "zh:cacad965fc420d33207d64d74d4c8e5f4ee6ce9e982a07baab8bff901aae9ca5",
-    "zh:cc2417989a09f09933f70076ce500cc2e6eba9e2ecf1fe02ede56c4b6fb88c06",
-    "zh:cfe7ae9cdb789dc9e4bd8b8c81834259e0796253bb00a57928eea0e709089721",
-    "zh:da9561a119b6950597058cedd8b481d39fae9929c44f4168dfe41c84127c780d",
+    "h1:szTaWezPHC12Dknjj1tq1myHehroctMWyp0casICfVU=",
+    "zh:1d3151298b4c96ad2f10e910b7f2bb85841915800c4919eb8629f57622a73eb3",
+    "zh:214034bf1058dbfea357a4dc2d05f204845c9a291a28cc16b00f60424d7ab98e",
+    "zh:30c0a11ba78166a109a54e319add42d3e04655c59bb16c750bc70ecde8e96f21",
+    "zh:52148b5dd252242b11ec60dd37359808b3f147e7d8a963c2a90e737204e3472e",
+    "zh:5e268b53fba2cda3463726f3f5d60bb0617f11bbbd75a1995c4f42c09a05dced",
+    "zh:5f6e2b9858649ad4666163816b03b474e29935470bc565bba2fed2afc8718a67",
+    "zh:871dc76e9f1cf1e08d5214d15c1eb6d2630de3d6a1d513a468ede014ad4ce5d7",
+    "zh:c2f3fb68891e830fc224ef496257ba43b7612c3df5c24efd3c9e7d6044f3d0e9",
+    "zh:ccf6bcf72d3e5955de6cf44d104a18daf7bad9d76fc45f5b097749960b169ecb",
+    "zh:ce6f280d7f5a39de5d31e2c94ef514c6e52ab1204fa0887ac45495433dafb1bd",
+    "zh:d888d239b97c1eab91b0f1a9e74acb7e5dd777254f21970fa880c7bc8be5f46e",
+    "zh:d9a9e90fedf98ade4f31e132be98dd3c7e2a4edfc964b50756f893cbf064192e",
+    "zh:e8f4fa7af6ed13941d97a7089c45b3fe2617ddfbe4d727136f07b55e24c506df",
+    "zh:ed3d07621ebac383fcd89eb9ecbf97e7a391db180dae79d9451952685f0eac93",
     "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
-    "zh:f64de864c686daaec01f185bca16235ecc130b0682b711b63f0339be8cca2b3d",
   ]
 }
 
 provider "registry.terraform.io/equinix/equinix" {
-  version     = "1.14.3"
-  constraints = "1.14.3"
+  version     = "1.24.0"
+  constraints = "1.24.0"
   hashes = [
-    "h1:OX7Axy/RukC2ZL88WhCz4Ie+JLMvQHaY2pOqiX+VWIA=",
-    "zh:0c775e1867793c4e2ac1c01f6f8f62ab7052c77cf7bbb7a547a53e3c1d4d9e41",
-    "zh:1b31dd64a51ee08da5dd8dad69c918995bc3e8460aa016c9d3c420f68cf87a2f",
-    "zh:2e3f2a1b7ebca407faecd984376451c50d92d7d9845511ef93fe84d2cb1d90f2",
-    "zh:6c808e8c26299f4f45a51463a7d0174736ad55dac81582200d1a8de2ae5ff929",
-    "zh:71a14f57ffda6c42df1316125395b8a62fc86e64c2c96d56287377dc171588d4",
-    "zh:7d416558e2059e29b56345a32f87f239342243f29c8eca8cf41a3f61699ebe54",
-    "zh:9035eee4a4b8984caf0099bdd9c0339c1efb6193d3f49276c639b6010da14354",
-    "zh:9fa46be0021524dafaaa8b54b9171d3331e50dd55d588d35e504ee00f95a1a6e",
-    "zh:abf72f188cf5c05657be3f3a46e7ba8de137d3e1bd58c1e281bff19e21120646",
-    "zh:c33375747011a58b89fa5d7ae47d9cc1f44052bc97f8fd6296084c59540a7bc9",
-    "zh:e3ac23e2544a46f577df14320ce829a498a6b24ff936d6558c14696a10afdacf",
-    "zh:ecdffb2694053cced2abaf0595903ae708f90ac41da8c4c504c4bcdde09e8227",
-    "zh:f76e175cb871f48b4e352942ae4308253a7113674d4e21108d072b55cb734fa2",
-    "zh:f7cc0717495f108ddfcaf843d25707ae0f6c8f2e6532f676037dc4c33380f31a",
+    "h1:3dcIF8c4ruonqRbqTm+TWuRY+svO/uqXhksSik6xXjc=",
+    "zh:1463c15083f01b0ded5edc7d4e7678490bfe22a048565eefccad003f626904bd",
+    "zh:232e01e0f24867c99c208aaf48cf8590ef53323bf8cd57ce97eaf14a49a8f037",
+    "zh:340fa2a45307ee299659fcd52c1b1bb1d917e63a4184524e08510292104bdab8",
+    "zh:4fc7a85450b39a0d90ea8b92c2626f7ceffd2af7307ce05a7a548452513fe696",
+    "zh:5c539c4c81397ba53661a3d552ccebdff77a684a9de59b6f75d7c8f57abfdc8e",
+    "zh:5d8e7a863bdf39b1332e7bd24f793cda753577d0dce172b77a58bf8099fcac5c",
+    "zh:96d20eeba4948d355dd6329c4676a5edb0af40e295100c59729fe1d497d26501",
+    "zh:b023cdd24fccc39cce8e0fb69bffeada4f653d5c55868c367bf2afe347406663",
+    "zh:bf46a55eb95ac77ff36da9da1b2622fa4d74a48e90a7c5bbc17d17c698364f2b",
+    "zh:cd856520480652db3d1ca803e34e91baef10862c4cb3e1946a7c68dcf832f364",
+    "zh:cec1339551bb25ac21deed228f7a80df8790bad157136ad0a275b81a970c59c1",
+    "zh:df3de6cecf8a8ea050243895b030a5f75f85d400ac39879f9eb47b7d9963c789",
+    "zh:e24b5475a1f9158ac6f74043636c2ce97f255e88f61f984520d76f334d4ab6f8",
+    "zh:ec1bcf074966540ca9dae9d179a654acda220ec4af8caa59e3acabf43205c1e3",
   ]
 }
 
 provider "registry.terraform.io/hashicorp/dns" {
-  version     = "3.3.2"
-  constraints = "3.3.2"
+  version     = "3.4.0"
+  constraints = "3.4.0"
   hashes = [
-    "h1:HjskPLRqmCw8Q/kiSuzti3iJBSpcAvcBFdlwFFQuoDE=",
-    "zh:05d2d50e301318362a4a82e6b7a9734ace07bc01abaaa649c566baf98814755f",
-    "zh:1e9fd1c3bfdda777e83e42831dd45b7b9e794250a0f351e5fd39762e8a0fe15b",
-    "zh:40e715fc7a2ede21f919567249b613844692c2f8a64f93ee64e5b68bae7ac2a2",
-    "zh:454d7aa83000a6e2ba7a7bfde4bcf5d7ed36298b22d760995ca5738ab02ee468",
-    "zh:46124ded51b4153ad90f12b0305fdbe0c23261b9669aa58a94a31c9cca2f4b19",
-    "zh:55a4f13d20f73534515a6b05701abdbfc54f4e375ba25b2dffa12afdad20e49d",
+    "h1:nnWpjQjxyHqj057xymOndkH8s5xwzV5AqqzmbRSg4ZA=",
+    "zh:0a853845b3dc567b86bef2c03ff2c1157c23752c0ce4394a494cb5ffb7394e59",
+    "zh:134988a8b7ca76ae89c36fd515a06ae01a163a5fbbe17417d43c024900ad7453",
+    "zh:1fce68832350b7f5790ff89333e534a7f2dfb71c41048a15fdf7a154b82dd5c0",
+    "zh:21b59f476053982f1735e3c97f10e0073bb8bd89a5ebb1981a49365ddbaa19b7",
+    "zh:2cd6904babccd7ba99bc6cc3f130c164ecec9d109750160bafabab6556536d81",
+    "zh:40549f65664f700dcaa1c3965a73fbce0df3d423f01c1ba069fad5a76166d82c",
+    "zh:4fbc584e941e2900535a5da4bd4ac8244dfe67873dedef489ce0332a85b3d3a4",
+    "zh:52ea4b6d7e8d3098d2eda24ac14e5fbdd9b5d4dd234c2501f52763189fd4881b",
     "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:7903b1ceb8211e2b8c79290e2e70906a4b88f4fba71c900eb3a425ce12f1716a",
-    "zh:b79fc4f444ef7a2fd7111a80428c070ad824f43a681699e99ab7f83074dfedbd",
-    "zh:ca9f45e0c4cb94e7d62536c226024afef3018b1de84f1ea4608b51bcd497a2a0",
-    "zh:ddc8bd894559d7d176e0ceb0bb1ae266519b01b315362ebfee8327bb7e7e5fa8",
-    "zh:e77334c0794ef8f9354b10e606040f6b0b67b373f5ff1db65bddcdd4569b428b",
+    "zh:7ccf35e0bfa450ae08d6f36dfb81e668ad65579d1daf1a4c233ef15b55ac6589",
+    "zh:9e3e39706ee27fae3d9dfcd9fa2831c4b1af84356f46bdb006025579894565ce",
+    "zh:cda591013efa067474cd3781f6c5d121473fc4206c05ffbc85493d67f019c24a",
   ]
 }
 
 provider "registry.terraform.io/hashicorp/helm" {
-  version     = "2.10.1"
-  constraints = "2.10.1"
+  version     = "2.12.1"
+  constraints = "2.12.1"
   hashes = [
-    "h1:ctDhNJU4tEcyoUgPzwKuJmbDIqUl25mCY+s/lVHP6Sg=",
-    "zh:0717312baed39fb0a00576297241b69b419880cad8771bf72dec97ebdc96b200",
-    "zh:0e0e287b4e8429a0700143c8159764502eba0b33b1d094bf0d4ef4d93c7802cb",
-    "zh:4f74605377dab4065aaad35a2c5fa6186558c6e2e57b9058bdc8a62cf91857b9",
-    "zh:505f4af4dedb7a4f8f45b4201900b8e16216bdc2a01cc84fe13cdbf937570e7e",
-    "zh:83f37fe692513c0ce307d487248765383e00f9a84ed95f993ce0d3efdf4204d3",
-    "zh:840e5a84e1b5744f0211f611a2c6890da58016a40aafd5971f12285164d4e29b",
-    "zh:8c03d8dee292fa0367b0511cf3e95b706e034f78025f5dff0388116e1798bf47",
-    "zh:937800d1860f6b3adbb20e65f11e5fcd940b21ce8bdb48198630426244691325",
-    "zh:c1853aa5cbbdd1d46f4b169e84c3482103f0e8575a9bb044dbde908e27348c5d",
-    "zh:c9b0f640590da20931c30818b0b0587aa517d5606cb6e8052e4e4bf38f97b54d",
+    "h1:sgYI7lwGqJqPopY3NGmhb1eQ0YbH8PIXaAZAmnJrAvw=",
+    "zh:1d623fb1662703f2feb7860e3c795d849c77640eecbc5a776784d08807b15004",
+    "zh:253a5bc62ba2c4314875139e3fbd2feaad5ef6b0fb420302a474ab49e8e51a38",
+    "zh:282358f4ad4f20d0ccaab670b8645228bfad1c03ac0d0df5889f0aea8aeac01a",
+    "zh:4fd06af3091a382b3f0d8f0a60880f59640d2b6d9d6a31f9a873c6f1bde1ec50",
+    "zh:6816976b1830f5629ae279569175e88b497abbbac30ee809948a1f923c67a80d",
+    "zh:7d82c4150cdbf48cfeec867be94c7b9bd7682474d4df0ebb7e24e148f964844f",
+    "zh:83f062049eea2513118a4c6054fb06c8600bac96196f25aed2cc21898ec86e93",
+    "zh:a79eec0cf4c08fca79e44033ec6e470f25ff23c3e2c7f9bc707ed7771c1072c0",
+    "zh:b2b2d904b2821a6e579910320605bc478bbef063579a23fbfdd6fcb5871b81f8",
+    "zh:e91177ca06a15487fc570cb81ecef6359aa399459ea2aa7c4f7367ba86f6fcad",
+    "zh:e976bcb82996fc4968f8382bbcb6673efb1f586bf92074058a232028d97825b1",
     "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
-    "zh:fe8bd4dd09dc7ca218959eda1ced9115408c2cdc9b4a76964bfa455f3bcadfd3",
   ]
 }
 
 provider "registry.terraform.io/hashicorp/kubernetes" {
-  version = "2.22.0"
+  version = "2.25.2"
   hashes = [
-    "h1:b6Wj111/wsMNg8FrHFXrf4mCZFtSXKHx4JvbZh3YTCY=",
-    "zh:1eac662b1f238042b2068401e510f0624efaf51fd6a4dd9c49d710a49d383b61",
-    "zh:4c35651603493437b0b13e070148a330c034ac62c8967c2de9da6620b26adca4",
-    "zh:50c0e8654efb46e3a3666c638ca2e0c8aec07f985fbc80f9205bed960386dc9b",
-    "zh:5f65194ddd6ea7e89b378297d882083a4b84962edb35dd35752f0c7e9d6282a0",
-    "zh:6fc0c2d65864324edde4db84f528268065df58229fc3ee321626687b0e603637",
-    "zh:73c58d007aba7f67c0aa9029794e10c2517bec565b7cb57d0f5948ea3f30e407",
-    "zh:7d6fc9d3c1843baccd2e1fc56317925a2f9df372427d30fcb5052d123adc887a",
-    "zh:a0ad9eb863b51586ea306c5f2beef74476c96684aed41a3ee99eb4b6d8898d01",
-    "zh:e218fcfbf4994ff741408a023a9d9eb6c697ce9f63ce5540d3b35226d86c963e",
+    "h1:QlTKoO0efmkzgX/9y0DQCEkg7VeidOSQW8epF6B4cEQ=",
+    "zh:044788ac936e0e8ece8f78a2e4e366ecd435ea8235388eaf2cbc8e7975d9d970",
+    "zh:24f5ff01df91f51f00ee7ff39430adeb63bb2ca4ea0042e68f06d6b65808c02f",
+    "zh:49984aa0aa1faa8c4f01e8faa039322f1e6fdaeab0b7e32f5c6e96edfde36a38",
+    "zh:4eeceaff56bac9fc782e7e33f157fa2c7e9a47b2c3c3d12da2642c312ace73f6",
+    "zh:4f49b6419345960d5af475e0200c243af4c9c140b0ee64799fe1fc9b023c49ea",
+    "zh:7958414d516867a2263a978792a24843f80023fb233cf051ff4095adc9803d85",
+    "zh:c633a755fc95e9ff0cd73656f052947afd85883a0987dde5198113aa48474156",
+    "zh:cbfe958d119795004ce1e8001449d01c056fa2a062b51d07843d98be216337d7",
+    "zh:cfb85392e18768578d4c943438897083895719be678227fd90efbe3500702a56",
+    "zh:d705a661ed5da425dd236a48645bec39fe78a67d2e70e8460b720417cbf260ac",
+    "zh:ddd7a01263da3793df4f3b5af65f166307eed5acf525e51e058cda59009cc856",
     "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
-    "zh:f95625f317795f0e38cc6293dd31c85863f4e225209d07d1e233c50d9295083c",
-    "zh:f96e0923a632bc430267fe915794972be873887f5e761ed11451d67202e256c8",
   ]
 }
 
 provider "registry.terraform.io/hashicorp/null" {
-  version = "3.2.1"
+  version = "3.2.2"
   hashes = [
-    "h1:FbGfc+muBsC17Ohy5g806iuI1hQc4SIexpYCrQHQd8w=",
-    "zh:58ed64389620cc7b82f01332e27723856422820cfd302e304b5f6c3436fb9840",
-    "zh:62a5cc82c3b2ddef7ef3a6f2fedb7b9b3deff4ab7b414938b08e51d6e8be87cb",
-    "zh:63cff4de03af983175a7e37e52d4bd89d990be256b16b5c7f919aff5ad485aa5",
-    "zh:74cb22c6700e48486b7cabefa10b33b801dfcab56f1a6ac9b6624531f3d36ea3",
+    "h1:zT1ZbegaAYHwQa+QwIFugArWikRJI9dqohj8xb0GY88=",
+    "zh:3248aae6a2198f3ec8394218d05bd5e42be59f43a3a7c0b71c66ec0df08b69e7",
+    "zh:32b1aaa1c3013d33c245493f4a65465eab9436b454d250102729321a44c8ab9a",
+    "zh:38eff7e470acb48f66380a73a5c7cdd76cc9b9c9ba9a7249c7991488abe22fe3",
+    "zh:4c2f1faee67af104f5f9e711c4574ff4d298afaa8a420680b0cb55d7bbc65606",
+    "zh:544b33b757c0b954dbb87db83a5ad921edd61f02f1dc86c6186a5ea86465b546",
+    "zh:696cf785090e1e8cf1587499516b0494f47413b43cb99877ad97f5d0de3dc539",
+    "zh:6e301f34757b5d265ae44467d95306d61bef5e41930be1365f5a8dcf80f59452",
     "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:79e553aff77f1cfa9012a2218b8238dd672ea5e1b2924775ac9ac24d2a75c238",
-    "zh:a1e06ddda0b5ac48f7e7c7d59e1ab5a4073bbcf876c73c0299e4610ed53859dc",
-    "zh:c37a97090f1a82222925d45d84483b2aa702ef7ab66532af6cbcfb567818b970",
-    "zh:e4453fbebf90c53ca3323a92e7ca0f9961427d2f0ce0d2b65523cc04d5d999c2",
-    "zh:e80a746921946d8b6761e77305b752ad188da60688cfd2059322875d363be5f5",
-    "zh:fbdb892d9822ed0e4cb60f2fedbdbb556e4da0d88d3b942ae963ed6ff091e48f",
-    "zh:fca01a623d90d0cad0843102f9b8b9fe0d3ff8244593bd817f126582b52dd694",
+    "zh:913a929070c819e59e94bb37a2a253c228f83921136ff4a7aa1a178c7cce5422",
+    "zh:aa9015926cd152425dbf86d1abdbc74bfe0e1ba3d26b3db35051d7b9ca9f72ae",
+    "zh:bb04798b016e1e1d49bcc76d62c53b56c88c63d6f2dfe38821afef17c416a0e1",
+    "zh:c23084e1b23577de22603cff752e59128d83cfecc2e6819edadd8cf7a10af11e",
   ]
 }
 
diff --git a/agent.tf b/agent.tf
index 13efe26..d00b92a 100644
--- a/agent.tf
+++ b/agent.tf
@@ -8,11 +8,11 @@ resource "coder_agent" "iipod" {
   connection_timeout      = 300
   startup_script          = file("./iipod-startup.sh")
   startup_script_timeout  = 300
-  startup_script          = file("./iipod-shutdown.sh")
-  shutdown_script         = "#!/bin/sh\necho Box is on it's way down!"
+  shutdown_script         = file("./iipod-shutdown.sh")
   shutdown_script_timeout = 300
   env = {
-    # GITHUB_TOKEN        = "$${data.coder_git_auth.github.access_token}"
+    # GITHUB_TOKEN = "$${data.coder_git_auth.github.access_token}"
+    GITHUB_TOKEN = "${data.coder_external_auth.primary-github.access_token}"
     # Just a hidden feature for now to try out
     OPENAI_API_TOKEN    = "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"
     ORGFILE_URL         = "${data.coder_parameter.org-url.value}"
@@ -26,31 +26,87 @@ resource "coder_agent" "iipod" {
   }
   display_apps {
     port_forwarding_helper = true
-    ssh_helper = true
-    vscode = true
-    vscode_insiders = true
-    web_terminal = true
+    ssh_helper             = true
+    vscode                 = true
+    vscode_insiders        = true
+    web_terminal           = true
   }
+  # metadata {
+  #   key          = "tmux-clients"
+  #   display_name = "tmux clients"
+  #   interval     = 5
+  #   timeout      = 5
+  #   script       = <<-EOT
+  #     #!/bin/bash
+  #     set -e
+  #     tmux list-clients -F "#{client_session}:#{client_width}x#{client_height}" | xargs echo
+  #   EOT
+  # }
+  # metadata {
+  #   key          = "tmux-windows"
+  #   display_name = "tmux windows"
+  #   interval     = 5
+  #   timeout      = 5
+  #   script       = <<-EOT
+  #     #!/bin/bash
+  #     set -e
+  #     tmux list-windows -F "#{window_index}:#{window_name}" | xargs echo
+  #   EOT
+  # }
+
+  # The following metadata blocks are optional. They are used to display
+  # information about your workspace in the dashboard. You can remove them
+  # if you don't want to display any information.
+  # For basic resources, you can use the `coder stat` command.
+  # If you need more control, you can write your own script.
   metadata {
-    key          = "tmux-clients"
-    display_name = "tmux clients"
-    interval     = 5
-    timeout      = 5
-    script       = <<-EOT
-      #!/bin/bash
-      set -e
-      tmux list-clients -F "#{client_session}:#{client_width}x#{client_height}" | xargs echo
-    EOT
+    display_name = "CPU Usage"
+    key          = "0_cpu_usage"
+    script       = "coder stat cpu"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "RAM Usage"
+    key          = "1_ram_usage"
+    script       = "coder stat mem"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Home Disk"
+    key          = "3_home_disk"
+    script       = "coder stat disk --path $${HOME}"
+    interval     = 60
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "CPU Usage (Host)"
+    key          = "4_cpu_usage_host"
+    script       = "coder stat cpu --host"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Memory Usage (Host)"
+    key          = "5_mem_usage_host"
+    script       = "coder stat mem --host"
+    interval     = 10
+    timeout      = 1
   }
+
   metadata {
-    key          = "tmux-windows"
-    display_name = "tmux windows"
-    interval     = 5
-    timeout      = 5
-    script       = <<-EOT
-      #!/bin/bash
-      set -e
-      tmux list-windows -F "#{window_index}:#{window_name}" | xargs echo
+    display_name = "Load Average (Host)"
+    key          = "6_load_host"
+    # get load avg scaled by number of cores
+    script   = <<EOT
+      echo "`cat /proc/loadavg | awk '{ print $1 }'` `nproc`" | awk '{ printf "%0.2f", $1/$2 }'
     EOT
+    interval = 60
+    timeout  = 1
   }
 }
diff --git a/build/Dockerfile b/build/Dockerfile
index b737581..a8498c7 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -29,7 +29,7 @@ RUN DEBIAN_FRONTEND=noninteractive \
     && DEBIAN_FRONTEND=noninteractive apt-get update
 
 
-# install main packages
+# apt install packages
 RUN DEBIAN_FRONTEND=noninteractive \
     apt-get install --yes \
     tmux \
@@ -41,11 +41,8 @@ RUN DEBIAN_FRONTEND=noninteractive \
     sudo \
     vim \
     wget \
-    dpkg-dev \
-    devscripts \
+    emacs-pgtk \
     language-pack-en \
-    libgccjit-13-dev \
-    libgtk-3-bin \
     openssh-client \
     postgresql-client \
     jq \
@@ -63,7 +60,6 @@ RUN DEBIAN_FRONTEND=noninteractive \
     psmisc \
     iproute2 \
     tcpdump \
-    openjdk-17-jdk \
     rlwrap \
     fonts-powerline \
     flatpak-xdg-utils \
@@ -78,6 +74,7 @@ RUN DEBIAN_FRONTEND=noninteractive \
     iftop \
     ripgrep \
     python-is-python3 \
+    nodejs \
     pipenv \
     gettext-base \
     locate \
@@ -96,15 +93,21 @@ RUN DEBIAN_FRONTEND=noninteractive \
     websockify \
     code \
     cmake \
+    dpkg-dev \
+    devscripts \
     libwebsockets-dev \
     libjson-c-dev \
+    openjdk-17-jdk \
 	&& ln -s /usr/bin/fdfind /usr/local/bin/fd \
 	&& rm -rf /var/lib/apt/lists/*
     # ubuntu-desktop \
+    # libgccjit-13-dev \
+    # libgtk-3-bin \
     # && apt-key fingerprint 0EBFCD88 \
 
 # Install novnc from juanjodiaz branch
-RUN git clone --branch add_clipboard_support https://github.com/juanjoDiaz/noVNC.git /usr/share/novnc
+RUN git clone --branch add_clipboard_support \
+  https://github.com/juanjoDiaz/noVNC.git /usr/share/novnc
 
 RUN localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8 \
   && touch /etc/localtime
@@ -182,7 +185,7 @@ RUN . /usr/local/lib/arch-helper.sh \
 ENV NERDCTL_VERSION=1.7.2
 RUN . /usr/local/lib/arch-helper.sh \
   && curl -L https://github.com/containerd/nerdctl/releases/download/v${NERDCTL_VERSION}/nerdctl-${NERDCTL_VERSION}-linux-${ARCH_TYPE_2}.tar.gz | tar --directory /usr/local/bin --extract --ungzip nerdctl
-# Leiningen for clojure
+# Leiningen for clojure / needs jdk
 ENV CLOJURE_VERSION=1.11.1 LEIN_VERSION=stable
 RUN curl -fsSL https://raw.githubusercontent.com/technomancy/leiningen/${LEIN_VERSION}/bin/lein \
     -o /usr/local/bin/lein \
@@ -244,56 +247,56 @@ RUN curl -s https://fluxcd.io/install.sh | bash
 RUN sudo su -c "flux completion bash > /etc/bash_completion.d/flux"
 RUN sudo su -c "kubectl completion bash > /etc/bash_completion.d/kubectl"
 
-# Ensure we have the deps for building emacs from HEAD
-RUN add-apt-repository ppa:ubuntu-elisp/ppa --yes && \
-  sed -i -e 's/^#\ //' /etc/apt/sources.list.d/ubuntu-elisp-ubuntu-ppa-mantic.list && \
-  DEBIAN_FRONTEND="noninteractive" apt-get update && \
-  DEBIAN_FRONTEND="noninteractive" apt-get -y build-dep emacs-snapshot
+# # Ensure we have the deps for building emacs from HEAD
+# RUN add-apt-repository ppa:ubuntu-elisp/ppa --yes && \
+#   sed -i -e 's/^#\ //' /etc/apt/sources.list.d/ubuntu-elisp-ubuntu-ppa-mantic.list && \
+#   DEBIAN_FRONTEND="noninteractive" apt-get update && \
+#   DEBIAN_FRONTEND="noninteractive" apt-get -y build-dep emacs-snapshot
 
-# Get emacs src
-RUN mkdir -p /usr/local/src && \
-  cd /usr/local/src && \
-  git clone --depth 1 https://git.savannah.gnu.org/git/emacs.git
+# # Get emacs src
+# RUN mkdir -p /usr/local/src && \
+#   cd /usr/local/src && \
+#   git clone --depth 1 https://git.savannah.gnu.org/git/emacs.git
 
-# Build emacs from src with pgtk installing to /usr/local
-RUN cd /usr/local/src/emacs && \
-  ./autogen.sh && \
-  ./configure --prefix=/usr/local \
-    --with-modules=yes \
-    --with-json=yes \
-    --with-native-compilation=yes \
-    --with-x=yes \
-    --with-x-toolkit=gtk3 \
-    --with-xwidgets=yes \
-    --with-pgtk=yes && \
-  make -j 64 && \
-  make install
+# # Build emacs from src with pgtk installing to /usr/local
+# RUN cd /usr/local/src/emacs && \
+#   ./autogen.sh && \
+#   ./configure --prefix=/usr/local \
+#     --with-modules=yes \
+#     --with-json=yes \
+#     --with-native-compilation=yes \
+#     --with-x=yes \
+#     --with-x-toolkit=gtk3 \
+#     --with-xwidgets=yes \
+#     --with-pgtk=yes && \
+#   make -j 64 && \
+#   make install
 
-# Build emacs from src without pgtk installing to /usr/local
-RUN cd /usr/local/src/emacs && \
-  ./autogen.sh && \
-  ./configure --prefix=/usr/local/stow/emacs-x \
-    --with-modules=yes \
-    --with-json=yes \
-    --with-native-compilation=yes \
-    --with-x=yes \
-    --with-x-toolkit=gtk3 \
-    --with-xwidgets=yes \
-    --with-pgtk=no && \
-  make -j 64 && \
-  make install
+# # Build emacs from src without pgtk installing to /usr/local
+# RUN cd /usr/local/src/emacs && \
+#   ./autogen.sh && \
+#   ./configure --prefix=/usr/local/stow/emacs-x \
+#     --with-modules=yes \
+#     --with-json=yes \
+#     --with-native-compilation=yes \
+#     --with-x=yes \
+#     --with-x-toolkit=gtk3 \
+#     --with-xwidgets=yes \
+#     --with-pgtk=no && \
+#   make -j 64 && \
+#   make install
 
 # Links
 RUN ln -sf /usr/bin/firefox-esr /usr/bin/firefox
-RUN ln -s /usr/bin/coder /usr/local/bin/coop
-RUN ln -s /usr/bin/coder /usr/local/bin/space
 
+# create ii user
 ARG USER=ii
 ENV LANG=en_US.utf8
 RUN useradd --groups sudo --no-create-home --shell /bin/bash ${USER} \
 	&& echo "${USER} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/${USER} \
 	&& chmod 0440 /etc/sudoers.d/${USER}
 
+# from here down, everything done as ii user
 USER $USER
 WORKDIR /home/${USER}
 RUN mkdir -p ~/.config
diff --git a/create_domain.tpl.json b/create_domain.tpl.json
index 62c4a99..ceb4a8e 100644
--- a/create_domain.tpl.json
+++ b/create_domain.tpl.json
@@ -9,7 +9,7 @@
       "name": "*.${DOMAIN}",
       "type": "A",
       "ttl": 60,
-      "records": [{ "content": "${IP}" }]
+      "records": [{ "content": "${INGRESS_IP}" }]
     }
   ],
   "comments": [
diff --git a/deployment.tf b/deployment.tf
index b8a2863..ce100d1 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -45,20 +45,36 @@ resource "kubernetes_deployment" "iipod" {
     labels = {
       "spacename" : local.spacename
       "spaceapp" : "iipod"
+      "app.kubernetes.io/name"     = "coder-workspace"
+      "app.kubernetes.io/instance" = "coder-workspace-${lower(data.coder_workspace.ii.owner)}-${lower(data.coder_workspace.ii.name)}"
+      "app.kubernetes.io/part-of"  = "coder"
+      "com.coder.resource"         = "true"
+      "com.coder.workspace.id"     = data.coder_workspace.ii.id
+      "com.coder.workspace.name"   = data.coder_workspace.ii.name
+      "com.coder.user.id"          = data.coder_workspace.ii.owner_id
+      "com.coder.user.username"    = data.coder_workspace.ii.owner
+    }
+    annotations = {
+      "com.coder.user.email" = data.coder_workspace.ii.owner_email
     }
   }
   spec {
-    # relicas = 1
+    replicas = 1
     selector {
       match_labels = {
-        spacename = local.spacename
+        spacename                = local.spacename
+        "app.kubernetes.io/name" = "coder-workspace"
       }
     }
+    strategy {
+      type = "Recreate"
+    }
     template {
       metadata {
         labels = {
           "spacename" : local.spacename
           "spaceapp" : "iipod"
+          "app.kubernetes.io/name" = "coder-workspace"
         }
       }
       spec {
@@ -76,6 +92,16 @@ resource "kubernetes_deployment" "iipod" {
           security_context {
             run_as_user = "1001"
           }
+          resources {
+            requests = {
+              "cpu"    = "250m"
+              "memory" = "512Mi"
+            }
+            limits = {
+              "cpu"    = "${data.coder_parameter.cpu.value}"
+              "memory" = "${data.coder_parameter.memory.value}Gi"
+            }
+          }
           env {
             name  = "CODER_AGENT_TOKEN"
             value = coder_agent.iipod.token
diff --git a/docs/deploy.org b/docs/deploy.org
index f7ef31e..e799151 100644
--- a/docs/deploy.org
+++ b/docs/deploy.org
@@ -125,32 +125,33 @@ terraform init
 ** push/create the template with terraform vars
 #+begin_src tmux
 # export CODER_CONFIG_DIR=~/.config/space.uk.cloudnative.coop
-export CODER_CONFIG_DIR=~/.config/space.uk.cloudnative.coop
+export CODER_CONFIG_DIR=~/.config/coder.cloudnative.coop
 export CODER_TEMPLATE_NAME=iipod
 cd ~/iipod
 source .envrc
-coder template push --create \
+coder template push \
     --yes \
     --directory . \
-    --message "$USER iipod Template at $(date)" \
-    --variable dns_update_keysecret=$DNS_UPDATE_KEYSECRET \
+    --variable coder_url=$CODER_URL \
+    --variable coder_domain=$CODER_DOMAIN \
     --variable pdns_account=$PDNS_ACCOUNT \
+    --variable pdns_api_url=$PDNS_API_URL \
     --variable pdns_api_key=$PDNS_API_KEY \
+    --variable ingress_ip=$INGRESS_IP \
     --variable pdns_api_url=$PDNS_API_URL \
-    --variable coder_url=$CODER_URL \
-    --variable coder_domain=$CODER_DOMAIN \
-    --variable local_ip=$LOCAL_IP \
-    --variable public_ip=$PUBLIC_IP \
-    --variable pdns_api_url=$DNS_API_URL \
-    --variable pdns_account=$DNS_ACCOUNT \
-    --variable dns_update_server=$DNS_UPDATE_SERVER \
-    --variable dns_update_keyname=$DNS_UPDATE_KEYNAME \
-    --variable dns_update_keyalgorithm=$DNS_UPDATE_KEYALGORITHM \
+    --variable pdns_account=$PDNS_ACCOUNT \
+    --variable dns_update_server=$PDNS_SERVER \
+    --variable dns_update_keyname=$PDNS_TSIG_KEYNAME \
+    --variable dns_update_keyalgorithm=$PDNS_TSIG_ALGO \
+    --variable dns_update_keysecret=$PDNS_TSIG_KEY \
     --variable default_git_url=$DEFAULT_GIT_URL \
     --variable default_org_url=$DEFAULT_ORG_URL \
     --variable default_container_image=$DEFAULT_CONTAINER_IMAGE \
-    $CODER_TEMPLATE_NAME
+    $CODER_TEMPLATE_NAME \
+    --message "$USER iipod Template at $(date)"
 #+end_src
+    # \
+    #--name "foo-bar-baz-`date +%T`"
 * workspace
 ** cd to iipod folder
 #+begin_src tmux
@@ -166,15 +167,11 @@ env | grep "DEFAULT_" | sort
 
 #+RESULTS:
 #+begin_src shell
-CODER_SSH_FORWARD_AGENT=true
-CODER_SSH_FORWARD_GPG=false
-CODER_SSH_NO_WAIT=true
-CODER_SSH_WAIT=no
 CODER_TEMPLATE_NAME=iipod
 CODER_WORKSPACE_STOP_AFTER=96h
-DEFAULT_CONTAINER_IMAGE=ghcr.io/ii/iipod:2023.07.31-01
+DEFAULT_CONTAINER_IMAGE=ghcr.io/ii/iipod:2024.01.18-02
 DEFAULT_GIT_URL=https://github.com/ii/iipod
-DEFAULT_ORG_URL=https://raw.githubusercontent.com/ii/iipod/vcluster/docs/vcluster.org
+DEFAULT_ORG_URL=https://raw.githubusercontent.com/ii/iipod/canon/org/vcluster.org
 #+end_src
 
 ** coder create with parameters
@@ -183,7 +180,7 @@ cd ~/iipod
 # These three vars are picked up by coder create
 # export CODER_CONFIG_DIR=~/.config/space.cloudnative.nz
 source .envrc
-export CODER_CONFIG_DIR=~/.config/space.uk.cloudnative.coop
+# export CODER_CONFIG_DIR=~/.config/space.uk.cloudnative.coop
 export CODER_TEMPLATE_NAME=iipod
 export CODER_WORKSPACE_STOP_AFTER=8h
 # SPACENAME is in the form fri0838
@@ -193,6 +190,8 @@ time coder create \
     --parameter container-image=$DEFAULT_CONTAINER_IMAGE \
     --parameter git-url=$DEFAULT_GIT_URL \
     --parameter org-url=$DEFAULT_ORG \
+    --parameter cpu=32 \
+    --parameter memory=64 \
     --yes $SPACENAME
 #+end_src
 ** older
diff --git a/namedspaced.tf b/namedspaced.tf
index 18760c9..3eb408a 100644
--- a/namedspaced.tf
+++ b/namedspaced.tf
@@ -55,6 +55,34 @@ curl -L -s \
   ${var.pdns_api_url}/api/v1/servers/localhost/zones/${local.user_domain}/metadata
 COMMAND
 }
+
+##### this creates a DNS zone per namespace.... this isn't needed yet, but might be useful later on
+# provisioner "local-exec" {
+#   quiet = true
+#   command = <<COMMAND
+# curl -L -s \
+#   -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
+#   -D - \
+#   -d '${templatefile("./create_domain.tpl.json", {
+#   DOMAIN = "${local.spacename}.${local.user_domain}.",
+#   NS1    = "ns.ii.nz",
+#   NS2    = "ns2.ii.nz",
+#   ACCOUNTNAME : "${var.pdns_account}",
+#   KEYNAME : "${var.dns_update_keyname}",
+#   INGRESS_IP : "${var.ingress_ip}"
+# })}' ${var.pdns_api_url}/api/v1/servers/localhost/zones
+# COMMAND
+# }
+# provisioner "local-exec" {
+#   quiet   = true
+#   command = <<COMMAND
+# curl -L -s \
+#   -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
+#   -D - \
+#   -d '{"kind": "TSIG-ALLOW-DNSUPDATE", "metadata": ["${var.dns_update_keyname}"]}' \
+#   ${var.pdns_api_url}/api/v1/servers/localhost/zones/${local.spacename}.${local.user_domain}/metadata
+# COMMAND
+# }
 # I want to apply a bunch of manifests at once
 # HELP WANTED to find a better way
 provisioner "local-exec" {
diff --git a/demo.org b/org/demo.org
similarity index 100%
rename from demo.org
rename to org/demo.org
diff --git a/parameters.tf b/parameters.tf
index d999769..95eac0c 100644
--- a/parameters.tf
+++ b/parameters.tf
@@ -40,3 +40,53 @@ data "coder_parameter" "org-url" {
   default      = var.default_org_url
   # icon         = "https://raw.githubusercontent.com/matifali/logos/main/docker.svg"
 }
+
+data "coder_parameter" "cpu" {
+  name         = "cpu"
+  display_name = "CPU"
+  description  = "The number of CPU cores"
+  default      = "4"
+  icon         = "/icon/memory.svg"
+  mutable      = true
+  option {
+    name  = "4 Cores"
+    value = "4"
+  }
+  option {
+    name  = "8 Cores"
+    value = "8"
+  }
+  option {
+    name  = "16 Cores"
+    value = "16"
+  }
+  option {
+    name  = "32 Cores"
+    value = "32"
+  }
+}
+
+data "coder_parameter" "memory" {
+  name         = "memory"
+  display_name = "Memory"
+  description  = "The amount of memory in GB"
+  default      = "8"
+  icon         = "/icon/memory.svg"
+  mutable      = true
+  option {
+    name  = "8 GB"
+    value = "8"
+  }
+  option {
+    name  = "16 GB"
+    value = "16"
+  }
+  option {
+    name  = "32 GB"
+    value = "32"
+  }
+  option {
+    name  = "64 GB"
+    value = "64"
+  }
+}
diff --git a/persistent_manifests/user-cert.yaml b/persistent_manifests/user-cert.yaml
index 16cba4f..623534e 100644
--- a/persistent_manifests/user-cert.yaml
+++ b/persistent_manifests/user-cert.yaml
@@ -10,6 +10,6 @@ spec:
     - "${username}.${coder_domain}"
     - "*.${username}.${coder_domain}"
   issuerRef:
-    name: letsencrypt-pdns
+    name: letsencrypt-rfc2136
     kind: ClusterIssuer
     group: cert-manager.io
diff --git a/persistent_manifests/space-cert.yaml b/unused_manifests/space-cert.yaml
similarity index 92%
rename from persistent_manifests/space-cert.yaml
rename to unused_manifests/space-cert.yaml
index 69abb97..8f79629 100644
--- a/persistent_manifests/space-cert.yaml
+++ b/unused_manifests/space-cert.yaml
@@ -11,6 +11,6 @@ spec:
     - "${spacename}.${username}.${coder_domain}"
     - "*.${spacename}.${username}.${coder_domain}"
   issuerRef:
-    name: letsencrypt-pdns
+    name: letsencrypt-rfc2136
     kind: ClusterIssuer
     group: cert-manager.io
diff --git a/persistent_manifests/vcluster.yaml b/unused_manifests/vcluster.yaml
similarity index 100%
rename from persistent_manifests/vcluster.yaml
rename to unused_manifests/vcluster.yaml
diff --git a/vars.tf b/vars.tf
index d68eb99..27f3bf8 100644
--- a/vars.tf
+++ b/vars.tf
@@ -4,11 +4,17 @@ data "coder_provisioner" "ii" {
 data "coder_workspace" "ii" {
 }
 
+# Warning: Deprecated Resource
+# on vars.tf line 7, in data "coder_git_auth" "github":
 # data "coder_git_auth" "github" {
 #   # Matches the ID of the git auth provider in Coder.
-#   id = "primary-github"
+#   id = "github"
 # }
 
+data "coder_external_auth" "primary-github" {
+  id = "primary-github"
+}
+
 # Can be set via TF_VAR_variable_name in the coder process ENV
 # But can also be set via a file similar var/space.sharing.io.yaml
 # And deployed with coder template push --variables-file ./vars/space.sharing.io.yaml or similar

From 946a4490455611275c96942bc206731d374d728c Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Tue, 30 Jan 2024 22:55:49 +0000
Subject: [PATCH 05/39] Syncing current iiPod with ii/iipod

---
 agent.tf         |  4 +--
 apps.tf          | 32 ++++++++---------
 docs/deploy.org  |  1 +
 iipod-startup.sh |  4 +--
 namedspaced.tf   | 94 ++++++++++++++++++++++++------------------------
 vars.tf          | 11 ++++--
 6 files changed, 76 insertions(+), 70 deletions(-)

diff --git a/agent.tf b/agent.tf
index d00b92a..2bf63ae 100644
--- a/agent.tf
+++ b/agent.tf
@@ -12,9 +12,9 @@ resource "coder_agent" "iipod" {
   shutdown_script_timeout = 300
   env = {
     # GITHUB_TOKEN = "$${data.coder_git_auth.github.access_token}"
-    GITHUB_TOKEN = "${data.coder_external_auth.primary-github.access_token}"
+    GITHUB_TOKEN = "${data.coder_external_auth.github.access_token}"
     # Just a hidden feature for now to try out
-    OPENAI_API_TOKEN    = "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"
+    OPENAI_API_TOKEN    = "${var.openai_api_token}"
     ORGFILE_URL         = "${data.coder_parameter.org-url.value}"
     SESSION_NAME        = "${lower(data.coder_workspace.ii.name)}"
     GIT_REPO            = "${data.coder_parameter.git-url.value}"
diff --git a/apps.tf b/apps.tf
index f3ac619..883450b 100644
--- a/apps.tf
+++ b/apps.tf
@@ -42,20 +42,20 @@ resource "coder_app" "web" {
   url      = "http://localhost:8000" # port 8000 is the default 'python -m http.server' port
 }
 
-# resource "coder_app" "code-server" {
-#   agent_id     = coder_agent.iipod.id
-#   slug         = "code-server"
-#   display_name = "code-server"
-#   # url          = "http://localhost:13337/?folder=/home/${local.username}"
-#   url       = "http://localhost:13337/?folder=/home/ii"
-#   icon      = "/icon/code.svg"
-#   subdomain = true
-#   share     = "public"
-#   # share     = "owner"
+resource "coder_app" "code-server" {
+  agent_id     = coder_agent.iipod.id
+  slug         = "code-server"
+  display_name = "code-server"
+  # url          = "http://localhost:13337/?folder=/home/${local.username}"
+  url       = "http://localhost:13337/?folder=/home/ii"
+  icon      = "/icon/code.svg"
+  subdomain = true
+  share     = "public"
+  # share     = "owner"
 
-#   healthcheck {
-#     url       = "http://localhost:13337/healthz"
-#     interval  = 5
-#     threshold = 6
-#   }
-# }
+  healthcheck {
+    url       = "http://localhost:13337/healthz"
+    interval  = 5
+    threshold = 6
+  }
+}
diff --git a/docs/deploy.org b/docs/deploy.org
index e799151..17b0a6c 100644
--- a/docs/deploy.org
+++ b/docs/deploy.org
@@ -134,6 +134,7 @@ coder template push \
     --directory . \
     --variable coder_url=$CODER_URL \
     --variable coder_domain=$CODER_DOMAIN \
+    --variable openai_api_token=$OPENAI_API_TOKEN \
     --variable pdns_account=$PDNS_ACCOUNT \
     --variable pdns_api_url=$PDNS_API_URL \
     --variable pdns_api_key=$PDNS_API_KEY \
diff --git a/iipod-startup.sh b/iipod-startup.sh
index 45400bb..7bdee6f 100644
--- a/iipod-startup.sh
+++ b/iipod-startup.sh
@@ -9,9 +9,8 @@ ORGFILE=$(basename "$ORGFILE_URL")
 echo "Starting TMUX session: $SPACE_NAME:iipod"
 tmux new -d -s $SPACENAME -n "iipod"
 tmux send-keys -t "$SPACENAME:iipod" "
-git clone $GIT_REPO
-cd $REPO_DIR
 wget $ORGFILE_URL
+git clone $GIT_REPO
 # ensure we can git push via ssh
 mkdir -p ~/.ssh
 ssh-keyscan -H github.com >>~/.ssh/known_hosts
@@ -22,7 +21,6 @@ echo "Starting TMUX session: $SPACE_NAME:emacs"
 tmux new-window -d -t $SPACENAME -n "emacs"
 tmux send-keys -t "$SPACENAME:emacs" "
 sleep 15
-cd $REPO_DIR
 emacsclient -nw $ORGFILE
 "
 
diff --git a/namedspaced.tf b/namedspaced.tf
index 3eb408a..572c437 100644
--- a/namedspaced.tf
+++ b/namedspaced.tf
@@ -57,39 +57,39 @@ COMMAND
 }
 
 ##### this creates a DNS zone per namespace.... this isn't needed yet, but might be useful later on
-# provisioner "local-exec" {
-#   quiet = true
-#   command = <<COMMAND
-# curl -L -s \
-#   -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
-#   -D - \
-#   -d '${templatefile("./create_domain.tpl.json", {
-#   DOMAIN = "${local.spacename}.${local.user_domain}.",
-#   NS1    = "ns.ii.nz",
-#   NS2    = "ns2.ii.nz",
-#   ACCOUNTNAME : "${var.pdns_account}",
-#   KEYNAME : "${var.dns_update_keyname}",
-#   INGRESS_IP : "${var.ingress_ip}"
-# })}' ${var.pdns_api_url}/api/v1/servers/localhost/zones
-# COMMAND
-# }
-# provisioner "local-exec" {
-#   quiet   = true
-#   command = <<COMMAND
-# curl -L -s \
-#   -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
-#   -D - \
-#   -d '{"kind": "TSIG-ALLOW-DNSUPDATE", "metadata": ["${var.dns_update_keyname}"]}' \
-#   ${var.pdns_api_url}/api/v1/servers/localhost/zones/${local.spacename}.${local.user_domain}/metadata
-# COMMAND
-# }
+provisioner "local-exec" {
+  quiet = true
+  command = <<COMMAND
+curl -L -s \
+  -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
+  -D - \
+  -d '${templatefile("./create_domain.tpl.json", {
+  DOMAIN = "${local.spacename}.${local.user_domain}.",
+  NS1    = "ns.ii.nz",
+  NS2    = "ns2.ii.nz",
+  ACCOUNTNAME : "${var.pdns_account}",
+  KEYNAME : "${var.dns_update_keyname}",
+  INGRESS_IP : "${var.ingress_ip}"
+})}' ${var.pdns_api_url}/api/v1/servers/localhost/zones
+COMMAND
+}
+provisioner "local-exec" {
+  quiet   = true
+  command = <<COMMAND
+curl -L -s \
+  -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
+  -D - \
+  -d '{"kind": "TSIG-ALLOW-DNSUPDATE", "metadata": ["${var.dns_update_keyname}"]}' \
+  ${var.pdns_api_url}/api/v1/servers/localhost/zones/${local.spacename}.${local.user_domain}/metadata
+COMMAND
+}
 # I want to apply a bunch of manifests at once
 # HELP WANTED to find a better way
 provisioner "local-exec" {
   command = <<COMMAND
 ../../kubectl version --client || (
   echo installing kubectl:
-  curl -s -L https://dl.k8s.io/release/v1.27.3/bin/linux/amd64/kubectl -o ../../kubectl \
+  curl -s -L https://dl.k8s.io/release/v1.29.1/bin/linux/amd64/kubectl -o ../../kubectl \
   && chmod +x ../../kubectl
 )
 COMMAND
@@ -125,7 +125,7 @@ provisioner "local-exec" {
   command = <<COMMAND
 ../../kubectl version --client || (
   echo installing kubectl:
-  curl -s -L https://dl.k8s.io/release/v1.27.3/bin/linux/amd64/kubectl -o ../../kubectl \
+  curl -s -L https://dl.k8s.io/release/v1.29.1/bin/linux/amd64/kubectl -o ../../kubectl \
   && chmod +x ../../kubectl
 )
 COMMAND
@@ -156,28 +156,28 @@ provisioner "local-exec" {
 COMMAND
 }
 # We could also deloy logstream-kube to show the pod coming up...
-#   provisioner "local-exec" {
-#     command = <<COMMAND
-# ~/helm version --short || (
-#   echo installing helm:
-#   curl -L https://get.helm.sh/helm-v3.12.1-linux-amd64.tar.gz | tar xvz --strip-components=1 \
-#   && mv helm ~/helm \
-#   && chmod +x ~/helm
-# )
-# COMMAND
-#   }
+provisioner "local-exec" {
+  command = <<COMMAND
+~/helm version --short || (
+  echo installing helm:
+  curl -L https://get.helm.sh/helm-v3.12.1-linux-amd64.tar.gz | tar xvz --strip-components=1 \
+  && mv helm ~/helm \
+  && chmod +x ~/helm
+)
+COMMAND
+}
 # provisioner "local-exec" {
 #   command = "~/kubectl -n ${local.namespace} apply -f ${path.module}/manifests/admin-sa.yaml"
 # }
-#   provisioner "local-exec" {
-#     command = <<COMMAND
-# ~/helm upgrade --install \
-#   --repo https://helm.coder.com/logstream-kube \
-#   --namespace ${local.namespace} \
-#   --set url=${var.coder_url} \
-#   coder-logstream-kube coder-logstream-kube
-# COMMAND
-#   }
+provisioner "local-exec" {
+  command = <<COMMAND
+~/helm upgrade --install \
+  --repo https://helm.coder.com/logstream-kube \
+  --namespace ${local.namespace} \
+  --set url=${var.coder_url} \
+  coder-logstream-kube coder-logstream-kube
+COMMAND
+}
 }
 resource "coder_metadata" "namespace" {
   resource_id = null_resource.namespace.id
diff --git a/vars.tf b/vars.tf
index 27f3bf8..f92814e 100644
--- a/vars.tf
+++ b/vars.tf
@@ -11,8 +11,8 @@ data "coder_workspace" "ii" {
 #   id = "github"
 # }
 
-data "coder_external_auth" "primary-github" {
-  id = "primary-github"
+data "coder_external_auth" "github" {
+  id = "github"
 }
 
 # Can be set via TF_VAR_variable_name in the coder process ENV
@@ -54,6 +54,13 @@ variable "coder_domain" {
   }
 }
 
+variable "openai_api_token" {
+  type        = string
+  description = "OpenAI API Token"
+  # default     = "example.com"
+  nullable = true
+}
+
 variable "pdns_api_key" {
   type        = string
   description = "PowerDNS API Key for Powerdns Domain Creation"

From 5357b4893b9b451a1e1d3e75966555cf7e4deddf Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Wed, 31 Jan 2024 00:25:23 +0000
Subject: [PATCH 06/39] Update deployment metadata to be markdown links

---
 deployment.tf | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/deployment.tf b/deployment.tf
index ce100d1..2db6d3f 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -14,21 +14,22 @@ resource "coder_metadata" "iipod" {
   #   key   = "ssh"
   #   value = "ssh -tA ii@${powerdns_record.a_record.name} kubectl exec -ti iipod-0 -- tmux at"
   # }
+  # These can now be markdown : https://github.com/coder/coder/pull/10521
   item {
     key   = "emacs"
-    value = "https://emacs-${local.space_domain}/"
+    value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)"
   }
   item {
     key   = "tmux"
-    value = "https://tmux-${local.space_domain}/"
+    value = "[tmux-${local.space_domain}](https://tmux-${local.space_domain}/)"
   }
   item {
     key   = "vnc"
-    value = "https://vnc-${local.space_domain}/"
+    value = "[vnc-${local.space_domain}](https://vnc-${local.space_domain}/)"
   }
   item {
     key   = "www"
-    value = "https://www-${local.space_domain}/"
+    value = "[www-${local.space_domain}](https://tmux-${local.space_domain}/)"
   }
 }
 

From e9210aca809e03f2371a2735ab6b4563652235a2 Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Wed, 31 Jan 2024 00:31:04 +0000
Subject: [PATCH 07/39] Open in new window by default

---
 deployment.tf | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/deployment.tf b/deployment.tf
index 2db6d3f..ab7421b 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -15,21 +15,22 @@ resource "coder_metadata" "iipod" {
   #   value = "ssh -tA ii@${powerdns_record.a_record.name} kubectl exec -ti iipod-0 -- tmux at"
   # }
   # These can now be markdown : https://github.com/coder/coder/pull/10521
+  # Using HTML anchor with target="_blank" to open in new window.
   item {
     key   = "emacs"
-    value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)"
+    value = "<a href=https://emacs-${local.space_domain}/ target="_blank">emacs-${local.space_domain}</a>"
   }
   item {
     key   = "tmux"
-    value = "[tmux-${local.space_domain}](https://tmux-${local.space_domain}/)"
+    value = "<a href=https://tmux-${local.space_domain}/ target="_blank">tmux-${local.space_domain}</a>"
   }
   item {
     key   = "vnc"
-    value = "[vnc-${local.space_domain}](https://vnc-${local.space_domain}/)"
+    value = "<a href=https://vnc-${local.space_domain}/ target="_blank">vnc-${local.space_domain}</a>"
   }
   item {
     key   = "www"
-    value = "[www-${local.space_domain}](https://tmux-${local.space_domain}/)"
+    value = "<a href=https://www-${local.space_domain}/ target="_blank">www-${local.space_domain}</a>"
   }
 }
 

From e8c041a1fb96f1b6ac474cf7f711546a874bae2c Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Wed, 31 Jan 2024 00:33:04 +0000
Subject: [PATCH 08/39] Fix quotes

---
 deployment.tf | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/deployment.tf b/deployment.tf
index ab7421b..5307d25 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -18,19 +18,19 @@ resource "coder_metadata" "iipod" {
   # Using HTML anchor with target="_blank" to open in new window.
   item {
     key   = "emacs"
-    value = "<a href=https://emacs-${local.space_domain}/ target="_blank">emacs-${local.space_domain}</a>"
+    value = "<a href=https://emacs-${local.space_domain}/ target=_blank>emacs-${local.space_domain}</a>"
   }
   item {
     key   = "tmux"
-    value = "<a href=https://tmux-${local.space_domain}/ target="_blank">tmux-${local.space_domain}</a>"
+    value = "<a href=https://tmux-${local.space_domain}/ target=_blank>tmux-${local.space_domain}</a>"
   }
   item {
     key   = "vnc"
-    value = "<a href=https://vnc-${local.space_domain}/ target="_blank">vnc-${local.space_domain}</a>"
+    value = "<a href=https://vnc-${local.space_domain}/ target=_blank>vnc-${local.space_domain}</a>"
   }
   item {
     key   = "www"
-    value = "<a href=https://www-${local.space_domain}/ target="_blank">www-${local.space_domain}</a>"
+    value = "<a href=https://www-${local.space_domain}/ target=_blank>www-${local.space_domain}</a>"
   }
 }
 

From c6bbbd8c668887fe3a2b3c6a60f2b7f181f4084c Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Wed, 31 Jan 2024 00:38:26 +0000
Subject: [PATCH 09/39] Would prefer ability to open in new window/tab by
 default

---
 deployment.tf | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/deployment.tf b/deployment.tf
index 5307d25..434458a 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -15,22 +15,24 @@ resource "coder_metadata" "iipod" {
   #   value = "ssh -tA ii@${powerdns_record.a_record.name} kubectl exec -ti iipod-0 -- tmux at"
   # }
   # These can now be markdown : https://github.com/coder/coder/pull/10521
-  # Using HTML anchor with target="_blank" to open in new window.
+  # but apparently only a limited set of markdown/html
+  #       allowedElements={["p", "em", "strong", "a", "pre", "code"]}
+  # https://github.com/coder/coder/pull/10521/files#diff-cbc535e52cef85ed2f3d7ec9ba042a35c692c7bb50a6077d9df1dd0e6d14a752R147
   item {
     key   = "emacs"
-    value = "<a href=https://emacs-${local.space_domain}/ target=_blank>emacs-${local.space_domain}</a>"
+    value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)"
   }
   item {
     key   = "tmux"
-    value = "<a href=https://tmux-${local.space_domain}/ target=_blank>tmux-${local.space_domain}</a>"
+    value = "[tmux-${local.space_domain}](https://tmux-${local.space_domain}/)"
   }
   item {
     key   = "vnc"
-    value = "<a href=https://vnc-${local.space_domain}/ target=_blank>vnc-${local.space_domain}</a>"
+    value = "[vnc-${local.space_domain}](https://vnc-${local.space_domain}/)"
   }
   item {
     key   = "www"
-    value = "<a href=https://www-${local.space_domain}/ target=_blank>www-${local.space_domain}</a>"
+    value = "[www-${local.space_domain}](https://tmux-${local.space_domain}/)"
   }
 }
 

From ab804795d04c688f91d5aa91818dea99170edd87 Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Wed, 31 Jan 2024 00:49:33 +0000
Subject: [PATCH 10/39] autoconnect and resize=remote for vnc deployment

---
 deployment.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deployment.tf b/deployment.tf
index 434458a..815bea7 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -28,7 +28,7 @@ resource "coder_metadata" "iipod" {
   }
   item {
     key   = "vnc"
-    value = "[vnc-${local.space_domain}](https://vnc-${local.space_domain}/)"
+    value = "[vnc-${local.space_domain}](https://vnc-${local.space_domain}/?autoconnect=true&resize=remote)"
   }
   item {
     key   = "www"

From dd39a5c30f1afb40a42273c138023e61da20b631 Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Wed, 31 Jan 2024 00:57:34 +0000
Subject: [PATCH 11/39] Appending (:target=_blank) to open in new window

---
 deployment.tf | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/deployment.tf b/deployment.tf
index 815bea7..cba816a 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -18,21 +18,22 @@ resource "coder_metadata" "iipod" {
   # but apparently only a limited set of markdown/html
   #       allowedElements={["p", "em", "strong", "a", "pre", "code"]}
   # https://github.com/coder/coder/pull/10521/files#diff-cbc535e52cef85ed2f3d7ec9ba042a35c692c7bb50a6077d9df1dd0e6d14a752R147
+  # Hoping appending (:target=_blank) will work
   item {
     key   = "emacs"
-    value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)"
+    value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)(:target=_blank)"
   }
   item {
     key   = "tmux"
-    value = "[tmux-${local.space_domain}](https://tmux-${local.space_domain}/)"
+    value = "[tmux-${local.space_domain}](https://tmux-${local.space_domain}/)(:target=_blank)"
   }
   item {
     key   = "vnc"
-    value = "[vnc-${local.space_domain}](https://vnc-${local.space_domain}/?autoconnect=true&resize=remote)"
+    value = "[vnc-${local.space_domain}](https://vnc-${local.space_domain}/?autoconnect=true&resize=remote)(:target=_blank)"
   }
   item {
     key   = "www"
-    value = "[www-${local.space_domain}](https://tmux-${local.space_domain}/)"
+    value = "[www-${local.space_domain}](https://tmux-${local.space_domain}/)(:target=_blank)"
   }
 }
 

From 59e067d9a62a4283e1a6b7cde112120a35657022 Mon Sep 17 00:00:00 2001
From: root <root@sv1.cloudnative.coop>
Date: Wed, 31 Jan 2024 01:00:06 +0000
Subject: [PATCH 12/39] (:target=blank) doesn't work

---
 deployment.tf | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/deployment.tf b/deployment.tf
index cba816a..815bea7 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -18,22 +18,21 @@ resource "coder_metadata" "iipod" {
   # but apparently only a limited set of markdown/html
   #       allowedElements={["p", "em", "strong", "a", "pre", "code"]}
   # https://github.com/coder/coder/pull/10521/files#diff-cbc535e52cef85ed2f3d7ec9ba042a35c692c7bb50a6077d9df1dd0e6d14a752R147
-  # Hoping appending (:target=_blank) will work
   item {
     key   = "emacs"
-    value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)(:target=_blank)"
+    value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)"
   }
   item {
     key   = "tmux"
-    value = "[tmux-${local.space_domain}](https://tmux-${local.space_domain}/)(:target=_blank)"
+    value = "[tmux-${local.space_domain}](https://tmux-${local.space_domain}/)"
   }
   item {
     key   = "vnc"
-    value = "[vnc-${local.space_domain}](https://vnc-${local.space_domain}/?autoconnect=true&resize=remote)(:target=_blank)"
+    value = "[vnc-${local.space_domain}](https://vnc-${local.space_domain}/?autoconnect=true&resize=remote)"
   }
   item {
     key   = "www"
-    value = "[www-${local.space_domain}](https://tmux-${local.space_domain}/)(:target=_blank)"
+    value = "[www-${local.space_domain}](https://tmux-${local.space_domain}/)"
   }
 }
 

From 3e808f07f868e5f230e69100d32195529f22d526 Mon Sep 17 00:00:00 2001
From: root <Hippie Hacker>
Date: Thu, 3 Oct 2024 22:25:28 +0000
Subject: [PATCH 13/39] chore: minor updates

---
 build/Dockerfile |  2 +-
 docs/deploy.org  | 18 ++++++++----------
 namedspaced.tf   |  4 ++--
 vars.tf          |  2 +-
 4 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/build/Dockerfile b/build/Dockerfile
index a8498c7..cfd06ad 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -89,7 +89,6 @@ RUN DEBIAN_FRONTEND=noninteractive \
     kitty \
     plasma-desktop \
     dbus-x11 \
-    firefox-esr \
     websockify \
     code \
     cmake \
@@ -100,6 +99,7 @@ RUN DEBIAN_FRONTEND=noninteractive \
     openjdk-17-jdk \
 	&& ln -s /usr/bin/fdfind /usr/local/bin/fd \
 	&& rm -rf /var/lib/apt/lists/*
+    # firefox-esr \
     # ubuntu-desktop \
     # libgccjit-13-dev \
     # libgtk-3-bin \
diff --git a/docs/deploy.org b/docs/deploy.org
index 17b0a6c..0532509 100644
--- a/docs/deploy.org
+++ b/docs/deploy.org
@@ -133,18 +133,16 @@ coder template push \
     --yes \
     --directory . \
     --variable coder_url=$CODER_URL \
+    --variable ingress_ip=$INGRESS_IP \
     --variable coder_domain=$CODER_DOMAIN \
     --variable openai_api_token=$OPENAI_API_TOKEN \
-    --variable pdns_account=$PDNS_ACCOUNT \
     --variable pdns_api_url=$PDNS_API_URL \
     --variable pdns_api_key=$PDNS_API_KEY \
-    --variable ingress_ip=$INGRESS_IP \
-    --variable pdns_api_url=$PDNS_API_URL \
-    --variable pdns_account=$PDNS_ACCOUNT \
-    --variable dns_update_server=$PDNS_SERVER \
-    --variable dns_update_keyname=$PDNS_TSIG_KEYNAME \
-    --variable dns_update_keyalgorithm=$PDNS_TSIG_ALGO \
-    --variable dns_update_keysecret=$PDNS_TSIG_KEY \
+    --variable pdns_api_account=$PDNS_API_ACCOUNT \
+    --variable dns_update_server=$DNS_UPDATE_SERVER \
+    --variable dns_update_keyname=$DNS_UPDATE_KEYNAME \
+    --variable dns_update_keyalgorithm=$DNS_UPDATE_KEYALGORITHM \
+    --variable dns_update_keysecret=$DNS_UPDATE_KEYSECRET \
     --variable default_git_url=$DEFAULT_GIT_URL \
     --variable default_org_url=$DEFAULT_ORG_URL \
     --variable default_container_image=$DEFAULT_CONTAINER_IMAGE \
@@ -191,8 +189,8 @@ time coder create \
     --parameter container-image=$DEFAULT_CONTAINER_IMAGE \
     --parameter git-url=$DEFAULT_GIT_URL \
     --parameter org-url=$DEFAULT_ORG \
-    --parameter cpu=32 \
-    --parameter memory=64 \
+    --parameter cpu=4 \
+    --parameter memory=16 \
     --yes $SPACENAME
 #+end_src
 ** older
diff --git a/namedspaced.tf b/namedspaced.tf
index 572c437..9a823bf 100644
--- a/namedspaced.tf
+++ b/namedspaced.tf
@@ -39,7 +39,7 @@ curl -L -s \
     DOMAIN = "${local.user_domain}.",
     NS1    = "ns.ii.nz",
     NS2    = "ns2.ii.nz",
-    ACCOUNTNAME : "${var.pdns_account}",
+    ACCOUNTNAME : "${var.pdns_api_account}",
     KEYNAME : "${var.dns_update_keyname}",
     INGRESS_IP : "${var.ingress_ip}"
 })}' ${var.pdns_api_url}/api/v1/servers/localhost/zones
@@ -67,7 +67,7 @@ curl -L -s \
   DOMAIN = "${local.spacename}.${local.user_domain}.",
   NS1    = "ns.ii.nz",
   NS2    = "ns2.ii.nz",
-  ACCOUNTNAME : "${var.pdns_account}",
+  ACCOUNTNAME : "${var.pdns_api_account}",
   KEYNAME : "${var.dns_update_keyname}",
   INGRESS_IP : "${var.ingress_ip}"
 })}' ${var.pdns_api_url}/api/v1/servers/localhost/zones
diff --git a/vars.tf b/vars.tf
index f92814e..dfdc728 100644
--- a/vars.tf
+++ b/vars.tf
@@ -75,7 +75,7 @@ variable "pdns_api_url" {
   nullable = false
 }
 
-variable "pdns_account" {
+variable "pdns_api_account" {
   type        = string
   description = "PowerDNS Account to associate user domain to"
   nullable    = false

From c9715c7d7eb3c95e1bce51c3231d3778b424aa6c Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <calebwoodbine.public@gmail.com>
Date: Fri, 4 Oct 2024 11:58:54 +1300
Subject: [PATCH 14/39] feat: add github actions workflow for build

builds the image
---
 .github/workflows/build.yml | 95 +++++++++++++++++++++++++++++++++++++
 1 file changed, 95 insertions(+)
 create mode 100644 .github/workflows/build.yml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..4462288
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,95 @@
+name: build
+on:
+  push: {}
+  release:
+    types: [published]
+  workflow_dispatch: {}
+permissions:
+  packages: write
+  contents: write
+  pull-requests: write
+  id-token: write
+  security-events: write
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
+      - uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8026d2bc3645ea78b0d2544766a1225eb5691f89 # v3.7.0
+      - name: Login to ghcr.io
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - id: run-info
+        name: collect job run info
+        env:
+          GHCR_DOCKER_REPO: ghcr.io/${{ github.repository }}
+        run: |
+          TAGS="latest,$(git show -s --format=%cd --date=format:'%Y.%m.%d.%H%M')"
+          REGISTRY="${GHCR_DOCKER_REPO,,}"
+          [ -z "$REGISTRY_OVERRIDE" ] || REGISTRY="$REGISTRY_OVERRIDE"
+          IMAGES_WITH_TAGS=""
+          for TAG in $(echo $TAGS | tr ',' ' '); do
+            NEW_TAG="$REGISTRY:$TAG"
+            if [ -n "$IMAGES_WITH_TAGS" ]; then
+              IMAGES_WITH_TAGS="$NEW_TAG,$IMAGES_WITH_TAGS"
+            else
+              IMAGES_WITH_TAGS="$NEW_TAG"
+            fi
+          done
+          echo "image=$REGISTRY" >> $GITHUB_OUTPUT
+          echo "images-with-tags=$IMAGES_WITH_TAGS" >> $GITHUB_OUTPUT
+      - name: Build and push
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+        id: build
+        with:
+          push: true
+          tags: ${{ steps.run-info.outputs.images-with-tags }}
+          context: build
+          platforms: linux/amd64
+          file: build/Dockerfile
+          labels: |
+            org.opencontainers.image.name=${{ steps.run-info.outputs.image }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.source=${{ github.repositoryUrl }}
+      - name: get-digests
+        id: get-digests
+        env:
+          DESTINATION: ${{ steps.run-info.outputs.image }}@${{ steps.build.outputs.digest }}
+        run: |
+          DESTINATION_DIGEST="$(crane digest "${DESTINATION}" || true)"
+          (
+            echo "DESTINATION_DIGEST"
+            echo "${DESTINATION_DIGEST}"
+          ) | column -t
+          echo "destination=${DESTINATION_DIGEST}" >> $GITHUB_OUTPUT
+      - name: Sign image
+        env:
+          COSIGN_YES: "true"
+        run: |
+          cosign sign ${{ steps.run-info.outputs.image }}@${{ steps.get-digests.outputs.destination }} -y --recursive
+      - uses: anchore/sbom-action@61119d458adab75f756bc0b9e4bde25725f86a7a # v0.17.2
+        with:
+          image: ${{ steps.run-info.outputs.image }}@${{ steps.get-digests.outputs.destination }}
+          artifact-name: sbom-spdx.json
+          output-file: /tmp/sbom-spdx.json
+      - name: publish sbom blob as blob
+        env:
+          COSIGN_YES: "true"
+        run: |
+          cosign attest --predicate /tmp/sbom-spdx.json ${{ steps.run-info.outputs.image }}@${{ steps.get-digests.outputs.destination }} --recursive
+      - name: image
+        id: image
+        run: |
+          echo "image=${{ steps.run-info.outputs.image }}@${{ steps.get-digests.outputs.destination }}" >> $GITHUB_OUTPUT
+      - name: image result
+        id: result
+        run: |
+          echo "Build, pushed and signed: ${{ steps.image.outputs.image }}"

From 1701332e7a8c8ed3a3e271476a3f56e26489cf83 Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <calebwoodbine.public@gmail.com>
Date: Tue, 8 Oct 2024 09:39:06 +1300
Subject: [PATCH 15/39] chore: update iipod build workflows

permissions and tidy steps
---
 .github/workflows/build.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4462288..5de6f4d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -5,18 +5,18 @@ on:
     types: [published]
   workflow_dispatch: {}
 permissions:
+  contents: read
   packages: write
-  contents: write
-  pull-requests: write
   id-token: write
-  security-events: write
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - name: Maximize build space
+        uses: ublue-os/remove-unwanted-software@517622d6452028f266b7ba4cc9a123b5f58a6b53 # v7
       - uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
       - uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - name: Set up QEMU
         uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
       - name: Set up Docker Buildx

From c9ad26242d97e6312117a649dda616c10cee8677 Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <calebwoodbine.public@gmail.com>
Date: Tue, 8 Oct 2024 13:35:39 +1300
Subject: [PATCH 16/39] chore: remove github token from agent

don't use it
---
 agent.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/agent.tf b/agent.tf
index 2bf63ae..18ae3e5 100644
--- a/agent.tf
+++ b/agent.tf
@@ -12,7 +12,7 @@ resource "coder_agent" "iipod" {
   shutdown_script_timeout = 300
   env = {
     # GITHUB_TOKEN = "$${data.coder_git_auth.github.access_token}"
-    GITHUB_TOKEN = "${data.coder_external_auth.github.access_token}"
+    # GITHUB_TOKEN = "${data.coder_external_auth.github.access_token}"
     # Just a hidden feature for now to try out
     OPENAI_API_TOKEN    = "${var.openai_api_token}"
     ORGFILE_URL         = "${data.coder_parameter.org-url.value}"

From a13921689dc229648fea84e3c6f24e36479d73e5 Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <calebwoodbine.public@gmail.com>
Date: Tue, 8 Oct 2024 13:35:58 +1300
Subject: [PATCH 17/39] chore: update params and defaults

- use default cpu and memory from variables
---
 deployment.tf | 10 +++---
 parameters.tf | 99 ++++++++++++++++++++++++++-------------------------
 vars.tf       | 20 +++++++++--
 3 files changed, 74 insertions(+), 55 deletions(-)

diff --git a/deployment.tf b/deployment.tf
index 815bea7..9e1d1eb 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -98,12 +98,14 @@ resource "kubernetes_deployment" "iipod" {
           }
           resources {
             requests = {
-              "cpu"    = "250m"
-              "memory" = "512Mi"
+              # "cpu"    = "250m"
+              # "memory" = "512Mi"
+              "cpu"    = "${var.container_resource_cpu / 2}"
+              "memory" = "${var.container_resource_memory / 2}Gi"
             }
             limits = {
-              "cpu"    = "${data.coder_parameter.cpu.value}"
-              "memory" = "${data.coder_parameter.memory.value}Gi"
+              "cpu"    = var.container_resource_cpu
+              "memory" = "${var.container_resource_memory}Gi"
             }
           }
           env {
diff --git a/parameters.tf b/parameters.tf
index 95eac0c..7b5ec7f 100644
--- a/parameters.tf
+++ b/parameters.tf
@@ -23,6 +23,7 @@ data "coder_parameter" "container-image" {
   description  = "The container image to use for the workspace"
   default      = var.default_container_image
   icon         = "https://raw.githubusercontent.com/matifali/logos/main/docker.svg"
+  mutable      = true
 }
 
 data "coder_parameter" "git-url" {
@@ -30,6 +31,7 @@ data "coder_parameter" "git-url" {
   display_name = "Git URL"
   description  = "The Git URL to checkout for this workspace"
   default      = var.default_git_url
+  mutable      = true
   # icon         = "https://raw.githubusercontent.com/matifali/logos/main/docker.svg"
 }
 
@@ -38,55 +40,56 @@ data "coder_parameter" "org-url" {
   display_name = "Orgfile url"
   description  = "The Orgfile URL to load into emacs"
   default      = var.default_org_url
+  mutable      = true
   # icon         = "https://raw.githubusercontent.com/matifali/logos/main/docker.svg"
 }
 
-data "coder_parameter" "cpu" {
-  name         = "cpu"
-  display_name = "CPU"
-  description  = "The number of CPU cores"
-  default      = "4"
-  icon         = "/icon/memory.svg"
-  mutable      = true
-  option {
-    name  = "4 Cores"
-    value = "4"
-  }
-  option {
-    name  = "8 Cores"
-    value = "8"
-  }
-  option {
-    name  = "16 Cores"
-    value = "16"
-  }
-  option {
-    name  = "32 Cores"
-    value = "32"
-  }
-}
+# data "coder_parameter" "cpu" {
+#   name         = "cpu"
+#   display_name = "CPU"
+#   description  = "The number of CPU cores"
+#   default      = "4"
+#   icon         = "/icon/memory.svg"
+#   mutable      = true
+#   option {
+#     name  = "4 Cores"
+#     value = "4"
+#   }
+#   option {
+#     name  = "8 Cores"
+#     value = "8"
+#   }
+#   option {
+#     name  = "16 Cores"
+#     value = "16"
+#   }
+#   option {
+#     name  = "32 Cores"
+#     value = "32"
+#   }
+# }
 
-data "coder_parameter" "memory" {
-  name         = "memory"
-  display_name = "Memory"
-  description  = "The amount of memory in GB"
-  default      = "8"
-  icon         = "/icon/memory.svg"
-  mutable      = true
-  option {
-    name  = "8 GB"
-    value = "8"
-  }
-  option {
-    name  = "16 GB"
-    value = "16"
-  }
-  option {
-    name  = "32 GB"
-    value = "32"
-  }
-  option {
-    name  = "64 GB"
-    value = "64"
-  }
-}
+# data "coder_parameter" "memory" {
+#   name         = "memory"
+#   display_name = "Memory"
+#   description  = "The amount of memory in GB"
+#   default      = "8"
+#   icon         = "/icon/memory.svg"
+#   mutable      = true
+#   option {
+#     name  = "8 GB"
+#     value = "8"
+#   }
+#   option {
+#     name  = "16 GB"
+#     value = "16"
+#   }
+#   option {
+#     name  = "32 GB"
+#     value = "32"
+#   }
+#   option {
+#     name  = "64 GB"
+#     value = "64"
+#   }
+# }
diff --git a/vars.tf b/vars.tf
index dfdc728..e799332 100644
--- a/vars.tf
+++ b/vars.tf
@@ -11,9 +11,9 @@ data "coder_workspace" "ii" {
 #   id = "github"
 # }
 
-data "coder_external_auth" "github" {
-  id = "github"
-}
+# data "coder_external_auth" "github" {
+#   id = "github"
+# }
 
 # Can be set via TF_VAR_variable_name in the coder process ENV
 # But can also be set via a file similar var/space.sharing.io.yaml
@@ -111,6 +111,20 @@ variable "dns_update_keysecret" {
   nullable    = false
   # sensitive   = true
 }
+variable "container_resource_cpu" {
+  type        = number
+  description = "the strict amount of CPU to provide"
+  default     = "4"
+  nullable    = false
+  # sensitive   = true
+}
+variable "container_resource_memory" {
+  type        = number
+  description = "the strict amount of memory to provide in gigabytes"
+  default     = "8"
+  nullable    = false
+  # sensitive   = true
+}
 
 variable "default_container_image" {
   type        = string

From 1b933d823c952b78633159e512c7b16e81c5754c Mon Sep 17 00:00:00 2001
From: Hippie Hacker <hh@ii.coop>
Date: Mon, 7 Oct 2024 18:37:36 -0600
Subject: [PATCH 18/39] chore: left/right eye

---
 apps.tf                                       | 17 +++-
 create_domain.tpl.json                        | 10 ++-
 deployment.tf                                 | 41 ++++++----
 docs/deploy.org                               | 31 +++++---
 ephemeral_manifests/ing-emacs.yaml            | 28 +++----
 .../{ing-tmux.yaml => ing-left.yaml}          | 38 ++++-----
 ephemeral_manifests/ing-right.yaml            | 65 +++++++++++++++
 ephemeral_manifests/ing-vnc.yaml              | 26 +++---
 ephemeral_manifests/ing-www.yaml              | 20 +++--
 .../space-cert.yaml                           |  0
 .../{svc-ttyd.yaml => svc-left.yaml}          |  4 +-
 iipod-startup.sh                              | 26 +++---
 namedspaced.tf                                | 79 ++++++++++---------
 vars.tf                                       | 28 +++----
 14 files changed, 264 insertions(+), 149 deletions(-)
 rename ephemeral_manifests/{ing-tmux.yaml => ing-left.yaml} (65%)
 create mode 100644 ephemeral_manifests/ing-right.yaml
 rename {unused_manifests => ephemeral_manifests}/space-cert.yaml (100%)
 rename ephemeral_manifests/{svc-ttyd.yaml => svc-left.yaml} (81%)

diff --git a/apps.tf b/apps.tf
index 883450b..98edfd3 100644
--- a/apps.tf
+++ b/apps.tf
@@ -10,11 +10,22 @@ resource "coder_app" "Emacs" {
 }
 
 # ttyd
-resource "coder_app" "tmux" {
+resource "coder_app" "left-tmux" {
   subdomain    = true
   share        = "public"
-  slug         = "tmux"
-  display_name = "tmux"
+  slug         = "left-tmux"
+  display_name = "left eye/tmux"
+  icon         = "https://cdn.icon-icons.com/icons2/2148/PNG/512/tmux_icon_131831.png"
+  agent_id     = coder_agent.iipod.id
+  url          = "http://localhost:7680" # 7681 is the default ttyd port, which calls 'tmux at -s $SPACENAME'
+}
+
+# ttyd
+resource "coder_app" "right-tmux" {
+  subdomain    = true
+  share        = "public"
+  slug         = "right-tmux"
+  display_name = "right eye/tmux"
   icon         = "https://cdn.icon-icons.com/icons2/2148/PNG/512/tmux_icon_131831.png"
   agent_id     = coder_agent.iipod.id
   url          = "http://localhost:7681" # 7681 is the default ttyd port, which calls 'tmux at -s $SPACENAME'
diff --git a/create_domain.tpl.json b/create_domain.tpl.json
index ceb4a8e..cac30a0 100644
--- a/create_domain.tpl.json
+++ b/create_domain.tpl.json
@@ -2,7 +2,7 @@
   "name": "${DOMAIN}",
   "kind": "Native",
   "nameservers": ["${NS1}.", "${NS2}."],
-  "account": "${ACCOUNTNAME}",
+  "account": "coder",
   "master_tsig_key_ids": ["${KEYNAME}"],
   "rrsets": [
     {
@@ -11,11 +11,17 @@
       "ttl": 60,
       "records": [{ "content": "${INGRESS_IP}" }]
     }
+    {
+      "name": "@",
+      "type": "A",
+      "ttl": 60,
+      "records": [{ "content": "${INGRESS_IP}" }]
+    }
   ],
   "comments": [
     {
       "content": "Created ${DOMAIN} Wildcard",
-      "account": "${ACCOUNTNAME}"
+      "account": "coder"
     }
   ]
 }
diff --git a/deployment.tf b/deployment.tf
index 9e1d1eb..8789ba4 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -18,22 +18,31 @@ resource "coder_metadata" "iipod" {
   # but apparently only a limited set of markdown/html
   #       allowedElements={["p", "em", "strong", "a", "pre", "code"]}
   # https://github.com/coder/coder/pull/10521/files#diff-cbc535e52cef85ed2f3d7ec9ba042a35c692c7bb50a6077d9df1dd0e6d14a752R147
-  item {
-    key   = "emacs"
-    value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)"
-  }
-  item {
-    key   = "tmux"
-    value = "[tmux-${local.space_domain}](https://tmux-${local.space_domain}/)"
-  }
-  item {
-    key   = "vnc"
-    value = "[vnc-${local.space_domain}](https://vnc-${local.space_domain}/?autoconnect=true&resize=remote)"
-  }
-  item {
-    key   = "www"
-    value = "[www-${local.space_domain}](https://tmux-${local.space_domain}/)"
-  }
+  # item {
+  #   key   = "emacs"
+  #   value = "[emacs-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://emacs-${local.spacename}-${data.coder_workspace.ii.owner}.${var.coder_domain})"
+  #   # value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)"
+  # }
+  # item {
+  #   key   = "left tmux/eye"
+  #   value = "[left-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://left-${local.spacename}-${data.coder_workspace.ii.owner}.${var.coder_domain})"
+  #   # value = "[lefteye-${local.space_domain}](https://lefteye-${local.space_domain}/)"
+  # }
+  # item {
+  #   key   = "right tmux/eye"
+  #   value = "[right-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://right-${local.spacename}-${data.coder_workspace.ii.owner}.${var.coder_domain})"
+  #   # value = "[righteye-${local.space_domain}](https://righteye-${local.space_domain}/)"
+  # }
+  # item {
+  #   key   = "vnc"
+  #   value = "[vnc-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://vnc-${local.spacename}-${data.coder_workspace.ii.owner}.${var.coder_domain}/?autoconnect=true&resize=remote)"
+  #   # value = "[vnc-${emacslocal.space_domain}](https://vnc-${local.space_domain}/?autoconnect=true&resize=remote)"
+  # }
+  # item {
+  #   key   = "www"
+  #   value = "[www-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://www-${local.spacename}-${data.coder_workspace.ii.owner}.${var.coder_domain})"
+  #   # value = "[www-${local.space_domain}](https://www-${local.space_domain}/)"
+  # }
 }
 
 resource "kubernetes_deployment" "iipod" {
diff --git a/docs/deploy.org b/docs/deploy.org
index 0532509..4c1ab93 100644
--- a/docs/deploy.org
+++ b/docs/deploy.org
@@ -91,11 +91,11 @@ ssh -A ii@sharing.io
 #+end_src
 ** CODER_CONFIG_DIR
 #+begin_src tmux
-export CODER_CONFIG_DIR=~/.config/space.cloudnative.nz
+export CODER_CONFIG_DIR=~/.config/coder.sharing.io
 #+end_src
 ** coder login
 #+begin_src tmux
-coder login https://space.cloudnative.nz
+coder login https://coder.sharing.io
 #+end_src
 * template
 :PROPERTIES:
@@ -109,6 +109,9 @@ ssh -A ii@sharing.io
 #+begin_src tmux
 cd ~/iipod
 #+end_src
+
+#+RESULTS:
+
 ** init terraform
 coder now supports speeding things up if you `terraform init` so .terraform.lock.hcl is pushed the template and cached.
 https://github.com/coder/coder/pull/7604/files
@@ -122,10 +125,12 @@ WARN: No .terraform.lock.hcl file found
 #+begin_src tmux
 terraform init
 #+end_src
+
+#+RESULTS:
+
 ** push/create the template with terraform vars
 #+begin_src tmux
-# export CODER_CONFIG_DIR=~/.config/space.uk.cloudnative.coop
-export CODER_CONFIG_DIR=~/.config/coder.cloudnative.coop
+export CODER_CONFIG_DIR=~/.config/coder.sharing.io
 export CODER_TEMPLATE_NAME=iipod
 cd ~/iipod
 source .envrc
@@ -133,12 +138,12 @@ coder template push \
     --yes \
     --directory . \
     --variable coder_url=$CODER_URL \
-    --variable ingress_ip=$INGRESS_IP \
+    --variable public_ip=$PUBLIC_IP \
     --variable coder_domain=$CODER_DOMAIN \
     --variable openai_api_token=$OPENAI_API_TOKEN \
     --variable pdns_api_url=$PDNS_API_URL \
     --variable pdns_api_key=$PDNS_API_KEY \
-    --variable pdns_api_account=$PDNS_API_ACCOUNT \
+    --variable dns_update_account=$DNS_UPDATE_ACCOUNT \
     --variable dns_update_server=$DNS_UPDATE_SERVER \
     --variable dns_update_keyname=$DNS_UPDATE_KEYNAME \
     --variable dns_update_keyalgorithm=$DNS_UPDATE_KEYALGORITHM \
@@ -149,6 +154,9 @@ coder template push \
     $CODER_TEMPLATE_NAME \
     --message "$USER iipod Template at $(date)"
 #+end_src
+
+#+RESULTS:
+
     # \
     #--name "foo-bar-baz-`date +%T`"
 * workspace
@@ -167,10 +175,10 @@ env | grep "DEFAULT_" | sort
 #+RESULTS:
 #+begin_src shell
 CODER_TEMPLATE_NAME=iipod
-CODER_WORKSPACE_STOP_AFTER=96h
-DEFAULT_CONTAINER_IMAGE=ghcr.io/ii/iipod:2024.01.18-02
-DEFAULT_GIT_URL=https://github.com/ii/iipod
-DEFAULT_ORG_URL=https://raw.githubusercontent.com/ii/iipod/canon/org/vcluster.org
+CODER_WORKSPACE_STOP_AFTER=7d
+DEFAULT_CONTAINER_IMAGE=ghcr.io/ii/iipod:2024.10.02-01
+DEFAULT_GIT_URL=https://github.com/ii/iipod/
+DEFAULT_ORG_URL=https://raw.githubusercontent.com/ii/iipod/org/vcluster.org
 #+end_src
 
 ** coder create with parameters
@@ -189,8 +197,6 @@ time coder create \
     --parameter container-image=$DEFAULT_CONTAINER_IMAGE \
     --parameter git-url=$DEFAULT_GIT_URL \
     --parameter org-url=$DEFAULT_ORG \
-    --parameter cpu=4 \
-    --parameter memory=16 \
     --yes $SPACENAME
 #+end_src
 ** older
@@ -206,3 +212,4 @@ EOF
 #+begin_src tmux
 echo FOO
 #+end_src
+a
diff --git a/ephemeral_manifests/ing-emacs.yaml b/ephemeral_manifests/ing-emacs.yaml
index e98ab01..bb84c07 100644
--- a/ephemeral_manifests/ing-emacs.yaml
+++ b/ephemeral_manifests/ing-emacs.yaml
@@ -5,7 +5,7 @@ metadata:
   namespace: ${namespace}
   labels:
     spaceapp: emacs
-    spacename: ${spacename}
+    spacename: "${spacename}"
   annotations:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
@@ -23,16 +23,16 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: emacs-${spacename}-${username}.${coder_domain}
-      http:
-        paths:
-          - backend:
-              service:
-                name: emacs-${spacename}
-                port:
-                  number: 80
-            path: /
-            pathType: ImplementationSpecific
+    # - host: emacs-${spacename}-${username}.${coder_domain}
+    #   http:
+    #     paths:
+    #       - backend:
+    #           service:
+    #             name: emacs-${spacename}
+    #             port:
+    #               number: 80
+    #         path: /
+    #         pathType: ImplementationSpecific
     - host: emacs-${spacename}.${username}.${coder_domain}
       http:
         paths:
@@ -54,9 +54,9 @@ spec:
             path: /
             pathType: ImplementationSpecific
   tls:
-    - hosts:
-        - emacs-${spacename}-${username}.${coder_domain}
-      # This one uses the default cert
+    # - hosts:
+    #     - emacs-${spacename}-${username}.${coder_domain}
+    #   # This one uses the default cert
     - hosts:
         - emacs-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
diff --git a/ephemeral_manifests/ing-tmux.yaml b/ephemeral_manifests/ing-left.yaml
similarity index 65%
rename from ephemeral_manifests/ing-tmux.yaml
rename to ephemeral_manifests/ing-left.yaml
index 3bf4ee6..98eec17 100644
--- a/ephemeral_manifests/ing-tmux.yaml
+++ b/ephemeral_manifests/ing-left.yaml
@@ -1,10 +1,10 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: tmux-${spacename}
+  name: left-${spacename}
   namespace: ${namespace}
   labels:
-    spaceapp: tmux
+    spaceapp: left
     spacename: ${spacename}
   annotations:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
@@ -23,7 +23,17 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: tmux-${spacename}-${username}.${coder_domain}
+    # - host: left-${spacename}-${username}.${coder_domain}
+    #   http:
+    #     paths:
+    #       - backend:
+    #           service:
+    #             name: ttyd-${spacename}
+    #             port:
+    #               number: 80
+    #         path: /
+    #         pathType: ImplementationSpecific
+    - host: left-${spacename}.${username}.${coder_domain}
       http:
         paths:
           - backend:
@@ -33,17 +43,7 @@ spec:
                   number: 80
             path: /
             pathType: ImplementationSpecific
-    - host: tmux-${spacename}.${username}.${coder_domain}
-      http:
-        paths:
-          - backend:
-              service:
-                name: ttyd-${spacename}
-                port:
-                  number: 80
-            path: /
-            pathType: ImplementationSpecific
-    - host: tmux.${spacename}.${username}.${coder_domain}
+    - host: left.${spacename}.${username}.${coder_domain}
       http:
         paths:
           - backend:
@@ -54,12 +54,12 @@ spec:
             path: /
             pathType: ImplementationSpecific
   tls:
+    # - hosts:
+    #     - left-${spacename}-${username}.${coder_domain}
+    #   # This one uses the default cert
     - hosts:
-        - tmux-${spacename}-${username}.${coder_domain}
-      # This one uses the default cert
-    - hosts:
-        - tmux-${spacename}.${username}.${coder_domain}
+        - left-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
     - hosts:
-        - tmux.${spacename}.${username}.${coder_domain}
+        - left.${spacename}.${username}.${coder_domain}
       secretName: ${spacename}-wildcard-tls
diff --git a/ephemeral_manifests/ing-right.yaml b/ephemeral_manifests/ing-right.yaml
new file mode 100644
index 0000000..62f0ff1
--- /dev/null
+++ b/ephemeral_manifests/ing-right.yaml
@@ -0,0 +1,65 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: right-${spacename}
+  namespace: ${namespace}
+  labels:
+    spaceapp: right
+    spacename: ${spacename}
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/server-snippets: |
+      location / {
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_http_version 1.1;
+      proxy_set_header X-Forwarded-Host $http_host;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Forwarded-For $remote_addr;
+      proxy_set_header Host $host;
+      proxy_set_header Connection "upgrade";
+      proxy_cache_bypass $http_upgrade;
+      }
+spec:
+  ingressClassName: nginx
+  rules:
+    # - host: right-${spacename}-${username}.${coder_domain}
+    #   http:
+    #     paths:
+    #       - backend:
+    #           service:
+    #             name: ttyd-${spacename}
+    #             port:
+    #               number: 80
+    #         path: /
+    #         pathType: ImplementationSpecific
+    - host: right-${spacename}.${username}.${coder_domain}
+      http:
+        paths:
+          - backend:
+              service:
+                name: ttyd-${spacename}
+                port:
+                  number: 80
+            path: /
+            pathType: ImplementationSpecific
+    - host: right.${spacename}.${username}.${coder_domain}
+      http:
+        paths:
+          - backend:
+              service:
+                name: ttyd-${spacename}
+                port:
+                  number: 80
+            path: /
+            pathType: ImplementationSpecific
+  tls:
+    # - hosts:
+    #     - right-${spacename}-${username}.${coder_domain}
+    #   # This one uses the default cert
+    - hosts:
+        - right-${spacename}.${username}.${coder_domain}
+      secretName: wildcard-tls
+    - hosts:
+        - right.${spacename}.${username}.${coder_domain}
+      secretName: ${spacename}-wildcard-tls
diff --git a/ephemeral_manifests/ing-vnc.yaml b/ephemeral_manifests/ing-vnc.yaml
index 209db1a..707fd19 100644
--- a/ephemeral_manifests/ing-vnc.yaml
+++ b/ephemeral_manifests/ing-vnc.yaml
@@ -22,16 +22,16 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: vnc-${spacename}-${username}.${coder_domain}
-      http:
-        paths:
-          - backend:
-              service:
-                name: novnc-${spacename}
-                port:
-                  number: 80
-            path: /
-            pathType: ImplementationSpecific
+    # - host: vnc-${spacename}-${username}.${coder_domain}
+    #   http:
+    #     paths:
+    #       - backend:
+    #           service:
+    #             name: novnc-${spacename}
+    #             port:
+    #               number: 80
+    #         path: /
+    #         pathType: ImplementationSpecific
     - host: vnc-${spacename}.${username}.${coder_domain}
       http:
         paths:
@@ -53,9 +53,9 @@ spec:
             path: /
             pathType: ImplementationSpecific
   tls:
-    - hosts:
-        - vnc-${spacename}-${username}.${coder_domain}
-      # This one uses the default cert
+    # - hosts:
+    #     - vnc-${spacename}-${username}.${coder_domain}
+    #   # This one uses the default cert
     - hosts:
         - vnc-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
diff --git a/ephemeral_manifests/ing-www.yaml b/ephemeral_manifests/ing-www.yaml
index 27208ed..96ac1ca 100644
--- a/ephemeral_manifests/ing-www.yaml
+++ b/ephemeral_manifests/ing-www.yaml
@@ -23,7 +23,17 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: www-${spacename}-${username}.${coder_domain}
+    # - host: www-${spacename}-${username}.${coder_domain}
+    #   http:
+    #     paths:
+    #       - backend:
+    #           service:
+    #             name: www-${spacename}
+    #             port:
+    #               number: 80
+    #         path: /
+    #         pathType: ImplementationSpecific
+    - host: www.${spacename}.${username}.${coder_domain}
       http:
         paths:
           - backend:
@@ -33,7 +43,7 @@ spec:
                   number: 80
             path: /
             pathType: ImplementationSpecific
-    - host: www.${spacename}.${username}.${coder_domain}
+    - host: www.${spacename}-${username}.${coder_domain}
       http:
         paths:
           - backend:
@@ -44,9 +54,9 @@ spec:
             path: /
             pathType: ImplementationSpecific
   tls:
-    - hosts:
-        - www-${spacename}-${username}.${coder_domain}
-      # This one uses the default cert
+    # - hosts:
+    #     - www-${spacename}-${username}.${coder_domain}
+    #   # This one uses the default cert
     - hosts:
         - www-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
diff --git a/unused_manifests/space-cert.yaml b/ephemeral_manifests/space-cert.yaml
similarity index 100%
rename from unused_manifests/space-cert.yaml
rename to ephemeral_manifests/space-cert.yaml
diff --git a/ephemeral_manifests/svc-ttyd.yaml b/ephemeral_manifests/svc-left.yaml
similarity index 81%
rename from ephemeral_manifests/svc-ttyd.yaml
rename to ephemeral_manifests/svc-left.yaml
index 4421cbc..9c811a9 100644
--- a/ephemeral_manifests/svc-ttyd.yaml
+++ b/ephemeral_manifests/svc-left.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: ttyd-${spacename}
+  name: left-${spacename}
   namespace: ${namespace}
   labels:
     spacename: ${spacename}
@@ -9,7 +9,7 @@ spec:
   ports:
     - port: 80
       protocol: TCP
-      targetPort: 7681
+      targetPort: 7680
   selector:
     spacename: ${spacename}
     spaceapp: iipod
diff --git a/iipod-startup.sh b/iipod-startup.sh
index 7bdee6f..331fa7d 100644
--- a/iipod-startup.sh
+++ b/iipod-startup.sh
@@ -17,22 +17,28 @@ ssh-keyscan -H github.com >>~/.ssh/known_hosts
 git remote add ssh $GIT_REPO_SSH
 "
 
-echo "Starting TMUX session: $SPACE_NAME:emacs"
-tmux new-window -d -t $SPACENAME -n "emacs"
-tmux send-keys -t "$SPACENAME:emacs" "
-sleep 15
-emacsclient -nw $ORGFILE
-"
-
 echo "Starting TMUX session: servers:ii"
 tmux new -d -s "servers" -n ii
 tmux send-keys -t "servers:ii" "
 echo These windows contain the services supporting your iipod
 "
 
-echo "Starting TMUX session: servers:ttyd"
-tmux new-window -d -t "servers" -n "ttyd"
-tmux send-keys -t "servers:ttyd" "
+echo "Starting TMUX session: servers:emacs"
+tmux new-window -d -t servers -n "emacs"
+tmux send-keys -t "servers:emacs" "
+sleep 15
+emacsclient -nw $ORGFILE
+"
+
+echo "Starting TMUX session: servers:left-ttyd"
+tmux new-window -d -t "servers" -n "left-ttyd"
+tmux send-keys -t "servers:left-ttyd" "
+ttyd --writable -p 7680 tmux at -t servers
+"
+
+echo "Starting TMUX session: servers:right-ttyd"
+tmux new-window -d -t "servers" -n "right-ttyd"
+tmux send-keys -t "servers:right-ttyd" "
 ttyd --writable tmux at -t $SPACENAME
 "
 
diff --git a/namedspaced.tf b/namedspaced.tf
index 9a823bf..09e2dee 100644
--- a/namedspaced.tf
+++ b/namedspaced.tf
@@ -19,12 +19,10 @@ resource "template_dir" "ephemeral" {
     spacename    = local.spacename
   }
 }
-
-# TODO look at https://registry.terraform.io/providers/kbst/kustomization/latest/docs/resources/resource
 resource "null_resource" "namespace" {
   depends_on = [
     template_dir.persistent,
-    template_dir.ephemeral
+    # template_dir.ephemeral
   ]
   # We want a per user domain USERNAME.DOMAIN.COM
   # We provision wildcard DNS01 certs for *.USERNAME.DOMAIN.COM
@@ -32,18 +30,17 @@ resource "null_resource" "namespace" {
   provisioner "local-exec" {
     quiet = true
     command = <<COMMAND
-curl -L -s \
-  -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
-  -D - \
-  -d '${templatefile("./create_domain.tpl.json", {
+  curl -L -s \
+    -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
+    -D - \
+    -d '${templatefile("./create_domain.tpl.json", {
     DOMAIN = "${local.user_domain}.",
-    NS1    = "ns.ii.nz",
-    NS2    = "ns2.ii.nz",
-    ACCOUNTNAME : "${var.pdns_api_account}",
+    NS1    = "ns1.sharing.io",
+    NS2    = "ns2.sharing.io",
     KEYNAME : "${var.dns_update_keyname}",
-    INGRESS_IP : "${var.ingress_ip}"
+    INGRESS_IP : "${var.public_ip}"
 })}' ${var.pdns_api_url}/api/v1/servers/localhost/zones
-COMMAND
+  COMMAND
 }
 provisioner "local-exec" {
   quiet   = true
@@ -57,34 +54,36 @@ COMMAND
 }
 
 ##### this creates a DNS zone per namespace.... this isn't needed yet, but might be useful later on
-provisioner "local-exec" {
-  quiet = true
-  command = <<COMMAND
-curl -L -s \
-  -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
-  -D - \
-  -d '${templatefile("./create_domain.tpl.json", {
-  DOMAIN = "${local.spacename}.${local.user_domain}.",
-  NS1    = "ns.ii.nz",
-  NS2    = "ns2.ii.nz",
-  ACCOUNTNAME : "${var.pdns_api_account}",
-  KEYNAME : "${var.dns_update_keyname}",
-  INGRESS_IP : "${var.ingress_ip}"
-})}' ${var.pdns_api_url}/api/v1/servers/localhost/zones
-COMMAND
-}
-provisioner "local-exec" {
-  quiet   = true
-  command = <<COMMAND
-curl -L -s \
-  -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
-  -D - \
-  -d '{"kind": "TSIG-ALLOW-DNSUPDATE", "metadata": ["${var.dns_update_keyname}"]}' \
-  ${var.pdns_api_url}/api/v1/servers/localhost/zones/${local.spacename}.${local.user_domain}/metadata
-COMMAND
-}
+# provisioner "local-exec" {
+#   quiet = true
+#   command = <<COMMAND
+# curl -L -s \
+#   -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
+#   -D - \
+#   -d '${templatefile("./create_domain.tpl.json", {
+#   DOMAIN = "${local.spacename}.${local.user_domain}.",
+#   NS1    = "ns1.sharing.io",
+#   NS2    = "ns2.sharing.io",
+#   ACCOUNTNAME : "coder",
+#   KEYNAME : "${var.dns_update_keyname}",
+#   INGRESS_IP : "${var.ingress_ip}"
+# })}' ${var.pdns_api_url}/api/v1/servers/localhost/zones
+# COMMAND
+# }
+# provisioner "local-exec" {
+#   quiet   = true
+#   command = <<COMMAND
+# curl -L -s \
+#   -H 'X-API-Key: ${var.pdns_api_key}' -H 'Content-Type: application/json' \
+#   -D - \
+#   -d '{"kind": "TSIG-ALLOW-DNSUPDATE", "metadata": ["${var.dns_update_keyname}"]}' \
+#   ${var.pdns_api_url}/api/v1/servers/localhost/zones/${local.spacename}.${local.user_domain}/metadata
+# COMMAND
+# }
+
 # I want to apply a bunch of manifests at once
 # HELP WANTED to find a better way
+
 provisioner "local-exec" {
   command = <<COMMAND
 ../../kubectl version --client || (
@@ -155,7 +154,8 @@ provisioner "local-exec" {
   ../../kubectl delete -n $OWNER svc,deployments,ingress -l spacename=$SPACENAME
 COMMAND
 }
-# We could also deloy logstream-kube to show the pod coming up...
+
+# We could also deploy logstream-kube to show the pod coming up...
 provisioner "local-exec" {
   command = <<COMMAND
 ~/helm version --short || (
@@ -178,6 +178,7 @@ provisioner "local-exec" {
   coder-logstream-kube coder-logstream-kube
 COMMAND
 }
+
 }
 resource "coder_metadata" "namespace" {
   resource_id = null_resource.namespace.id
diff --git a/vars.tf b/vars.tf
index e799332..3a9cef6 100644
--- a/vars.tf
+++ b/vars.tf
@@ -75,7 +75,7 @@ variable "pdns_api_url" {
   nullable = false
 }
 
-variable "pdns_api_account" {
+variable "dns_update_account" {
   type        = string
   description = "PowerDNS Account to associate user domain to"
   nullable    = false
@@ -162,22 +162,22 @@ variable "default_org_url" {
   }
 }
 
-variable "ingress_ip" {
-  type        = string
-  description = "Local LB IP"
-  nullable    = false
-  validation {
-    condition     = can(cidrhost("${var.ingress_ip}/32", 0))
-    error_message = "Must be valid IP Address"
-  }
-
-}
-# variable "public_ip" {
+# variable "ingress_ip" {
 #   type        = string
-#   description = "Public IP"
+#   description = "Local LB IP"
 #   nullable    = false
 #   validation {
-#     condition     = can(cidrhost("${var.public_ip}/32", 0))
+#     condition     = can(cidrhost("${var.ingress_ip}/32", 0))
 #     error_message = "Must be valid IP Address"
 #   }
+
 # }
+variable "public_ip" {
+  type        = string
+  description = "Public IP"
+  nullable    = false
+  validation {
+    condition     = can(cidrhost("${var.public_ip}/32", 0))
+    error_message = "Must be valid IP Address"
+  }
+}

From d40420c7afe4f5492d77e09c01b425653d9a5f19 Mon Sep 17 00:00:00 2001
From: Hippie Hacker <hh@ii.coop>
Date: Mon, 7 Oct 2024 19:37:10 -0600
Subject: [PATCH 19/39] use single per subsriber

---
 deployment.tf                                 | 50 +++++++++----------
 docs/deploy.org                               |  2 +
 ephemeral_manifests/ing-emacs.yaml            | 26 +++++-----
 ephemeral_manifests/ing-left.yaml             | 28 +++++------
 ephemeral_manifests/ing-right.yaml            | 28 +++++------
 ephemeral_manifests/ing-vnc.yaml              | 26 +++++-----
 ephemeral_manifests/ing-www.yaml              | 26 +++++-----
 ephemeral_manifests/svc-right.yaml            | 15 ++++++
 .../space-cert.yaml                           |  0
 9 files changed, 109 insertions(+), 92 deletions(-)
 create mode 100644 ephemeral_manifests/svc-right.yaml
 rename {ephemeral_manifests => unused_manifests}/space-cert.yaml (100%)

diff --git a/deployment.tf b/deployment.tf
index 8789ba4..8a2fb18 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -18,31 +18,31 @@ resource "coder_metadata" "iipod" {
   # but apparently only a limited set of markdown/html
   #       allowedElements={["p", "em", "strong", "a", "pre", "code"]}
   # https://github.com/coder/coder/pull/10521/files#diff-cbc535e52cef85ed2f3d7ec9ba042a35c692c7bb50a6077d9df1dd0e6d14a752R147
-  # item {
-  #   key   = "emacs"
-  #   value = "[emacs-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://emacs-${local.spacename}-${data.coder_workspace.ii.owner}.${var.coder_domain})"
-  #   # value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)"
-  # }
-  # item {
-  #   key   = "left tmux/eye"
-  #   value = "[left-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://left-${local.spacename}-${data.coder_workspace.ii.owner}.${var.coder_domain})"
-  #   # value = "[lefteye-${local.space_domain}](https://lefteye-${local.space_domain}/)"
-  # }
-  # item {
-  #   key   = "right tmux/eye"
-  #   value = "[right-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://right-${local.spacename}-${data.coder_workspace.ii.owner}.${var.coder_domain})"
-  #   # value = "[righteye-${local.space_domain}](https://righteye-${local.space_domain}/)"
-  # }
-  # item {
-  #   key   = "vnc"
-  #   value = "[vnc-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://vnc-${local.spacename}-${data.coder_workspace.ii.owner}.${var.coder_domain}/?autoconnect=true&resize=remote)"
-  #   # value = "[vnc-${emacslocal.space_domain}](https://vnc-${local.space_domain}/?autoconnect=true&resize=remote)"
-  # }
-  # item {
-  #   key   = "www"
-  #   value = "[www-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://www-${local.spacename}-${data.coder_workspace.ii.owner}.${var.coder_domain})"
-  #   # value = "[www-${local.space_domain}](https://www-${local.space_domain}/)"
-  # }
+  item {
+    key   = "emacs"
+    value = "[emacs-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://emacs-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain})"
+    # value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)"
+  }
+  item {
+    key   = "left tmux/eye"
+    value = "[left-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://left-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain})"
+    # value = "[lefteye-${local.space_domain}](https://lefteye-${local.space_domain}/)"
+  }
+  item {
+    key   = "right tmux/eye"
+    value = "[right-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://right-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain})"
+    # value = "[righteye-${local.space_domain}](https://righteye-${local.space_domain}/)"
+  }
+  item {
+    key   = "vnc"
+    value = "[vnc-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://vnc-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}/?autoconnect=true&resize=remote)"
+    # value = "[vnc-${emacslocal.space_domain}](https://vnc-${local.space_domain}/?autoconnect=true&resize=remote)"
+  }
+  item {
+    key   = "www"
+    value = "[www-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://www-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain})"
+    # value = "[www-${local.space_domain}](https://www-${local.space_domain}/)"
+  }
 }
 
 resource "kubernetes_deployment" "iipod" {
diff --git a/docs/deploy.org b/docs/deploy.org
index 4c1ab93..9c942f5 100644
--- a/docs/deploy.org
+++ b/docs/deploy.org
@@ -181,6 +181,8 @@ DEFAULT_GIT_URL=https://github.com/ii/iipod/
 DEFAULT_ORG_URL=https://raw.githubusercontent.com/ii/iipod/org/vcluster.org
 #+end_src
 
+
+
 ** coder create with parameters
 #+begin_src tmux
 cd ~/iipod
diff --git a/ephemeral_manifests/ing-emacs.yaml b/ephemeral_manifests/ing-emacs.yaml
index bb84c07..0c60f4b 100644
--- a/ephemeral_manifests/ing-emacs.yaml
+++ b/ephemeral_manifests/ing-emacs.yaml
@@ -43,16 +43,16 @@ spec:
                   number: 80
             path: /
             pathType: ImplementationSpecific
-    - host: emacs.${spacename}.${username}.${coder_domain}
-      http:
-        paths:
-          - backend:
-              service:
-                name: emacs-${spacename}
-                port:
-                  number: 80
-            path: /
-            pathType: ImplementationSpecific
+    # - host: emacs.${spacename}.${username}.${coder_domain}
+    #   http:
+    #     paths:
+    #       - backend:
+    #           service:
+    #             name: emacs-${spacename}
+    #             port:
+    #               number: 80
+    #         path: /
+    #         pathType: ImplementationSpecific
   tls:
     # - hosts:
     #     - emacs-${spacename}-${username}.${coder_domain}
@@ -60,6 +60,6 @@ spec:
     - hosts:
         - emacs-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
-    - hosts:
-        - emacs.${spacename}.${username}.${coder_domain}
-      secretName: ${spacename}-wildcard-tls
+    # - hosts:
+    #     - emacs.${spacename}.${username}.${coder_domain}
+    #   secretName: ${spacename}-wildcard-tls
diff --git a/ephemeral_manifests/ing-left.yaml b/ephemeral_manifests/ing-left.yaml
index 98eec17..2edffe7 100644
--- a/ephemeral_manifests/ing-left.yaml
+++ b/ephemeral_manifests/ing-left.yaml
@@ -38,21 +38,21 @@ spec:
         paths:
           - backend:
               service:
-                name: ttyd-${spacename}
-                port:
-                  number: 80
-            path: /
-            pathType: ImplementationSpecific
-    - host: left.${spacename}.${username}.${coder_domain}
-      http:
-        paths:
-          - backend:
-              service:
-                name: ttyd-${spacename}
+                name: left-${spacename}
                 port:
                   number: 80
             path: /
             pathType: ImplementationSpecific
+    # - host: left.${spacename}.${username}.${coder_domain}
+    #   http:
+    #     paths:
+    #       - backend:
+    #           service:
+    #             name: ttyd-${spacename}
+    #             port:
+    #               number: 80
+    #         path: /
+    #         pathType: ImplementationSpecific
   tls:
     # - hosts:
     #     - left-${spacename}-${username}.${coder_domain}
@@ -60,6 +60,6 @@ spec:
     - hosts:
         - left-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
-    - hosts:
-        - left.${spacename}.${username}.${coder_domain}
-      secretName: ${spacename}-wildcard-tls
+    # - hosts:
+    #     - left.${spacename}.${username}.${coder_domain}
+    #   secretName: ${spacename}-wildcard-tls
diff --git a/ephemeral_manifests/ing-right.yaml b/ephemeral_manifests/ing-right.yaml
index 62f0ff1..db9255c 100644
--- a/ephemeral_manifests/ing-right.yaml
+++ b/ephemeral_manifests/ing-right.yaml
@@ -38,21 +38,21 @@ spec:
         paths:
           - backend:
               service:
-                name: ttyd-${spacename}
-                port:
-                  number: 80
-            path: /
-            pathType: ImplementationSpecific
-    - host: right.${spacename}.${username}.${coder_domain}
-      http:
-        paths:
-          - backend:
-              service:
-                name: ttyd-${spacename}
+                name: right-${spacename}
                 port:
                   number: 80
             path: /
             pathType: ImplementationSpecific
+    # - host: right.${spacename}.${username}.${coder_domain}
+    #   http:
+    #     paths:
+    #       - backend:
+    #           service:
+    #             name: ttyd-${spacename}
+    #             port:
+    #               number: 80
+    #         path: /
+    #         pathType: ImplementationSpecific
   tls:
     # - hosts:
     #     - right-${spacename}-${username}.${coder_domain}
@@ -60,6 +60,6 @@ spec:
     - hosts:
         - right-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
-    - hosts:
-        - right.${spacename}.${username}.${coder_domain}
-      secretName: ${spacename}-wildcard-tls
+    # - hosts:
+    #     - right.${spacename}.${username}.${coder_domain}
+    #   secretName: ${spacename}-wildcard-tls
diff --git a/ephemeral_manifests/ing-vnc.yaml b/ephemeral_manifests/ing-vnc.yaml
index 707fd19..3e72c4a 100644
--- a/ephemeral_manifests/ing-vnc.yaml
+++ b/ephemeral_manifests/ing-vnc.yaml
@@ -42,16 +42,16 @@ spec:
                   number: 80
             path: /
             pathType: ImplementationSpecific
-    - host: vnc.${spacename}.${username}.${coder_domain}
-      http:
-        paths:
-          - backend:
-              service:
-                name: novnc-${spacename}
-                port:
-                  number: 80
-            path: /
-            pathType: ImplementationSpecific
+    # - host: vnc.${spacename}.${username}.${coder_domain}
+    #   http:
+    #     paths:
+    #       - backend:
+    #           service:
+    #             name: novnc-${spacename}
+    #             port:
+    #               number: 80
+    #         path: /
+    #         pathType: ImplementationSpecific
   tls:
     # - hosts:
     #     - vnc-${spacename}-${username}.${coder_domain}
@@ -59,6 +59,6 @@ spec:
     - hosts:
         - vnc-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
-    - hosts:
-        - vnc.${spacename}.${username}.${coder_domain}
-      secretName: ${spacename}-wildcard-tls
+    # - hosts:
+    #     - vnc.${spacename}.${username}.${coder_domain}
+    #   secretName: ${spacename}-wildcard-tls
diff --git a/ephemeral_manifests/ing-www.yaml b/ephemeral_manifests/ing-www.yaml
index 96ac1ca..e19f0a0 100644
--- a/ephemeral_manifests/ing-www.yaml
+++ b/ephemeral_manifests/ing-www.yaml
@@ -43,16 +43,16 @@ spec:
                   number: 80
             path: /
             pathType: ImplementationSpecific
-    - host: www.${spacename}-${username}.${coder_domain}
-      http:
-        paths:
-          - backend:
-              service:
-                name: www-${spacename}
-                port:
-                  number: 80
-            path: /
-            pathType: ImplementationSpecific
+    # - host: www.${spacename}-${username}.${coder_domain}
+    #   http:
+    #     paths:
+    #       - backend:
+    #           service:
+    #             name: www-${spacename}
+    #             port:
+    #               number: 80
+    #         path: /
+    #         pathType: ImplementationSpecific
   tls:
     # - hosts:
     #     - www-${spacename}-${username}.${coder_domain}
@@ -60,6 +60,6 @@ spec:
     - hosts:
         - www-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
-    - hosts:
-        - www.${spacename}.${username}.${coder_domain}
-      secretName: ${spacename}-wildcard-tls
+    # - hosts:
+    #     - www.${spacename}.${username}.${coder_domain}
+    #   secretName: ${spacename}-wildcard-tls
diff --git a/ephemeral_manifests/svc-right.yaml b/ephemeral_manifests/svc-right.yaml
new file mode 100644
index 0000000..2146bbb
--- /dev/null
+++ b/ephemeral_manifests/svc-right.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: right-${spacename}
+  namespace: ${namespace}
+  labels:
+    spacename: ${spacename}
+spec:
+  ports:
+    - port: 80
+      protocol: TCP
+      targetPort: 7681
+  selector:
+    spacename: ${spacename}
+    spaceapp: iipod
diff --git a/ephemeral_manifests/space-cert.yaml b/unused_manifests/space-cert.yaml
similarity index 100%
rename from ephemeral_manifests/space-cert.yaml
rename to unused_manifests/space-cert.yaml

From 2d8678f6cf4f3e6b0319fa46eba8e9c1938a4d44 Mon Sep 17 00:00:00 2001
From: root <Hippie Hacker>
Date: Tue, 15 Oct 2024 19:36:38 +0000
Subject: [PATCH 20/39] left- right-

---
 ephemeral_manifests/ing-right.yaml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/ephemeral_manifests/ing-right.yaml b/ephemeral_manifests/ing-right.yaml
index db9255c..3718004 100644
--- a/ephemeral_manifests/ing-right.yaml
+++ b/ephemeral_manifests/ing-right.yaml
@@ -38,11 +38,26 @@ spec:
         paths:
           - backend:
               service:
+<<<<<<< HEAD
                 name: right-${spacename}
+=======
+                name: ttyd-${spacename}
                 port:
                   number: 80
             path: /
             pathType: ImplementationSpecific
+    - host: right.${spacename}.${username}.${coder_domain}
+      http:
+        paths:
+          - backend:
+              service:
+                name: ttyd-${spacename}
+>>>>>>> a295ece (chore: dd left and right)
+                port:
+                  number: 80
+            path: /
+            pathType: ImplementationSpecific
+<<<<<<< HEAD
     # - host: right.${spacename}.${username}.${coder_domain}
     #   http:
     #     paths:
@@ -53,6 +68,8 @@ spec:
     #               number: 80
     #         path: /
     #         pathType: ImplementationSpecific
+=======
+>>>>>>> a295ece (chore: dd left and right)
   tls:
     # - hosts:
     #     - right-${spacename}-${username}.${coder_domain}
@@ -60,6 +77,12 @@ spec:
     - hosts:
         - right-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
+<<<<<<< HEAD
     # - hosts:
     #     - right.${spacename}.${username}.${coder_domain}
     #   secretName: ${spacename}-wildcard-tls
+=======
+    - hosts:
+        - right.${spacename}.${username}.${coder_domain}
+      secretName: ${spacename}-wildcard-tls
+>>>>>>> a295ece (chore: dd left and right)

From 2289a1aa0ce3f59dc83b59bb1a79e9382e5e668f Mon Sep 17 00:00:00 2001
From: BobyMCbobs <calebwoodbine.public@gmail.com>
Date: Thu, 17 Oct 2024 21:12:24 +0000
Subject: [PATCH 21/39] chore: quality of life update

- bump base image
- add docker backend
- shuffle list of dependencies
- update go, kubectl, gh, helm, talosctl, kn, dive, ko, gopls
- add ii user to docker group
- remove awscli

Co-Authored-By: Stephen Heywood <stephen@ii.coop>
---
 build/Dockerfile | 137 ++++++++++++++++++++++++-----------------------
 1 file changed, 70 insertions(+), 67 deletions(-)

diff --git a/build/Dockerfile b/build/Dockerfile
index cfd06ad..88dc16d 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:mantic-20231128
+FROM ubuntu:noble-20241009
 
 # install enough to setup apt repos
 RUN DEBIAN_FRONTEND=noninteractive \
@@ -32,71 +32,74 @@ RUN DEBIAN_FRONTEND=noninteractive \
 # apt install packages
 RUN DEBIAN_FRONTEND=noninteractive \
     apt-get install --yes \
-    tmux \
-    tmate \
-    bash-completion \
-    less \
-    git \
-    xz-utils \
-    sudo \
-    vim \
-    wget \
-    emacs-pgtk \
-    language-pack-en \
-    openssh-client \
-    postgresql-client \
-    jq \
     apache2-utils \
-    inotify-tools \
-    xtermcontrol \
-    tzdata \
-    silversearcher-ag \
+    asciinema \
+    bash-completion \
+    bsdmainutils \
+    cmake \
+    code \
+    dbus-x11 \
+    devscripts \
     direnv \
-    rsync \
-    lsof \
-    htop \
+    dnsutils \
+    docker-ce \
+    docker-ce-cli \
+    containerd.io \
+    docker-buildx-plugin \
+    docker-compose-plugin \
+    dpkg-dev \
+    emacs-pgtk \
+    fd-find \
     file \
-    unzip \
-    psmisc \
-    iproute2 \
-    tcpdump \
-    rlwrap \
-    fonts-powerline \
     flatpak-xdg-utils \
+    fonts-powerline \
+    gettext-base \
+    git \
     google-cloud-sdk \
-    bsdmainutils \
-    awscli \
-    python3-pip \
-    dnsutils \
-    net-tools \
-    tree \
-    iputils-ping \
+    graphviz \
+    htop \
+    icewm \
     iftop \
-    ripgrep \
-    python-is-python3 \
-    nodejs \
-    pipenv \
-    gettext-base \
+    inotify-tools \
+    iproute2 \
+    iputils-ping \
+    jq \
+    kitty \
+    language-pack-en \
+    less \
+    libjson-c-dev \
+    libwebsockets-dev \
     locate \
-    fd-find \
-    graphviz \
+    lsof \
+    net-tools \
     netcat-openbsd \
-    asciinema \
+    nodejs \
+    openjdk-17-jdk \
+    openssh-client \
+    pipenv \
+    plasma-desktop \
+    postgresql-client \
+    psmisc \
+    python-is-python3 \
+    python3-pip \
+    ripgrep \
+    rlwrap \
+    rsync \
+    silversearcher-ag \
     ssh-import-id \
-    docker-ce-cli \
+    sudo \
+    tcpdump \
     tigervnc-standalone-server \
-    icewm \
-    kitty \
-    plasma-desktop \
-    dbus-x11 \
+    tmate \
+    tmux \
+    tree \
+    tzdata \
+    unzip \
+    vim \
     websockify \
-    code \
-    cmake \
-    dpkg-dev \
-    devscripts \
-    libwebsockets-dev \
-    libjson-c-dev \
-    openjdk-17-jdk \
+    wget \
+    xtermcontrol \
+    xz-utils \
 	&& ln -s /usr/bin/fdfind /usr/local/bin/fd \
 	&& rm -rf /var/lib/apt/lists/*
     # firefox-esr \
@@ -114,7 +117,7 @@ RUN localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8
 
 # Settings for GO and crictl
 ENV GOROOT=/usr/local/go \
-  GO_VERSION=1.21.6 \
+  GO_VERSION=1.23.2 \
   PATH="$PATH:/usr/local/go/bin:/usr/libexec/flatpak-xdg-utils:/home/ii/go/bin" \
   CONTAINERD_NAMESPACE=k8s.io
 
@@ -126,15 +129,15 @@ RUN . /usr/local/lib/arch-helper.sh \
   && curl -L https://dl.google.com/go/go${GO_VERSION}.linux-${ARCH_TYPE_2}.tar.gz \
     | tar --directory /usr/local --extract --ungzip
 # kind binary
-ENV KIND_VERSION=0.20.0
+ENV KIND_VERSION=0.24.0
 RUN . /usr/local/lib/arch-helper.sh \
   && curl -Lo /usr/local/bin/kind \
     https://github.com/kubernetes-sigs/kind/releases/download/v${KIND_VERSION}/kind-linux-${ARCH_TYPE_2} \
     && chmod +x /usr/local/bin/kind
 # kubectl binary
-ENV KUBECTL_VERSION=1.29.1
+ENV KUBECTL_VERSION=1.31.1
 RUN . /usr/local/lib/arch-helper.sh \
-  && curl -L https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VERSION}/bin/linux/${ARCH_TYPE_2}/kubectl -o /usr/local/bin/kubectl \
+  && curl -L https://dl.k8s.io/v${KUBECTL_VERSION}/bin/linux/${ARCH_TYPE_2}/kubectl -o /usr/local/bin/kubectl \
     && chmod +x /usr/local/bin/kubectl
 # tilt binary
 ENV TILT_VERSION=0.33.10
@@ -143,7 +146,7 @@ RUN . /usr/local/lib/arch-helper.sh \
     https://github.com/tilt-dev/tilt/releases/download/v${TILT_VERSION}/tilt.${TILT_VERSION}.linux.${ARCH_TYPE_1}.tar.gz \
     | tar --directory /usr/local/bin --extract --ungzip tilt
 # gh cli
-ENV GH_VERSION=2.42.1
+ENV GH_VERSION=2.58.0
 RUN . /usr/local/lib/arch-helper.sh \
   && curl -sSL https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${ARCH_TYPE_2}.tar.gz \
     | tar --directory /usr/local --extract --ungzip \
@@ -157,11 +160,11 @@ RUN . /usr/local/lib/arch-helper.sh \
     | tar --directory /usr/local/bin --extract --xz \
   --strip-components 1 tmate-${TMATE_VERSION}-static-linux-${ARCH_TYPE_3}/tmate
 # helm binary
-ENV HELM_VERSION=3.14.0
+ENV HELM_VERSION=3.16.2
 RUN . /usr/local/lib/arch-helper.sh \
   && curl -L https://get.helm.sh/helm-v${HELM_VERSION}-linux-${ARCH_TYPE_2}.tar.gz | tar --directory /usr/local/bin --extract -xz --strip-components 1 linux-${ARCH_TYPE_2}/helm
 # talosctl
-ENV TALOSCTL_VERSION=1.6.1
+ENV TALOSCTL_VERSION=1.8.1
 RUN . /usr/local/lib/arch-helper.sh \
   && curl -L -o /usr/local/bin/talosctl https://github.com/talos-systems/talos/releases/download/v${TALOSCTL_VERSION}/talosctl-linux-${ARCH_TYPE_2} && \
   chmod +x /usr/local/bin/talosctl
@@ -191,19 +194,19 @@ RUN curl -fsSL https://raw.githubusercontent.com/technomancy/leiningen/${LEIN_VE
     -o /usr/local/bin/lein \
     && chmod +x /usr/local/bin/lein \
     && lein version
-ENV KN_CLIENT_VERSION=1.11.2
+ENV KN_CLIENT_VERSION=1.15.0
 RUN . /usr/local/lib/arch-helper.sh \
   && curl -L https://github.com/knative/client/releases/download/knative-v${KN_CLIENT_VERSION}/kn-linux-${ARCH_TYPE_2} -o /usr/local/bin/kn \
   && chmod +x /usr/local/bin/kn
-ENV DIVE_VERSION=0.11.0
+ENV DIVE_VERSION=0.12.0
 RUN . /usr/local/lib/arch-helper.sh \
   && curl -L https://github.com/wagoodman/dive/releases/download/v${DIVE_VERSION}/dive_${DIVE_VERSION}_linux_${ARCH_TYPE_2}.tar.gz | tar --directory /usr/local/bin --extract --ungzip dive
 ENV UPTERM_VERSION=0.13.0
 RUN . /usr/local/lib/arch-helper.sh \
   && curl -L https://github.com/owenthereal/upterm/releases/download/v${UPTERM_VERSION}/upterm_linux_${ARCH_TYPE_2}.tar.gz | tar --directory /usr/local/bin --extract --ungzip upterm
 ENV METALCLI_VERSION=0.19.0 \
-  KO_VERSION=0.15.1 \
-  GOPLS_VERSION=0.12.2
+  KO_VERSION=0.16.0 \
+  GOPLS_VERSION=0.16.2
 #  GOPLS_VERSION=0.10.0 # Also a big jump... 0.13.0 is just around the corner
 RUN set -x \
   && /bin/env GO111MODULE=on GOPATH=/usr/local/go /usr/local/go/bin/go install golang.org/x/tools/gopls@v$GOPLS_VERSION \
@@ -292,7 +295,7 @@ RUN ln -sf /usr/bin/firefox-esr /usr/bin/firefox
 # create ii user
 ARG USER=ii
 ENV LANG=en_US.utf8
-RUN useradd --groups sudo --no-create-home --shell /bin/bash ${USER} \
+RUN useradd --groups sudo,docker --no-create-home --shell /bin/bash ${USER} \
 	&& echo "${USER} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/${USER} \
 	&& chmod 0440 /etc/sudoers.d/${USER}
 

From f2470d8c90a94c3cd7589c8959aae8eccf1620a6 Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <calebwoodbine.public@gmail.com>
Date: Fri, 18 Oct 2024 11:55:40 +1300
Subject: [PATCH 22/39] chore: make iipod run as privileged

for use with docker
---
 deployment.tf | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/deployment.tf b/deployment.tf
index 8a2fb18..f4c4f00 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -103,7 +103,9 @@ resource "kubernetes_deployment" "iipod" {
           image   = data.coder_parameter.container-image.value
           command = ["sh", "-c", coder_agent.iipod.init_script]
           security_context {
-            run_as_user = "1001"
+            run_as_user                = "1001"
+            privileged                 = true
+            allow_privilege_escalation = true
           }
           resources {
             requests = {

From a3115bd157713a3ebc5e08a8bbaaa992c453fbc7 Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <calebwoodbine.public@gmail.com>
Date: Fri, 18 Oct 2024 11:56:41 +1300
Subject: [PATCH 23/39] chore: add mounts for docker

make docker+kind work
---
 deployment.tf | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/deployment.tf b/deployment.tf
index f4c4f00..7999b60 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -98,6 +98,37 @@ resource "kubernetes_deployment" "iipod" {
           run_as_user = "1001"
           fs_group    = "1001"
         }
+        volume {
+          name = "modules"
+          host_path {
+            path = "/lib/modules"
+            type = "Directory"
+          }
+        }
+        volume {
+          name = "cgroup"
+          host_path {
+            path = "/sys/fs/cgroup"
+            type = "Directory"
+          }
+        }
+        volume {
+          name = "var-run"
+          empty_dir {
+          }
+        }
+        volume {
+          name = "var-lib-docker"
+          empty_dir {
+          }
+        }
+        dns_policy = "None"
+        dns_config {
+          nameservers = [
+            "1.0.0.1",
+            "1.1.1.1"
+          ]
+        }
         container {
           name    = "iipod"
           image   = data.coder_parameter.container-image.value
@@ -119,6 +150,23 @@ resource "kubernetes_deployment" "iipod" {
               "memory" = "${var.container_resource_memory}Gi"
             }
           }
+          volume_mount {
+            mount_path = "/lib/modules"
+            name       = "modules"
+            read_only  = true
+          }
+          volume_mount {
+            mount_path = "/sys/fs/cgroup"
+            name       = "cgroup"
+          }
+          volume_mount {
+            mount_path = "/var/run"
+            name       = "var-run"
+          }
+          volume_mount {
+            mount_path = "/var/lib/docker"
+            name       = "var-lib-docker"
+          }
           env {
             name  = "CODER_AGENT_TOKEN"
             value = coder_agent.iipod.token

From a59dea7bcbe75aa62b24d247c50076413945d126 Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <calebwoodbine.public@gmail.com>
Date: Fri, 18 Oct 2024 12:02:16 +1300
Subject: [PATCH 24/39] chore: enable docker service on startup

add service start script
---
 iipod-startup.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/iipod-startup.sh b/iipod-startup.sh
index 331fa7d..d24dc0b 100644
--- a/iipod-startup.sh
+++ b/iipod-startup.sh
@@ -124,3 +124,7 @@ kitty -T KITTY --detach --hold --start-as=maximized bash -c 'tmux at'
 # # kubectl -n flux-system  wait --timeout=10m --for=condition=Released helmrelease snoopdb
 # kubectl -n default logs statefulset/snoopdb --since=1s -f
 # "
+
+if service --status-all |& grep -q docker; then
+    sudo service docker start
+fi

From 2b753fe4bf4c7e340bca477fd804ccd8b61c615e Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <calebwoodbine.public@gmail.com>
Date: Fri, 18 Oct 2024 12:20:18 +1300
Subject: [PATCH 25/39] chore: use env bash for startup.sh

newer syntaxes allowed
---
 iipod-startup.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/iipod-startup.sh b/iipod-startup.sh
index d24dc0b..2ac096f 100644
--- a/iipod-startup.sh
+++ b/iipod-startup.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 set -x
 
 # Caclulate vars needod for REPO and ORGFILE

From 55d91634983de04d0534ab710bdc7eae0f2ff445 Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <calebwoodbine.public@gmail.com>
Date: Fri, 18 Oct 2024 12:20:41 +1300
Subject: [PATCH 26/39] chore: ignore unused variable dns_update_account

remove dns_update_account
---
 vars.tf | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/vars.tf b/vars.tf
index 3a9cef6..0a38e19 100644
--- a/vars.tf
+++ b/vars.tf
@@ -75,11 +75,11 @@ variable "pdns_api_url" {
   nullable = false
 }
 
-variable "dns_update_account" {
-  type        = string
-  description = "PowerDNS Account to associate user domain to"
-  nullable    = false
-}
+# variable "dns_update_account" {
+#   type        = string
+#   description = "PowerDNS Account to associate user domain to"
+#   nullable    = false
+# }
 
 variable "dns_update_server" {
   type        = string

From 5d9e22635e26ec1d4ec147758edacdf8557e9d6a Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <calebwoodbine.public@gmail.com>
Date: Fri, 18 Oct 2024 12:20:55 +1300
Subject: [PATCH 27/39] chore: remove conflict diff for ing-right

mistakenly committed recently
---
 ephemeral_manifests/ing-right.yaml | 23 -----------------------
 1 file changed, 23 deletions(-)

diff --git a/ephemeral_manifests/ing-right.yaml b/ephemeral_manifests/ing-right.yaml
index 3718004..62f0ff1 100644
--- a/ephemeral_manifests/ing-right.yaml
+++ b/ephemeral_manifests/ing-right.yaml
@@ -38,9 +38,6 @@ spec:
         paths:
           - backend:
               service:
-<<<<<<< HEAD
-                name: right-${spacename}
-=======
                 name: ttyd-${spacename}
                 port:
                   number: 80
@@ -52,24 +49,10 @@ spec:
           - backend:
               service:
                 name: ttyd-${spacename}
->>>>>>> a295ece (chore: dd left and right)
                 port:
                   number: 80
             path: /
             pathType: ImplementationSpecific
-<<<<<<< HEAD
-    # - host: right.${spacename}.${username}.${coder_domain}
-    #   http:
-    #     paths:
-    #       - backend:
-    #           service:
-    #             name: ttyd-${spacename}
-    #             port:
-    #               number: 80
-    #         path: /
-    #         pathType: ImplementationSpecific
-=======
->>>>>>> a295ece (chore: dd left and right)
   tls:
     # - hosts:
     #     - right-${spacename}-${username}.${coder_domain}
@@ -77,12 +60,6 @@ spec:
     - hosts:
         - right-${spacename}.${username}.${coder_domain}
       secretName: wildcard-tls
-<<<<<<< HEAD
-    # - hosts:
-    #     - right.${spacename}.${username}.${coder_domain}
-    #   secretName: ${spacename}-wildcard-tls
-=======
     - hosts:
         - right.${spacename}.${username}.${coder_domain}
       secretName: ${spacename}-wildcard-tls
->>>>>>> a295ece (chore: dd left and right)

From 1b746a54507432918a7aa7ffd6a44b5168d2008c Mon Sep 17 00:00:00 2001
From: ii <Hippie Hacker>
Date: Mon, 21 Oct 2024 22:36:27 +0000
Subject: [PATCH 28/39] feat: add kata with dind

mostly working ok!
---
 deployment.tf    | 94 +++++++++++++++++++++++++++++++++++++++---------
 iipod-startup.sh |  6 ++--
 2 files changed, 80 insertions(+), 20 deletions(-)

diff --git a/deployment.tf b/deployment.tf
index 7999b60..b3868d9 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -99,19 +99,19 @@ resource "kubernetes_deployment" "iipod" {
           fs_group    = "1001"
         }
         volume {
-          name = "modules"
+          name = "lib-modules"
           host_path {
             path = "/lib/modules"
             type = "Directory"
           }
         }
-        volume {
-          name = "cgroup"
-          host_path {
-            path = "/sys/fs/cgroup"
-            type = "Directory"
-          }
-        }
+        # volume {
+        #   name = "proc-modules"
+        #   host_path {
+        #     path = "/proc/modules"
+        #     type = "Directory"
+        #   }
+        # }
         volume {
           name = "var-run"
           empty_dir {
@@ -129,6 +129,8 @@ resource "kubernetes_deployment" "iipod" {
             "1.1.1.1"
           ]
         }
+        runtime_class_name = "kata"
+        # share_process_namespace = true
         container {
           name    = "iipod"
           image   = data.coder_parameter.container-image.value
@@ -150,15 +152,6 @@ resource "kubernetes_deployment" "iipod" {
               "memory" = "${var.container_resource_memory}Gi"
             }
           }
-          volume_mount {
-            mount_path = "/lib/modules"
-            name       = "modules"
-            read_only  = true
-          }
-          volume_mount {
-            mount_path = "/sys/fs/cgroup"
-            name       = "cgroup"
-          }
           volume_mount {
             mount_path = "/var/run"
             name       = "var-run"
@@ -175,6 +168,73 @@ resource "kubernetes_deployment" "iipod" {
             name  = "SPACENAME"
             value = local.spacename
           }
+          env {
+            name  = "DOCKER_HOST"
+            value = "tcp://0.0.0.0:2375"
+          }
+        }
+        container {
+          name  = "dind"
+          image = "docker:27.3.1-dind"
+#           command = [
+#             "/bin/sh",
+#             "-c",
+#             true == true ? "sleep infinity" : <<EOF
+# set -xe -o pipefail
+
+# dev=$(ip route show default | grep -E '^default' | sed 's/.*\sdev\s\(\S*\)\s.*$/\1/')
+# addr=$(ip addr show dev "$dev" | grep inet | grep -v inet6 | sed 's/^\s*inet\s\(\S.*\).*\/.*$/\1/')
+
+# echo 1 > /proc/sys/net/ipv4/ip_forward
+# iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p tcp
+# iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p udp
+
+# exec /usr/local/bin/dockerd --iptables=false --ip6tables=false -D
+# EOF
+#           ]
+
+          security_context {
+            privileged  = true
+            allow_privilege_escalation = true
+            run_as_user = "0"
+            capabilities {
+              add = ["all"]
+            }
+            run_as_non_root = false
+            read_only_root_filesystem = false
+          }
+          env {
+            name  = "DOCKER_HOST"
+            value = "tcp://0.0.0.0:2375"
+          }
+          env {
+            name  = "DOCKER_TLS_CERTDIR"
+            value = ""
+          }
+          resources {
+            limits = {
+              "cpu"    = var.container_resource_cpu
+              "memory" = "${var.container_resource_memory}Gi"
+            }
+          }
+          volume_mount {
+            mount_path = "/var/run"
+            name       = "var-run"
+          }
+          volume_mount {
+            mount_path = "/var/lib/docker"
+            name       = "var-lib-docker"
+          }
+          # volume_mount {
+          #   mount_path = "/lib/modules"
+          #   name       = "lib-modules"
+          #   read_only = true
+          # }
+          # volume_mount {
+          #   mount_path = "/proc/modules"
+          #   name       = "proc-modules"
+          #   read_only = true
+          # }
         }
       }
     }
diff --git a/iipod-startup.sh b/iipod-startup.sh
index 2ac096f..77f6c1c 100644
--- a/iipod-startup.sh
+++ b/iipod-startup.sh
@@ -125,6 +125,6 @@ kitty -T KITTY --detach --hold --start-as=maximized bash -c 'tmux at'
 # kubectl -n default logs statefulset/snoopdb --since=1s -f
 # "
 
-if service --status-all |& grep -q docker; then
-    sudo service docker start
-fi
+# if service --status-all |& grep -q docker; then
+#     sudo service docker start
+# fi

From 845589cc2408f3776a0764416d4b831a05f4178f Mon Sep 17 00:00:00 2001
From: ii <Hippie Hacker>
Date: Thu, 24 Oct 2024 22:33:08 +0000
Subject: [PATCH 29/39] feat: add conditional template privileged mode

- by default run restricted with Kata
- set an optional privileged flag to run with runc and high privilege to use docker

Co-Authored-By: Caleb Woodbine <calebwoodbine.public@gmail.com>
---
 README.md        |   1 -
 README.org       |  86 ++++++++++++++++++++++
 deployment.tf    | 183 +++++++++++++++++++++++++++--------------------
 iipod-startup.sh |   6 +-
 providers.tf     |   4 ++
 vars.tf          |   5 ++
 6 files changed, 202 insertions(+), 83 deletions(-)
 delete mode 100644 README.md
 create mode 100644 README.org

diff --git a/README.md b/README.md
deleted file mode 100644
index 30fd8e1..0000000
--- a/README.md
+++ /dev/null
@@ -1 +0,0 @@
-# Nothing here yet
diff --git a/README.org b/README.org
new file mode 100644
index 0000000..03037fd
--- /dev/null
+++ b/README.org
@@ -0,0 +1,86 @@
+* iipod
+
+Setup
+
+#+begin_src bash
+terraform init
+#+end_src
+
+Create a .envrc
+
+#+begin_src shell
+export CODER_URL="https://coder.sharing.io"
+export CODER_DOMAIN="coder.sharing.io" #*.DOMAIN for spaces
+export LOCAL_IP="" # local to the cluster for ingress
+export PUBLIC_IP="" # external DNS / reachable by everyone
+# Need to create domains, so need PDNS account
+export PDNS_API_KEY="" # Usually pretty short
+export PDNS_API_URL="https://pdns.ii.nz" # We may run this per cluster later
+export PDNS_API_ACCOUNT="" # Actually the PowerDNS Admin account
+# RFC2136 TSIG
+export DNS_UPDATE_SERVER="" # DNS Server to connect to
+export DNS_UPDATE_KEYNAME="sharing.io." # TSIG Key Name
+export DNS_UPDATE_KEYALGORITHM="hmac-sha256" # TSIG Key Algorithm
+export DNS_UPDATE_KEYSECRET=""
+# The rest of these are for the defaults for the template default vars and workspace rich-params
+export DEFAULT_GIT_URL="https://github.com/ii/iipod/"
+export DEFAULT_ORG_URL=""
+export DEFAULT_CONTAINER_IMAGE="ghcr.io/ii/iipod:2024.10.17.2139"
+
+# For when we create/push a template, to push a .terraform.lock
+export TF_VERSION="1.9.7"
+# For when we instanciate a template, the name and how long to keep it up
+export CODER_TEMPLATE_NAME="iipod"
+# export CODER_WORKSPACE_STOP_AFTER="7d"
+export OPENAI_API_TOKEN=""
+#+end_src
+
+Push the standard template
+
+#+begin_src shell
+coder template push \
+  --yes \
+  --directory . \
+  --variable coder_url=$CODER_URL \
+  --variable ingress_ip=$INGRESS_IP \
+  --variable coder_domain=$CODER_DOMAIN \
+  --variable openai_api_token=$OPENAI_API_TOKEN \
+  --variable pdns_api_url=$PDNS_API_URL \
+  --variable pdns_api_key=$PDNS_API_KEY \
+  --variable pdns_api_account=$PDNS_API_ACCOUNT \
+  --variable dns_update_server=$DNS_UPDATE_SERVER \
+  --variable dns_update_keyname=$DNS_UPDATE_KEYNAME \
+  --variable dns_update_keyalgorithm=$DNS_UPDATE_KEYALGORITHM \
+  --variable dns_update_keysecret=$DNS_UPDATE_KEYSECRET \
+  --variable default_git_url=$DEFAULT_GIT_URL \
+  --variable default_org_url=$DEFAULT_ORG_URL \
+  --variable default_container_image=$DEFAULT_CONTAINER_IMAGE \
+  $CODER_TEMPLATE_NAME-privileged \
+  --message "$USER iipod Template at $(date)" --variable public_ip="$(dig +short A coder.sharing.io)" \
+  --variable privileged=false
+#+end_src
+
+Push the privileged template
+
+#+begin_src shell
+coder template push \
+  --yes \
+  --directory . \
+  --variable coder_url=$CODER_URL \
+  --variable ingress_ip=$INGRESS_IP \
+  --variable coder_domain=$CODER_DOMAIN \
+  --variable openai_api_token=$OPENAI_API_TOKEN \
+  --variable pdns_api_url=$PDNS_API_URL \
+  --variable pdns_api_key=$PDNS_API_KEY \
+  --variable pdns_api_account=$PDNS_API_ACCOUNT \
+  --variable dns_update_server=$DNS_UPDATE_SERVER \
+  --variable dns_update_keyname=$DNS_UPDATE_KEYNAME \
+  --variable dns_update_keyalgorithm=$DNS_UPDATE_KEYALGORITHM \
+  --variable dns_update_keysecret=$DNS_UPDATE_KEYSECRET \
+  --variable default_git_url=$DEFAULT_GIT_URL \
+  --variable default_org_url=$DEFAULT_ORG_URL \
+  --variable default_container_image=$DEFAULT_CONTAINER_IMAGE \
+  $CODER_TEMPLATE_NAME-privileged \
+  --message "$USER iipod Template at $(date)" --variable public_ip="$(dig +short A coder.sharing.io)" \
+  --variable privileged=true
+#+end_src
diff --git a/deployment.tf b/deployment.tf
index b3868d9..04a6de0 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -98,20 +98,28 @@ resource "kubernetes_deployment" "iipod" {
           run_as_user = "1001"
           fs_group    = "1001"
         }
-        volume {
-          name = "lib-modules"
-          host_path {
-            path = "/lib/modules"
-            type = "Directory"
+        dynamic "volume" {
+          for_each = var.privileged == true ? [1] : []
+
+          content {
+            name = "sys-fs-cgroup"
+            host_path {
+              path = "/sys/fs/cgroup"
+              type = "Directory"
+            }
+          }
+        }
+        dynamic "volume" {
+          for_each = var.privileged == true ? [1] : []
+
+          content {
+            name = "lib-modules"
+            host_path {
+              path = "/lib/modules"
+              type = "Directory"
+            }
           }
         }
-        # volume {
-        #   name = "proc-modules"
-        #   host_path {
-        #     path = "/proc/modules"
-        #     type = "Directory"
-        #   }
-        # }
         volume {
           name = "var-run"
           empty_dir {
@@ -122,6 +130,22 @@ resource "kubernetes_deployment" "iipod" {
           empty_dir {
           }
         }
+        # volume {
+        #   name = "var-lib-docker"
+        #   ephemeral {
+        #     volume_claim_template {
+        #       spec {
+        #         storage_class_name = "local-path"
+        #         access_modes = ["ReadWriteOnce"]
+        #         resources {
+        #           requests = {
+        #             "storage" = "1Gi" # required by API but unused with local-path
+        #           }
+        #         }
+        #       }
+        #     }
+        #   }
+        # }
         dns_policy = "None"
         dns_config {
           nameservers = [
@@ -129,7 +153,7 @@ resource "kubernetes_deployment" "iipod" {
             "1.1.1.1"
           ]
         }
-        runtime_class_name = "kata"
+        runtime_class_name = var.privileged != true ? "kata" : ""
         # share_process_namespace = true
         container {
           name    = "iipod"
@@ -137,8 +161,15 @@ resource "kubernetes_deployment" "iipod" {
           command = ["sh", "-c", coder_agent.iipod.init_script]
           security_context {
             run_as_user                = "1001"
-            privileged                 = true
-            allow_privilege_escalation = true
+            privileged                 = var.privileged
+            allow_privilege_escalation = var.privileged
+            dynamic "capabilities" {
+              for_each = var.privileged == true ? [1] : []
+
+              content {
+                add = ["all"]
+              }
+            }
           }
           resources {
             requests = {
@@ -152,6 +183,23 @@ resource "kubernetes_deployment" "iipod" {
               "memory" = "${var.container_resource_memory}Gi"
             }
           }
+          dynamic "volume_mount" {
+            for_each = var.privileged == true ? [1] : []
+
+            content {
+              mount_path = "/sys/fs/cgroup"
+              name       = "sys-fs-cgroup"
+            }
+          }
+          dynamic "volume_mount" {
+            for_each = var.privileged == true ? [1] : []
+
+            content {
+              mount_path = "/lib/modules"
+              name       = "lib-modules"
+              read_only = true
+            }
+          }
           volume_mount {
             mount_path = "/var/run"
             name       = "var-run"
@@ -169,73 +217,50 @@ resource "kubernetes_deployment" "iipod" {
             value = local.spacename
           }
           env {
-            name  = "DOCKER_HOST"
-            value = "tcp://0.0.0.0:2375"
-          }
-        }
-        container {
-          name  = "dind"
-          image = "docker:27.3.1-dind"
-#           command = [
-#             "/bin/sh",
-#             "-c",
-#             true == true ? "sleep infinity" : <<EOF
-# set -xe -o pipefail
-
-# dev=$(ip route show default | grep -E '^default' | sed 's/.*\sdev\s\(\S*\)\s.*$/\1/')
-# addr=$(ip addr show dev "$dev" | grep inet | grep -v inet6 | sed 's/^\s*inet\s\(\S.*\).*\/.*$/\1/')
-
-# echo 1 > /proc/sys/net/ipv4/ip_forward
-# iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p tcp
-# iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p udp
-
-# exec /usr/local/bin/dockerd --iptables=false --ip6tables=false -D
-# EOF
-#           ]
-
-          security_context {
-            privileged  = true
-            allow_privilege_escalation = true
-            run_as_user = "0"
-            capabilities {
-              add = ["all"]
-            }
-            run_as_non_root = false
-            read_only_root_filesystem = false
-          }
-          env {
-            name  = "DOCKER_HOST"
-            value = "tcp://0.0.0.0:2375"
-          }
-          env {
-            name  = "DOCKER_TLS_CERTDIR"
-            value = ""
-          }
-          resources {
-            limits = {
-              "cpu"    = var.container_resource_cpu
-              "memory" = "${var.container_resource_memory}Gi"
-            }
-          }
-          volume_mount {
-            mount_path = "/var/run"
-            name       = "var-run"
+            name  = "IIPOD_USE_DOCKER"
+            value = "${var.privileged}"
           }
-          volume_mount {
-            mount_path = "/var/lib/docker"
-            name       = "var-lib-docker"
-          }
-          # volume_mount {
-          #   mount_path = "/lib/modules"
-          #   name       = "lib-modules"
-          #   read_only = true
-          # }
-          # volume_mount {
-          #   mount_path = "/proc/modules"
-          #   name       = "proc-modules"
-          #   read_only = true
+          # env {
+          #   name  = "DOCKER_HOST"
+          #   value = "tcp://0.0.0.0:2375"
           # }
         }
+        # container {
+        #   name  = "dind"
+        #   image = "docker:27.3.1-dind"
+        #   security_context {
+        #     privileged  = true
+        #     allow_privilege_escalation = true
+        #     run_as_user = "0"
+        #     capabilities {
+        #       add = ["all"]
+        #     }
+        #     run_as_non_root = false
+        #     read_only_root_filesystem = false
+        #   }
+        #   env {
+        #     name  = "DOCKER_HOST"
+        #     value = "tcp://0.0.0.0:2375"
+        #   }
+        #   env {
+        #     name  = "DOCKER_TLS_CERTDIR"
+        #     value = ""
+        #   }
+        #   resources {
+        #     limits = {
+        #       "cpu"    = var.container_resource_cpu
+        #       "memory" = "${var.container_resource_memory}Gi"
+        #     }
+        #   }
+        #   volume_mount {
+        #     name = "var-lib-docker"
+        #     mount_path = "/var/lib/docker"
+        #   }
+        #   volume_mount {
+        #     mount_path = "/var/run"
+        #     name       = "var-run"
+        #   }
+        # }
       }
     }
   }
diff --git a/iipod-startup.sh b/iipod-startup.sh
index 77f6c1c..546cbb4 100644
--- a/iipod-startup.sh
+++ b/iipod-startup.sh
@@ -125,6 +125,6 @@ kitty -T KITTY --detach --hold --start-as=maximized bash -c 'tmux at'
 # kubectl -n default logs statefulset/snoopdb --since=1s -f
 # "
 
-# if service --status-all |& grep -q docker; then
-#     sudo service docker start
-# fi
+if [ "${IIPOD_USE_DOCKER}" = "true" ] && service --status-all |& grep -q docker; then
+    sudo service docker start
+fi
diff --git a/providers.tf b/providers.tf
index ad5da2f..3f209ec 100644
--- a/providers.tf
+++ b/providers.tf
@@ -16,6 +16,10 @@ terraform {
       source  = "hashicorp/helm"
       version = "2.12.1"
     }
+    kubernetes = {
+      source = "hashicorp/kubernetes"
+      version = "2.33.0"
+    }
     # github = {
     #   source  = "integrations/github"
     #   version = "5.29.0" # Current as of July 10th 2023
diff --git a/vars.tf b/vars.tf
index 0a38e19..3d9dd46 100644
--- a/vars.tf
+++ b/vars.tf
@@ -181,3 +181,8 @@ variable "public_ip" {
     error_message = "Must be valid IP Address"
   }
 }
+
+variable "privileged" {
+  type        = bool
+  description = "Whether to deploy a privileged environment"
+}

From 76dc17b9414006495855a57a1c535f2ef2484c0a Mon Sep 17 00:00:00 2001
From: ii <Hippie Hacker>
Date: Thu, 24 Oct 2024 22:36:49 +0000
Subject: [PATCH 30/39] chore: update readme for privileged

add note
fix template name

Co-Authored-By: Caleb Woodbine <calebwoodbine.public@gmail.com>
---
 README.org | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/README.org b/README.org
index 03037fd..c06854e 100644
--- a/README.org
+++ b/README.org
@@ -55,7 +55,7 @@ coder template push \
   --variable default_git_url=$DEFAULT_GIT_URL \
   --variable default_org_url=$DEFAULT_ORG_URL \
   --variable default_container_image=$DEFAULT_CONTAINER_IMAGE \
-  $CODER_TEMPLATE_NAME-privileged \
+  $CODER_TEMPLATE_NAME \
   --message "$USER iipod Template at $(date)" --variable public_ip="$(dig +short A coder.sharing.io)" \
   --variable privileged=false
 #+end_src
@@ -84,3 +84,7 @@ coder template push \
   --message "$USER iipod Template at $(date)" --variable public_ip="$(dig +short A coder.sharing.io)" \
   --variable privileged=true
 #+end_src
+
+* Note
+
+Privileged requires the namespace label ~pod-security.kubernetes.io/enforce: privileged~.

From ae4f0a823a88b154768f75bad539973088de2bc3 Mon Sep 17 00:00:00 2001
From: ii <Hippie Hacker>
Date: Wed, 30 Oct 2024 22:32:09 +0000
Subject: [PATCH 31/39] chore: add bridged network annotation

use multus annotation
---
 deployment.tf | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/deployment.tf b/deployment.tf
index 04a6de0..4a8e332 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -45,6 +45,12 @@ resource "coder_metadata" "iipod" {
   }
 }
 
+locals {
+  pod_annotations_privileged = {
+    "k8s.v1.cni.cncf.io/networks" = "kube-system/br0"
+  }
+}
+
 resource "kubernetes_deployment" "iipod" {
   wait_for_rollout = false # For use with https://github.com/coder/coder-logstream-kube
   count            = data.coder_workspace.ii.transition == "start" ? 1 : 0
@@ -89,6 +95,7 @@ resource "kubernetes_deployment" "iipod" {
           "spaceapp" : "iipod"
           "app.kubernetes.io/name" = "coder-workspace"
         }
+        annotations = var.privileged == true ? local.pod_annotations_privileged : null
       }
       spec {
         # looks nicer than iipod-tues511-38a8euw3-3t3e8e83s

From 9a9d2b2e58e36b5dff1061d7e3771fa4d4b03277 Mon Sep 17 00:00:00 2001
From: ii <Hippie Hacker>
Date: Wed, 30 Oct 2024 22:32:32 +0000
Subject: [PATCH 32/39] chore: add cluster networking to iipod

get stuff talking
---
 deployment.tf | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/deployment.tf b/deployment.tf
index 4a8e332..f79d1a3 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -157,7 +157,8 @@ resource "kubernetes_deployment" "iipod" {
         dns_config {
           nameservers = [
             "1.0.0.1",
-            "1.1.1.1"
+            "1.1.1.1",
+            "10.200.0.10"
           ]
         }
         runtime_class_name = var.privileged != true ? "kata" : ""

From 26d5285d7e9b0b0506014f477704e4adfc64d953 Mon Sep 17 00:00:00 2001
From: ii <Hippie Hacker>
Date: Sun, 3 Nov 2024 22:09:08 +0000
Subject: [PATCH 33/39] chore: update pod dns

use 1.1.1.1
---
 deployment.tf | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/deployment.tf b/deployment.tf
index f79d1a3..4a8e332 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -157,8 +157,7 @@ resource "kubernetes_deployment" "iipod" {
         dns_config {
           nameservers = [
             "1.0.0.1",
-            "1.1.1.1",
-            "10.200.0.10"
+            "1.1.1.1"
           ]
         }
         runtime_class_name = var.privileged != true ? "kata" : ""

From 70df366f785012b1b085a0075b77d9b30eeb01ad Mon Sep 17 00:00:00 2001
From: ii <Hippie Hacker>
Date: Sun, 3 Nov 2024 22:09:19 +0000
Subject: [PATCH 34/39] chore: use Cilium route for Docker

fix Docker networking
---
 iipod-startup.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/iipod-startup.sh b/iipod-startup.sh
index 546cbb4..ef125f7 100644
--- a/iipod-startup.sh
+++ b/iipod-startup.sh
@@ -126,5 +126,9 @@ kitty -T KITTY --detach --hold --start-as=maximized bash -c 'tmux at'
 # "
 
 if [ "${IIPOD_USE_DOCKER}" = "true" ] && service --status-all |& grep -q docker; then
+    # NOTE use Cilium not Multus
+    if ip route | grep -q net1; then
+        sudo ip route del default dev net1
+    fi
     sudo service docker start
 fi

From 8d4215111305caa6ff164cf6d819c6fb65cbca33 Mon Sep 17 00:00:00 2001
From: ii <Hippie Hacker>
Date: Mon, 4 Nov 2024 21:15:20 +0000
Subject: [PATCH 35/39] chore: remove sbom step in build

not enough disk space and sboms are not made useful here yet
---
 .github/workflows/build.yml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5de6f4d..22eead1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -75,16 +75,6 @@ jobs:
           COSIGN_YES: "true"
         run: |
           cosign sign ${{ steps.run-info.outputs.image }}@${{ steps.get-digests.outputs.destination }} -y --recursive
-      - uses: anchore/sbom-action@61119d458adab75f756bc0b9e4bde25725f86a7a # v0.17.2
-        with:
-          image: ${{ steps.run-info.outputs.image }}@${{ steps.get-digests.outputs.destination }}
-          artifact-name: sbom-spdx.json
-          output-file: /tmp/sbom-spdx.json
-      - name: publish sbom blob as blob
-        env:
-          COSIGN_YES: "true"
-        run: |
-          cosign attest --predicate /tmp/sbom-spdx.json ${{ steps.run-info.outputs.image }}@${{ steps.get-digests.outputs.destination }} --recursive
       - name: image
         id: image
         run: |

From c40b5656da9e65cd7c91f7abd95df799a065d1a0 Mon Sep 17 00:00:00 2001
From: ii <Hippie Hacker>
Date: Mon, 4 Nov 2024 21:15:46 +0000
Subject: [PATCH 36/39] chore: update .terraform.lock.hcl

latest providers
---
 .terraform.lock.hcl | 134 ++++++++++++++++++++------------------------
 1 file changed, 61 insertions(+), 73 deletions(-)

diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
index 71d9bdc..b9dab73 100644
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@@ -1,7 +1,7 @@
-# This file is maintained automatically by "terraform init".
+# This file is maintained automatically by "tofu init".
 # Manual edits may be lost in future updates.
 
-provider "registry.terraform.io/coder/coder" {
+provider "registry.opentofu.org/coder/coder" {
   version     = "0.13.0"
   constraints = "0.13.0"
   hashes = [
@@ -24,7 +24,7 @@ provider "registry.terraform.io/coder/coder" {
   ]
 }
 
-provider "registry.terraform.io/equinix/equinix" {
+provider "registry.opentofu.org/equinix/equinix" {
   version     = "1.24.0"
   constraints = "1.24.0"
   hashes = [
@@ -46,97 +46,85 @@ provider "registry.terraform.io/equinix/equinix" {
   ]
 }
 
-provider "registry.terraform.io/hashicorp/dns" {
+provider "registry.opentofu.org/hashicorp/dns" {
   version     = "3.4.0"
   constraints = "3.4.0"
   hashes = [
-    "h1:nnWpjQjxyHqj057xymOndkH8s5xwzV5AqqzmbRSg4ZA=",
-    "zh:0a853845b3dc567b86bef2c03ff2c1157c23752c0ce4394a494cb5ffb7394e59",
-    "zh:134988a8b7ca76ae89c36fd515a06ae01a163a5fbbe17417d43c024900ad7453",
-    "zh:1fce68832350b7f5790ff89333e534a7f2dfb71c41048a15fdf7a154b82dd5c0",
-    "zh:21b59f476053982f1735e3c97f10e0073bb8bd89a5ebb1981a49365ddbaa19b7",
-    "zh:2cd6904babccd7ba99bc6cc3f130c164ecec9d109750160bafabab6556536d81",
-    "zh:40549f65664f700dcaa1c3965a73fbce0df3d423f01c1ba069fad5a76166d82c",
-    "zh:4fbc584e941e2900535a5da4bd4ac8244dfe67873dedef489ce0332a85b3d3a4",
-    "zh:52ea4b6d7e8d3098d2eda24ac14e5fbdd9b5d4dd234c2501f52763189fd4881b",
-    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:7ccf35e0bfa450ae08d6f36dfb81e668ad65579d1daf1a4c233ef15b55ac6589",
-    "zh:9e3e39706ee27fae3d9dfcd9fa2831c4b1af84356f46bdb006025579894565ce",
-    "zh:cda591013efa067474cd3781f6c5d121473fc4206c05ffbc85493d67f019c24a",
+    "h1:j0k6DE/Vng3r8QQQutSRNZ7DjzI9tDtgwCcIT/tIrOI=",
+    "zh:16061e224e1d89b66dd93a2345e80fe00f24a6f7f72c768e792c4ffbcdd1445d",
+    "zh:1b2e125211a5508d3d8879747174f20d16b2aac15cc0a2b7dae6f40cd6c85610",
+    "zh:608fc152d9c9e02a84eb980430f821c22f7de14156af61fb7014fb8707d796ba",
+    "zh:642aa33abde6c6d1a55baeaa9feb41e1a99421e637f998e75430948c52211f2b",
+    "zh:7481c9840e8055996373144f60c672ebbbd454bf8596e797fbaa0d32c8432036",
+    "zh:78c2ea092588daf63f8209daf22cb2526c1681b131a731e0d33bd4eac23cdf5f",
+    "zh:a2fa471df1dd201463a6fcc3be35cea95008872afc65decf55a60903b72bef3b",
+    "zh:e489792c5d519c2b0aad6cac0ab8e277fa4845e7d8e246d03679ab7c3aa728ec",
+    "zh:f5c8236ec3064544ce531cce369bec4a756ce689f2f102d3e28e04bad35aa10f",
+    "zh:f762322b47d02e371a710fed2f1eaa62ccbf4678ecf8b8a10002b00128afe395",
   ]
 }
 
-provider "registry.terraform.io/hashicorp/helm" {
+provider "registry.opentofu.org/hashicorp/helm" {
   version     = "2.12.1"
   constraints = "2.12.1"
   hashes = [
-    "h1:sgYI7lwGqJqPopY3NGmhb1eQ0YbH8PIXaAZAmnJrAvw=",
-    "zh:1d623fb1662703f2feb7860e3c795d849c77640eecbc5a776784d08807b15004",
-    "zh:253a5bc62ba2c4314875139e3fbd2feaad5ef6b0fb420302a474ab49e8e51a38",
-    "zh:282358f4ad4f20d0ccaab670b8645228bfad1c03ac0d0df5889f0aea8aeac01a",
-    "zh:4fd06af3091a382b3f0d8f0a60880f59640d2b6d9d6a31f9a873c6f1bde1ec50",
-    "zh:6816976b1830f5629ae279569175e88b497abbbac30ee809948a1f923c67a80d",
-    "zh:7d82c4150cdbf48cfeec867be94c7b9bd7682474d4df0ebb7e24e148f964844f",
-    "zh:83f062049eea2513118a4c6054fb06c8600bac96196f25aed2cc21898ec86e93",
-    "zh:a79eec0cf4c08fca79e44033ec6e470f25ff23c3e2c7f9bc707ed7771c1072c0",
-    "zh:b2b2d904b2821a6e579910320605bc478bbef063579a23fbfdd6fcb5871b81f8",
-    "zh:e91177ca06a15487fc570cb81ecef6359aa399459ea2aa7c4f7367ba86f6fcad",
-    "zh:e976bcb82996fc4968f8382bbcb6673efb1f586bf92074058a232028d97825b1",
-    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+    "h1:S0+5VN/viVA4YYpm9q45bZ903EqP3bwjv5abps+a3lE=",
+    "zh:0349149992646530c33314cb973eba68757606a037017ba47e56db695d4b3afe",
+    "zh:3138ffe23c481b01419a4a21adf83538efe6e698b421c4a8f7d142b198518709",
+    "zh:44658e3070405b88fbd76161ecddde62f478dc31aaebee3b93c2f2783a6d45f9",
+    "zh:5600a3407dfb8b77da7561490157afa8ad505c864a5dd35ed8d678e9ad8378ca",
+    "zh:6445e359c813ecbb7c2edf722ed0d1f33dfb171b6a7b470f40cf1e24045b7441",
+    "zh:7973054604c7f5a51600f6e63fa0327d05b29fac2bffd222c21660cbdd2939f9",
+    "zh:7c59e2d4602ab5d9de0ba8e442ec1fc425c8f143581018d1e7f645298a124f01",
+    "zh:8c0fb411dd5de664ac5e801d70507781790c4fc196518a56966d66d0963c240c",
+    "zh:a6a988c91bbf1828a8fc55001f10c7d06c5c53dc718ee7cd6814bdfa2e6652e0",
+    "zh:b7935d7dacd7e5a91ff9d17cfb04ce88c9100e563fd88487d14519e8d8d8b2e1",
   ]
 }
 
-provider "registry.terraform.io/hashicorp/kubernetes" {
-  version = "2.25.2"
+provider "registry.opentofu.org/hashicorp/kubernetes" {
+  version     = "2.33.0"
+  constraints = "2.33.0"
   hashes = [
-    "h1:QlTKoO0efmkzgX/9y0DQCEkg7VeidOSQW8epF6B4cEQ=",
-    "zh:044788ac936e0e8ece8f78a2e4e366ecd435ea8235388eaf2cbc8e7975d9d970",
-    "zh:24f5ff01df91f51f00ee7ff39430adeb63bb2ca4ea0042e68f06d6b65808c02f",
-    "zh:49984aa0aa1faa8c4f01e8faa039322f1e6fdaeab0b7e32f5c6e96edfde36a38",
-    "zh:4eeceaff56bac9fc782e7e33f157fa2c7e9a47b2c3c3d12da2642c312ace73f6",
-    "zh:4f49b6419345960d5af475e0200c243af4c9c140b0ee64799fe1fc9b023c49ea",
-    "zh:7958414d516867a2263a978792a24843f80023fb233cf051ff4095adc9803d85",
-    "zh:c633a755fc95e9ff0cd73656f052947afd85883a0987dde5198113aa48474156",
-    "zh:cbfe958d119795004ce1e8001449d01c056fa2a062b51d07843d98be216337d7",
-    "zh:cfb85392e18768578d4c943438897083895719be678227fd90efbe3500702a56",
-    "zh:d705a661ed5da425dd236a48645bec39fe78a67d2e70e8460b720417cbf260ac",
-    "zh:ddd7a01263da3793df4f3b5af65f166307eed5acf525e51e058cda59009cc856",
-    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+    "h1:bKw7j/Unbym/WPdFiKMZ0i/84SpPe8g2cgrzM7TkGaQ=",
+    "zh:00aed83f28880460431f70e5a057c9324d1228b3f76e6554199700632ca62361",
+    "zh:4aac46187fd23bdabd801290070fa718609a2064ed5c876c4ab61fdf6e46ea04",
+    "zh:676dd70c2ff3df25a962bae4b11a2896d4313b0fd39132ec78ae3418bb1b2ef5",
+    "zh:6a01808157d2c9b415b49ea1d294cd19262a89b3b02e0de8d1db6cdc393dffa9",
+    "zh:941a0ef4b851ad37cff9ef9d38849529b5fb0c6b3ad149a6c2457d50b7964adf",
+    "zh:9a7b0ec7d84a481d9c7544056e0639d240e1373a1d61d4aebce049cc9673a6a6",
+    "zh:a6c68f47f72089f426b9a9040cc8a9fcb98d362b5b35d26028781f9fec3f0293",
+    "zh:a6ccb8f33dd52ceaca754cb51aea667fc9a8e3bfd5a192002005b7cfece65ee5",
+    "zh:e63a6fb4a72a0634f2fb0c261d5dea0182f13b5f9f0cd1560344602cc7482b68",
+    "zh:f0b79ba3c5f28b688b802ef0f052b6b4f99aa45a70e8d4efe21fd824f7a69c6c",
   ]
 }
 
-provider "registry.terraform.io/hashicorp/null" {
-  version = "3.2.2"
+provider "registry.opentofu.org/hashicorp/null" {
+  version = "3.2.3"
   hashes = [
-    "h1:zT1ZbegaAYHwQa+QwIFugArWikRJI9dqohj8xb0GY88=",
-    "zh:3248aae6a2198f3ec8394218d05bd5e42be59f43a3a7c0b71c66ec0df08b69e7",
-    "zh:32b1aaa1c3013d33c245493f4a65465eab9436b454d250102729321a44c8ab9a",
-    "zh:38eff7e470acb48f66380a73a5c7cdd76cc9b9c9ba9a7249c7991488abe22fe3",
-    "zh:4c2f1faee67af104f5f9e711c4574ff4d298afaa8a420680b0cb55d7bbc65606",
-    "zh:544b33b757c0b954dbb87db83a5ad921edd61f02f1dc86c6186a5ea86465b546",
-    "zh:696cf785090e1e8cf1587499516b0494f47413b43cb99877ad97f5d0de3dc539",
-    "zh:6e301f34757b5d265ae44467d95306d61bef5e41930be1365f5a8dcf80f59452",
-    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:913a929070c819e59e94bb37a2a253c228f83921136ff4a7aa1a178c7cce5422",
-    "zh:aa9015926cd152425dbf86d1abdbc74bfe0e1ba3d26b3db35051d7b9ca9f72ae",
-    "zh:bb04798b016e1e1d49bcc76d62c53b56c88c63d6f2dfe38821afef17c416a0e1",
-    "zh:c23084e1b23577de22603cff752e59128d83cfecc2e6819edadd8cf7a10af11e",
+    "h1:LF8arSzHfhbyQSFtTMTYEqCM34klzrbAQBJMHYCs9d8=",
+    "zh:1d57d25084effd3fdfd902eca00020b34b1fb020253b84d7dd471301606015ac",
+    "zh:65b7f9799b88464d9c2ec529713b7f52ea744275b61a8dc86cdedab1b2dcb933",
+    "zh:80d3e9c95b7b4ae7c54005cd127cae82e5c53d2b7023ef24c147337bac9dadd9",
+    "zh:841b60c07683e4bf456799ccd718896fdafdcc2c49252ae09967f2e74d8c8a03",
+    "zh:8fa1c592a9c78222e35713c6edb3f1f818a4c6f3524a30a209f0a7e919827b68",
+    "zh:bb795cc1429e09466840c09d39a28edf1db5070b1ec76822fc1173906a264572",
+    "zh:da1784818a89bea29dfe660632f0060a7a843e4e564d74435fbeca002b0f7d2a",
+    "zh:f409bf21b1cdaa6dac47cd79806f3d93f67e9507fe4dbf33b0165335f53bc2e1",
+    "zh:fbea7a1ff84b430ba9594698e93196d81d03e4036de3d1cafccb2a96d5b38581",
+    "zh:fbf0c84663a7e85881388d7d71ac862184f05fbf2d17ecf76bc5d3d7503ea260",
   ]
 }
 
-provider "registry.terraform.io/hashicorp/template" {
+provider "registry.opentofu.org/hashicorp/template" {
   version = "2.2.0"
   hashes = [
-    "h1:94qn780bi1qjrbC3uQtjJh3Wkfwd5+tTtJHOb7KTg9w=",
-    "zh:01702196f0a0492ec07917db7aaa595843d8f171dc195f4c988d2ffca2a06386",
-    "zh:09aae3da826ba3d7df69efeb25d146a1de0d03e951d35019a0f80e4f58c89b53",
-    "zh:09ba83c0625b6fe0a954da6fbd0c355ac0b7f07f86c91a2a97849140fea49603",
-    "zh:0e3a6c8e16f17f19010accd0844187d524580d9fdb0731f675ffcf4afba03d16",
-    "zh:45f2c594b6f2f34ea663704cc72048b212fe7d16fb4cfd959365fa997228a776",
-    "zh:77ea3e5a0446784d77114b5e851c970a3dde1e08fa6de38210b8385d7605d451",
-    "zh:8a154388f3708e3df5a69122a23bdfaf760a523788a5081976b3d5616f7d30ae",
-    "zh:992843002f2db5a11e626b3fc23dc0c87ad3729b3b3cff08e32ffb3df97edbde",
-    "zh:ad906f4cebd3ec5e43d5cd6dc8f4c5c9cc3b33d2243c89c5fc18f97f7277b51d",
-    "zh:c979425ddb256511137ecd093e23283234da0154b7fa8b21c2687182d9aea8b2",
+    "h1:tdS0otiAtvUV8uLJWJNfcqOPo3llj7FyRzExw6X1srY=",
+    "zh:374c28bafc43cd65e578cb209efc9eee4c1cec7618f451528e928db98059e8c8",
+    "zh:6a2982e70fbc2ab2668d624c648ef2eb32243c1a1185246b03991a7a21326db9",
+    "zh:af83169c21bb13f141510a349e1f70cf7d893247a269bd71cad74dd22f1df0f5",
+    "zh:b81a5bedc91a1a81b938c393247248d6c3d1bd8ea685541f9c858908c0afb6b3",
+    "zh:de15486244af2d29d44d510d647cd6e0b1408e89952261013c572b7c9bfd744b",
   ]
 }

From f7fc5fa96ab4669763900fb93111ad343d2fc564 Mon Sep 17 00:00:00 2001
From: Stephen Heywood <stephen@ii.coop>
Date: Tue, 5 Nov 2024 12:46:05 +1300
Subject: [PATCH 37/39] chore: add xclip

---
 build/Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/build/Dockerfile b/build/Dockerfile
index 88dc16d..888118a 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -98,6 +98,7 @@ RUN DEBIAN_FRONTEND=noninteractive \
     vim \
     websockify \
     wget \
+    xclip \
     xtermcontrol \
     xz-utils \
 	&& ln -s /usr/bin/fdfind /usr/local/bin/fd \

From 639417933ae6c980fb250cea4b1a32394d910b16 Mon Sep 17 00:00:00 2001
From: Chris McClimans <chris@mcclimans.net>
Date: Sat, 17 Jan 2026 23:36:16 -0500
Subject: [PATCH 38/39] Add Claude Code module and fix Doom Emacs build

- Add claude.tf with Claude Code module integration
- Update agent.tf with CLAUDE_CODE_OAUTH_TOKEN env var
- Fix Dockerfile: remove --fonts flag (no longer supported by Doom Emacs)
- Make DNS variables optional in vars.tf
- Add vars/coder.sharing.io.yaml config file
- Add .coderignore to exclude build/ and .terraform/

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .coderignore               |  2 ++
 agent.tf                   |  4 +++-
 build/Dockerfile           |  2 +-
 claude.tf                  | 47 ++++++++++++++++++++++++++++++++++++++
 vars.tf                    | 28 +++++++++++------------
 vars/coder.sharing.io.yaml | 17 ++++++++++++++
 6 files changed, 83 insertions(+), 17 deletions(-)
 create mode 100644 .coderignore
 create mode 100644 claude.tf
 create mode 100644 vars/coder.sharing.io.yaml

diff --git a/.coderignore b/.coderignore
new file mode 100644
index 0000000..7138005
--- /dev/null
+++ b/.coderignore
@@ -0,0 +1,2 @@
+build/
+.terraform/
diff --git a/agent.tf b/agent.tf
index 18ae3e5..5ec048f 100644
--- a/agent.tf
+++ b/agent.tf
@@ -14,7 +14,9 @@ resource "coder_agent" "iipod" {
     # GITHUB_TOKEN = "$${data.coder_git_auth.github.access_token}"
     # GITHUB_TOKEN = "${data.coder_external_auth.github.access_token}"
     # Just a hidden feature for now to try out
-    OPENAI_API_TOKEN    = "${var.openai_api_token}"
+    OPENAI_API_TOKEN       = "${var.openai_api_token}"
+    # Claude Code OAuth token (long-lived)
+    CLAUDE_CODE_OAUTH_TOKEN = local.claude_token
     ORGFILE_URL         = "${data.coder_parameter.org-url.value}"
     SESSION_NAME        = "${lower(data.coder_workspace.ii.name)}"
     GIT_REPO            = "${data.coder_parameter.git-url.value}"
diff --git a/build/Dockerfile b/build/Dockerfile
index 888118a..e21abbe 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -308,7 +308,7 @@ RUN mkdir -p ~/.config
 # Doom Emacs
 RUN git clone --depth 1 https://github.com/doomemacs/doomemacs ~/.config/emacs
 RUN git clone --depth 1 https://github.com/ii/doom-config ~/.config/doom
-RUN yes | ~/.config/emacs/bin/doom install --env --fonts
+RUN yes | ~/.config/emacs/bin/doom install --env
 RUN cd ~/.config/doom && git pull && ~/.config/emacs/bin/doom sync || true && true || true
 
 # Our tmux uses yank now
diff --git a/claude.tf b/claude.tf
new file mode 100644
index 0000000..cad9f9d
--- /dev/null
+++ b/claude.tf
@@ -0,0 +1,47 @@
+# Claude Code Integration
+# =======================
+# Adds Claude Code AI agent to the workspace.
+# Uses a shared OAuth token with optional user override.
+
+# Template-level variable for shared OAuth token
+variable "claude_oauth_token" {
+  type        = string
+  description = "Claude Code OAuth token (long-lived, shared across workspaces)"
+  sensitive   = true
+  default     = ""
+}
+
+# User-configurable parameter for custom token
+data "coder_parameter" "claude_oauth_token" {
+  name         = "claude_oauth_token"
+  display_name = "Claude Code Token (optional)"
+  description  = "Your own Claude OAuth token. Leave empty to use shared token."
+  type         = "string"
+  mutable      = true
+  default      = ""
+  order        = 50
+}
+
+# Resolve token: user-provided takes precedence, then template default
+locals {
+  claude_token = coalesce(
+    data.coder_parameter.claude_oauth_token.value,
+    var.claude_oauth_token
+  )
+}
+
+# Claude Code module from Coder registry
+module "claude-code" {
+  count   = local.claude_token != "" ? 1 : 0
+  source  = "registry.coder.com/modules/claude-code/coder"
+  version = "1.2.1"
+
+  agent_id = coder_agent.iipod.id
+  folder   = "/home/coder"
+
+  # Run in tmux for persistent background sessions
+  experiment_use_tmux = true
+
+  # Enable task reporting to Coder UI (requires Coder v2.21+)
+  experiment_report_tasks = true
+}
diff --git a/vars.tf b/vars.tf
index 3d9dd46..b217583 100644
--- a/vars.tf
+++ b/vars.tf
@@ -64,15 +64,15 @@ variable "openai_api_token" {
 variable "pdns_api_key" {
   type        = string
   description = "PowerDNS API Key for Powerdns Domain Creation"
-  # default     = "example.com"
-  nullable = false
+  default     = ""
+  nullable    = true
 }
 
 variable "pdns_api_url" {
   type        = string
   description = "PowerDNS API URL for Powerdns Domain Creation"
-  # default     = "https://pdns.ii.nz/"
-  nullable = false
+  default     = ""
+  nullable    = true
 }
 
 # variable "dns_update_account" {
@@ -84,32 +84,30 @@ variable "pdns_api_url" {
 variable "dns_update_server" {
   type        = string
   description = "Nameserver for RFC2136 Updates"
-  # default     = "123.253.176.253"
-  nullable = false
-  validation {
-    condition     = can(regex("(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]", var.dns_update_server))
-    error_message = "Invalid input, must be a valid domain name."
-  }
+  default     = ""
+  nullable    = true
 }
 
 variable "dns_update_keyname" {
   type        = string
   description = "TSIG Key Name for RFC2136 Updates"
-  nullable    = false
+  default     = ""
+  nullable    = true
 }
 
 variable "dns_update_keyalgorithm" {
   type        = string
   description = "TSIG Algorithm for RFC2136 Updates"
-  nullable    = false
-  # default     = "hmac-sha256"
+  default     = "hmac-sha256"
+  nullable    = true
 }
 
 variable "dns_update_keysecret" {
   type        = string
   description = "TSIG Key Secret for RFC2136 Updates"
-  nullable    = false
-  # sensitive   = true
+  default     = ""
+  nullable    = true
+  sensitive   = true
 }
 variable "container_resource_cpu" {
   type        = number
diff --git a/vars/coder.sharing.io.yaml b/vars/coder.sharing.io.yaml
new file mode 100644
index 0000000..94b0031
--- /dev/null
+++ b/vars/coder.sharing.io.yaml
@@ -0,0 +1,17 @@
+# Variables for coder.sharing.io deployment
+coder_url: "https://coder.sharing.io"
+coder_domain: "coder.sharing.io"
+default_container_image: "ghcr.io/ii/iipod:latest"
+default_git_url: "https://github.com/ii/iipod/"
+default_org_url: "https://raw.githubusercontent.com/ii/iipod/canon/README.org"
+public_ip: "157.151.169.69"
+# DNS/PDNS - left empty, subdomain creation disabled
+pdns_api_key: ""
+pdns_api_url: ""
+dns_update_server: ""
+dns_update_keyname: ""
+dns_update_keysecret: ""
+# Resources
+container_resource_cpu: 4
+container_resource_memory: 8
+privileged: false

From 4edad60d4bc0c13936f41fa649c0fa5ab371a78c Mon Sep 17 00:00:00 2001
From: Chris McClimans <chris@mcclimans.net>
Date: Sun, 18 Jan 2026 00:07:19 -0500
Subject: [PATCH 39/39] Migrate to coder provider v2.0 API

- Update coder provider version constraint to >= 0.17.0
- Add coder_workspace_owner data source (replaces owner attributes)
- Replace data.coder_workspace.ii.owner with data.coder_workspace_owner.ii.name
- Replace data.coder_workspace.ii.owner_email with data.coder_workspace_owner.ii.email
- Replace data.coder_workspace.ii.owner_id with data.coder_workspace_owner.ii.id
- Remove deprecated startup_script_timeout and shutdown_script_timeout
- Fix claude_token coalesce logic for empty string handling
- Add openai_api_token default value

See: https://help.coder.com/hc/en-us/articles/28479967660823

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .coderignore               |   4 +-
 .terraform.lock.hcl        | 130 -------------------------------------
 agent.tf                   |  10 ++-
 claude.tf                  |   6 +-
 deployment.tf              |  20 +++---
 providers.tf               |   2 +-
 vars.tf                    |  12 ++--
 vars/coder.sharing.io.yaml |   2 +
 8 files changed, 29 insertions(+), 157 deletions(-)
 delete mode 100644 .terraform.lock.hcl

diff --git a/.coderignore b/.coderignore
index 7138005..645a8ff 100644
--- a/.coderignore
+++ b/.coderignore
@@ -1,2 +1,2 @@
-build/
-.terraform/
+build
+.terraform
diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
deleted file mode 100644
index b9dab73..0000000
--- a/.terraform.lock.hcl
+++ /dev/null
@@ -1,130 +0,0 @@
-# This file is maintained automatically by "tofu init".
-# Manual edits may be lost in future updates.
-
-provider "registry.opentofu.org/coder/coder" {
-  version     = "0.13.0"
-  constraints = "0.13.0"
-  hashes = [
-    "h1:szTaWezPHC12Dknjj1tq1myHehroctMWyp0casICfVU=",
-    "zh:1d3151298b4c96ad2f10e910b7f2bb85841915800c4919eb8629f57622a73eb3",
-    "zh:214034bf1058dbfea357a4dc2d05f204845c9a291a28cc16b00f60424d7ab98e",
-    "zh:30c0a11ba78166a109a54e319add42d3e04655c59bb16c750bc70ecde8e96f21",
-    "zh:52148b5dd252242b11ec60dd37359808b3f147e7d8a963c2a90e737204e3472e",
-    "zh:5e268b53fba2cda3463726f3f5d60bb0617f11bbbd75a1995c4f42c09a05dced",
-    "zh:5f6e2b9858649ad4666163816b03b474e29935470bc565bba2fed2afc8718a67",
-    "zh:871dc76e9f1cf1e08d5214d15c1eb6d2630de3d6a1d513a468ede014ad4ce5d7",
-    "zh:c2f3fb68891e830fc224ef496257ba43b7612c3df5c24efd3c9e7d6044f3d0e9",
-    "zh:ccf6bcf72d3e5955de6cf44d104a18daf7bad9d76fc45f5b097749960b169ecb",
-    "zh:ce6f280d7f5a39de5d31e2c94ef514c6e52ab1204fa0887ac45495433dafb1bd",
-    "zh:d888d239b97c1eab91b0f1a9e74acb7e5dd777254f21970fa880c7bc8be5f46e",
-    "zh:d9a9e90fedf98ade4f31e132be98dd3c7e2a4edfc964b50756f893cbf064192e",
-    "zh:e8f4fa7af6ed13941d97a7089c45b3fe2617ddfbe4d727136f07b55e24c506df",
-    "zh:ed3d07621ebac383fcd89eb9ecbf97e7a391db180dae79d9451952685f0eac93",
-    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
-  ]
-}
-
-provider "registry.opentofu.org/equinix/equinix" {
-  version     = "1.24.0"
-  constraints = "1.24.0"
-  hashes = [
-    "h1:3dcIF8c4ruonqRbqTm+TWuRY+svO/uqXhksSik6xXjc=",
-    "zh:1463c15083f01b0ded5edc7d4e7678490bfe22a048565eefccad003f626904bd",
-    "zh:232e01e0f24867c99c208aaf48cf8590ef53323bf8cd57ce97eaf14a49a8f037",
-    "zh:340fa2a45307ee299659fcd52c1b1bb1d917e63a4184524e08510292104bdab8",
-    "zh:4fc7a85450b39a0d90ea8b92c2626f7ceffd2af7307ce05a7a548452513fe696",
-    "zh:5c539c4c81397ba53661a3d552ccebdff77a684a9de59b6f75d7c8f57abfdc8e",
-    "zh:5d8e7a863bdf39b1332e7bd24f793cda753577d0dce172b77a58bf8099fcac5c",
-    "zh:96d20eeba4948d355dd6329c4676a5edb0af40e295100c59729fe1d497d26501",
-    "zh:b023cdd24fccc39cce8e0fb69bffeada4f653d5c55868c367bf2afe347406663",
-    "zh:bf46a55eb95ac77ff36da9da1b2622fa4d74a48e90a7c5bbc17d17c698364f2b",
-    "zh:cd856520480652db3d1ca803e34e91baef10862c4cb3e1946a7c68dcf832f364",
-    "zh:cec1339551bb25ac21deed228f7a80df8790bad157136ad0a275b81a970c59c1",
-    "zh:df3de6cecf8a8ea050243895b030a5f75f85d400ac39879f9eb47b7d9963c789",
-    "zh:e24b5475a1f9158ac6f74043636c2ce97f255e88f61f984520d76f334d4ab6f8",
-    "zh:ec1bcf074966540ca9dae9d179a654acda220ec4af8caa59e3acabf43205c1e3",
-  ]
-}
-
-provider "registry.opentofu.org/hashicorp/dns" {
-  version     = "3.4.0"
-  constraints = "3.4.0"
-  hashes = [
-    "h1:j0k6DE/Vng3r8QQQutSRNZ7DjzI9tDtgwCcIT/tIrOI=",
-    "zh:16061e224e1d89b66dd93a2345e80fe00f24a6f7f72c768e792c4ffbcdd1445d",
-    "zh:1b2e125211a5508d3d8879747174f20d16b2aac15cc0a2b7dae6f40cd6c85610",
-    "zh:608fc152d9c9e02a84eb980430f821c22f7de14156af61fb7014fb8707d796ba",
-    "zh:642aa33abde6c6d1a55baeaa9feb41e1a99421e637f998e75430948c52211f2b",
-    "zh:7481c9840e8055996373144f60c672ebbbd454bf8596e797fbaa0d32c8432036",
-    "zh:78c2ea092588daf63f8209daf22cb2526c1681b131a731e0d33bd4eac23cdf5f",
-    "zh:a2fa471df1dd201463a6fcc3be35cea95008872afc65decf55a60903b72bef3b",
-    "zh:e489792c5d519c2b0aad6cac0ab8e277fa4845e7d8e246d03679ab7c3aa728ec",
-    "zh:f5c8236ec3064544ce531cce369bec4a756ce689f2f102d3e28e04bad35aa10f",
-    "zh:f762322b47d02e371a710fed2f1eaa62ccbf4678ecf8b8a10002b00128afe395",
-  ]
-}
-
-provider "registry.opentofu.org/hashicorp/helm" {
-  version     = "2.12.1"
-  constraints = "2.12.1"
-  hashes = [
-    "h1:S0+5VN/viVA4YYpm9q45bZ903EqP3bwjv5abps+a3lE=",
-    "zh:0349149992646530c33314cb973eba68757606a037017ba47e56db695d4b3afe",
-    "zh:3138ffe23c481b01419a4a21adf83538efe6e698b421c4a8f7d142b198518709",
-    "zh:44658e3070405b88fbd76161ecddde62f478dc31aaebee3b93c2f2783a6d45f9",
-    "zh:5600a3407dfb8b77da7561490157afa8ad505c864a5dd35ed8d678e9ad8378ca",
-    "zh:6445e359c813ecbb7c2edf722ed0d1f33dfb171b6a7b470f40cf1e24045b7441",
-    "zh:7973054604c7f5a51600f6e63fa0327d05b29fac2bffd222c21660cbdd2939f9",
-    "zh:7c59e2d4602ab5d9de0ba8e442ec1fc425c8f143581018d1e7f645298a124f01",
-    "zh:8c0fb411dd5de664ac5e801d70507781790c4fc196518a56966d66d0963c240c",
-    "zh:a6a988c91bbf1828a8fc55001f10c7d06c5c53dc718ee7cd6814bdfa2e6652e0",
-    "zh:b7935d7dacd7e5a91ff9d17cfb04ce88c9100e563fd88487d14519e8d8d8b2e1",
-  ]
-}
-
-provider "registry.opentofu.org/hashicorp/kubernetes" {
-  version     = "2.33.0"
-  constraints = "2.33.0"
-  hashes = [
-    "h1:bKw7j/Unbym/WPdFiKMZ0i/84SpPe8g2cgrzM7TkGaQ=",
-    "zh:00aed83f28880460431f70e5a057c9324d1228b3f76e6554199700632ca62361",
-    "zh:4aac46187fd23bdabd801290070fa718609a2064ed5c876c4ab61fdf6e46ea04",
-    "zh:676dd70c2ff3df25a962bae4b11a2896d4313b0fd39132ec78ae3418bb1b2ef5",
-    "zh:6a01808157d2c9b415b49ea1d294cd19262a89b3b02e0de8d1db6cdc393dffa9",
-    "zh:941a0ef4b851ad37cff9ef9d38849529b5fb0c6b3ad149a6c2457d50b7964adf",
-    "zh:9a7b0ec7d84a481d9c7544056e0639d240e1373a1d61d4aebce049cc9673a6a6",
-    "zh:a6c68f47f72089f426b9a9040cc8a9fcb98d362b5b35d26028781f9fec3f0293",
-    "zh:a6ccb8f33dd52ceaca754cb51aea667fc9a8e3bfd5a192002005b7cfece65ee5",
-    "zh:e63a6fb4a72a0634f2fb0c261d5dea0182f13b5f9f0cd1560344602cc7482b68",
-    "zh:f0b79ba3c5f28b688b802ef0f052b6b4f99aa45a70e8d4efe21fd824f7a69c6c",
-  ]
-}
-
-provider "registry.opentofu.org/hashicorp/null" {
-  version = "3.2.3"
-  hashes = [
-    "h1:LF8arSzHfhbyQSFtTMTYEqCM34klzrbAQBJMHYCs9d8=",
-    "zh:1d57d25084effd3fdfd902eca00020b34b1fb020253b84d7dd471301606015ac",
-    "zh:65b7f9799b88464d9c2ec529713b7f52ea744275b61a8dc86cdedab1b2dcb933",
-    "zh:80d3e9c95b7b4ae7c54005cd127cae82e5c53d2b7023ef24c147337bac9dadd9",
-    "zh:841b60c07683e4bf456799ccd718896fdafdcc2c49252ae09967f2e74d8c8a03",
-    "zh:8fa1c592a9c78222e35713c6edb3f1f818a4c6f3524a30a209f0a7e919827b68",
-    "zh:bb795cc1429e09466840c09d39a28edf1db5070b1ec76822fc1173906a264572",
-    "zh:da1784818a89bea29dfe660632f0060a7a843e4e564d74435fbeca002b0f7d2a",
-    "zh:f409bf21b1cdaa6dac47cd79806f3d93f67e9507fe4dbf33b0165335f53bc2e1",
-    "zh:fbea7a1ff84b430ba9594698e93196d81d03e4036de3d1cafccb2a96d5b38581",
-    "zh:fbf0c84663a7e85881388d7d71ac862184f05fbf2d17ecf76bc5d3d7503ea260",
-  ]
-}
-
-provider "registry.opentofu.org/hashicorp/template" {
-  version = "2.2.0"
-  hashes = [
-    "h1:tdS0otiAtvUV8uLJWJNfcqOPo3llj7FyRzExw6X1srY=",
-    "zh:374c28bafc43cd65e578cb209efc9eee4c1cec7618f451528e928db98059e8c8",
-    "zh:6a2982e70fbc2ab2668d624c648ef2eb32243c1a1185246b03991a7a21326db9",
-    "zh:af83169c21bb13f141510a349e1f70cf7d893247a269bd71cad74dd22f1df0f5",
-    "zh:b81a5bedc91a1a81b938c393247248d6c3d1bd8ea685541f9c858908c0afb6b3",
-    "zh:de15486244af2d29d44d510d647cd6e0b1408e89952261013c572b7c9bfd744b",
-  ]
-}
diff --git a/agent.tf b/agent.tf
index 5ec048f..0a9f3d8 100644
--- a/agent.tf
+++ b/agent.tf
@@ -7,9 +7,7 @@ resource "coder_agent" "iipod" {
   troubleshooting_url     = "http://ii.nz" # blocking, non-blocking
   connection_timeout      = 300
   startup_script          = file("./iipod-startup.sh")
-  startup_script_timeout  = 300
   shutdown_script         = file("./iipod-shutdown.sh")
-  shutdown_script_timeout = 300
   env = {
     # GITHUB_TOKEN = "$${data.coder_git_auth.github.access_token}"
     # GITHUB_TOKEN = "${data.coder_external_auth.github.access_token}"
@@ -21,10 +19,10 @@ resource "coder_agent" "iipod" {
     SESSION_NAME        = "${lower(data.coder_workspace.ii.name)}"
     GIT_REPO            = "${data.coder_parameter.git-url.value}"
     SPACE_DOMAIN        = "${local.space_domain}"
-    GIT_AUTHOR_NAME     = "${data.coder_workspace.ii.owner}"
-    GIT_COMMITTER_NAME  = "${data.coder_workspace.ii.owner}"
-    GIT_AUTHOR_EMAIL    = "${data.coder_workspace.ii.owner_email}"
-    GIT_COMMITTER_EMAIL = "${data.coder_workspace.ii.owner_email}"
+    GIT_AUTHOR_NAME     = "${data.coder_workspace_owner.ii.name}"
+    GIT_COMMITTER_NAME  = "${data.coder_workspace_owner.ii.name}"
+    GIT_AUTHOR_EMAIL    = "${data.coder_workspace_owner.ii.email}"
+    GIT_COMMITTER_EMAIL = "${data.coder_workspace_owner.ii.email}"
   }
   display_apps {
     port_forwarding_helper = true
diff --git a/claude.tf b/claude.tf
index cad9f9d..f8757c8 100644
--- a/claude.tf
+++ b/claude.tf
@@ -24,10 +24,8 @@ data "coder_parameter" "claude_oauth_token" {
 
 # Resolve token: user-provided takes precedence, then template default
 locals {
-  claude_token = coalesce(
-    data.coder_parameter.claude_oauth_token.value,
-    var.claude_oauth_token
-  )
+  # Use user token if provided, otherwise fall back to template variable
+  claude_token = data.coder_parameter.claude_oauth_token.value != "" ? data.coder_parameter.claude_oauth_token.value : var.claude_oauth_token
 }
 
 # Claude Code module from Coder registry
diff --git a/deployment.tf b/deployment.tf
index 4a8e332..60f07f2 100644
--- a/deployment.tf
+++ b/deployment.tf
@@ -20,27 +20,27 @@ resource "coder_metadata" "iipod" {
   # https://github.com/coder/coder/pull/10521/files#diff-cbc535e52cef85ed2f3d7ec9ba042a35c692c7bb50a6077d9df1dd0e6d14a752R147
   item {
     key   = "emacs"
-    value = "[emacs-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://emacs-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain})"
+    value = "[emacs-${local.spacename}.${data.coder_workspace_owner.ii.name}.${var.coder_domain}](https://emacs-${local.spacename}.${data.coder_workspace_owner.ii.name}.${var.coder_domain})"
     # value = "[emacs-${local.space_domain}](https://emacs-${local.space_domain}/)"
   }
   item {
     key   = "left tmux/eye"
-    value = "[left-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://left-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain})"
+    value = "[left-${local.spacename}.${data.coder_workspace_owner.ii.name}.${var.coder_domain}](https://left-${local.spacename}.${data.coder_workspace_owner.ii.name}.${var.coder_domain})"
     # value = "[lefteye-${local.space_domain}](https://lefteye-${local.space_domain}/)"
   }
   item {
     key   = "right tmux/eye"
-    value = "[right-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://right-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain})"
+    value = "[right-${local.spacename}.${data.coder_workspace_owner.ii.name}.${var.coder_domain}](https://right-${local.spacename}.${data.coder_workspace_owner.ii.name}.${var.coder_domain})"
     # value = "[righteye-${local.space_domain}](https://righteye-${local.space_domain}/)"
   }
   item {
     key   = "vnc"
-    value = "[vnc-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://vnc-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}/?autoconnect=true&resize=remote)"
+    value = "[vnc-${local.spacename}.${data.coder_workspace_owner.ii.name}.${var.coder_domain}](https://vnc-${local.spacename}.${data.coder_workspace_owner.ii.name}.${var.coder_domain}/?autoconnect=true&resize=remote)"
     # value = "[vnc-${emacslocal.space_domain}](https://vnc-${local.space_domain}/?autoconnect=true&resize=remote)"
   }
   item {
     key   = "www"
-    value = "[www-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain}](https://www-${local.spacename}.${data.coder_workspace.ii.owner}.${var.coder_domain})"
+    value = "[www-${local.spacename}.${data.coder_workspace_owner.ii.name}.${var.coder_domain}](https://www-${local.spacename}.${data.coder_workspace_owner.ii.name}.${var.coder_domain})"
     # value = "[www-${local.space_domain}](https://www-${local.space_domain}/)"
   }
 }
@@ -58,23 +58,23 @@ resource "kubernetes_deployment" "iipod" {
     name = "iipod-${local.spacename}"
     # namespace = "spaces" #var.namespace
     # namespace = "coder" #var.namespace
-    # namespace = "${data.coder_workspace.ii.name}-${data.coder_workspace.ii.owner}"
+    # namespace = "${data.coder_workspace.ii.name}-${data.coder_workspace_owner.ii.name}"
     namespace = local.namespace
     # namespace = "coder" #var.namespace
     labels = {
       "spacename" : local.spacename
       "spaceapp" : "iipod"
       "app.kubernetes.io/name"     = "coder-workspace"
-      "app.kubernetes.io/instance" = "coder-workspace-${lower(data.coder_workspace.ii.owner)}-${lower(data.coder_workspace.ii.name)}"
+      "app.kubernetes.io/instance" = "coder-workspace-${lower(data.coder_workspace_owner.ii.name)}-${lower(data.coder_workspace.ii.name)}"
       "app.kubernetes.io/part-of"  = "coder"
       "com.coder.resource"         = "true"
       "com.coder.workspace.id"     = data.coder_workspace.ii.id
       "com.coder.workspace.name"   = data.coder_workspace.ii.name
-      "com.coder.user.id"          = data.coder_workspace.ii.owner_id
-      "com.coder.user.username"    = data.coder_workspace.ii.owner
+      "com.coder.user.id"          = data.coder_workspace_owner.ii.id
+      "com.coder.user.username"    = data.coder_workspace_owner.ii.name
     }
     annotations = {
-      "com.coder.user.email" = data.coder_workspace.ii.owner_email
+      "com.coder.user.email" = data.coder_workspace_owner.ii.email
     }
   }
   spec {
diff --git a/providers.tf b/providers.tf
index 3f209ec..a0da34d 100644
--- a/providers.tf
+++ b/providers.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     coder = {
       source  = "coder/coder"
-      version = "0.13.0" # Current as of January 17th 2024
+      version = ">= 0.17.0" # Updated for Claude Code module
     }
     equinix = {
       source  = "equinix/equinix"
diff --git a/vars.tf b/vars.tf
index b217583..55f85f3 100644
--- a/vars.tf
+++ b/vars.tf
@@ -4,6 +4,10 @@ data "coder_provisioner" "ii" {
 data "coder_workspace" "ii" {
 }
 
+# New in coder provider v2.0 - owner info moved to separate data source
+data "coder_workspace_owner" "ii" {
+}
+
 # Warning: Deprecated Resource
 # on vars.tf line 7, in data "coder_git_auth" "github":
 # data "coder_git_auth" "github" {
@@ -20,8 +24,8 @@ data "coder_workspace" "ii" {
 # And deployed with coder template push --variables-file ./vars/space.sharing.io.yaml or similar
 
 locals {
-  username          = lower(data.coder_workspace.ii.owner)
-  namespace         = lower(data.coder_workspace.ii.owner)
+  username          = lower(data.coder_workspace_owner.ii.name)
+  namespace         = lower(data.coder_workspace_owner.ii.name)
   spacename         = lower(data.coder_workspace.ii.name)
   user_domain       = "${local.namespace}.${var.coder_domain}"
   space_domain      = "${local.spacename}.${local.user_domain}"
@@ -57,8 +61,8 @@ variable "coder_domain" {
 variable "openai_api_token" {
   type        = string
   description = "OpenAI API Token"
-  # default     = "example.com"
-  nullable = true
+  default     = ""
+  nullable    = true
 }
 
 variable "pdns_api_key" {
diff --git a/vars/coder.sharing.io.yaml b/vars/coder.sharing.io.yaml
index 94b0031..453f3a8 100644
--- a/vars/coder.sharing.io.yaml
+++ b/vars/coder.sharing.io.yaml
@@ -15,3 +15,5 @@ dns_update_keysecret: ""
 container_resource_cpu: 4
 container_resource_memory: 8
 privileged: false
+# OpenAI API token (optional, can be empty)
+openai_api_token: ""