2ee14fdf6e
## Description Enable any agent module to run its AI agent inside Coder's Agent Boundaries. The agentapi module handles boundary installation, config setup, and wrapper script creation, then exports AGENTAPI_BOUNDARY_PREFIX for consuming modules to use in their start scripts. Supports three boundary installation modes: - coder boundary subcommand (default, Coder v2.30+) - Standalone binary via install script (use_boundary_directly) - Compiled from source (compile_boundary_from_source) Users must provide a boundary config.yaml with their allowlist and settings when enabling boundary. Closes #457 ## Type of Change - [x] Feature/enhancement ## Module Information **Path:** `registry/coder/modules/agentapi` **Breaking change:** No ## Testing & Validation - [x] Tests pass (`bun test`) - [x] Code formatted (`bun fmt`) - [x] Changes tested locally --------- Co-authored-by: Shane White <shane.white@cloudsecure.ltd> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: 35C4n0r <70096901+35C4n0r@users.noreply.github.com>
96 lines
3.3 KiB
Bash
96 lines
3.3 KiB
Bash
#!/bin/bash
|
|
# boundary.sh - Boundary installation and setup for agentapi module.
|
|
# Sourced by main.sh when ENABLE_BOUNDARY=true.
|
|
# Exports AGENTAPI_BOUNDARY_PREFIX for use by module start scripts.
|
|
|
|
validate_boundary_subcommand() {
|
|
if command_exists coder; then
|
|
if coder boundary --help > /dev/null 2>&1; then
|
|
return 0
|
|
else
|
|
echo "Error: 'coder' command found but does not support 'boundary' subcommand. Please enable install_boundary."
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "Error: ENABLE_BOUNDARY=true, but 'coder' command not found. Boundary cannot be enabled." >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# Install boundary binary if needed.
|
|
# Uses one of three strategies:
|
|
# 1. Compile from source (compile_boundary_from_source=true)
|
|
# 2. Install from release (use_boundary_directly=true)
|
|
# 3. Use coder boundary subcommand (default, no installation needed)
|
|
install_boundary() {
|
|
if [ "${COMPILE_BOUNDARY_FROM_SOURCE}" = "true" ]; then
|
|
echo "Compiling boundary from source (version: ${BOUNDARY_VERSION})"
|
|
|
|
# Remove existing boundary directory to allow re-running safely
|
|
if [ -d boundary ]; then
|
|
rm -rf boundary
|
|
fi
|
|
|
|
echo "Cloning boundary repository"
|
|
git clone https://github.com/coder/boundary.git
|
|
cd boundary || exit 1
|
|
git checkout "${BOUNDARY_VERSION}"
|
|
|
|
make build
|
|
|
|
sudo cp boundary /usr/local/bin/
|
|
sudo chmod +x /usr/local/bin/boundary
|
|
cd - || exit 1
|
|
elif [ "${USE_BOUNDARY_DIRECTLY}" = "true" ]; then
|
|
echo "Installing boundary using official install script (version: ${BOUNDARY_VERSION})"
|
|
curl -fsSL https://raw.githubusercontent.com/coder/boundary/main/install.sh | bash -s -- --version "${BOUNDARY_VERSION}"
|
|
else
|
|
validate_boundary_subcommand
|
|
echo "Using coder boundary subcommand (provided by Coder)"
|
|
fi
|
|
}
|
|
|
|
# Set up boundary: install, write config, create wrapper script.
|
|
# Exports AGENTAPI_BOUNDARY_PREFIX pointing to the wrapper script.
|
|
setup_boundary() {
|
|
local module_path="$1"
|
|
|
|
echo "Setting up coder boundary..."
|
|
|
|
# Install boundary binary if needed
|
|
install_boundary
|
|
|
|
# Determine which boundary command to use and create wrapper script
|
|
BOUNDARY_WRAPPER_SCRIPT="$module_path/boundary-wrapper.sh"
|
|
|
|
if [ "${COMPILE_BOUNDARY_FROM_SOURCE}" = "true" ] || [ "${USE_BOUNDARY_DIRECTLY}" = "true" ]; then
|
|
# Use boundary binary directly (from compilation or release installation)
|
|
cat > "${BOUNDARY_WRAPPER_SCRIPT}" << 'WRAPPER_EOF'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
exec boundary -- "$@"
|
|
WRAPPER_EOF
|
|
else
|
|
# Use coder boundary subcommand (default)
|
|
# Copy coder binary to strip CAP_NET_ADMIN capabilities.
|
|
# This is necessary because boundary doesn't work with privileged binaries
|
|
# (you can't launch privileged binaries inside network namespaces unless
|
|
# you have sys_admin).
|
|
CODER_NO_CAPS="$module_path/coder-no-caps"
|
|
if ! cp "$(which coder)" "$CODER_NO_CAPS"; then
|
|
echo "Error: Failed to copy coder binary to ${CODER_NO_CAPS}. Boundary cannot be enabled." >&2
|
|
exit 1
|
|
fi
|
|
cat > "${BOUNDARY_WRAPPER_SCRIPT}" << 'WRAPPER_EOF'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
exec "${SCRIPT_DIR}/coder-no-caps" boundary -- "$@"
|
|
WRAPPER_EOF
|
|
fi
|
|
|
|
chmod +x "${BOUNDARY_WRAPPER_SCRIPT}"
|
|
export AGENTAPI_BOUNDARY_PREFIX="${BOUNDARY_WRAPPER_SCRIPT}"
|
|
echo "Boundary wrapper configured: ${AGENTAPI_BOUNDARY_PREFIX}"
|
|
}
|