It could be helpful to allow CODER_AGENT_URL to be overridden.

Oh @hulto it's possible what you are looking for can already be done! In the TF template, set the access URL for the Coder provider: https://registry.terraform.io/providers/coder/coder/latest/docs#url-1. This can allow your workspaces to communicate directly to a part of the Coder network without the identity aware proxy.

We will be sure to respect the headers in these areas though. I'll look into the complexity for a fix

Oh that's awesome! This work :)

Is there a way I could collapse down from two domains to one?
Right now I'm using an internal domain with bypass policies for the IP that the agents will come from.
The second domain is for users and has auth policies.

I tired:

• Setting bypass policies just on the resources that the agents need but when doing devcontainers there was overlap in the rpc endpoint for streaming docker logs back.
• Setting CF service account auth for the agents but that got messy having to add the headers at the install (wget), and the agent running. I also couldn't get the coder health checks to use the service account though I probably did something wrong.
• Setting IP bypass and auth policies on one domain but I ran into issues when users are colocated with the agents they need to turn of the headers.

@hulto - Have you tried setting that URL in the template? That should ensure all traffic goes through the internal domain.

Beyond that, I'm really sure of things we could do in Coder to make this easier because your traffic is initially hitting Cloudflare's gateway before our server API. Open to suggestions though. I'm just scratching my head 🤔

Yep! Setting the URL works!
One thing that doesn't work is the VSCode extension tries to use it for install which errors in my setup.

Only two things didn't seem to work with the CODER_HEADER_COMMAND that i'd love added to coder were gitssh and devcontainers.