Problem
CODER_BROWSER_ONLY is a deployment-wide switch. A deployment often hosts a mix of templates with different data-handling requirements: one template may need SSH, port forwarding and desktop IDE connections refused, while general-purpose templates on the same deployment still need them for everyday work.
Today that is all-or-nothing, so the restriction can only be adopted by removing SSH and desktop IDE access from every user of the deployment.
Why the existing options do not cover it
coder_agents display_apps { ssh_helper = false, port_forwarding_helper = false, vscode = false, web_terminal = false } is presentation only. It hides the dashboard buttons; the agent still serves SSH, port forwarding and reconnecting PTYs to any client holding the workspace owners session token, so it is not an enforcement boundary.CODER_AGENT_BLOCK_FILE_TRANSFER only rejects SSH exec requests whose command name matches scp/rsync/nc/sftp. An ordinary session writing to stdout is unaffected.- Standing up a second deployment purely to scope this setting is a large amount of infrastructure (separate control plane, database, gateway) for one flag.
Where this lives today (v2.36.4)
enterprise/coderd/coderd.go installs a single global handler: api.AGPL.WorkspaceClientCoordinateOverride.Store(&handler) when FeatureBrowserOnly is enabled.enterprise/coderd/workspaceagents.go shouldBlockNonBrowserConnections responds Non-browser connections are disabled for your deployment.codersdk/templates.go has no ssh / browser / port-forward field, so there is no per-template equivalent to configure.
Proposal
A template-level setting that makes coderd refuse non-browser client connections for workspaces built from that template, enforced server-side at the same coordinate endpoint rather than in the UI. The deployment-wide flag would remain as a global override.
Being able to express it in Terraform alongside the other template settings would be ideal, so it stays reviewable as code rather than a dashboard toggle.
Use case
Templates that handle regulated data on a deployment that also serves general development templates.
Problem
CODER_BROWSER_ONLYis a deployment-wide switch. A deployment often hosts a mix of templates with different data-handling requirements: one template may need SSH, port forwarding and desktop IDE connections refused, while general-purpose templates on the same deployment still need them for everyday work.Today that is all-or-nothing, so the restriction can only be adopted by removing SSH and desktop IDE access from every user of the deployment.
Why the existing options do not cover it
coder_agentsdisplay_apps { ssh_helper = false, port_forwarding_helper = false, vscode = false, web_terminal = false }is presentation only. It hides the dashboard buttons; the agent still serves SSH, port forwarding and reconnecting PTYs to any client holding the workspace owners session token, so it is not an enforcement boundary.CODER_AGENT_BLOCK_FILE_TRANSFERonly rejects SSH exec requests whose command name matchesscp/rsync/nc/sftp. An ordinary session writing to stdout is unaffected.Where this lives today (v2.36.4)
enterprise/coderd/coderd.goinstalls a single global handler:api.AGPL.WorkspaceClientCoordinateOverride.Store(&handler)whenFeatureBrowserOnlyis enabled.enterprise/coderd/workspaceagents.goshouldBlockNonBrowserConnectionsrespondsNon-browser connections are disabled for your deployment.codersdk/templates.gohas no ssh / browser / port-forward field, so there is no per-template equivalent to configure.Proposal
A template-level setting that makes coderd refuse non-browser client connections for workspaces built from that template, enforced server-side at the same coordinate endpoint rather than in the UI. The deployment-wide flag would remain as a global override.
Being able to express it in Terraform alongside the other template settings would be ideal, so it stays reviewable as code rather than a dashboard toggle.
Use case
Templates that handle regulated data on a deployment that also serves general development templates.