chore(docs): add requirements re ports and stun server to docs #12026
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -13,6 +13,37 @@ user <-> workspace connections are end-to-end encrypted. | |
|
|
||
| [Tailscale's open source](https://tailscale.com) backs our networking logic. | ||
|
|
||
| ## Requirements | ||
|
|
||
| In order for clients and workspaces to be able to connect: | ||
|
|
||
| - All clients and agents must be able to establish a connection to the Coder | ||
| server (`CODER_ACCESS_URL`) over HTTPS (`tcp/443`). | ||
| - Any reverse proxy or ingress between the Coder control plane and clients must | ||
johnstcn marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| support WebSockets. | ||
|
|
||
| In order for clients to be able to establish direct connections: | ||
|
|
||
| > **Note:** Direct connections via the web browser are not supported. To improve | ||
| > latency for browser-based applications running inside Coder workspaces, | ||
johnstcn marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| > consider deploying one or more | ||
| > [workspace proxies](../admin/workspace-proxies.md). | ||
|
|
||
| - The client is connecting using the CLI (e.g. `coder ssh` or | ||
| `coder port-forward`). | ||
johnstcn marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| - The client and workspace agent are both able to connect to a specific STUN | ||
| server. | ||
| > The STUN server needs to tell the client and workspace their respective | ||
| > `address:port` pairs from its perspective so that they can establish a | ||
| > direct connection with each other. If the client and agent are only able to | ||
| > connect to STUN servers on different networks, then a direct connection will | ||
| > not be possible. For an in-depth technical explanation, see | ||
| > [How NAT traversal works (tailscale.com)](https://tailscale.com/blog/how-nat-traversal-works). | ||
johnstcn marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| - Outbound UDP traffic must be allowed for both the client and the agent from | ||
| source ports `udp/3478` and `udp/41641` to all destination ports. | ||
| > For more detailed information, see | ||
| > [What firewall ports should I open to use Tailscale? (tailscale.com)](https://tailscale.com/kb/1082/firewall-ports). | ||
johnstcn marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
|
There was a problem hiding this comment. There should probably be some details about NATs and stuff but I really don't know what to write without getting super technical :/ There was a problem hiding this comment. Honestly I'd prefer to just link to Tailscale's docs on this. There was a problem hiding this comment. IDK how well Tailscale's docs cut it, this one doesn't really explain much about NAT just about firewalls. There was a problem hiding this comment. I link to https://tailscale.com/blog/how-nat-traversal-works a bit above in the STUN section. There was a problem hiding this comment. This is a good blog post but it's not very good documentation since it's 9000 words long. We should probably dumb it down There was a problem hiding this comment. OK, I added a fairly high-level overview. There was a problem hiding this comment. I've Slack'd you some diagrams. If we're going to explain it, then those are my suggested examples. There was a problem hiding this comment. Added and moved to a separate page as this one is getting plenty big already. |
||
| ## coder server | ||
|
|
||
| Workspaces connect to the coder server via the server's external address, set | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.