Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: coder/coder
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: coder/coder
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: zedkipp/boundary-log-forwarding
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 4 commits
  • 14 files changed
  • 1 contributor

Commits on Dec 9, 2025

  1. feat(agent): add boundary log forwarding to coderd 

    Add a feature that transmits boundary audit logs from workspaces to coderd
via the agent API, then re-emits them to stderr in a structured format.

The implementation includes:
- BoundaryLog proto messages and ReportBoundaryLogs RPC (API v2.7)
- BoundaryLogProxy server that accepts connections from boundary processes
  on a Unix socket and forwards logs to coderd
- Server-side handler that formats logs to stderr
- Environment variables CODER_BOUNDARY_LOG_SOCKET and CODER_WORKSPACE_ID
  automatically set for all commands in the workspace

Architecture:
- Boundary process connects to Unix socket at $CODER_BOUNDARY_LOG_SOCKET
- Sends length-prefixed protobuf ReportBoundaryLogsRequest messages
- Agent proxies messages to coderd via DRPC
- coderd re-emits to stderr

Log format:
[API] 2025-12-08 20:58:46.093 [warn] boundary: workspace.id=... decision=deny http.method="GET" http.url="..." time="..."
    @zedkipp
    zedkipp committed Dec 9, 2025
    Configuration menu
    Copy the full SHA
    df8eeec View commit details
    Browse the repository at this point in the history

  2. docs(boundarylogproxy): document wire format compatibility 

    Boundary uses its own proto definitions with matching field numbers,
allowing direct unmarshaling into agent proto types.
    @zedkipp
    zedkipp committed Dec 9, 2025
    Configuration menu
    Copy the full SHA
    23e55e4 View commit details
    Browse the repository at this point in the history

  3. refactor(agentapi): use slog for boundary logs 

    Replace fmt.Fprintf to stderr with structured slog logging for boundary
audit events. This integrates with coder's existing logging infrastructure
and provides better observability.
    @zedkipp
    zedkipp committed Dec 9, 2025
    Configuration menu
    Copy the full SHA
    c1c56e3 View commit details
    Browse the repository at this point in the history

  4. fix(agentapi): only log matched_rule for denied boundary requests

    @zedkipp
    zedkipp committed Dec 9, 2025
    Configuration menu
    Copy the full SHA
    3a70a8a View commit details
    Browse the repository at this point in the history
Loading