Use the existing general Ensombl EU Dokploy installation for the Coder Community control plane. Keep developer compute on isolated, replaceable Hetzner VMs.
The live topology confirms:
Create the following on the existing EU Dokploy installation:
Project: development-workspaces
Environment: production
Compose application: coder
Native PostgreSQL service: coder-postgresql
Public domains:
Deploy Coder Community as a single replica from a reviewed, pinned image version and digest.
Give the container no Docker socket, privileged mode, host networking, or host mounts.
Set initial limits of 2 CPUs and 4 GB RAM. Alert at 80% sustained memory or CPU and reassess after the six-developer rollout.
Use Dokploy’s Traefik and Domains configuration for routing, TLS, WebSockets, and wildcard workspace applications.
Use the native PostgreSQL service as Coder’s only durable state. The Coder application itself remains replaceable.
Register the database with the existing EU Dokploy backup destination. Deployment is blocked until a restore test proves that this database is covered.
Before every Coder upgrade:
The existing Dokploy host becomes an accepted single point of failure. No second manager, worker, or HA database is added in v1. The recovery target is 60 minutes.
Add Coder as a confidential OIDC application through the existing ensombl-auth provisioning flow.
Authenticate through https://auth.ensombl.io with MFA and restrict access to the engineering group.
Disable Coder password authentication.
Ordinary developers receive only Coder member access. Limit Coder owner/template-administrator access to two platform operators.
Create a Bitwarden Secrets Manager project named development-workspaces and a read-only runtime machine account named development-workspaces-runtime.
Dokploy receives only that project’s access token and non-secret configuration.
Load at runtime:
Never expose the ensombl-auth token, Dokploy administrator credentials, or staging/production application secrets to Coder or a developer workspace.
Encrypt per-user GitHub external-auth tokens in Coder’s database.
Use a separate Hetzner project named development-workspaces:
Use NBG1 initially because the existing Coder control plane is in the Ensombl EU infrastructure and Coder Community has no regional workspace proxies. Run a representative latency acceptance test before the full rollout; if the browser desktop is unusable for APAC developers, revisit location or regional architecture as a separate project.
Each workspace image contains:
Orca must run inside the remote desktop because it owns local repositories, Git worktrees, terminals, and embedded-browser state. Running Orca against a laptop-local checkout would defeat the remote-workspace objective. Coder remote desktop support (https://coder.com/docs/user-guides/workspace-access/remote-desktops), Coder KasmVNC module (https://registry.coder.com/modules/coder/kasmvnc).
Coder Community’s SSH and port-forward support remains technically available through its tunnel. Remote desktop is the supported workflow, and direct workspace networking remains unavailable. This is an accepted trust-based limitation rather than an unsupported reverse-proxy hack.
Enforce workspace egress on the separate gateway, outside developer-controlled VMs:
Operate the gateway in monitor-only mode for the first pilot week. Review legitimate destinations, then enable default-deny.
Allow:
Deny OpenRouter, Ox Alpha, unapproved inference services, and everything not explicitly allowed.
Do not deploy an AI gateway in v1. Personal ChatGPT/Codex and Claude subscriptions use vendor OAuth and cannot be meaningfully governed through a company API proxy. The acceptable-use policy permits those subscriptions and prohibits submitting Ensombl code or customer data to other model providers.
Personal laptops and phones remain outside technical enforcement. This is intentional: the team is trusted, and the system is designed for mistakes, compromised software, and workspace isolation—not determined insider prevention.
GitHub IP allowlisting remains deferred because Ensombl currently uses GitHub Team and the feature requires Enterprise Cloud. GitHub IP allowlist requirements (https://docs.github.com/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization).
Once the environment is stable:
Document control owners, access policy, acceptable AI use, change management, incident response, backup/recovery, vulnerability management, vendor review, and offboarding.
Preserve evidence from Zitadel, GitHub, Dokploy deployments, infrastructure pull requests, gateway decisions, CI, Bitwarden access, backups, and restore tests.
Run a readiness assessment when a customer opportunity makes SOC 2 commercially relevant.
Close identified gaps, pursue a Type I examination, and then begin the operating-evidence period needed for Type II.
SOC 2 evaluates whether Ensombl’s selected controls are appropriately designed and operating effectively; it does not require Coder Premium or employee surveillance. AICPA SOC 2 overview (https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2/). The workspace design also follows NIST SSDF guidance for protected development environments, segmentation, strong authentication, and restricted outbound connectivity. NIST SSDF (https://csrc.nist.gov/projects/ssdf).
Zitadel users outside the engineering group cannot enter Coder.
Coder has no password-login path.
The Coder application has no Docker socket, privileged mode, or global ensombl-auth credentials.
A developer can open the browser desktop and use Orca, Codex, Claude, GitHub, builds, and previews.
Official OpenAI and Anthropic subscription flows work without company API keys.
OpenRouter, an arbitrary inference endpoint, external DNS, DoH, QUIC, reverse SSH, VPN endpoints, and IP-literal HTTPS fail and produce metadata-only denial records.
Developer A cannot reach Developer B’s VM, services, volume, or home directory.
Workspaces cannot reach production, infrastructure services, the Coder database, or Hetzner metadata.
No workspace has a public IP or externally reachable port.
Workspace stop/start replaces the VM while preserving its volume.
Workspace deletion retains the volume.
A malicious-dependency fixture cannot contact an arbitrary collection endpoint or obtain non-development credentials.
Suspending a test user completes Zitadel, Coder, GitHub, Bitwarden, and workspace revocation within 30 minutes.
Coder PostgreSQL restores through the EU Dokploy backup path.
A selected developer volume restores from independently encrypted backup storage.
Loss of the Dokploy-hosted Coder application fails closed and is recovered within 60 minutes.
The EU Ensombl Dokploy manager remains the Coder control-plane host.
Developer compute never runs on the shared Dokploy manager.
The current single-node Dokploy cluster is accepted for v1.
No Kubernetes, additional Dokploy worker, HA database, regional Coder proxy, Coder Premium, TLS interception, DLP, prompt logging, command recording, or managed personal devices.
No attempt is made to defeat a determined insider.
Personal ChatGPT/Codex and Claude subscriptions are approved risks; other model providers are prohibited for Ensombl data.
Git is authoritative for committed work. Persistent volumes protect work in progress but are independently backed up.
Coder, templates, images, and dependencies use reviewed pinned versions rather than latest.