Connectivity & Auth Issues

For common failures and diagnostics overview, see the Troubleshooting page. For worker/pipeline issues, see Worker & Pipeline Issues.

Coder Connectivity Issues

Coder is the only runtime. If the orchestrator cannot reach Coder, it cannot provision worker workspaces, and the pipeline stalls. Most connectivity issues are network, token, or permission problems.

Command	Purpose
`coder ping`	Check basic connectivity from orchestrator to Coder.
`coder ws ls`	List Coder workspaces to see if provisioning succeeded.
`coder logs workspace-name`	Read build logs for a failed workspace provision.
`coder ssh workspace-name`	Open shell on worker workspace to inspect state.
`coder tokens list`	Verify NEXUS service account token is valid and not expired.

bash

# From NEXUS workspace, verify Coder API reachable
curl -H "Authorization: Bearer $CODER_NEXUS_TOKEN"   $CODER_URL/api/v2/users/me

# If this fails, token is invalid or network path is broken

Token expiry is silent

A Coder API token may be valid enough to open a connection but return 401 on every request. The controller log will show repeated Coder API errors. Do not assume connectivity is fine just because the NEXUS workspace is running; verify the token with coder tokens list or curl.

Token Problems

OpenFlows deliberately does not store long-lived GitHub tokens or LLM keys in worker workspaces. The only tokens the operator must manage are the Coder API token for the NEXUS service account and, optionally, the LiteLLM fallback key. GitHub identity is handled by Coder external auth.

Variable	Meaning
`CODER_NEXUS_TOKEN`	Coder API token for NEXUS service account. Stored in orchestrator env.
`CODER_SESSION_TOKEN`	Human operator token for Coder CLI. Not used by orchestrator.
`GITHUB_TOKEN`	Deprecated. GitHub identity via Coder external auth only.
`LITELLM_API_KEY`	LiteLLM fallback key. Only needed if Coder AI Gateway unavailable.

Rotating Coder Tokens

bash

coder tokens create --name nexus-my-team --user nexus-my-team

# Copy new token into NEXUS workspace environment
coder ssh openflows-nexus-my-team
export CODER_NEXUS_TOKEN=sk-...

openflows controller restart --tenant my-team

GitHub External Auth

GitHub identity is provided by Coder external auth only. There are no GitHub PATs inside OpenFlows. If workers cannot clone, push, or open PRs, the external auth link is the first thing to check.

bash

# Check current user's external auth providers
coder external-auth list

# If GitHub missing or expired, re-link it
coder external-auth login github

# Verify git access from worker workspace
coder ssh forge-1-my-team
git remote -v
git fetch origin

External auth is per-user, not per-workspace

The GitHub identity belongs to the Coder user that owns the workspace. If the NEXUS service account owns the controller workspace, it needs its own GitHub external auth link. If a human user owns a worker workspace, that user needs a link.