[lightningspirit]

Summary

Every user uses the same OneDev server, so the URL is now a template default and each user only needs the ONEDEV_TOKEN user secret.

• main.tf: variable onedev_url (https://host[:port] or empty) → agent env ONEDEV_DEFAULT_SERVER_URL. A separate name, so it never conflicts with a user secret.
• build/tod-env.sh (the /usr/local/bin/tod wrapper), server URL precedence: ONEDEV_SERVER_URL (user secret) → tod config file (read with tod config get server-url, tod's own parser) → template default. Token mapping unchanged.
• Smoke test: default used when nothing else is set; a user value wins.
• READMEs: only the ONEDEV_TOKEN secret (with the coder secret create command); vars.example.yaml has onedev_url again.
• Image tags: node v0.9.0, php-wordpress v0.9.0, ops v0.8.0.

Existing workspaces

Nothing changes until a workspace is updated. After the update: users with an ONEDEV_SERVER_URL secret or a tod config server URL keep it (they win over the default); the token handling is unchanged.

Checks

• Local precedence test: none → empty; default only → default; secret + default → secret; config file + default → file; secret + file + default → secret
• Local node-js build: smoke test passes; just lint, just validate pass

Release

vars.yaml needs onedev_url (set in the release workspace).

🤖 Generated with Claude Code