Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Reported by customer on ticket 4935

Currently, the Helm chart hardcodes CODER_PPROF_ADDRESS to 0.0.0.0:6060 in the template, making it impossible to override via coder.env values.

This is documented in values.yaml:
CODER_PPROF_ADDRESS: set to 0.0.0.0:6060 and cannot be changed.

However, this creates a security concern: when pprof is enabled via CODER_PPROF_ENABLE=true, the profiling endpoint becomes accessible from any pod within the cluster, not just localhost.

Additional context:
• CLI default for CODER_PPROF_ADDRESS: 127.0.0.1:6060 (localhost only)
• Helm chart current behavior: Forces 0.0.0.0:6060 (all interfaces)
• The same pattern could potentially be applied to CODER_PROMETHEUS_ADDRESS for consistency

Relevant Log Output

N/A

Expected Behavior

We would like to restrict pprof access to localhost only (127.0.0.1:6060) to prevent any pod in the cluster from pulling profiling data. This matches the CLI default behavior, where CODER_PPROF_ADDRESS defaults to 127.0.0.1:6060.

Steps to Reproduce

1. Spin up a coder deployment on Kubernetes.
2. Enable PPROF via CODER_PPROF_ENABLE and set CODER_PPROF_ADDRESS to 127.0.0.1:6060
3. Exec into the coder pod and check the environment variables that were set.
4. CODER_PPROF_ADDRESS is set to 0.0.0.0:6060 although the environment variable was overridden. This is because the Helm chart template (_coder.tpl) hardcodes CODER_PPROF_ADDRESS to 0.0.0.0:6060 before custom environment variables are applied.

Environment

• Host OS: N/A
• Coder version: All versions of coder (as of Jan 27 2026)

Additional Context

No response