cdsr: initial import of deployed stack (runtime 4.133.0, pinned extensions, SSOT vault)
This commit is contained in:
Antigravity
91
q5vault/index.md
Normal file
91
q5vault/index.md
Normal file
@@ -0,0 +1,91 @@
|
||||
---
|
||||
title: 💻 Code Server SSOT
|
||||
description: Single source of truth for the SSO-gated code-server IDE at cdsr.loca.zone, its pinned extension baseline, and its operations.
|
||||
source: verified deployment on the loca operator host, 2026-08-19
|
||||
reviewed: 2026-08-19
|
||||
---
|
||||
|
||||
# 💻 Code Server SSOT
|
||||
|
||||
Browser IDE for user `loca`, reverse-proxied by Nginx, gated by Authelia one-factor login, running loopback-only on `127.0.0.1:52224`. Extensions come from Open VSX and are pinned in a lock file, never installed ad hoc.
|
||||
|
||||
## 🚀 Quick start
|
||||
|
||||
- open: https://cdsr.loca.zone
|
||||
- login at `auth.loca.zone` first (one-factor), then the editor shell loads
|
||||
- wiki (public, no login): https://wiki.cdsr.loca.zone
|
||||
- service: `cdsr.service` (system scope, `User=loca`)
|
||||
- `systemctl status cdsr --no-pager`
|
||||
- `sudo -n systemctl restart cdsr`
|
||||
- health: `curl -sf http://127.0.0.1:52224/healthz`
|
||||
- project root: `/home/loca/dev/code-server`
|
||||
- config: `config/config.yaml`
|
||||
- extension pins: `config/extensions.lock.json`
|
||||
- runtime pin: `config/runtime-version.txt`
|
||||
- state: `data/user/`, `data/extensions/`
|
||||
|
||||
## 🔐 Auth flow
|
||||
|
||||
- Browser → Nginx `cdsr.loca.zone:443` → `auth_request` to Authelia → code-server `127.0.0.1:52224`
|
||||
- Authelia rule: `cdsr.loca.zone` = `one_factor`; default policy stays `bypass`, so the wiki host needs no rule and stays public
|
||||
- code-server runs `auth: none` + `cert: false` on purpose: TLS and identity are terminated in front of it, and it never listens on a public interface
|
||||
|
||||
## 🧩 Extension baseline
|
||||
|
||||
| Extension | Version | Role |
|
||||
| --- | --- | --- |
|
||||
| `Continue.continue` | 2.1.0 | open-source AI agent, chat, edit, autocomplete |
|
||||
| `Anthropic.claude-code` | 2.1.235 | first-party Claude Code IDE integration |
|
||||
| `ms-python.python` | 2026.4.0 | Python language support |
|
||||
| `ms-python.debugpy` | 2026.6.0 | Python debugger, pinned explicitly |
|
||||
| `ms-toolsai.jupyter` | 2025.9.1 | notebooks in the browser IDE |
|
||||
| `ms-azuretools.vscode-containers` | 2.4.5 | Container Tools, successor to the old Docker extension |
|
||||
|
||||
- install or repair: `cd /home/loca/dev/code-server && ./scripts/install-extensions.sh`
|
||||
- audit against the lock file: `./scripts/list-extension-versions.sh`
|
||||
- optional, enterprise-only: `sourcegraph.cody-ai` 1.155.0 via `./scripts/install-extensions.sh --include-optional`
|
||||
- AI models come from the host LiteLLM gateway (`127.0.0.1:52001`), not a cloud sign-in; use the `free` model — see [[operations/extensions]]
|
||||
- a fresh browser profile starts in Restricted Mode and hides every third-party extension until the folder is trusted — see [[operations/extensions]]
|
||||
- details: [[operations/extensions]]
|
||||
|
||||
## ⬆️ Upgrade sequence
|
||||
|
||||
```bash
|
||||
cd /home/loca/dev/code-server/tmp
|
||||
curl -fsSL -O https://github.com/coder/code-server/releases/download/v<NEW>/code-server_<NEW>_amd64.deb
|
||||
sudo -n dpkg -i code-server_<NEW>_amd64.deb
|
||||
echo "<NEW>" > /home/loca/dev/code-server/config/runtime-version.txt
|
||||
cd /home/loca/dev/code-server
|
||||
./scripts/install-extensions.sh
|
||||
./scripts/list-extension-versions.sh
|
||||
sudo -n systemctl restart cdsr
|
||||
```
|
||||
|
||||
Extensions land on disk before the restart, so the restart is what loads them into the extension host; reload the browser window afterwards if a session was open. The currently deployed pin is 4.133.0. Full procedure: [[operations/install-upgrade]].
|
||||
|
||||
## 🔀 Dev server routing
|
||||
|
||||
- default: start a dev server on `127.0.0.1:<port>`, then open `https://cdsr.loca.zone/proxy/<port>/`
|
||||
- path-sensitive frameworks: use `https://cdsr.loca.zone/absproxy/<port>/` and set the framework's base path
|
||||
- pretty per-port subdomains are intentionally not configured; see [[reference/dev-routing]]
|
||||
|
||||
## ✅ Do / don't
|
||||
|
||||
- do: install extensions only from Open VSX through `config/extensions.lock.json`
|
||||
- do: keep the bind address loopback-only and let Nginx own TLS
|
||||
- do: sign in to AI providers inside the running editor UI
|
||||
- don't: commit provider tokens, cookies, or extension secrets into this project
|
||||
- don't: enable the packaged `code-server@loca` unit; state belongs in `data/`
|
||||
- don't: add an Authelia rule for `wiki.cdsr.loca.zone`; the wiki is public by design
|
||||
|
||||
## Start here
|
||||
|
||||
| Need | Page |
|
||||
| --- | --- |
|
||||
| Understand the deployed shape | [[architecture/runtime-topology]] |
|
||||
| Install or upgrade the runtime | [[operations/install-upgrade]] |
|
||||
| Fix auth or TLS | [[operations/auth-tls]] |
|
||||
| Manage the extension baseline | [[operations/extensions]] |
|
||||
| Re-run proof checks | [[operations/verification]] |
|
||||
| Look up a path or port | [[reference/config-paths]] |
|
||||
| Expose a dev server | [[reference/dev-routing]] |
|
||||
Reference in New Issue
Block a user