---
title: 💻 Code Server SSOT
description: Single source of truth for the SSO-gated code-server IDE at cdsr.loca.zone, its pinned extension baseline, and its operations.
source: verified deployment on the loca operator host, 2026-08-19
reviewed: 2026-08-19
---

# 💻 Code Server SSOT

Browser IDE for user `loca`, reverse-proxied by Nginx, gated by Authelia one-factor login, running loopback-only on `127.0.0.1:52224`. Extensions come from Open VSX and are pinned in a lock file, never installed ad hoc.

## 🚀 Quick start

- open: https://cdsr.loca.zone
  - login at `auth.loca.zone` first (one-factor), then the editor shell loads
  - wiki (public, no login): https://wiki.cdsr.loca.zone
- service: `cdsr.service` (system scope, `User=loca`)
  - `systemctl status cdsr --no-pager`
  - `sudo -n systemctl restart cdsr`
  - health: `curl -sf http://127.0.0.1:52224/healthz`
- project root: `/home/loca/dev/code-server`
  - config: `config/config.yaml`
  - extension pins: `config/extensions.lock.json`
  - runtime pin: `config/runtime-version.txt`
  - state: `data/user/`, `data/extensions/`

## 🔐 Auth flow

- Browser → Nginx `cdsr.loca.zone:443` → `auth_request` to Authelia → code-server `127.0.0.1:52224`
- Authelia rule: `cdsr.loca.zone` = `one_factor`; default policy stays `bypass`, so the wiki host needs no rule and stays public
- code-server runs `auth: none` + `cert: false` on purpose: TLS and identity are terminated in front of it, and it never listens on a public interface

## 🧩 Extension baseline

| Extension | Version | Role |
| --- | --- | --- |
| `Continue.continue` | 2.1.0 | open-source AI agent, chat, edit, autocomplete |
| `Anthropic.claude-code` | 2.1.235 | first-party Claude Code IDE integration |
| `ms-python.python` | 2026.4.0 | Python language support |
| `ms-python.debugpy` | 2026.6.0 | Python debugger, pinned explicitly |
| `ms-toolsai.jupyter` | 2025.9.1 | notebooks in the browser IDE |
| `ms-azuretools.vscode-containers` | 2.4.5 | Container Tools, successor to the old Docker extension |

- install or repair: `cd /home/loca/dev/code-server && ./scripts/install-extensions.sh`
- audit against the lock file: `./scripts/list-extension-versions.sh`
- optional, enterprise-only: `sourcegraph.cody-ai` 1.155.0 via `./scripts/install-extensions.sh --include-optional`
- AI models come from the host LiteLLM gateway (`127.0.0.1:52001`), not a cloud sign-in; use the `free` model — see [[operations/extensions]]
- a fresh browser profile starts in Restricted Mode and hides every third-party extension until the folder is trusted — see [[operations/extensions]]
- details: [[operations/extensions]]

## ⬆️ Upgrade sequence

```bash
cd /home/loca/dev/code-server/tmp
curl -fsSL -O https://github.com/coder/code-server/releases/download/v<NEW>/code-server_<NEW>_amd64.deb
sudo -n dpkg -i code-server_<NEW>_amd64.deb
echo "<NEW>" > /home/loca/dev/code-server/config/runtime-version.txt
cd /home/loca/dev/code-server
./scripts/install-extensions.sh
./scripts/list-extension-versions.sh
sudo -n systemctl restart cdsr
```

Extensions land on disk before the restart, so the restart is what loads them into the extension host; reload the browser window afterwards if a session was open. The currently deployed pin is 4.133.0. Full procedure: [[operations/install-upgrade]].

## 🔀 Dev server routing

- default: start a dev server on `127.0.0.1:<port>`, then open `https://cdsr.loca.zone/proxy/<port>/`
- path-sensitive frameworks: use `https://cdsr.loca.zone/absproxy/<port>/` and set the framework's base path
- pretty per-port subdomains are intentionally not configured; see [[reference/dev-routing]]

## ✅ Do / don't

- do: install extensions only from Open VSX through `config/extensions.lock.json`
- do: keep the bind address loopback-only and let Nginx own TLS
- do: sign in to AI providers inside the running editor UI
- don't: commit provider tokens, cookies, or extension secrets into this project
- don't: enable the packaged `code-server@loca` unit; state belongs in `data/`
- don't: add an Authelia rule for `wiki.cdsr.loca.zone`; the wiki is public by design

## Start here

| Need | Page |
| --- | --- |
| Understand the deployed shape | [[architecture/runtime-topology]] |
| Install or upgrade the runtime | [[operations/install-upgrade]] |
| Fix auth or TLS | [[operations/auth-tls]] |
| Manage the extension baseline | [[operations/extensions]] |
| Re-run proof checks | [[operations/verification]] |
| Look up a path or port | [[reference/config-paths]] |
| Expose a dev server | [[reference/dev-routing]] |