---
title: 📂 Config & Paths Reference
description: Exhaustive table of every config file, state directory, system path, and port used by the code-server deployment, with purpose and owner
source: verified deployment on the loca operator host, 2026-08-19
reviewed: 2026-08-19
---

# 📂 Config & Paths Reference

## Path & Port Table

| Path / Port | Purpose | Owner / Permissions | Notes |
| --- | --- | --- | --- |
| `config/config.yaml` | code-server runtime config | `loca:loca` 644 | Effective config shown below |
| `config/extensions.lock.json` | pinned extension versions + VSIX metadata | `loca:loca` 644 | Baseline + optional entries |
| `config/runtime-version.txt` | upstream code-server version pin | `loca:loca` 644 | Content: `4.133.0` |
| `scripts/install-extensions.sh` | installs baseline from lock file | `loca:loca` 755 | Reads `config/extensions.lock.json`, verifies sha256, `--include-optional` for optional entries |
| `scripts/list-extension-versions.sh` | audits installed vs lock file | `loca:loca` 755 | Exits non-zero on MISSING/MISMATCH |
| `deploy/cdsr.service` | systemd unit source | `loca:loca` 644 | Installed to `/etc/systemd/system/cdsr.service` |
| `deploy/cdsr.nginx.conf` | nginx site config source | `loca:loca` 644 | Installed to `/etc/nginx/sites-available/cdsr.loca.zone` |
| `data/user/` | code-server user data dir | `loca:loca` 755 | Set via `user-data-dir` |
| `data/user/User/settings.json` | VS Code settings (telemetry off, auto-update off) | `loca:loca` 644 | Seeded at deploy |
| `data/extensions/` | installed extensions dir | `loca:loca` 755 | Set via `extensions-dir` |
| `tmp/extensions/` | VSIX download cache | `loca:loca` 755 | Filenames `<id>-<version>@<platform>.vsix` |
| `q5vault/` | Quartz wiki vault (real content) | `loca:loca` 755 | Symlinked as `/home/loca/dev/wikis/cdsr/content` |
| `quartz.config.cdsr.yaml` | Quartz config for this wiki | `loca:loca` 644 | Symlinked as `/home/loca/dev/wikis/cdsr/quartz.config.yaml` |
| `/etc/systemd/system/cdsr.service` | installed systemd unit | `root:root` 644 | Requires `sudo -n install` for edits; enable/start via `systemctl` |
| `/etc/nginx/sites-available/cdsr.loca.zone` | installed nginx site | `root:root` 644 | Requires `sudo -n install` for edits; symlinked into `sites-enabled` |
| `/etc/nginx/sites-enabled/cdsr.loca.zone` | symlink to sites-available | `root:root` 755 | Created by `ln -sf` |
| `/etc/nginx/snippets/security-headers-app.conf` | security headers for app host | `root:root` 644 | Included in app 443 block |
| `/etc/nginx/snippets/security-headers.conf` | security headers for wiki host | `root:root` 644 | Included in wiki 443 block |
| `/etc/nginx/snippets/authelia-location.conf` | Authelia location config | `root:root` 644 | Included in app 443 block |
| `/etc/nginx/snippets/authelia-authrequest.conf` | auth_request to Authelia | `root:root` 644 | Protects app `location /` |
| `/etc/letsencrypt/live/cdsr.loca.zone/` | TLS cert lineage | `root:root` 700 dir, 600 files | `fullchain.pem`, `privkey.pem`; expires 2026-11-17 |
| `/home/loca/dev/services/authelia/config/configuration.yml` | Authelia config | `root:root` 644 | Requires `sudo -n install` after staging in `/tmp`; rule `cdsr.loca.zone` = `one_factor` |
| `/home/loca/dev/wikis/cdsr/content` | symlink → `q5vault/` | `loca:loca` symlink | Wiki build source |
| `/home/loca/dev/wikis/cdsr/quartz.config.yaml` | symlink → `quartz.config.cdsr.yaml` | `loca:loca` symlink | Wiki build config |
| `/home/loca/dev/wikis/cdsr/current` | symlink → latest `dist-*` build | `loca:loca` symlink | Nginx `root` points here |
| `/usr/bin/code-server` | upstream binary (Debian package) | `root:root` 755 | Installed via `dpkg -i` from GitHub release v4.133.0 |
| `/usr/lib/code-server` | upstream libs (Node, extensions host) | `root:root` 755 | Package-managed, do not modify |

## Loopback Port & Range

- `127.0.0.1:52224` — code-server bind address (chosen inside mandatory 51000-53000 loopback range for loca.zone app backends)
- Health endpoint: `http://127.0.0.1:52224/healthz` — always HTTP 200 while the server is up; body is `{"status":"expired","lastHeartbeat":0}` when no editor session is connected (healthy-idle) and `{"status":"alive",...}` while a browser session is connected. Only a non-200 or no response indicates failure; HTTP 200 from `/` also proves liveness

## Effective `config/config.yaml`

```yaml
bind-addr: 127.0.0.1:52224
auth: none
cert: false
app-name: Code Server · loca.zone
user-data-dir: /home/loca/dev/code-server/data/user
extensions-dir: /home/loca/dev/code-server/data/extensions
disable-telemetry: true
```

## Root-Owned Files Requiring `sudo -n install`

- `/etc/systemd/system/cdsr.service`
- `/etc/nginx/sites-available/cdsr.loca.zone`
- `/etc/nginx/snippets/security-headers-app.conf`
- `/etc/nginx/snippets/security-headers.conf`
- `/etc/nginx/snippets/authelia-location.conf`
- `/etc/nginx/snippets/authelia-authrequest.conf`
- `/home/loca/dev/services/authelia/config/configuration.yml`

Edit workflow: stage in `/tmp`, then `sudo -n install -m 644 -o root -g root /tmp/<file> /target/path`.