cdsr/q5vault/index.md

title, description, source, reviewed

title	description	source	reviewed
💻 Code Server SSOT	Single source of truth for the SSO-gated code-server IDE at cdsr.loca.zone, its pinned extension baseline, and its operations.	verified deployment on the loca operator host, 2026-08-19	2026-08-19

💻 Code Server SSOT

Browser IDE for user loca, reverse-proxied by Nginx, gated by Authelia one-factor login, running loopback-only on 127.0.0.1:52224. Extensions come from Open VSX and are pinned in a lock file, never installed ad hoc.

🚀 Quick start

• open: https://cdsr.loca.zone
  • login at auth.loca.zone first (one-factor), then the editor shell loads
  • wiki (public, no login): https://wiki.cdsr.loca.zone
• service: cdsr.service (system scope, User=loca)
  • systemctl status cdsr --no-pager
  • sudo -n systemctl restart cdsr
  • health: curl -sf http://127.0.0.1:52224/healthz
• project root: /home/loca/dev/code-server
  • config: config/config.yaml
  • extension pins: config/extensions.lock.json
  • runtime pin: config/runtime-version.txt
  • state: data/user/, data/extensions/

🔐 Auth flow

• Browser → Nginx cdsr.loca.zone:443 → auth_request to Authelia → code-server 127.0.0.1:52224
• Authelia rule: cdsr.loca.zone = one_factor; default policy stays bypass, so the wiki host needs no rule and stays public
• code-server runs auth: none + cert: false on purpose: TLS and identity are terminated in front of it, and it never listens on a public interface

🧩 Extension baseline

Extension	Version	Role
Continue.continue	2.1.0	open-source AI agent, chat, edit, autocomplete
Anthropic.claude-code	2.1.235	first-party Claude Code IDE integration
ms-python.python	2026.4.0	Python language support
ms-python.debugpy	2026.6.0	Python debugger, pinned explicitly
ms-toolsai.jupyter	2025.9.1	notebooks in the browser IDE
ms-azuretools.vscode-containers	2.4.5	Container Tools, successor to the old Docker extension

• install or repair: cd /home/loca/dev/code-server && ./scripts/install-extensions.sh
• audit against the lock file: ./scripts/list-extension-versions.sh
• optional, enterprise-only: sourcegraph.cody-ai 1.155.0 via ./scripts/install-extensions.sh --include-optional
• AI models come from the host LiteLLM gateway (127.0.0.1:52001), not a cloud sign-in; use the free model — see operations/extensions
• a fresh browser profile starts in Restricted Mode and hides every third-party extension until the folder is trusted — see operations/extensions
• details: operations/extensions

⬆️ Upgrade sequence

cd /home/loca/dev/code-server/tmp
curl -fsSL -O https://github.com/coder/code-server/releases/download/v<NEW>/code-server_<NEW>_amd64.deb
sudo -n dpkg -i code-server_<NEW>_amd64.deb
echo "<NEW>" > /home/loca/dev/code-server/config/runtime-version.txt
cd /home/loca/dev/code-server
./scripts/install-extensions.sh
./scripts/list-extension-versions.sh
sudo -n systemctl restart cdsr

Extensions land on disk before the restart, so the restart is what loads them into the extension host; reload the browser window afterwards if a session was open. The currently deployed pin is 4.133.0. Full procedure: operations/install-upgrade.

🔀 Dev server routing

• default: start a dev server on 127.0.0.1:<port>, then open https://cdsr.loca.zone/proxy/<port>/
• path-sensitive frameworks: use https://cdsr.loca.zone/absproxy/<port>/ and set the framework's base path
• pretty per-port subdomains are intentionally not configured; see reference/dev-routing

✅ Do / don't

• do: install extensions only from Open VSX through config/extensions.lock.json
• do: keep the bind address loopback-only and let Nginx own TLS
• do: sign in to AI providers inside the running editor UI
• don't: commit provider tokens, cookies, or extension secrets into this project
• don't: enable the packaged code-server@loca unit; state belongs in data/
• don't: add an Authelia rule for wiki.cdsr.loca.zone; the wiki is public by design

Start here

Need	Page
Understand the deployed shape	architecture/runtime-topology
Install or upgrade the runtime	operations/install-upgrade
Fix auth or TLS	operations/auth-tls
Manage the extension baseline	operations/extensions
Re-run proof checks	operations/verification
Look up a path or port	reference/config-paths
Expose a dev server	reference/dev-routing