92 lines
4.5 KiB
Markdown
92 lines
4.5 KiB
Markdown
---
|
|
title: 💻 Code Server SSOT
|
|
description: Single source of truth for the SSO-gated code-server IDE at cdsr.loca.zone, its pinned extension baseline, and its operations.
|
|
source: verified deployment on the loca operator host, 2026-08-19
|
|
reviewed: 2026-08-19
|
|
---
|
|
|
|
# 💻 Code Server SSOT
|
|
|
|
Browser IDE for user `loca`, reverse-proxied by Nginx, gated by Authelia one-factor login, running loopback-only on `127.0.0.1:52224`. Extensions come from Open VSX and are pinned in a lock file, never installed ad hoc.
|
|
|
|
## 🚀 Quick start
|
|
|
|
- open: https://cdsr.loca.zone
|
|
- login at `auth.loca.zone` first (one-factor), then the editor shell loads
|
|
- wiki (public, no login): https://wiki.cdsr.loca.zone
|
|
- service: `cdsr.service` (system scope, `User=loca`)
|
|
- `systemctl status cdsr --no-pager`
|
|
- `sudo -n systemctl restart cdsr`
|
|
- health: `curl -sf http://127.0.0.1:52224/healthz`
|
|
- project root: `/home/loca/dev/code-server`
|
|
- config: `config/config.yaml`
|
|
- extension pins: `config/extensions.lock.json`
|
|
- runtime pin: `config/runtime-version.txt`
|
|
- state: `data/user/`, `data/extensions/`
|
|
|
|
## 🔐 Auth flow
|
|
|
|
- Browser → Nginx `cdsr.loca.zone:443` → `auth_request` to Authelia → code-server `127.0.0.1:52224`
|
|
- Authelia rule: `cdsr.loca.zone` = `one_factor`; default policy stays `bypass`, so the wiki host needs no rule and stays public
|
|
- code-server runs `auth: none` + `cert: false` on purpose: TLS and identity are terminated in front of it, and it never listens on a public interface
|
|
|
|
## 🧩 Extension baseline
|
|
|
|
| Extension | Version | Role |
|
|
| --- | --- | --- |
|
|
| `Continue.continue` | 2.1.0 | open-source AI agent, chat, edit, autocomplete |
|
|
| `Anthropic.claude-code` | 2.1.235 | first-party Claude Code IDE integration |
|
|
| `ms-python.python` | 2026.4.0 | Python language support |
|
|
| `ms-python.debugpy` | 2026.6.0 | Python debugger, pinned explicitly |
|
|
| `ms-toolsai.jupyter` | 2025.9.1 | notebooks in the browser IDE |
|
|
| `ms-azuretools.vscode-containers` | 2.4.5 | Container Tools, successor to the old Docker extension |
|
|
|
|
- install or repair: `cd /home/loca/dev/code-server && ./scripts/install-extensions.sh`
|
|
- audit against the lock file: `./scripts/list-extension-versions.sh`
|
|
- optional, enterprise-only: `sourcegraph.cody-ai` 1.155.0 via `./scripts/install-extensions.sh --include-optional`
|
|
- AI models come from the host LiteLLM gateway (`127.0.0.1:52001`), not a cloud sign-in; use the `free` model — see [[operations/extensions]]
|
|
- a fresh browser profile starts in Restricted Mode and hides every third-party extension until the folder is trusted — see [[operations/extensions]]
|
|
- details: [[operations/extensions]]
|
|
|
|
## ⬆️ Upgrade sequence
|
|
|
|
```bash
|
|
cd /home/loca/dev/code-server/tmp
|
|
curl -fsSL -O https://github.com/coder/code-server/releases/download/v<NEW>/code-server_<NEW>_amd64.deb
|
|
sudo -n dpkg -i code-server_<NEW>_amd64.deb
|
|
echo "<NEW>" > /home/loca/dev/code-server/config/runtime-version.txt
|
|
cd /home/loca/dev/code-server
|
|
./scripts/install-extensions.sh
|
|
./scripts/list-extension-versions.sh
|
|
sudo -n systemctl restart cdsr
|
|
```
|
|
|
|
Extensions land on disk before the restart, so the restart is what loads them into the extension host; reload the browser window afterwards if a session was open. The currently deployed pin is 4.133.0. Full procedure: [[operations/install-upgrade]].
|
|
|
|
## 🔀 Dev server routing
|
|
|
|
- default: start a dev server on `127.0.0.1:<port>`, then open `https://cdsr.loca.zone/proxy/<port>/`
|
|
- path-sensitive frameworks: use `https://cdsr.loca.zone/absproxy/<port>/` and set the framework's base path
|
|
- pretty per-port subdomains are intentionally not configured; see [[reference/dev-routing]]
|
|
|
|
## ✅ Do / don't
|
|
|
|
- do: install extensions only from Open VSX through `config/extensions.lock.json`
|
|
- do: keep the bind address loopback-only and let Nginx own TLS
|
|
- do: sign in to AI providers inside the running editor UI
|
|
- don't: commit provider tokens, cookies, or extension secrets into this project
|
|
- don't: enable the packaged `code-server@loca` unit; state belongs in `data/`
|
|
- don't: add an Authelia rule for `wiki.cdsr.loca.zone`; the wiki is public by design
|
|
|
|
## Start here
|
|
|
|
| Need | Page |
|
|
| --- | --- |
|
|
| Understand the deployed shape | [[architecture/runtime-topology]] |
|
|
| Install or upgrade the runtime | [[operations/install-upgrade]] |
|
|
| Fix auth or TLS | [[operations/auth-tls]] |
|
|
| Manage the extension baseline | [[operations/extensions]] |
|
|
| Re-run proof checks | [[operations/verification]] |
|
|
| Look up a path or port | [[reference/config-paths]] |
|
|
| Expose a dev server | [[reference/dev-routing]] |
|