Code Server SSOT

2 min read

🧭 Runtime Topology

Request path

flowchart LR
    Browser[Browser] --> Nginx443[Nginx 443\nTLS + security headers]
    Nginx443 --> Authelia[Authelia auth_request\nauth.loca.zone one_factor]
    Authelia --> CodeServer[code-server on 127.0.0.1:52224]
  • Browser → Nginx cdsr.loca.zone:443
    • TLS terminates at Nginx
    • security headers included for app traffic
    • forwards requests to code-server only after auth_request
  • Nginx → Authelia
    • authelia_location and authelia_authrequest snippets included
    • auth_request policy for cdsr.loca.zone is one_factor
    • request allowed only after successful Authelia authentication
  • Authelia → code-server
    • reverse proxy to 127.0.0.1:52224
    • loopback target: bind-addr is not public
    • headers forwarded: Host, X-Real-IP, X-Forwarded-For, X-Forwarded-Proto
    • websocket headers: proxy_http_version 1.1, Upgrade $http_upgrade, Connection $connection_upgrade
    • proxy_read_timeout 86400

Local directory map

  • /home/loca/dev/code-server
    • config/
    • scripts/
    • deploy/
    • data/user/
    • data/extensions/
    • tmp/extensions/
    • q5vault/
  • /etc/systemd/system/cdsr.service
  • /etc/nginx/sites-available/cdsr.loca.zone
  • /etc/letsencrypt/live/cdsr.loca.zone/
  • /home/loca/dev/wikis/cdsr/{content,quartz.config.yaml,current}

Why auth: none and cert: false

  • bind-addr is 127.0.0.1:52224, so code-server never binds a public interface
  • auth: none is correct because Authelia performs edge auth; enabling code-server auth would add a second credential store, break websocket UX, and duplicate login logic
  • cert: false is correct because TLS is terminated at Nginx with a Let’s Encrypt lineage certificate
  • certs are in /etc/letsencrypt/live/cdsr.loca.zone/ for Nginx TLS termination
  • Authelia handles identity at the edge with auth_request before requests enter code-server
  • this is only safe because code-server is loopback-only

Process / state facts

  • system scope unit: cdsr.service
    • User=loca
    • Group=loca
    • Restart=always
    • WorkingDirectory=/home/loca/dev/code-server
  • state lives in /home/loca/dev/code-server/data/user and /home/loca/dev/code-server/data/extensions, not ~/.config/code-server
  • packaged unit code-server@loca is deliberately disabled

Websocket + long-poll requirement

  • Nginx must proxy websocket upgrades for terminal, shell, and extension transport:
    • proxy_http_version 1.1
    • proxy_set_header Upgrade $http_upgrade
    • proxy_set_header Connection $connection_upgrade
  • keep long sessions with proxy_read_timeout 86400