Code Server SSOT

4 min read

✅ Verification checklist

Run in order. Each step must produce the expected output before proceeding.

1. systemd service

systemctl status cdsr --no-pager

Expected: Active: active (running) with Main PID present.

2. code-server loopback health

curl -sf http://127.0.0.1:52224/healthz

Expected (no editor session): JSON {"status":"expired","lastHeartbeat":0} Expected (with browser session connected): JSON {"status":"alive",...}

curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:52224/

Expected: 200

3. app host requires Authelia

curl -sSI https://cdsr.loca.zone/

Expected: HTTP/1.1 302 with Location: https://auth.loca.zone/?rd=https%3A%2F%2Fcdsr.loca.zone%2F&rm=HEAD (or equivalent redirect into Authelia).

4. wiki host is public

curl -sSI https://wiki.cdsr.loca.zone/

Expected: HTTP/1.1 200 with Content-Type: text/html and no Location header pointing to auth.loca.zone.

5. Authelia config valid and container up

cd /home/loca/dev/services/authelia && sudo -n docker compose config

Expected: clean YAML output, no errors.

cd /home/loca/dev/services/authelia && sudo -n docker compose ps

Expected: authelia container Up (healthy).

6. extension baseline audit

cd /home/loca/dev/code-server && ./scripts/list-extension-versions.sh

Expected:

ok       Continue.continue@2.1.0
ok       Anthropic.claude-code@2.1.235
ok       ms-python.python@2026.4.0
ok       ms-python.debugpy@2026.6.0
ok       ms-toolsai.jupyter@2025.9.1
ok       ms-azuretools.vscode-containers@2.4.5

Exit code: 0

7. browser smoke (manual)

  1. Open https://cdsr.loca.zone in a browser.
  2. Complete Authelia one-factor login at auth.loca.zone.
  3. Confirm code-server editor shell loads (activity bar, file explorer, terminals).
  4. Open Extensions view (Ctrl+Shift+X): verify Continue and Claude Code are installed and enabled.
  5. Open integrated terminal (Ctrl+): run whoami-> outputloca`.

8. dev-routing smoke (manual)

  1. In the integrated terminal from step 7, run: 
    python3 -m http.server 52325 --bind 127.0.0.1
  2. In the browser, open https://cdsr.loca.zone/proxy/52325/
  3. Expected: directory listing or test page renders through code-server’s built-in proxy.

9. wiki build smoke

cd /home/loca/dev/wikis && ./build.sh cdsr

Expected: build completes, emits current -> dist-<timestamp> symlink. A git warning about the vault not being a git repository is normal and expected.

Then open https://wiki.cdsr.loca.zone/:

  • quick-start page renders
  • internal wikilinks resolve (e.g. [[operations/extensions]], [[architecture/runtime-topology]])
  • footer links point to https://cdsr.loca.zone and https://loca.zone

Pre-publish wiki lint gate

Run before every build.sh invocation, so ahead of step 9 above. This is a gate, not a smoke test: a non-zero exit means nothing gets published.

python3 /home/loca/dev/wikis/lint-vault.py /home/loca/dev/code-server/q5vault

Expected: 11 pages, 0 findings, all 5 checks clean and exit code 0.

  • --quiet suppresses the clean summary so only failures print, which is the form to use in a wrapper
  • the vault may be named instead of pathed: python3 /home/loca/dev/wikis/lint-vault.py cdsr resolves /home/loca/dev/wikis/cdsr/content, the symlink into this vault
  • why it exists: a frontmatter description: whose value held an unquoted colon-space made the Quartz note-properties transformer fail its YAML parse, and esbuild then died with a Go all goroutines are asleep - deadlock! panic instead of a readable error. One unquoted colon cost a whole build with no usable diagnostic
  • it complements scripts/validate-ssot.py, which build.sh runs itself: that validator only gates wikis shipping a wiki-ia.json manifest, and this wiki ships none, so its SSOT Validation passed line is a vacuous pass here and this linter is the only real pre-publish gate on the vault
  • check 1, frontmatter scalars: unquoted values containing a colon-space, starting with #, @, *, &, !, % or a backtick, ending in a colon, carrying an inline # comment that would silently truncate the value, or holding an unterminated quote. Reported as file:line plus the offending key
  • check 2, wikilinks in tables: an unescaped | inside [[...]] on a table row splits the cell, and an alias containing / is truncated at the slash when rendered
  • check 3, dead wikilinks: every target must resolve to a real .md in the vault, tried vault-root-relative first and then relative to the linking page, tolerating a leading ./ and an optional #anchor
  • check 4, house style: no markdown bold anywhere
  • check 5, page shape: no second H1 in one file, and no page without a frontmatter block
  • checks 2 to 5 ignore fenced blocks and inline code spans, because nothing in those regions renders as markdown, so the example wikilinks in step 9 above are not treated as links
  • standard library only, so it runs on any host with python3 and needs no pyyaml

Note: the git-repository warning from build.sh is normal — the vault is a plain directory, not a git repo.