📂 Config & Paths Reference

Path & Port Table

Path / Port	Purpose	Owner / Permissions	Notes
config/config.yaml	code-server runtime config	loca:loca 644	Effective config shown below
config/extensions.lock.json	pinned extension versions + VSIX metadata	loca:loca 644	Baseline + optional entries
config/runtime-version.txt	upstream code-server version pin	loca:loca 644	Content: 4.133.0
scripts/install-extensions.sh	installs baseline from lock file	loca:loca 755	Reads config/extensions.lock.json, verifies sha256, --include-optional for optional entries
scripts/list-extension-versions.sh	audits installed vs lock file	loca:loca 755	Exits non-zero on MISSING/MISMATCH
deploy/cdsr.service	systemd unit source	loca:loca 644	Installed to /etc/systemd/system/cdsr.service
deploy/cdsr.nginx.conf	nginx site config source	loca:loca 644	Installed to /etc/nginx/sites-available/cdsr.loca.zone
data/user/	code-server user data dir	loca:loca 755	Set via user-data-dir
data/user/User/settings.json	VS Code settings (telemetry off, auto-update off)	loca:loca 644	Seeded at deploy
data/extensions/	installed extensions dir	loca:loca 755	Set via extensions-dir
tmp/extensions/	VSIX download cache	loca:loca 755	Filenames <id>-<version>@<platform>.vsix
q5vault/	Quartz wiki vault (real content)	loca:loca 755	Symlinked as /home/loca/dev/wikis/cdsr/content
quartz.config.cdsr.yaml	Quartz config for this wiki	loca:loca 644	Symlinked as /home/loca/dev/wikis/cdsr/quartz.config.yaml
/etc/systemd/system/cdsr.service	installed systemd unit	root:root 644	Requires sudo -n install for edits; enable/start via systemctl
/etc/nginx/sites-available/cdsr.loca.zone	installed nginx site	root:root 644	Requires sudo -n install for edits; symlinked into sites-enabled
/etc/nginx/sites-enabled/cdsr.loca.zone	symlink to sites-available	root:root 755	Created by ln -sf
/etc/nginx/snippets/security-headers-app.conf	security headers for app host	root:root 644	Included in app 443 block
/etc/nginx/snippets/security-headers.conf	security headers for wiki host	root:root 644	Included in wiki 443 block
/etc/nginx/snippets/authelia-location.conf	Authelia location config	root:root 644	Included in app 443 block
/etc/nginx/snippets/authelia-authrequest.conf	auth_request to Authelia	root:root 644	Protects app location /
/etc/letsencrypt/live/cdsr.loca.zone/	TLS cert lineage	root:root 700 dir, 600 files	fullchain.pem, privkey.pem; expires 2026-11-17
/home/loca/dev/services/authelia/config/configuration.yml	Authelia config	root:root 644	Requires sudo -n install after staging in /tmp; rule cdsr.loca.zone = one_factor
/home/loca/dev/wikis/cdsr/content	symlink → q5vault/	loca:loca symlink	Wiki build source
/home/loca/dev/wikis/cdsr/quartz.config.yaml	symlink → quartz.config.cdsr.yaml	loca:loca symlink	Wiki build config
/home/loca/dev/wikis/cdsr/current	symlink → latest dist-* build	loca:loca symlink	Nginx root points here
/usr/bin/code-server	upstream binary (Debian package)	root:root 755	Installed via dpkg -i from GitHub release v4.133.0
/usr/lib/code-server	upstream libs (Node, extensions host)	root:root 755	Package-managed, do not modify

Loopback Port & Range

• 127.0.0.1:52224 — code-server bind address (chosen inside mandatory 51000-53000 loopback range for loca.zone app backends)
• Health endpoint: http://127.0.0.1:52224/healthz — always HTTP 200 while the server is up; body is {"status":"expired","lastHeartbeat":0} when no editor session is connected (healthy-idle) and {"status":"alive",...} while a browser session is connected. Only a non-200 or no response indicates failure; HTTP 200 from / also proves liveness

Effective config/config.yaml

bind-addr: 127.0.0.1:52224
auth: none
cert: false
app-name: Code Server · loca.zone
user-data-dir: /home/loca/dev/code-server/data/user
extensions-dir: /home/loca/dev/code-server/data/extensions
disable-telemetry: true

Root-Owned Files Requiring sudo -n install

• /etc/systemd/system/cdsr.service
• /etc/nginx/sites-available/cdsr.loca.zone
• /etc/nginx/snippets/security-headers-app.conf
• /etc/nginx/snippets/security-headers.conf
• /etc/nginx/snippets/authelia-location.conf
• /etc/nginx/snippets/authelia-authrequest.conf
• /home/loca/dev/services/authelia/config/configuration.yml

Edit workflow: stage in /tmp, then sudo -n install -m 644 -o root -g root /tmp/<file> /target/path.