Code-Server Code-Server

[SSO] Visual Studio Code

Code-server is VS Code running on a remote server, accessible through the browser.

Links:

Alternative: OpenVSCode Server

Authentik ForwardAuth

Authentik ForwardAuth limits browser access to code-server to Authentik’s developers group. Every authorized user reaches the same container, workspace, repositories, and mounted SSH material; this is not a multi-user authorization boundary.

Setup

scripts/authentik-apps.py --application code-server --apply
scripts/labctl.py service recreate dev/code-server

Keep localaccess-authentik@file on the router and keep the service reachable only through Traefik’s dev-code-server network. Set PASSWORD or HASHED_PASSWORD temporarily only when local recovery is necessary.

Verify

Confirm authorized access, non-member denial, logout, session-refresh group revocation, WebSocket/editor functionality, recovery, and absence of a direct browser route.

name: code-server
services:
  code-server:
    image: lscr.io/linuxserver/code-server:4.139.1
    container_name: code-server
    hostname: code-server
    restart: unless-stopped
    environment:
      PUID: ${PUID}
      PGID: ${PGID}
      TZ: ${TIMEZONE}
      PASSWORD: # optional
      HASHED_PASSWORD: # optional
      SUDO_PASSWORD: ${ADMIN_PASSWORD} # optional
      SUDO_PASSWORD_HASH:  # optional
      PROXY_DOMAIN: code.${MYDOMAIN} # optional
      DEFAULT_WORKSPACE: /config/workspace # optional
    volumes:
      - ${DOCKER_VOLUMES}/code-server:/config
      - ${ADMIN_HOME}/repos:/config/repos
      - ${ADMIN_HOME}/.ssh:/config/.ssh
    networks:
      - dev-code-server
    labels:
      traefik.enable: true
      traefik.docker.network: dev-code-server
      traefik.http.routers.code.middlewares: localaccess-authentik@file
      traefik.http.routers.code.rule: Host(`code.${MYDOMAIN}`)
      traefik.http.services.code.loadbalancer.server.port: 8443
      homepage.group: Development
      homepage.name: Code-Server
      homepage.icon: code.png
      homepage.href: https://code.${MYDOMAIN}/
      homepage.description: "[SSO] Visual Studio Code"

networks:
  dev-code-server:
    external: true