Add app: code-server (VS Code in the browser)

[pofallon]

Add code-server (coder/code-server) — full VS Code running in the browser — to the catalog.

Components

• single code-server container

Hola packaging notes

• Pinned image, expose only, data under ${HOLA_APP_DATA}:
  • /home/coder (settings, extensions) and a workspace/projects dir.
  • honor PUID/PGID/TZ (linuxserver image) or run as the coder user.
• Ingress: port 8080. code-server uses websockets — confirm Traefik passes them. If served under a path, set the base path / --abs-proxy-base-path; cleanest is its own subdomain.
• Auth — important: code-server is a remote code-execution environment; it must not be exposed unauthenticated. It has no native OIDC, so use forward-auth (the Authentik gate in front) and disable its built-in password (AUTH=none behind the gate, or keep the password as defense-in-depth). Do not ship it open.

Security notes (call out in the README)

• Anyone who reaches it gets a shell as the container user → keep the forward-auth gate mandatory and restrict to hola-admins if possible.
• Do not mount the Docker socket or run privileged by default. If "deploy from inside code-server" is ever wanted, that's a separate, explicitly-opted-in capability — not the default.

Open questions

• Base image: official codercom/code-server vs linuxserver/code-server (PUID/PGID, easier perms).
• Default workspace layout / which dir is the persisted project root.
• Bundle common toolchains (node/python) or keep it minimal?

How to add it (see repo README)

1. ./bin/create-package.sh code-server → edit src/code-server/src/{compose.yaml,manifest.json} (manifest auth.mode: forward-auth).
2. Add icons/code-server.svg.
3. ./bin/push-oci-package.sh code-server then ./bin/build-catalog.sh.

Acceptance

• Installs, healthy at https://code.<base>, reachable only through the Authentik forward-auth gate, the editor + terminal work (websockets), and settings/projects persist across a restart.

🤖 Generated with Claude Code