Code-server

**Essential Configuration:**

1. **Config File (~/.config/code-server/config.yaml):**
```yaml
bind-addr: 0.0.0.0:8080
auth: password
password: secure_password_here
cert: false
proxy-domain: code.yourdomain.com
```

2. **Authentication Methods:**
```bash
# Password authentication (default)
auth: password
password: your_password

# Disable authentication (dangerous, use with reverse proxy auth)
auth: none

# Use hashed password
hashed-password: "$argon2i$v=19$m=4096,t=3,p=1$..."
```

3. **Environment Variables:**
```bash
# Set password via env
export PASSWORD="your_password"

# Disable telemetry
export TELEMETRY_LEVEL="off"

# Custom extensions directory
export EXTENSIONS_GALLERY='{"serviceUrl": "https://open-vsx.org/vscode/gallery"}'
```

4. **Port Forwarding Configuration:**
```bash
# Forward local dev server to public URL
# In code-server terminal:
npm run dev # Starts on localhost:3000

# code-server automatically detects and offers to forward
# Access at: https://code.yourdomain.com/proxy/3000/
```

5. **Extensions Configuration:**
```bash
# Install from marketplace
code-server --install-extension publisher.extension-name

# Install from VSIX
code-server --install-extension /path/to/extension.vsix

# List installed extensions
code-server --list-extensions

# Uninstall extension
code-server --uninstall-extension publisher.extension-name
```

6. **Settings Sync:**
```json
// settings.json location: ~/.local/share/code-server/User/settings.json
{
"workbench.colorTheme": "Default Dark+",
"editor.fontSize": 14,
"editor.formatOnSave": true,
"files.autoSave": "afterDelay",
"terminal.integrated.shell.linux": "/bin/bash"
}
```

7. **Multi-User Setup:**
```bash
# Create service for user1
sudo systemctl enable --now code-server@user1

# Create service for user2
sudo systemctl enable --now code-server@user2

# Each user gets own config in their home directory
# ~/.config/code-server/config.yaml
```

8. **Security Hardening:**
```bash
# Limit network access
bind-addr: 127.0.0.1:8080 # Only localhost

# Use strong password (20+ chars)
password: $(openssl rand -base64 32)

# Enable HTTPS on reverse proxy
# Use fail2ban for brute force protection
sudo apt install fail2ban

# Configure fail2ban for code-server
sudo nano /etc/fail2ban/jail.local
```

Add:
```ini
[nginx-code-server]
enabled = true
port = 80,443
filter = nginx-code-server
logpath = /var/log/nginx/access.log
maxretry = 3
bantime = 3600
```

9. **Performance Tuning:**
```yaml
# Increase file watcher limit
echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# Disable telemetry
export TELEMETRY_LEVEL=off

# Use faster protocol
# In settings.json:
{
"terminal.integrated.rendererType": "dom"
}
```

10. **Backup and Migration:**
```bash
# Backup user data
tar -czf code-server-backup.tar.gz \
~/.local/share/code-server \
~/.config/code-server

# Restore on new server
tar -xzf code-server-backup.tar.gz -C ~
```

**Best Practices:**
- Use reverse proxy (Nginx/Caddy) for SSL termination
- Enable automatic HTTPS with Let's Encrypt
- Set strong passwords (20+ characters)
- Regularly update code-server: `curl -fsSL https://code-server.dev/install.sh | sh`
- Mount projects directory separately for easy backup
- Use systemd for automatic restart on failure
- Configure rate limiting on reverse proxy
- Enable fail2ban for brute force protection
- Use OAuth2 proxy for SSO integration
- Separate dev/staging/prod instances per user/team
- Monitor logs: `journalctl -u code-server@$USER -f`
- Set up automated backups of user data and config