Self-Hosting Remote VSCode with Cloudflare Tunnel and Authentik SSO

Working remotely on lab projects meant a VPN or SSH keys on every device. code-server fixed that — full VS Code in a browser tab, locked behind Google SSO, running 24/7 on the Mac Mini. Here's how it works. What's in the stack code-server by Coder — VS Code in the browser, packaged as a Docker image by LinuxServer.io Cloudflare Tunnel — outbound-only tunnel, no open ports on the router Authentik by Authentik Security — self-hosted SSO with Google OAuth2 Nginx Proxy Manager by jc21 — reverse proxy that enforces forward auth on every request Why not just use SSH? SSH works, but requires a client and keys on every device, and you lose the full editor experience. code-server gives you extensions, an integrated terminal, and Claude Code in any modern browser. Once it's running and proxied, it works on iPad just as well as a laptop. How the auth flow works Every request to code.yourdomain.com goes through this chain: Browser → Cloudflare Tunnel Edge → Nginx Proxy Manager → Authentik outpost