Recommended Free Tools
Self-hosting code-server on a VPS gives you a browser-based development environment you control. Install it under a regular Linux user, keep its listener on 127.0.0.1:8080, and choose either an SSH tunnel for private access or an authenticated HTTPS reverse proxy for a public URL. A public deployment also needs a domain, TLS certificate, firewall rules, and end-to-end WebSocket support.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The official requirements guidance recommends at least 1 GB of RAM and two CPU cores, with WebSockets available. Treat that as a vendor baseline rather than a performance guarantee: extensions, language servers, terminals, and concurrent workspaces can require more capacity.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How the deployment works
code-server runs the VS Code experience as a service on your VPS. Your browser connects to that service, while the VPS provides the CPU, memory, storage, operating-system access, terminal, extensions, and project files.
Private access with SSH
The safest default for one administrator is to bind code-server to localhost and forward the port through SSH. Nothing needs to listen publicly for the IDE itself; the only Internet-facing service is SSH.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Public access with HTTPS
For a convenient URL, place Caddy or NGINX in front of code-server. The proxy terminates TLS, handles the public hostname, and forwards requests and WebSocket upgrades to 127.0.0.1:8080. Keep code-server’s own authentication enabled unless you have deliberately designed and documented a complete external identity boundary.
“Never expose code-server directly to the internet without some form of authentication and encryption, otherwise someone can take over your machine via the terminal.”
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
VPS requirements and sizing
| Requirement | What to plan for | Qualification |
|---|---|---|
| Memory | At least 1 GB RAM | Official recommendation; not an independently benchmarked guarantee. |
| CPU | At least 2 CPU cores | Official recommendation; heavier builds and language servers may need more. |
| Operating system | A supported Linux distribution, such as Debian or Ubuntu | The worked example uses a Debian VM; other supported package and image options are documented. |
| Network | WebSockets must work end to end | Check the VPS firewall, reverse proxy, and any upstream network policy. |
| Public deployment | A domain name and TLS certificate | The official guidance recommends an external domain and a service such as Let’s Encrypt for HTTPS. |
| Storage | Enough for the operating system, repositories, extensions, build artifacts, and backups | No universal disk figure is stated; size it from your projects and retention policy. |
| Version control | Record the installed code-server version during every change | The reviewed official pages did not state a stable current version number. |
When the baseline is not enough
The 1 GB/two-core recommendation is a starting point, not a promise that every project will feel responsive. A large repository, several language servers, a browser-based build, or multiple simultaneous users can consume memory and CPU quickly. Start with the documented baseline for a light single-user workspace, then watch memory pressure, swap activity, CPU saturation, disk usage, and service logs before increasing the VPS size.
Choose an exposure pattern
| Pattern | Exposure surface | Identity control | Certificate work | Best fit |
|---|---|---|---|---|
| SSH port forwarding | SSH only; code-server remains on localhost | SSH keys plus code-server login | None for the forwarded localhost connection | One user, administrators, and the smallest attack surface |
| Caddy reverse proxy | Public HTTPS endpoint | code-server password, optionally an upstream identity layer | Automated HTTPS through Caddy and Let’s Encrypt integration | A simple public hostname with low certificate maintenance |
| NGINX reverse proxy | Public HTTPS endpoint | code-server password, optionally an upstream identity layer | Managed by your NGINX and certificate workflow | Teams already standardised on NGINX |
| Self-signed certificate | Public or private endpoint, depending on firewall rules | code-server password or another identity layer | Manual certificate generation and client trust management | Controlled environments where every client can trust your certificate |
| External authentication proxy | Public HTTPS endpoint | Pomerium, oauth2-proxy, Cloudflare Access, or another identity layer in front of code-server | Handled by the proxy or its TLS integration | Multiple users, central policy, or single sign-on requirements |
Do not combine a public listener with an assumption that a network firewall is sufficient. The proxy, TLS layer, authentication, and code-server service must all be configured as one trust boundary.
Prepare the VPS before installation
- Create a regular administrative account. Use a dedicated non-root user for the IDE and administrative work. Keep the VPS provider’s recovery method available in case an account or firewall change locks you out.
- Use SSH keys. Install your public key for administration and verify a second session before changing access rules.
- Apply operating-system updates. Reboot when the distribution requires it, then confirm that SSH still works.
- Set the firewall policy. Allow SSH and, for a public HTTPS design, the HTTPS port required by the proxy and certificate workflow. Do not allow the code-server port directly from the Internet.
- Choose a hostname early. For public access, point your DNS record to the VPS before requesting a certificate. Decide whether you need only one hostname or separate names for administration and development.
- Plan backups. Identify project directories,
~/.config/code-server/, proxy configuration, and any certificate state that must be recoverable.
Install code-server
The official installation documentation lists several supported paths. Select one that matches your distribution and how you intend to maintain updates.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Official installation script
The Linux installation script can be previewed with its --dry-run option. Run the dry run first to see the package-manager actions and service setup, inspect the output, and then run the same official command without --dry-run. Keep the script output in your change record so you know which repository or package source was used.
Distribution packages
Debian and Ubuntu packages are documented, as are packages for Fedora, CentOS, RHEL, and SUSE. Arch/AUR packages, Docker, Helm, standalone release archives, cloud-provider integrations, and one-click applications are also listed as supported methods. Use one installation method consistently on a given host; mixing a release archive with a distribution package makes upgrades and service ownership harder to audit.
Enable the per-user service
For a Debian or Ubuntu package installation, the documented service command is:
systemctl enable --now code-server@$USERRun it as the intended user, with the appropriate administrative privilege mechanism if your package requires one. Then check the unit state and recent logs:
systemctl status code-server@$USER
journalctl -u code-server@$USER --no-pagerRecord the version reported by the installed binary after installation. The official pages reviewed for this guide did not provide a stable version number that can be treated as current indefinitely.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Configure the local code-server service
The generated configuration is normally at ~/.config/code-server/config.yaml. The default design binds to 127.0.0.1:8080, enables password authentication, and leaves TLS disabled. That is appropriate when SSH carries the connection or when a local reverse proxy terminates HTTPS.
bind-addr: 127.0.0.1:8080
auth: password
cert: falseDo not change bind-addr to 0.0.0.0 merely to make a proxy work. A reverse proxy on the same VPS can reach the loopback address, and SSH forwarding can reach it as well. A public bind unnecessarily exposes the application to every interface and increases the consequences of an authentication or TLS mistake.
Protect the configuration file and any credentials it contains with normal user and filesystem permissions. If you change the listening address, port, or authentication settings, restart the per-user service and confirm the new state before proceeding.
Option A: use an SSH tunnel
This option avoids a public web endpoint and is usually the least complex secure design for one person.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- Confirm code-server is running on the VPS and listening on
127.0.0.1:8080. - From your workstation, create a local forward:
ssh -N -L 8080:127.0.0.1:8080 user@your-vps-host- Keep that SSH session open. Open
http://127.0.0.1:8080in your local browser and enter the code-server password. - When finished, close the SSH session. The tunnel disappears, but the VPS service remains available for the next connection.
The local port can be changed if another application already uses 8080; only the first number in the -L argument and the browser address need to match. The destination remains the VPS loopback address and code-server port.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
SSH tunnel limitations
- Every client needs SSH access and a working tunnel command.
- Closing or losing the SSH connection interrupts the browser session until the tunnel is recreated.
- It is less convenient for a team or for a mobile browser than a managed HTTPS hostname.
Option B: Caddy with automatic HTTPS
Caddy is a practical choice when you want a public hostname with automated certificate handling. The VPS must resolve the hostname to the server, and the firewall and certificate-validation path must allow the traffic required by your chosen setup.
- Create a DNS record such as
ide.example.comthat points to the VPS address. - Install Caddy using the method appropriate for your distribution and run it as a service.
- Keep code-server bound to
127.0.0.1:8080. - Add a site block that proxies the hostname to the local service:
ide.example.com {
reverse_proxy 127.0.0.1:8080
}- Reload Caddy and inspect its logs for certificate issuance and upstream errors.
- Open the final HTTPS hostname, complete the code-server login, and test a terminal and workspace before declaring the setup complete.
Caddy handles WebSocket proxying in its normal reverse-proxy flow, but you still need to test an interactive terminal, extension installation, and a reconnect. A page that loads while WebSockets fail is not a working IDE.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Option C: NGINX with HTTPS
NGINX works well when it is already your organisation’s standard reverse proxy. Terminate TLS at NGINX and forward the request to localhost. The upgrade headers are essential for the WebSocket connection used by the IDE.
server {
listen 443 ssl;
server_name ide.example.com;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}Use your existing NGINX certificate and key management process, or integrate a Let’s Encrypt workflow. The documented proxy_set_header Host $host setting makes the address shown inside code-server reflect the public hostname instead of the internal upstream address.
- Point DNS at the VPS and install the certificate for the exact hostname.
- Place the proxy configuration in the distribution’s enabled-server configuration and validate the NGINX syntax.
- Reload NGINX without stopping the service.
- Test login, terminal input, workspace loading, extension installation, and a browser refresh. Watch NGINX and code-server logs during each test.
Authentication and identity choices
Built-in password authentication
The default configuration uses password authentication. It is suitable for a private SSH-tunnel deployment and can be part of a public HTTPS deployment when the password is long, unique, and stored through your normal secret-management practice.
External identity in front of code-server
Pomerium, oauth2-proxy, Cloudflare Access, or another access proxy can add an identity layer, policy checks, and single sign-on. Put that layer behind HTTPS and in front of code-server. Decide which system owns session expiry, group membership, logout, and emergency access.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not disable code-server authentication casually. If you remove it, document exactly which upstream component authenticates every request, how direct access to the upstream is blocked, and how a misconfigured proxy is detected. The loopback bind is an important backstop even when external authentication is enabled.
Self-signed certificates
code-server can generate or use a certificate directly, but every client must trust that certificate. Self-signed deployments create operational work: distributing trust, rotating certificates, handling hostname mismatches, and avoiding browser warnings. They are better suited to controlled networks than to a general public endpoint.
Verify the deployment end to end
Run these checks from the client perspective, not only from the VPS shell:
- Address: The browser uses the intended HTTPS hostname, or the local address created by the SSH tunnel.
- Certificate: The browser reports a valid certificate for the exact public hostname, with no warning or unexpected issuer.
- Login: The authentication prompt appears and rejects an incorrect credential.
- Workspace: A repository opens, files can be edited, and changes persist after a refresh.
- Terminal: A terminal opens, accepts input, and returns output. This is a direct WebSocket test.
- Extensions: Install or update an extension and confirm that the operation survives a reconnect.
- Reconnect: Restart the browser or briefly interrupt the network, then verify that the session recovers as designed.
- Restart persistence: Restart the code-server service and confirm that it returns automatically through the enabled per-user unit.
- Exposure: From an unrelated network, verify that the code-server port is not directly reachable when it should be loopback-only.
Operate, update, and back up the VPS
Routine maintenance
- Apply operating-system security updates on a repeatable schedule.
- Update code-server through the same installation method used originally.
- Record the old and new versions, configuration changes, restart time, and verification results.
- Review service and proxy logs after upgrades, especially for authentication failures, certificate errors, and WebSocket disconnects.
- Monitor memory, CPU, disk capacity, and process restarts. A full disk can break extensions, logs, builds, and certificate renewal.
Backups
Back up project data separately from the VPS when the work is valuable. Include ~/.config/code-server/config.yaml, proxy configuration, deployment notes, and any certificate or identity-provider state that is needed for recovery. Test restoring a small project and rebuilding the service configuration; an untested backup is only an assumption.
Change control
Keep a short record of the VPS operating-system release, code-server version, service unit, bind address, public hostname, proxy type, authentication boundary, open firewall ports, and backup location. This turns an otherwise personal server into a maintainable system that another administrator can understand.
Troubleshoot common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Browser cannot connect through SSH | The service is stopped, the tunnel points to the wrong port, or the local port is already occupied. | Check systemctl status code-server@$USER, verify the configured bind address and port, and choose a free local forwarding port. |
| Proxy returns 502 or 504 | NGINX or Caddy cannot reach the upstream service. | Confirm code-server is listening on 127.0.0.1:8080, inspect proxy logs, and verify the upstream address exactly. |
| Editor loads but terminal or extensions fail | WebSocket upgrade headers are missing or blocked. | Check NGINX Upgrade, Connection, and HTTP/1.1 settings; test the proxy path and inspect browser and server logs. |
| Public URL shows the wrong internal address | The proxy is not preserving the host header. | In NGINX, set proxy_set_header Host $host; then reload and reconnect. |
| Certificate warning | The certificate is self-signed, expired, issued for another hostname, or not trusted by the client. | Check the hostname, certificate chain, renewal logs, and client trust store. |
| Password prompt loops | Cookies, proxy headers, or an upstream identity layer are inconsistent. | Test in a private browser window, verify HTTPS and host preservation, and ensure only the intended component controls authentication. |
| Service fails after reboot | The per-user unit was not enabled, the user environment changed, or configuration is invalid. | Run the status and journal commands, validate config.yaml, and confirm systemctl enable --now code-server@$USER was run for the correct user. |
| VPS becomes unresponsive | Memory, CPU, or disk capacity is exhausted. | Inspect resource metrics and logs, stop unnecessary workloads, remove safe temporary data, and move to a larger VPS if the workload exceeds the baseline. |
Which design should you choose?
- Choose SSH forwarding when one person needs administrative access and the IDE should never have a public web endpoint.
- Choose Caddy when you want a straightforward public hostname and automated certificate handling.
- Choose NGINX when your team already operates NGINX and has an established TLS renewal process.
- Add an external identity proxy when several people need controlled access, central sign-on, or policy-based authorization.
- Use a self-signed certificate only when you can distribute and maintain client trust deliberately.
Regardless of the choice, keep code-server private on the VPS, require authentication and encryption, preserve WebSocket upgrades, restrict firewall exposure, and verify the complete browser-to-terminal path after every configuration or version change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
