services:
  vscode:
    image: lscr.io/linuxserver/code-server:4.127.0-ls350
    container_name: vscode
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/New_York
      # --- AUTH CHANGE ---
      - AUTH=none            # Tell code-server to skip its own password prompt
      - SUDO_PASSWORD=password 
      - PROXY_DOMAIN=code.castaldifamily.com 
      - DEFAULT_WORKSPACE=/config/workspace 
      - PWA_APPNAME=vscode 
    volumes:
      - /mnt/appdata/vscode/data:/config
    networks:
      - proxy-net
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vscode.entrypoints=websecure"
      - "traefik.http.routers.vscode.rule=Host(`code.castaldifamily.com`)"
      - "traefik.http.routers.vscode.tls=true"
      - "traefik.http.routers.vscode.tls.certresolver=cloudflare"
      - "traefik.http.services.vscode.loadbalancer.server.port=8443"
      # --- THE BOUNCER ---
      - "traefik.http.routers.vscode.middlewares=security-headers@file,authentik-auth@file"

networks:
  proxy-net:
    external: true