how to run code-server behind cloudflare and nginx

I can’t find any documentation on how to run code-server behind an https url without using ssl on code-server.

I can’t figure out for the life of me how to have code-server answering to a certain https domain with the ssl certification handled by another system. Probably I’m not experienced enough and there is a very simple way to achieve this, but I fail no matter what I try. (is there a code-server documentation effort somewhere?)

Here is my scenario:

• I want to run code-server on c.begiter.net.
• I have code-server installed (not docker) on my server.
• begiter.net DNS, and HTTPS is managed by CloudFlare.
• I have nginx installed on my server, with multiple sub-domains registered. None of them employ ssl since that part is handled by CloudFlare.
• c.begiter.net is proxied to localhost:9999, which runs code-server.

If I access with IP (and self-signed certificate - https://IP:9999), everything works fine on the desktop. On my iPad, after the password screen, websocket upgrades fail with 1006. I tried with Safari, Firefox, Chrome, Yandex, and Aloha browsers. I got Chrome to dump errors to Javascript console and the gist of it is http upgrade fails with code 1006 (which apparently is a browser-related error code, not something you can fix on the server).

Accessing with c.begiter.net fails with a white screen of death, with nginx reporting “upstream error”. Meaning, code-server on localhost:9999 does not respond to requests - my guess, since they are to https://c.begiter.net but CloudFlare sends http:// requests to my server.

I can’t figure out what command line parameters to use for code-server. Here is my current command line: /home/necmettin/editor/code-server --port 9999 --user-data-dir /home/necmettin/editor/user-data --extensions-dir /home/necmettin/editor/extension-data --auth password --disable-ssh --host 213.159.29.172 --cert /home/necmettin/editor/cert/editor.crt --cert-key /home/necmettin/editor/cert/editor.key

And here is my nginx proxy setup (for Location / or c.begiter.net):

proxy_pass http://unix:/tmp/editor.sock;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Accept-Encoding gzip;
proxy_set_header Host $host;

What am I doing wrong? What is the correct way to do this? Please advise.

[nhooyr]

You cannot proxy to localhost:9999. localhost is only accessible locally, you need to make code-server listen on your servers public IP and proxy Cloudflare to that.

[cmoog]

We’re making it easier to access your code-server instance securely from any device. We’ve eliminated the need for configuring TLS, domain registration, DNS, DoS protect, and authentication. To gain pre-release access, please consider joining our alpha program.

cc @necmettin @TomaruDev @HPaulson