配置
tailscale
sudo tailscale funnel --bg <oauth2-proxy端口>
oauth2-proxy
国内没有个人免费的oidc provider，所以我建议用github就行（我试过gitee等，但它们只支持oauth2授权，不支持oidc登录）
保存以下配置到 ~/.config/oauth2-proxy/oauth2-proxy.toml ，需要配置TODO行
## OAuth2 Proxy Config File https://github.com/oauth2-proxy/oauth2-proxy
provider = "github"github_users = ["你的github用户名"] # TODO 必须，否则任何github账号都可授权通过## the OAuth Redirect URL. defaults to the "https://" + requested host header + "/oauth2/callback"
redirect_url = "https://TODO.ts.net/oauth2/callback" # TODO# oidc_issuer_url = "https://gitee.com/oauth/authorize" # 失败的尝试……因为gitee不支持oidc登录，只支持oauth2授权## Email Domains to allow authentication for (this authorizes any email on this domain)
## for more granular authorization use `authenticated_emails_file`
## To authorize any email addresses use "*"
email_domains = ["*",
]# skip_provider_button = true## The OAuth Client ID, Secret
client_id = "TODO" # TODO 在 https://github.com/settings/developers 添加oauth app并生成对应id,secret
client_secret = "TODO"## Scopes Added to the request
## It has the same behavior as the --scope flag
scope = "read:org user:email"## <addr>:<port> to listen on for HTTP/HTTPS clients
http_address = "127.0.0.1:<oauth2-proxy端口>" # TODO
# https_address = ":443"## the http url(s) of the upstream endpoint. If multiple, routing is based on path
upstreams = ["http://localhost:<code-server端口>/", # TODO
]## Are we running behind a reverse proxy? Will not accept headers like X-Real-Ip unless this is set.
reverse_proxy = true## Cookie Settings
## Name - the cookie name
## Secret - the seed string for secure cookies; should be 16, 24, or 32 bytes
## for use with an AES cipher when cookie_refresh or pass_access_token
## is set
## Domain - (optional) cookie domain to force cookies to (ie: .yourcompany.com)
## Expire - (duration) expire timeframe for cookie
## Refresh - (duration) refresh the cookie when duration has elapsed after cookie was initially set.
## Should be less than cookie_expire; set to 0 to disable.
## On refresh, OAuth token is re-validated.
## (ie: 1h means tokens are refreshed on request 1hr+ after it was set)
## Secure - secure cookies are only sent by the browser of a HTTPS connection (recommended)
## HttpOnly - httponly cookies are not readable by javascript (recommended)
# cookie_name = "_oauth2_proxy"
cookie_secret = "TODO" # TODO 用 `openssl rand -base64 24` 命令生成32个字符
# cookie_domains = ""
# cookie_expire = "168h"
# cookie_refresh = ""
cookie_httponly = true
cookie_secure = true # https true; http false## TLS Settings
# tls_cert_file = ""
# tls_key_file = ""## Logging configuration
#logging_filename = ""
#logging_max_size = 100
#logging_max_age = 7
#logging_local_time = true
#logging_compress = false
#standard_logging = true
#standard_logging_format = "[{{.Timestamp}}] [{{.File}}] {{.Message}}"
#request_logging = true
#request_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}"
#auth_logging = true
#auth_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}"## pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
# pass_basic_auth = false # true
# pass_user_headers = true
## pass the request Host Header to upstream
## when disabled the upstream Host is used as the Host Header
pass_host_header = true## Pass OAuth Access token to upstream via "X-Forwarded-Access-Token"
pass_access_token = true## Authenticated Email Addresses File (one email per line)
# authenticated_emails_file = ""## Htpasswd File (optional)
## Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -B" for bcrypt encryption
## enabling exposes a username/login signin form
# htpasswd_file = ""## bypass authentication for requests that match the method & path. Format: method=path_regex OR path_regex alone for all methods
# skip_auth_routes = [
# "GET=^/probe",
# "^/metrics"
# ]## mark paths as API routes to get HTTP Status code 401 instead of redirect to login page
# api_routes = [
# "^/api"
# ]## Templates
## optional directory with custom sign_in.html and error.html
# custom_templates_dir = ""## skip SSL checking for HTTPS requests
# ssl_insecure_skip_verify = false
code-server
~/.config/code-server/config.yaml
bind-addr: 0.0.0.0:<code-server端口号> # TODO
auth: password
password: TODO # TODO 建议用强密码
#cert: /home/TODO/code-server.crt
#cert-key: /home/TODO/code-server.key
实验
用别的github账号登录会 500 错误，用配置里的账号则会跳转到code-server登录页