nixos/services/code-server.nix

# services/code-server.nix — Web IDE at code.nordhammer.it, protected by Authelia.
#
# Run as fred so it has access to ~/nixos-config and the rest of the home dir.
# Auth is handled entirely by Authelia (auth = "none" disables code-server's own
# password gate). After deploy, install the Claude extension from a terminal:
#   code-server --install-extension anthropic.claude-code
# and set ANTHROPIC_API_KEY in ~/.config/code-server/env or via a shell profile.
{ config, pkgs, lib, ... }:
{
  config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
    services.code-server = {
      enable = true;
      host = "127.0.0.1";
      port = 4444;
      auth = "none";
      user = "fred";
      extraArguments = [
        "--disable-telemetry"
        "--disable-update-check"
      ];
    };

    # Make the claude CLI available in code-server's integrated terminal.
    environment.systemPackages = [ pkgs.claude-code ];

    # Patch the Claude Code extension to add crossorigin="anonymous" to its
    # stylesheet link — required for Firefox due to stricter CORS handling.
    # Idempotent: sed won't match after the first apply.
    system.activationScripts.claude-code-firefox-fix.text = ''
      for f in /home/fred/.local/share/code-server/extensions/anthropic.claude-code-*/extension.js; do
        [ -f "$f" ] && ${pkgs.gnused}/bin/sed -i \
          's|<link href="''${q}" rel="stylesheet">|<link href="''${q}" rel="stylesheet" crossorigin="anonymous">|' \
          "$f"
      done
    '';
  };
}