How do you Block Access via the IP Address?

[MickMorley]

I have code-server deployed via Docker and have Authelia to authenticate users. All of this is internal to my network and not exposed to the internet. I want Authelia to only authenticate users and remove the code-server $PASSWORD.

The problem is, access is still achieved without authentication by navigating to "http://IP:8443/login".

I'd like to block access when navigating to "http://IP:8443/login" and force the use of https://code.example.com. Is there any way to do this?

[code-asher]

If you make Docker expose the port on localhost only, that should work. Something like docker run -p 127.0.0.1:8443:8443 I believe.

Alternatively, you could block 8443 at the firewall level.

[MickMorley]

Thank you very much. I learned something new. Here is a great article explaining on exposing the port to localhost only.

This will not work for me, my NGINX proxy is on VLAN7 and code-server is on VLAN3. I wanted to be able to restrict access from other people on VLAN3 from accessing code-server.

I was hoping that code-server had a way to limit access to only a reverse proxy, like Nextcloud.

[code-asher]

Ahhh I see. Nope, nothing like that in code-server, it would need to be blocked externally.

[MickMorley]

I found this login with args page from #1285 that may work.

My workflow/thought process:

1. Accessing it via the IP you'd have to know the password.
2. Accessing it via the reverse proxy, if authenticated with SSO, it'll pass the password for you.