{"slug":"code-on-ipad-using-visual-studio-code-caddy-and-code-server","title":"Code on iPad using Visual Studio Code, Caddy, and code-server","tags":["tailscale"],"agent_summary":"Last validated: Oct 16, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Code on iPad using Visual Studio Code, Caddy, and code-server\r\n\r\nLast validated: Oct 16, 2025\r\n\r\n[Visual Studio Code](https://code.visualstudio.com/) (VS Code) has quickly become the text editor many people use for their day-to-day work. Its cross-platform compatibility, speed, and vast library of extensions make it a popular choice.\r\n\r\nCoder.com's [code-server](https://github.com/cdr/code-server) lets you run VS Code on a server and access it on any device, including an iPad. However, [code-server isn't safe to expose over the public internet](https://github.com/coder/code-server/blob/main/docs/guide.md#expose-code-server), which usually leads to installing a public-facing SSH proxy or an HTTP reverse proxy like nginx in front of it. Tailscale eliminates all that, giving you a fast, private connection no matter where you are.\r\n\r\nIn this guide you'll set up code-server and use Tailscale to connect to it securely from an iPad. When you're done, you'll have a secure development environment you can access anywhere.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/solutions/code-on-ipad-vscode-caddy-code-server\\#prerequisites)\r\n\r\nTo complete this guide, you'll need the following:\r\n\r\n- A Tailscale account. [Create a free Personal account](https://login.tailscale.com/start) if you don't have one already.\r\n- A server to host code-server. This guide assumes you're using an Ubuntu 24.04 server and you have `sudo` access to install and run services. You can also install code-server on other platforms\r\n- The Tailscale client installed and running on your server so you can connect to it securely. Follow the [Install Tailscale on Linux](https://tailscale.com/docs/install/linux) instructions if you're using Ubuntu, or [download and install Tailscale](https://tailscale.com/download) manually.\r\n- An iPad with Tailscale installed and running to access your VS Code server through a web browser. [Download and install Tailscale](https://tailscale.com/download) on your device. You can also use an Android tablet or a laptop as long as they're running Tailscale.\r\n- [MagicDNS](https://tailscale.com/docs/features/magicdns) enabled on your tailnet, so you can use your server's MagicDNS hostname and use HTTPS certificates.\r\n\r\n## [Step 1: Verify your Tailscale setup](https://tailscale.com/docs/solutions/code-on-ipad-vscode-caddy-code-server\\#step-1-verify-your-tailscale-setup)\r\n\r\nBefore you set up code-server, confirm you can connect to your server on your tailnet. Start by getting [your machine's Tailscale IP address](https://tailscale.com/docs/concepts/ip-and-dns-addresses).\r\n\r\nIf you're logged into your server already, you can find the Tailscale IP address with the following command:\r\n\r\n```shell\r\ntailscale ip --4\r\n```\r\n\r\nCopy the 100.x.y.z address. After you've found it, type `exit` to end your session.\r\n\r\nNow start a new session that uses your Tailscale IP address:\r\n\r\n```shell\r\nssh @\r\n```\r\n\r\nAfter you connect successfully, you can set up code-server.\r\n\r\n## [Step 2: Install and secure code-server](https://tailscale.com/docs/solutions/code-on-ipad-vscode-caddy-code-server\\#step-2-install-and-secure-code-server)\r\n\r\nTo use code-server with Tailscale, you'll install it on your server and then change its settings so it's only available to devices on your tailnet.\r\n\r\nYou can install code-server with a script or download pre-built binaries from their [GitHub releases page](https://github.com/cdr/code-server/releases). For this guide, you'll use the script.\r\n\r\nOn your server, run the following one-line command to install code-server:\r\n\r\n```shell\r\ncurl -fsSL https://code-server.dev/install.sh | sh\r\n```\r\n\r\nThe installation program runs, eventually presenting the following output to indicate it's installed:\r\n\r\n```markup\r\nTo have systemd start code-server now and restart on boot:\r\n sudo systemctl enable --now code-server@$USER\r\nOr, if you don't want/need a background service you can run:\r\n code-server\r\n\r\nDeploy code-server for your team with Coder: https://github.com/coder/coder\r\n```\r\n\r\nConfigure code-server to start on boot by running the following command:\r\n\r\n```shell\r\nsudo systemctl enable --now code-server@$USER\r\n```\r\n\r\nThe command completes with the following message:\r\n\r\n```markup\r\nCreated symlink /etc/systemd/system/default.target.wants/code-server@your-user.service → /usr/lib/systemd/system/code-server@.service.\r\n```\r\n\r\ncode-server is now running on your local machine on port `8080`.\r\n\r\nBy default, code-server only accepts connections from the local device (`127.0.0.1`) and restricts access with a password. Because you'll only be accessing code-server over Tailscale, and Tailscale already uses your existing single sign-on (SSO) identity provider, there's no need for password-based authentication. You can already trust that you're authorized if you can even access the server. To do this, you'll update code-server's configuration to change how authentication works and the IP address code-server uses.\r\n\r\nOpen the code-server configuration file at `~/.config/code-server/config.yaml` using `nano` or another text editor:\r\n\r\n```shell\r\nnano ~/.config/code-server/config.yaml\r\n```\r\n\r\nThe configuration file looks like the following example, with a `bind-address` set to the local device and password authentication:\r\n\r\n```yaml\r\nbind-addr: 127.0.0.1:8080\r\nauth: password\r\npassword: \r\ncert: false\r\n```\r\n\r\nUpdate the `auth` field to `none`, remove the `password` field, and make the service available only on your Tailscale IP address by changing the `bind-addr` field to your Tailscale IP address:\r\n\r\n```yaml\r\nbind-addr: <100.x.y.z address>:8080\r\nauth: none\r\ncert: false\r\n```\r\n\r\nSave the file and exit your editor.\r\n\r\nApply the changes by restarting code-server:\r\n\r\n```shell\r\nsudo systemctl restart code-server@$USER\r\n```\r\n\r\nThe service is now listening, but only on the Tailscale IP address.\r\n\r\nOn your iPad, ensure you've connected to your tailnet and that your server appears in the Tailscale application's list of devices.\r\n\r\nOpen a browser and access your server by visiting `http://100.x.y.z:8080/`, using your IP address.\r\n\r\n![The code-server UI running on your tailnet.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fcode-server-runing.50fe3d66.png&w=3840&q=75)\r\n\r\nYou've got a working environment, but you can't use all of its features until you enable HTTPS support.\r\n\r\n## [Step 3: Use HTTPS with Caddy](https://tailscale.com/docs/solutions/code-on-ipad-vscode-caddy-code-server\\#step-3-use-https-with-caddy)\r\n\r\ncode-server's basic features work well over plain HTTP. Your connection is secure as long as you're connecting over an encrypted and authenticated\r\nTailscale link. However, some features, like using the system clipboard, will be unavailable because web browsers require HTTPS for them to work. To make code-server fully functional, you'll need to set up an HTTPS connection with certificates.\r\n\r\nCaddy automatically recognizes and uses certificates for your Tailscale network (`*.ts.net`), and can use Tailscale's HTTPS certificates.\r\n\r\nFirst, [ensure you've enabled HTTPS certificates for your tailnet](https://tailscale.com/docs/how-to/set-up-https-certificates).\r\n\r\nThen, on your server, request a Let's Encrypt certificate. To do this, you need your machine name and your [tailnet name](https://tailscale.com/docs/concepts/tailnet-name). You can find your tailnet DNS name in the [DNS](https://login.tailscale.com/admin/dns) page of the admin console. You can also run the `tailscale cert` command without arguments, and it will tell you the domain to use:\r\n\r\n```shell\r\ntailscale cert\r\n```\r\n\r\nThe usage message gives you the details you need:\r\n\r\n```markup\r\nUsage: tailscale cert [flags] \r\nFor domain, use \"machine-name.tailnet-name.ts.net\".\r\n```\r\n\r\nRun `tailscale cert` with `sudo` and provide the domain:\r\n\r\n```shell\r\nsudo tailscale cert machine-name.tailnet-name.ts.net\r\n```\r\n\r\nThe command displays the following output, indicating it created the certificate files:\r\n\r\n```markup\r\nWrote public cert to machine-name.tailnet-name.ts.net.crt\r\nWrote private key to machine-name.tailnet-name.ts.net.key\r\n```\r\n\r\nThen, install Caddy on the server running code-server. On Ubuntu, install Caddy with the following commands:\r\n\r\n```shell\r\nsudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl\r\ncurl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg\r\ncurl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list\r\nchmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg\r\nchmod o+r /etc/apt/sources.list.d/caddy-stable.list\r\nsudo apt update\r\nsudo apt install caddy\r\n```\r\n\r\nThis installs Caddy's dependencies, adds Caddy's official package repository to your package manager sources, and installs Caddy as a service.\r\n\r\nNow configure Caddy to use your Tailscale domain name. Edit `/etc/caddy/Caddyfile` with a text editor:\r\n\r\n```shell\r\nsudo nano /etc/caddy/Caddyfile\r\n```\r\n\r\nReplace the contents of the file with the following, using your domain name and your Tailscale IP address:\r\n\r\n```markup\r\nmachine-name.tailnet-name.ts.net {\r\n reverse_proxy 100.x.y.z:8080\r\n}\r\n```\r\n\r\nThis defines a reverse proxy which forwards requests on to your code-server instance.\r\n\r\nSave the file and exit the editor.\r\n\r\nInstalling Caddy on Ubuntu using the official scripts runs the Caddy server under the `caddy` user. For Tailscale to work with Caddy, you have to tell `tailscaled` to allow the `caddy` user to get the certificate.\r\n\r\nOpen the file `/etc/default/tailscaled` with your text editor:\r\n\r\n```shell\r\nsudo nano /etc/default/tailscaled\r\n```\r\n\r\nAdd the following line to the file to allow the `caddy` user access to fetch certificates:\r\n\r\n```markup\r\nTS_PERMIT_CERT_UID=caddy\r\n```\r\n\r\nReview the [tailscaled](https://tailscale.com/docs/reference/tailscaled) documentation for more information on its configuration options.\r\n\r\nSave the file. Now restart the `tailscaled` service to apply the changes:\r\n\r\n```shell\r\nsudo systemctl reload tailscaled\r\n```\r\n\r\nReload Caddy to apply the configuration changes you made:\r\n\r\n```shell\r\nsudo systemctl reload caddy\r\n```\r\n\r\nVisit `https://machine-name.domain-alias.ts.net` on your iPad to connect to code-server. This time, all features that require a valid HTTP certificate work as expected.\r\n\r\n## [Conclusion](https://tailscale.com/docs/solutions/code-on-ipad-vscode-caddy-code-server\\#conclusion)\r\n\r\nYou can now access your VS Code instance from anywhere. You can code from a café near your home or from the other side of the world. And it's only accessible over Tailscale.\r\n\r\nSince you'll be developing on this device, it'll have access to sensitive information such as private code or private data. To keep things even more secure, you may want to restrict all access to the server to only be over Tailscale.\r\n\r\nFor more information on how to further lock down a server, [read our guide on Ubuntu and ufw](https://tailscale.com/docs/how-to/secure-ubuntu-server-with-ufw).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Code on iPad using Visual Studio Code, Caddy, and code-server

\n

Last validated: Oct 16, 2025

\n

Visual Studio Code (VS Code) has quickly become the text editor many people use for their day-to-day work. Its cross-platform compatibility, speed, and vast library of extensions make it a popular choice.

\n

Coder.com's code-server lets you run VS Code on a server and access it on any device, including an iPad. However, code-server isn't safe to expose over the public internet, which usually leads to installing a public-facing SSH proxy or an HTTP reverse proxy like nginx in front of it. Tailscale eliminates all that, giving you a fast, private connection no matter where you are.

\n

In this guide you'll set up code-server and use Tailscale to connect to it securely from an iPad. When you're done, you'll have a secure development environment you can access anywhere.

\n

Prerequisites

\n

To complete this guide, you'll need the following:

\n
    \n
  • A Tailscale account. Create a free Personal account if you don't have one already.
    • \n
  • A server to host code-server. This guide assumes you're using an Ubuntu 24.04 server and you have sudo access to install and run services. You can also install code-server on other platforms
    • \n
  • The Tailscale client installed and running on your server so you can connect to it securely. Follow the Install Tailscale on Linux instructions if you're using Ubuntu, or download and install Tailscale manually.
    • \n
  • An iPad with Tailscale installed and running to access your VS Code server through a web browser. Download and install Tailscale on your device. You can also use an Android tablet or a laptop as long as they're running Tailscale.
    • \n
  • MagicDNS enabled on your tailnet, so you can use your server's MagicDNS hostname and use HTTPS certificates.
    • \n
\n

Step 1: Verify your Tailscale setup

\n

Before you set up code-server, confirm you can connect to your server on your tailnet. Start by getting your machine's Tailscale IP address.

\n

If you're logged into your server already, you can find the Tailscale IP address with the following command:

\n
tailscale ip --4\n
\n

Copy the 100.x.y.z address. After you've found it, type exit to end your session.

\n

Now start a new session that uses your Tailscale IP address:

\n
ssh <username>@<copied 100.x.y.z address>\n
\n

After you connect successfully, you can set up code-server.

\n

Step 2: Install and secure code-server

\n

To use code-server with Tailscale, you'll install it on your server and then change its settings so it's only available to devices on your tailnet.

\n

You can install code-server with a script or download pre-built binaries from their GitHub releases page. For this guide, you'll use the script.

\n

On your server, run the following one-line command to install code-server:

\n
curl -fsSL https://code-server.dev/install.sh | sh\n
\n

The installation program runs, eventually presenting the following output to indicate it's installed:

\n
To have systemd start code-server now and restart on boot:\r\n  sudo systemctl enable --now code-server@$USER\r\nOr, if you don't want/need a background service you can run:\r\n  code-server\r\n\r\nDeploy code-server for your team with Coder: https://github.com/coder/coder\n
\n

Configure code-server to start on boot by running the following command:

\n
sudo systemctl enable --now code-server@$USER\n
\n

The command completes with the following message:

\n
Created symlink /etc/systemd/system/default.target.wants/code-server@your-user.service → /usr/lib/systemd/system/code-server@.service.\n
\n

code-server is now running on your local machine on port 8080.

\n

By default, code-server only accepts connections from the local device (127.0.0.1) and restricts access with a password. Because you'll only be accessing code-server over Tailscale, and Tailscale already uses your existing single sign-on (SSO) identity provider, there's no need for password-based authentication. You can already trust that you're authorized if you can even access the server. To do this, you'll update code-server's configuration to change how authentication works and the IP address code-server uses.

\n

Open the code-server configuration file at ~/.config/code-server/config.yaml using nano or another text editor:

\n
nano ~/.config/code-server/config.yaml\n
\n

The configuration file looks like the following example, with a bind-address set to the local device and password authentication:

\n
bind-addr: 127.0.0.1:8080\r\nauth: password\r\npassword: <random-password>\r\ncert: false\n
\n

Update the auth field to none, remove the password field, and make the service available only on your Tailscale IP address by changing the bind-addr field to your Tailscale IP address:

\n
bind-addr: <100.x.y.z address>:8080\r\nauth: none\r\ncert: false\n
\n

Save the file and exit your editor.

\n

Apply the changes by restarting code-server:

\n
sudo systemctl restart code-server@$USER\n
\n

The service is now listening, but only on the Tailscale IP address.

\n

On your iPad, ensure you've connected to your tailnet and that your server appears in the Tailscale application's list of devices.

\n

Open a browser and access your server by visiting http://100.x.y.z:8080/, using your IP address.

\n

\"The

\n

You've got a working environment, but you can't use all of its features until you enable HTTPS support.

\n

Step 3: Use HTTPS with Caddy

\n

code-server's basic features work well over plain HTTP. Your connection is secure as long as you're connecting over an encrypted and authenticated\r\nTailscale link. However, some features, like using the system clipboard, will be unavailable because web browsers require HTTPS for them to work. To make code-server fully functional, you'll need to set up an HTTPS connection with certificates.

\n

Caddy automatically recognizes and uses certificates for your Tailscale network (*.ts.net), and can use Tailscale's HTTPS certificates.

\n

First, ensure you've enabled HTTPS certificates for your tailnet.

\n

Then, on your server, request a Let's Encrypt certificate. To do this, you need your machine name and your tailnet name. You can find your tailnet DNS name in the DNS page of the admin console. You can also run the tailscale cert command without arguments, and it will tell you the domain to use:

\n
tailscale cert\n
\n

The usage message gives you the details you need:

\n
Usage: tailscale cert [flags] <domain>\r\nFor domain, use \"machine-name.tailnet-name.ts.net\".\n
\n

Run tailscale cert with sudo and provide the domain:

\n
sudo tailscale cert machine-name.tailnet-name.ts.net\n
\n

The command displays the following output, indicating it created the certificate files:

\n
Wrote public cert to machine-name.tailnet-name.ts.net.crt\r\nWrote private key to machine-name.tailnet-name.ts.net.key\n
\n

Then, install Caddy on the server running code-server. On Ubuntu, install Caddy with the following commands:

\n
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl\r\ncurl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg\r\ncurl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list\r\nchmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg\r\nchmod o+r /etc/apt/sources.list.d/caddy-stable.list\r\nsudo apt update\r\nsudo apt install caddy\n
\n

This installs Caddy's dependencies, adds Caddy's official package repository to your package manager sources, and installs Caddy as a service.

\n

Now configure Caddy to use your Tailscale domain name. Edit /etc/caddy/Caddyfile with a text editor:

\n
sudo nano /etc/caddy/Caddyfile\n
\n

Replace the contents of the file with the following, using your domain name and your Tailscale IP address:

\n
machine-name.tailnet-name.ts.net {\r\n  reverse_proxy 100.x.y.z:8080\r\n}\n
\n

This defines a reverse proxy which forwards requests on to your code-server instance.

\n

Save the file and exit the editor.

\n

Installing Caddy on Ubuntu using the official scripts runs the Caddy server under the caddy user. For Tailscale to work with Caddy, you have to tell tailscaled to allow the caddy user to get the certificate.

\n

Open the file /etc/default/tailscaled with your text editor:

\n
sudo nano /etc/default/tailscaled\n
\n

Add the following line to the file to allow the caddy user access to fetch certificates:

\n
TS_PERMIT_CERT_UID=caddy\n
\n

Review the tailscaled documentation for more information on its configuration options.

\n

Save the file. Now restart the tailscaled service to apply the changes:

\n
sudo systemctl reload tailscaled\n
\n

Reload Caddy to apply the configuration changes you made:

\n
sudo systemctl reload caddy\n
\n

Visit https://machine-name.domain-alias.ts.net on your iPad to connect to code-server. This time, all features that require a valid HTTP certificate work as expected.

\n

Conclusion

\n

You can now access your VS Code instance from anywhere. You can code from a café near your home or from the other side of the world. And it's only accessible over Tailscale.

\n

Since you'll be developing on this device, it'll have access to sensitive information such as private code or private data. To keep things even more secure, you may want to restrict all access to the server to only be over Tailscale.

\n

For more information on how to further lock down a server, read our guide on Ubuntu and ufw.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}