diff --git a/dot_ssh/.chezmoiattrs b/dot_ssh/.chezmoiattrs
new file mode 100644
index 0000000..4c17907
--- /dev/null
+++ b/dot_ssh/.chezmoiattrs
@@ -0,0 +1 @@
+* private
diff --git a/dot_ssh/config.tmpl b/dot_ssh/config.tmpl
new file mode 100644
index 0000000..b0f2b0c
--- /dev/null
+++ b/dot_ssh/config.tmpl
@@ -0,0 +1,19 @@
+{{- if eq .chezmoi.os "darwin" }}
+Include ~/.ssh/1Password/config
+
+Host *
+	IdentityAgent "~/Library/Group Containers/2BUA8C4S2C.com.1password/t/agent.sock"
+
+{{- end }}
+
+Host *
+	CanonicalizeHostname yes
+	CanonicalDomains halosaur-major.ts.net
+	CanonicalizeMaxDots 0
+
+Host *.halosaur-major.ts.net
+	ForwardAgent yes
+
+Host echo-dev.local
+	HostName echo-dev.local
+	User admin
diff --git a/run_install-packages.sh.tmpl b/run_install-packages.sh.tmpl
index 9a5bdf9..54fed33 100755
--- a/run_install-packages.sh.tmpl
+++ b/run_install-packages.sh.tmpl
@@ -51,6 +51,9 @@ if [[ "$os" == "darwin" ]]; then
   [[ -r "$HOME/.fzf.zsh" ]] || "$(brew --prefix)/opt/fzf/install" --key-bindings --completion --no-update-rc || true
   install_cargo_packages
   install_uv_tools
+{{ if .full_setup }}
+  brew install code-server 2>/dev/null || true
+{{ end }}
   exit 0
 fi
 
@@ -285,6 +288,13 @@ install_bandwhich_user() {
   export PATH="$HOME/.local/bin:$PATH"
 }
 
+install_code_server_user() {
+  command -v code-server >/dev/null 2>&1 && return 0
+  command -v curl >/dev/null 2>&1 || return 0
+  curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone || true
+  export PATH="$HOME/.local/lib/code-server-*/bin:$PATH"
+}
+
 install_procs_user() {
   command -v procs >/dev/null 2>&1 && return 0
   command -v curl >/dev/null 2>&1 || return 0
@@ -393,6 +403,8 @@ fi
 install_duf_user
 install_bandwhich_user
 install_procs_user
+install_code_server_user
+systemctl --user enable --now code-server 2>/dev/null || true
 {{ end -}}
 
 # ---- Post-package-manager installs (GitHub releases / official installers) ----