...
  View open merge request
Commits (17)
#!/bin/bash
CONTAINERS="dev-redis dev-mysql dev-controller dev-ssh dev-django dev-smtpsink dev-registry dev-nginx dev-toolbox"
CONTAINERS="dev-redis dev-mysql dev-controller dev-ssh dev-django dev-smtpsink dev-registry dev-nginx dev-toolbox dev-jupyterhub"
die()
......
......@@ -8,7 +8,7 @@ from django.shortcuts import redirect
from django.urls import reverse
from django.views.decorators.csrf import csrf_exempt
from django.views.generic import View
from main.helpers import upload_data, get_base_url, lookup_job_file, get_request_user
from main.helpers import upload_data, get_base_url, lookup_job_file, get_request_user, LoggerAdapter
from main.mixins import JobAuthMixin
from main.models import Job, Webapp, JobQueue
......@@ -44,10 +44,14 @@ class APIJobView(JobAuthMixin, View):
@csrf_exempt
def jobs(request):
o_log = LoggerAdapter(log, {'prefix': "API-jobs"})
o_log.info("request received")
user = get_request_user(request)
if not user:
log.info("API request without http authorisation %s %s %s", request.META['HTTP_USER_AGENT'],
request.META['REMOTE_ADDR'], request.META['QUERY_STRING'])
o_log.info("%s request without http authorisation %s %s %s",
request.META['HTTP_USER_AGENT'],
request.META['REMOTE_ADDR'],
request.META['QUERY_STRING'])
return JsonResponse({'error': 'API request without http authorisation'}, status=401)
if request.POST['job[webapp_id]'].isdigit():
......@@ -69,8 +73,13 @@ def jobs(request):
except JobQueue.DoesNotExist:
return JsonResponse({'error': 'Unknown queue'}, status=400)
log.info("Job submit by user %s", user)
o_log.info("Job submit by user %s", user)
job = Job.objects.create(param=request.POST.get('job[param]', ''), queue=queue, webapp=app, user=user)
if app.get_webapp_version() is None:
o_log.debug('No usable versions')
return JsonResponse({'error': "This app is not yet published"}, status=404)
job.version = app.get_webapp_version().number # TODO: add version selection in the api
upload_data(request.FILES.values(), job)
......@@ -83,6 +92,7 @@ def jobs(request):
# start the job
job.state = Job.WAITING
job.save()
o_log.info("request successfully submitted.")
no_domain_url = reverse('api:job', kwargs={'pk':job.id})
response = {
......
......@@ -128,8 +128,9 @@ class RunnerForm(forms.ModelForm):
class WebappForm(forms.ModelForm):
# Basic
name = forms.CharField(label="Application name", label_suffix="")
contact = forms.EmailField(label="Email contact", label_suffix="", required=False, help_text="By default this will be your personnal e-mail address. You may fill this field if you wish to use a different contact address.")
name = forms.CharField(label="Application name", label_suffix="")
contact = forms.EmailField(label="Email contact", label_suffix="",
required=False, help_text="By default this will be your personnal e-mail address. You may fill this field if you wish to use a different contact address.")
description = forms.CharField(widget=forms.Textarea, label="Description", label_suffix="")
private = forms.TypedChoiceField(
coerce=lambda x: x == 'True',
......@@ -143,6 +144,7 @@ class WebappForm(forms.ModelForm):
# Advanced
ADVANCED_FIELDS = ("docker_os", "memory_limit_mb", "job_queue",
"entrypoint", "owner", "tags")
docker_os = forms.ModelChoiceField(
queryset=DockerOs.objects.all().distinct(),
label='Operating sytem',
......@@ -158,8 +160,13 @@ class WebappForm(forms.ModelForm):
entrypoint = forms.CharField(label="Entrypoint", label_suffix="",
help_text=mark_safe('This is the <a href="https://allgo.gitlabpages.inria.fr/doc/deploy.html#entrypoint">command executed when allgo runs a job</a> for this app.'),
initial="/home/allgo/entrypoint")
owner = forms.CharField(required=False, label="Owner", label_suffix='', help_text="Username of the new owner of the application. You will immediately loose access to the application.")
tags = TagField(required=False, label_suffix='', help_text="Tags are separated by a comma.")
notebook_gitrepo = forms.CharField(required=False, label="Notebook repository", label_suffix="",
help_text=mark_safe('git repository URL (https only) publicly available.<br /> This repo should contain a notebook (ipynb file).'),
initial="https://")
owner = forms.CharField(required=False, label="Owner", label_suffix='',
help_text="Username of the new owner of the application. You will immediately loose access to the application.")
tags = TagField(required=False, label_suffix='',
help_text="Tags are separated by a comma.")
def __init__(self, *args, **kwargs):
super(WebappForm, self).__init__(*args, **kwargs)
......@@ -186,7 +193,9 @@ class WebappForm(forms.ModelForm):
class Meta:
model = Webapp
fields = ('name', 'description', 'contact', 'entrypoint', 'job_queue', 'private', 'docker_os', 'entrypoint', 'owner', 'tags')
fields = ('name', 'description', 'contact', 'private',
'job_queue', 'notebook_gitrepo',
'docker_os', 'entrypoint', 'owner', 'tags')
class WebappSandboxForm(forms.ModelForm):
......
......@@ -36,6 +36,15 @@ REDIS_MESSAGE_WEBAPP_UPDATED = "webapp:%d"
##################################################
class LoggerAdapter(logging.LoggerAdapter):
"""This class makes all log message prefixed.
Usage: log = LoggerAdapter("your prefix", logging.getLogger('allgo'))
cf: https://docs.python.org/3/howto/logging-cookbook.html
https://stackoverflow.com/questions/30002070/create-logger-that-prefixes-log-messages"""
def process(self, msg, kwargs):
return '[%s] %s' % (self.extra['prefix'], msg), kwargs
# global redis connection pool
_redis_connection_pool = None
......@@ -222,5 +231,3 @@ def query_webapps_for_user(user):
# select webapps that are either public or owned by the user
return Webapp.objects.filter(Q(private=False) | Q(user_id=user.id))
......@@ -5,7 +5,7 @@ from django.conf import settings
from django.contrib import auth
from django.contrib.auth.models import User, AnonymousUser
from django.core.validators import MinLengthValidator, MinValueValidator, \
RegexValidator
RegexValidator, URLValidator
from django.db import models
from django.db.models.signals import post_save
from django.dispatch import receiver
......@@ -226,11 +226,14 @@ class Webapp(TimeStampModel):
private = models.BooleanField(default=1)
#FIXME: unused field
access_token = models.CharField(max_length=255, blank=True, null=True,
access_token = models.CharField(max_length=255, blank=True, null=True,
validators=[token_validator])
sandbox_state = models.IntegerField(null=True, choices=SANDBOX_STATE_CHOICES, default=IDLE)
sandbox_version = models.ForeignKey('WebappVersion', null=True, blank=True, related_name='webappversions')
notebook_gitrepo = models.CharField(max_length=255, blank=True, null=True)
sandbox_version = models.ForeignKey('WebappVersion', null=True, blank=True,
related_name='webappversions')
nb_url_validator = URLValidator(schemes=['https'], message="Only https url are allowed as notebook url.")
notebook_gitrepo = models.URLField(max_length=255, blank=True, null=True,
validators=[nb_url_validator])
memory_limit = models.BigIntegerField(null=True,
validators=[MinValueValidator(0)])
......
......@@ -282,10 +282,10 @@ class WebappCreate(ProviderAccessMixin, SuccessMessageMixin, CreateView):
group_required: groups that user must belong to.
"""
model = Webapp
model = Webapp
form_class = WebappForm
success_message = 'Webapp created successfully.'
template_name = 'webapp_add_update.html'
template_name = 'webapp_add_update.html'
# group_required = ['inria', ]
def get_success_url(self):
......@@ -316,6 +316,10 @@ class WebappCreate(ProviderAccessMixin, SuccessMessageMixin, CreateView):
obj.docker_name = slugify(form.cleaned_data['name'])
obj.memory_limit = form.get_memory_limit(self.request)
notebook_field = form.declared_fields['notebook_gitrepo']
if( notebook_field.initial == form.cleaned_data['notebook_gitrepo'] ):
obj.notebook_gitrepo = None
# validate the Webapp record before saving
# (this is a safety measure, do not remove)
# FIXME: currently this raises an exception if the slugify-generated
......@@ -1104,7 +1108,7 @@ class JobDetail(JobAuthMixin, DetailView):
class JobCreate(AllAccessMixin, SuccessMessageMixin, CreateView):
""" Display the data related a specific web and create a job instance
""" Display the data related a specific app and create a job instance
into the database
Attributes:
......
......@@ -304,3 +304,15 @@ a.fa-layers.disabled:not(.btn) {
height: 100%;
}
}
#jupyterhub
/* Values have been fixed based on the notebook used as test,
* to make disappear the elevators.
*/
{
width : 114%;
height: 350px; /* nothing works with % */
margin-left: -6%;
border: none;
}
......@@ -11,10 +11,10 @@
<meta name="description" content="allgo allow you to use console applications made by research team, online." />
<meta name="viewport" content="width=device-width, initial-scale=1.0, shrink-to-fit=no">
<link rel="stylesheet" type="text/css" href="{% static 'css/bootstrap.min.css' %}" media="all" charset="utf-8">
<link rel="stylesheet" type="text/css" href="{% static 'css/fontawesome-all.min.css' %}" media="all" charset="utf-8">
<link rel="stylesheet" type="text/css" href="{% static 'css/allgo.css' %}" media="all" charset="utf-8">
<link rel="stylesheet" type="text/css" href="{% static 'css/prism.css' %}" media="all" charset="utf-8">
<link rel="stylesheet" type="text/css" href="{% static 'css/bootstrap.min.css' %}" media="all">
<link rel="stylesheet" type="text/css" href="{% static 'css/fontawesome-all.min.css' %}" media="all">
<link rel="stylesheet" type="text/css" href="{% static 'css/allgo.css' %}" media="all">
<link rel="stylesheet" type="text/css" href="{% static 'css/prism.css' %}" media="all">
<link rel="icon" type="image/png" href="{% static 'images/favicon.ico' %}" sizes="16x16">
{% endblock %}
......
......@@ -41,8 +41,8 @@
</div>
</div>
<div class="logos">
<a href="https://inria.fr"><img class="float-left" src="{% static 'images/inria.png' %}"></a>
<a href="https://www.irisa.fr"><img class="float-right" src="{% static 'images/irisa.png' %}"></a>
<a href="https://inria.fr"><img class="float-left" src="{% static 'images/inria.png' %}" alt="inria logo"></a>
<a href="https://www.irisa.fr"><img class="float-right" src="{% static 'images/irisa.png' %}" alt="irisa logo"></a>
</div>
</div>
</footer>
......@@ -4,7 +4,7 @@
<div class="container">
<nav class="navbar navbar-expand-xl navbar-dark bg-dark">
<a class="navbar-brand text-hide" href="{% url 'main:home' %}">
<img src="{% static "images/logo-allgo.png" %}" width="50px" height="50px" alt="allgo logo">A||go</a>
<img src="{% static "images/logo-allgo.png" %}" width=50 height=50 alt="allgo logo">A||go</a>
<button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarNav" aria-controls="navbarNav" aria-expanded="false" aria-label="Toggle navigation">
<span class="navbar-toggler-icon"></span>
</button>
......
......@@ -16,30 +16,42 @@
<div class="card-body">
<nav class="navbar">
<ul class="nav nav-bar mx-auto">
<li class="nav-item">
<li class="nav-item"><!-- Run a job -->
<a
class="nav-link"
href="{% url 'main:webapp_detail' webapp.docker_name %}"
title="Start a job"
data-toggle="tooltip"
data-placement="bottom" ><i class="fas fa-play" data-fa-transform="shrink-10 up-.5" data-fa-mask="fas fa-circle"></i><span class="text-hide">Run a job</a></li>
data-placement="bottom" >
<i class="fas fa-play" data-fa-transform="shrink-10 up-.5" data-fa-mask="fas fa-circle"></i>
<span class="text-hide">Run a job</span>
</a>
</li>
{% if webapp.notebook_gitrepo %}
<li class="nav-item">
<li class="nav-item"><!-- Run a Notebook -->
<a
class="nav-link"
href="/jupyter?repo={{ webapp.notebook_gitrepo }}"
title="Start a Jupyter notebook"
data-toggle="tooltip"
data-placement="bottom"><i class="fas fa-sticky-note" data-fa-transform="shrink-10 up-.5" data-fa-mask="fas fa-circle"></i><span class="text-hide">Run notebook</a></li>
{% endif %}
data-placement="bottom">
<i class="fas fa-sticky-note" data-fa-transform="shrink-10 up-.5" data-fa-mask="fas fa-circle"></i>
<span class="text-hide">Run notebook</span>
</a>
</li>
{% endif %}
{% if webapp.user == user and webapp.sandbox_state != webapp.IDLE %}
<li class="nav-item">
<li class="nav-item"><!-- sandbox -->
<a
class="nav-link app-unfinished"
href="{% url 'main:webapp_sandbox_panel' webapp.docker_name %}"
title="There is an active sandbox"
data-toggle="tooltip"
data-placement="bottom"><i class="fas fa-exclamation-circle"></i><span class="text-hide">There is an active sandbox</span></a></li>
data-placement="bottom">
<i class="fas fa-exclamation-circle"></i>
<span class="text-hide">There is an active sandbox</span>
</a>
</li>
{% endif %}
</ul>
</nav>
......
......@@ -27,17 +27,14 @@
{% endif %}
</div>
</div>
<div class="col">
<div class="form-group">
{{ form.contact.label_tag }}
{{ form.contact | attr:"placeholder:john.smith@example.net" | add_class:"form-control" }}
<small class="form-text text-muted">{{ form.contact.help_text }}</small>
</div>
</div>
</div>
</div><!--form-row-->
<div class="form-group">
{{ form.description.label_tag }}
......@@ -48,20 +45,20 @@
<div class="form-group">
{{ form.private.label_tag }}
<div class="btn-group btn-group-toggle" data-toggle="buttons">
{% for private_field in form.private %}
<label class="btn btn-secondary {% if private_field.data.selected %}active{% endif %}">
<input
type="{{ private_field.data.type }}"
id="{{ private_field.id_for_label }}"
value="{{ private_field.data.value }}"
name="{{ private_field.data.name }}"
{% if private_field.data.selected %}checked{% endif %}>
{{ private_field.choice_label }}
</label>
{% endfor %}
{% for private_field in form.private %}
<label class="btn btn-secondary {% if private_field.data.selected %}active{% endif %}">
<input
type="{{ private_field.data.type }}"
id="{{ private_field.id_for_label }}"
value="{{ private_field.data.value }}"
name="{{ private_field.data.name }}"
{% if private_field.data.selected %}checked{% endif %}>
{{ private_field.choice_label }}
</label>
{% endfor %}
</div>
<small class="form-text text-muted">{{ form.private.help_text }}</small>
</div>
</div><!--form-group-->
<div class="card">
<div class="card-header">
......@@ -98,7 +95,6 @@
<div class="form-row">
<div class="form-group col-md-6">
{{ form.job_queue.label_tag }}
<select name="{{ form.job_queue.name }}" id="{{ form.job_queue.id_for_label }}" class="form-control">
{% for choice in form.job_queue.field.queryset %}
<option value="{{ choice.pk }}"
......@@ -113,7 +109,7 @@
{{ form.tags | attr:"placeholder:comma, separated, tags" | add_class:"form-control" }}
<small class="form-text text-muted">{{ form.tags.help_text }}</small>
</div>
</div>
</div><!-- form-group col-md-6 -->
<div class="form-group col-md-6">
{{ form.entrypoint.label_tag }}
......@@ -122,15 +118,20 @@
</div>
<small class="form-text text-muted">{{ form.entrypoint.help_text }}</small>
{% if action != "Create" %}
<div class="form-group">
{{ form.owner.label_tag }}
{{ form.owner | attr:"placeholder:Enter the new owner username" | add_class:"form-control" }}
<small class="form-text text-muted">{{ form.owner.help_text }}</small>
</div>
{% endif %}
</div>
{% if action != "Create" %}
<div class="form-group">
{{ form.owner.label_tag }}
{{ form.owner | attr:"placeholder:Enter the new owner username" | add_class:"form-control" }}
<small class="form-text text-muted">{{ form.owner.help_text }}</small>
</div>
{% endif %}
{{ form.notebook_gitrepo.label_tag }}
<div class="input-group">
{{ form.notebook_gitrepo | add_class:"form-control" }}
</div>
<small class="form-text text-muted">{{ form.notebook_gitrepo.help_text }}</small>
</div><!-- form-group col-md-6 -->
</div>
</div>
</div>
......
......@@ -203,11 +203,12 @@
<p class="mt-3">A Jupyter notebook is available to try the application online. You can
launch it <a href="/jupyter?repo={{ webapp.notebook_gitrepo }}" title="Jupyter notebook">using this link</a>.</p>
<p class="small text-muted">If you don't know what Jupyter is, you can <a href="https://jupyter.org/" title="Project Jupyter">visit their website</a>.</p>
<iframe id="jupyterhub"
src="/jupyter?repo={{ webapp.notebook_gitrepo }}"
></iframe>
</div>
{% endif %}
</div>
</div>
</div>
</div>
{% endblock %}
......
# code from https://github.com/opendns/registry-oauth-server/blob/master/tokens.py
import time
import hashlib
import base64
......@@ -10,12 +11,12 @@ import config
SIGNING_KEY_PATH = config.env.ALLGO_TOKEN_SIGNING_KEY_PATH
SIGNING_KEY_TYPE = config.env.ALLGO_TOKEN_SIGNING_KEY_TYPE
SIGNING_KEY_ALG = config.env.ALLGO_TOKEN_SIGNING_KEY_ALG
SIGNING_KEY_ALG = config.env.ALLGO_TOKEN_SIGNING_KEY_ALG
SIGNING_KEY = open(SIGNING_KEY_PATH).read()
ISSUER = config.env.ALLGO_TOKEN_ISSUER
ISSUER = config.env.ALLGO_TOKEN_ISSUER
TOKEN_EXPIRATION = config.env.ALLGO_TOKEN_EXPIRATION
TOKEN_TYPE = config.env.ALLGO_TOKEN_TYPE
TOKEN_TYPE = config.env.ALLGO_TOKEN_TYPE
def run_command(command):
......@@ -28,10 +29,11 @@ def key_id_encode(the_bytes):
result = []
for i in range(0, len(source), 4):
start = i
end = start+4
end = start + 4
result.append(str(source[start:end], 'utf-8'))
return ":".join(result)
def kid_from_crypto_key(private_key_path, key_type):
"""
python implementation of
......@@ -101,4 +103,3 @@ class Token(object):
headers=self.header)
return token
......@@ -4,13 +4,6 @@ from . import views
app_name = 'jwt'
urlpatterns = [
url(r'^jwt/auth$', views.jwt_auth, name="jwt_auth"), # REGISTRY_AUTH_TOKEN_REALM for docker registry
# hooks for registry pull/push for image manifests
url(r'^jwt/pre-(push|pull)$', views.pre_pushpull, name="pre_pushpull"),
url(r'^jwt/post-push$', views.post_push, name="post_push"),
# default catch-all route for docker registry urls (normally unused because
# the reverse-proxy is expected to route them directly to the registry)
url(r'^v2/', views.registry_notfound),
url(r'^jwt/auth', views.jwt_auth, name="jwt_auth"), # REGISTRY_AUTH_TOKEN_REALM for docker registry
url(r'^jupyter$', views.jupyter, name="jupyter"), # 302 redirect to jupyterhub + bearer + gitrepo
]
......@@ -2,229 +2,125 @@ import base64
import logging
import config.env
import requests
from urllib.parse import urlencode
from django.contrib.auth.decorators import login_required
from django.http import JsonResponse, HttpResponse
from django.views.decorators.csrf import csrf_exempt
from main.models import User, AllgoUser, Runner, Webapp, WebappVersion
from main.helpers import is_allowed_ip_admin
from django.shortcuts import redirect
from main.models import User, AllgoUser, Runner
from main.helpers import LoggerAdapter
from .tokens import Token
log = logging.getLogger('jwt')
# tokens below this size will automatically be rejected (to prevent any
# misconfiguration)
MIN_TOKEN_SIZE = 32
# on startup read the controller token from ALLGO_CONTROLLER_TOKEN_PATH
def _read_controller_token():
path = config.env.ALLGO_CONTROLLER_TOKEN_PATH
try:
with open(path) as fp:
token = fp.read().strip()
return token
except OSError as e:
log.warning("failed to get the controller token at %r (%s)", path, e)
CONTROLLER_TOKEN = _read_controller_token()
@csrf_exempt
def pre_pushpull(request, action):
"""pre-hook for pushing/pulling image manifests
This endpoint is called by allgo.aio before pushing/pulling an image to the
registry.
it returns a 200 response with the WebappVersion.id in the body if
successful
"""
if request.META.get("HTTP_X_ORIGIN") != "aio":
# this endpoint is only usable by allgo.aio
return HttpResponse(status=404)
if request.method != "POST":
return HttpResponse(status=405)
repo = request.GET["repo"]
tag = request.GET["tag"]
try:
# find the relevant webapp
webapp = Webapp.objects.get(docker_name=repo)
except Webapp.DoesNotExist:
return JsonResponse({"error": "unknown repository"}, status=404)
if action == "pull":
# find the id of the WebappVersion to be pulled
version = WebappVersion.objects.filter(webapp=webapp, number=tag,
state=WebappVersion.READY).order_by("-id").first()
if version is None:
return JsonResponse({"error": "unknown tag"}, status=404)
elif action == "push":
# create a new WebappVersion entry in state USER
version = WebappVersion.objects.create(
webapp=webapp, number=tag, state=WebappVersion.USER,
published=True, description="TODO")
version.save()
else:
return HttpResponse(status=500)
log.info("%s docker image %s:%s -> id%d",
action, webapp.docker_name, tag, version.id)
# return the version id of the image being pushed/pulled
return HttpResponse(str(version.id))
@csrf_exempt
def post_push(request):
"""post-push hook for image manifests
This endpoint is called by allgo.aio after pushing an image to the
registry, but before the result is forwarded to the client.
It is responsible of updating the database with the new webapp version.
@login_required
def jupyter(request):
"""
if request.META.get("HTTP_X_ORIGIN") != "aio":
# this endpoint is only usable by allgo.aio
return HttpResponse(status=404)
if request.method != "POST":
return HttpResponse(status=405)
version_id = int(request.GET["version_id"])
success = int(request.GET["success"])
if not success:
# push failed
# -> remove the version
WebappVersion.objects.filter(id=version_id,
state=WebappVersion.USER).delete()
else:
# Switch the version state to READY
# (see PushManager._process() in controller.py for more details about the
# process)
# version being pushed
version_query = WebappVersion.objects.filter(id=version_id)
version = version_query.get()
# query and lock candidate versions to be READY
versions = list(version_query.union(WebappVersion.objects.filter(
webapp=version.webapp, number=version.number,
state=WebappVersion.READY)).select_for_update())
# set the latest one to READY and the others to REPLACED
latest_id = max(v.id for v in versions)
for v in versions:
old = v.get_state_display()
v.state = (WebappVersion.READY if v.id == latest_id else
WebappVersion.REPLACED)
new = v.get_state_display()
log.info("version id %d: %s -> %s", v.id, old, new)
v.save()
return HttpResponse(status=204)
@csrf_exempt
def registry_notfound(request):
"""Default endpoint for all registry urls
should never be served (if the reverse-proxy is well configured)
Redirect to jupyter notebook with git repo (http get parameter named repo)
:param request:
:return:
"""
return JsonResponse({"error":
"registry not found (this is very likely a reverse-proxy config issue)"},
status=404)
token = Token("jupyter")
user = request.user.get_username()
token.claim['upn'] = user
token.claim['atk'] = AllgoUser.objects.get(user_id=request.user.id).token
log.info("Jupyter token %s %s", user, token.claim['atk'])
encoded_token = token.encode_token()
next = "/user/%s/git-pull?" % user + urlencode({'repo': request.GET.get("repo")})
jupyter_url = config.env.ALLGO_JUPYTER_URL
url_redirect = jupyter_url + "?" + urlencode({'bearer': encoded_token, "next": next})
log.info( "jupyter redirect to : " + url_redirect )
return redirect(url_redirect)
def jwt_auth(request):
"""
JWT auth used by docker registry endpoint specified at https://docs.docker.com/registry/spec/auth/jwt/
The HTTP request is expected to include an Authorization header using the
Basic authentication method
The client may provide either:
- the email+password of an allgo user
- a runner token, in which case the username is the arbitrary value"$token"
and the password is the token value
:param request:
:return:
"""
#
# Identify the actor making the request (either a User or a Runner)
#
o_log = LoggerAdapter(log, {'prefix': "jwt_auth"})
auth_header = request.META.get('HTTP_AUTHORIZATION', '')
if not auth_header:
log.info("Token request without http authorisation %s %s %s", request.META['HTTP_USER_AGENT'],
request.META['REMOTE_ADDR'], request.META['QUERY_STRING'])
o_log.info("Token request without http authorisation %s %s %s",
request.META['HTTP_USER_AGENT'],
request.META['REMOTE_ADDR'],
request.META['QUERY_STRING'])
return HttpResponse(status=401)
token_type, credentials = auth_header.split(' ')
if token_type != "Basic":
log.info("Token request with unknown http authentication method %s %s %r",
request.META['HTTP_USER_AGENT'],
request.META['REMOTE_ADDR'], token_type)
return HttpResponse(status=401)
username, password = base64.b64decode(credentials).decode('utf-8').split(':', 1)
#log.debug('HTTP_AUTHORIZATION %s username %s', auth_header, username)
if username == "$token":
if len(password) < MIN_TOKEN_SIZE:
log.info("provided token is too short")
return HttpResponse(status=401)
if password == CONTROLLER_TOKEN:
actor = "CONTROLLER"
else:
try:
actor = Runner.objects.get(token=password)
log.info("Token for runner called")
except Runner.DoesNotExist:
return HttpResponse(status=401)
username, password = base64.b64decode(credentials).decode('utf-8').split(':')
o_log.debug('HTTP_AUTHORIZATION %s', auth_header)
o_log.debug('username %s', username)
o_log.debug('password %s', password)
o_log.debug('runners : %s', Runner.objects.all())
if username == "$token" and Runner.objects.get(token=password):
o_log.info("Token for runner called")
user = Runner.objects.get(token=password)
else:
o_log.info("No $token user or no Runner defined.")
try:
actor = User.objects.get(email=username)
user = User.objects.get(email=username)
except User.DoesNotExist:
log.warning("Token request but user doest not exist")
o_log.warning("Token request but user doest not exist")
return HttpResponse(status=401)
password_valid = actor.check_password(password)
password_valid = user.check_password(password)
if token_type != 'Basic' or not password_valid:
log.info("Token request but user password mismatch")
o_log.info("Token request but user password mismatch")
return HttpResponse(status=401)
#
# Evaluate the allowed actions
#
try:
resource_type, repository, requested_actions = request.GET.get('scope', "::").split(":")
except ValueError:
return JsonResponse({'error': 'Invalid scope parameter'}, status=400)
allowed_actions = []
if resource_type == "repository":
if actor == "CONTROLLER":
if is_allowed_ip_admin(get_client_ip(request)):
allowed_actions.extend(("pull", "push"))
else:
try:
webapp = Webapp.objects.get(docker_name = repository)
except Webapp.DoesNotExist:
pass
else:
if "pull" in requested_actions and webapp.is_pullable_by(actor,
client_ip = get_client_ip(request)):
allowed_actions.append("pull")
if "push" in requested_actions and webapp.is_pushable_by(actor):
allowed_actions.append("push")
#
# Generate the token
#
service = request.GET['service']
log.info("Token authorized for %s on %s actions %s", actor, repository, allowed_actions)
token = Token(service, resource_type, repository, allowed_actions)
scope = request.GET['scope'] if 'scope' in request.GET.keys() else None
if not scope:
typ = ''
name = ''
actions = []
else:
params = scope.split(':')
if len(params) != 3:
return JsonResponse({'error': 'Invalid scope parameter'}, status=400)
typ = params[0]
name = params[1]
actions = params[2].split(',')
authorized_actions = get_allowed_actions(user, scope, actions, request) if scope else []
o_log.info("Token authorized actions %s %s %s", authorized_actions, user, scope)
token = Token(service, typ, name, authorized_actions)
encoded_token = token.encode_token()
return JsonResponse({'token': encoded_token})
return JsonResponse({'token': token.encode_token()})
def get_allowed_actions(user, scope, actions, request):
"""
Test if user is allowed to do actions in scope
To shorten it, if user is owner of the app, push/pull is allowed otherwise None
:param user:
:param scope:
:param actions:
:param request:
:return:
"""
resource_type, resource_name, resource_actions = scope.split(":")
if isinstance(user, Runner):
if user.account.is_superuser and get_client_ip(request) in config.env.ALLGO_ALLOWED_IP_ADMIN.split(','):
return ['*']
elif resource_type == "repository" and resource_name in [w.name for w in user.webapps]:
return ['pull']
else:
allgouser = AllgoUser.objects.get(user=user)
log.debug("Get allowed actions for user %s actions %s resource type %s", allgouser.user.username, actions,
resource_type)
if resource_type == "repository" and resource_name.rstrip('-incoming') in allgouser.getApp():
return actions
else:
log.error("User %s token %s can't access to scope %s (User apps : %s)", allgouser.user.username,
allgouser.token, scope, allgouser.getApp())
def get_client_ip(request):
......
......@@ -42,10 +42,32 @@ services:
ALLGO_DEBUG: "True"
ALLGO_ALLOW_LOCAL_ACCOUNTS: "True"
ALLGO_JUPYTER_URL: "http://0.0.0.0:8000/hub/login"
ALLGO_TOKEN_SIGNING_KEY_PATH: "/vol/ro/certs/tokens.key"
ALLGO_HTTP_SERVER: "django"
ALLGO_EMAIL_BACKEND: "django.core.mail.backends.console.EmailBackend"
# JUPYTER HUB
######################################################################################################################
dev-jupyterhub:
container_name: dev-jupyterhub
build: jupyterhub
ports:
- "8000:8000"
volumes:
- "/data/dev/django/ro/certs:/certs"
- "./jupyterhub/jupyterhub_config.py:/srv/jupyterhub/jupyterhub_config.py"
- "./django/allgo-logo.svg:/srv/jupyterhub/allgo_logo.svg"
- "./jupyterhub/jupyter_notebook_config.py:/etc/jupyter/jupyter_notebook_config.py"
networks: [dev]
environment:
JUPYTERHUB_LOG_LEVEL: "debug"
JUPYTERHUB_JWT_KEY: "/certs/tokens.key"
ALLGO_URL: "https://dev-django"
# IFRAME_CSP: "http://localhost:8008" # we do not succeed in unsing it.
# REDIS
######################################################################################################################
......
jupyterhub_cookie_secret
jupyterhub.sqlite
FROM debian:jessie
ENV DEBIAN_FRONTEND noninteractive
RUN REPO=http://cdn-fastly.deb.debian.org && \
echo "deb $REPO/debian jessie main\ndeb $REPO/debian-security jessie/updates main" > /etc/apt/sources.list && \
apt-get -y update && \
apt-get -y upgrade && \
apt-get -y install wget locales git bzip2 &&\
/usr/sbin/update-locale LANG=C.UTF-8 && \
locale-gen C.UTF-8 && \
apt-get remove -y locales && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*
ENV LANG C.UTF-8
# install Python + NodeJS with conda
RUN wget -q https://repo.continuum.io/miniconda/Miniconda3-4.2.12-Linux-x86_64.sh -O /tmp/miniconda.sh && \
echo 'd0c7c71cc5659e54ab51f2005a8d96f3 */tmp/miniconda.sh' | md5sum -c - && \
bash /tmp/miniconda.sh -f -b -p /opt/conda && \
/opt/conda/bin/conda install --yes -c conda-forge \
python=3.5 sqlalchemy tornado jinja2 traitlets requests pip pycurl \
nodejs configurable-http-proxy && \
/opt/conda/bin/pip install --upgrade pip && \
rm /tmp/miniconda.sh
ENV PATH=/opt/conda/bin:$PATH
ADD . /src/jupyterhub
WORKDIR /src/jupyterhub
RUN rm -rf $PWD ~/.cache ~/.npm
RUN pip install notebook==5.4.1
RUN pip install matplotlib
#RUN conda install matplotlib
#RUN conda install pandas
#RUN conda install -c anaconda numpy
#RUN conda install -c anaconda scipy
#RUN conda install scikit-learn
RUN pip install https://github.com/data-8/nbgitpuller/archive/28fe9b1af2ba64b346d59bd13c99581346bf349f.zip --upgrade
RUN jupyter serverextension enable --py nbgitpuller --sys-prefix
RUN pip install ipywidgets
RUN jupyter nbextension enable --py widgetsnbextension
RUN pip install https://github.com/scampion/jwtauthenticator/archive/master.zip --upgrade
RUN pip install allgo
RUN mkdir -p /srv/jupyterhub/
WORKDIR /srv/jupyterhub/
EXPOSE 8000
ENV PYTHONUNBUFFERED 1
CMD jupyterhub -f /srv/jupyterhub/jupyterhub_config.py
\ No newline at end of file
import os
c.NotebookApp.tornado_settings = {
'headers': {
'Content-Security-Policy': "frame-ancestors 'self' http://localhost:8008 "
# 'Content-Security-Policy': "frame-ancestors 'self' %s " % os.environ.get("IFRAME_CSP") #FIXME
}
}
# Configuration file for jupyterhub.
#------------------------------------------------------------------------------
# Application(SingletonConfigurable) configuration
#------------------------------------------------------------------------------
## This is an application.
## The date format used by logging formatters for %(asctime)s
#c.Application.log_datefmt = '%Y-%m-%d %H:%M:%S'
## The Logging format template
#c.Application.log_format = '[%(name)s]%(highlevel)s %(message)s'
## Set the log level by value or name.
#c.Application.log_level = 30
#------------------------------------------------------------------------------
# JupyterHub(Application) configuration
#------------------------------------------------------------------------------
## An Application for starting a Multi-User Jupyter Notebook server.
## Maximum number of concurrent servers that can be active at a time.
#
# Setting this can limit the total resources your users can consume.
#
# An active server is any server that's not fully stopped. It is considered
# active from the time it has been requested until the time that it has
# completely stopped.
#
# If this many user servers are active, users will not be able to launch new
# servers until a server is shutdown. Spawn requests will be rejected with a 429
# error asking them to try again.
#
# If set to 0, no limit is enforced.
#c.JupyterHub.active_server_limit = 0
## Grant admin users permission to access single-user servers.
#
# Users should be properly informed if this is enabled.
#c.JupyterHub.admin_access = False
## DEPRECATED since version 0.7.2, use Authenticator.admin_users instead.
#c.JupyterHub.admin_users = set()
## Allow named single-user servers per user
#c.JupyterHub.allow_named_servers = False
## Answer yes to any questions (e.g. confirm overwrite)
#c.JupyterHub.answer_yes = False
## PENDING DEPRECATION: consider using service_tokens
#
# Dict of token:username to be loaded into the database.
#
# Allows ahead-of-time generation of API tokens for use by externally managed
# services, which authenticate as JupyterHub users.
#
# Consider using service_tokens for general services that talk to the JupyterHub
# API.
#c.JupyterHub.api_tokens = {}
## Class for authenticating users.
#
# This should be a class with the following form:
#
# - constructor takes one kwarg: `config`, the IPython config object.
#
# with an authenticate method that:
#
# - is a coroutine (asyncio or tornado)
# - returns username on success, None on failure
# - takes two arguments: (handler, data),
# where `handler` is the calling web.RequestHandler,
# and `data` is the POST form data from the login page.
#c.JupyterHub.authenticator_class = 'jupyterhub.auth.PAMAuthenticator'
#c.JSONWebTokenLocalAuthenticator.add_user_cmd = ['useradd', 'USERNAME', '--disabled-password']
#c.LocalAuthenticator.create_system_users = True
#c.JupyterHub.spawner_class = 'jupyterhub.spawner.LocalProcessSpawner'
c.JupyterHub.authenticator_class = 'jwtauthenticator.jwtauthenticator.JSONWebTokenLocalAuthenticator'
#c.JupyterHub.authenticator_class = 'jwtauthenticator.jwtauthenticator.JSONWebTokenAuthenticator'
# # one of "secret" or "signing_certificate" must be given. If both, then "secret" will be the signing method used.
#c.JSONWebTokenAuthenticator.secret = '<insert-256-bit-secret-key-here>' # The secrect key used to generate the given token
# # -OR-
import os
c.JSONWebTokenAuthenticator.signing_certificate = os.environ.get("JUPYTERHUB_JWT_KEY") #/foo/bar/adfs-signature.crt' # The certificate used to sign the incoming JSONWebToken, must be in PEM Format
c.JSONWebTokenAuthenticator.username_claim_field = 'upn' # The claim field contianing the username/sAMAccountNAme/userPrincipalName
c.JSONWebTokenAuthenticator.expected_audience = 'jupyter' # This config option should match the aud field of the JSONWebToken, empty string to disable the validation of this field.
c.JSONWebTokenLocalAuthenticator.create_system_users = True # This will enable local user creation upon authentication, requires JSONWebTokenLocalAuthenticator
c.LocalAuthenticator.create_system_users = True
c.JSONWebTokenAuthenticator.param_name = 'bearer' # default value
## The base URL of the entire application.
#
# Add this to the begining of all JupyterHub URLs. Use base_url to run
# JupyterHub within an existing website.
#c.JupyterHub.base_url = '/'
## Whether to shutdown the proxy when the Hub shuts down.
#
# Disable if you want to be able to teardown the Hub while leaving the proxy
# running.
#
# Only valid if the proxy was starting by the Hub process.
#
# If both this and cleanup_servers are False, sending SIGINT to the Hub will
# only shutdown the Hub, leaving everything else running.
#
# The Hub should be able to resume from database state.
#c.JupyterHub.cleanup_proxy = True
## Whether to shutdown single-user servers when the Hub shuts down.
#
# Disable if you want to be able to teardown the Hub while leaving the single-
# user servers running.
#
# If both this and cleanup_proxy are False, sending SIGINT to the Hub will only
# shutdown the Hub, leaving everything else running.
#
# The Hub should be able to resume from database state.
#c.JupyterHub.cleanup_servers = True
## Maximum number of concurrent users that can be spawning at a time.
#
# Spawning lots of servers at the same time can cause performance problems for
# the Hub or the underlying spawning system. Set this limit to prevent bursts of
# logins from attempting to spawn too many servers at the same time.
#
# This does not limit the number of total running servers. See
# active_server_limit for that.
#
# If more than this many users attempt to spawn at a time, their requests will
# be rejected with a 429 error asking them to try again. Users will have to wait
# for some of the spawning services to finish starting before they can start
# their own.
#
# If set to 0, no limit is enforced.
#c.JupyterHub.concurrent_spawn_limit = 100
## The config file to load
#c.JupyterHub.config_file = 'jupyterhub_config.py'
## DEPRECATED: does nothing
#c.JupyterHub.confirm_no_ssl = False
## Number of days for a login cookie to be valid. Default is two weeks.
#c.JupyterHub.cookie_max_age_days = 14
## The cookie secret to use to encrypt cookies.
#
# Loaded from the JPY_COOKIE_SECRET env variable by default.
#
# Should be exactly 256 bits (32 bytes).
#c.JupyterHub.cookie_secret = b''
## File in which to store the cookie secret.
#c.JupyterHub.cookie_secret_file = 'jupyterhub_cookie_secret'
## The location of jupyterhub data files (e.g. /usr/local/share/jupyterhub)
#c.JupyterHub.data_files_path = '/opt/conda/share/jupyterhub'
## Include any kwargs to pass to the database connection. See
# sqlalchemy.create_engine for details.
#c.JupyterHub.db_kwargs = {}
## url for the database. e.g. `sqlite:///jupyterhub.sqlite`
#c.JupyterHub.db_url = 'sqlite:///jupyterhub.sqlite'
c.JupyterHub.log_level = 'DEBUG'
## log all database transactions. This has A LOT of output
#c.JupyterHub.debug_db = False
## DEPRECATED since version 0.8: Use ConfigurableHTTPProxy.debug
#c.JupyterHub.debug_proxy = False
## DEPRECATED: use output redirection instead, e.g.
#
# jupyterhub &>> /var/log/jupyterhub.log
#c.JupyterHub.extra_log_file = ''
## Extra log handlers to set on JupyterHub logger
#c.JupyterHub.extra_log_handlers = []
## Generate default config file
#c.JupyterHub.generate_config = False
## The ip or hostname for proxies and spawners to use for connecting to the Hub.
#
# Use when the bind address (`hub_ip`) is 0.0.0.0 or otherwise different from
# the connect address.
#
# Default: when `hub_ip` is 0.0.0.0, use `socket.gethostname()`, otherwise use
# `hub_ip`.
#
# Note: Some spawners or proxy implementations might not support hostnames.
# Check your spawner or proxy documentation to see if they have extra
# requirements.
#
# .. versionadded:: 0.8
#c.JupyterHub.hub_connect_ip = ''
## The port for proxies & spawners to connect to the hub on.
#
# Used alongside `hub_connect_ip` and only when different from hub_port.
#
# .. versionadded:: 0.8
#c.JupyterHub.hub_connect_port = 0
## The ip address for the Hub process to *bind* to.
#
# By default, the hub listens on localhost only. This address must be accessible
# from the proxy and user servers. You may need to set this to a public ip or
# '' for all interfaces if the proxy or user servers are in containers or on a
# different host.
#
# See `hub_connect_ip` for cases where the bind and connect address should
# differ.
#c.JupyterHub.hub_ip = '127.0.0.1'
## The internal port for the Hub process.
#
# This is the internal port of the hub itself. It should never be accessed
# directly. See JupyterHub.port for the public port to use when accessing
# jupyterhub. It is rare that this port should be set except in cases of port
# conflict.
#c.JupyterHub.hub_port = 8081
## The public facing ip of the whole JupyterHub application (specifically
# referred to as the proxy).
#
# This is the address on which the proxy will listen. The default is to listen
# on all interfaces. This is the only address through which JupyterHub should
# be accessed by users.
#c.JupyterHub.ip = ''
## Supply extra arguments that will be passed to Jinja environment.
#c.JupyterHub.jinja_environment_options = {}
## Interval (in seconds) at which to update last-activity timestamps.
#c.JupyterHub.last_activity_interval = 300
## Dict of 'group': ['usernames'] to load at startup.
#
# This strictly *adds* groups and users to groups.
#
# Loading one set of groups, then starting JupyterHub again with a different set
# will not remove users or groups from previous launches. That must be done
# through the API.
#c.JupyterHub.load_groups = {}
## Specify path to a logo image to override the Jupyter logo in the banner.
c.JupyterHub.logo_file = '/srv/jupyterhub/allgo_logo.svg'
## File to write PID Useful for daemonizing JupyterHub.
#c.JupyterHub.pid_file = ''
## The public facing port of the proxy.
#
# This is the port on which the proxy will listen. This is the only port
# through which JupyterHub should be accessed by users.
#c.JupyterHub.port = 8000
## DEPRECATED since version 0.8 : Use ConfigurableHTTPProxy.api_url
#c.JupyterHub.proxy_api_ip = ''
## DEPRECATED since version 0.8 : Use ConfigurableHTTPProxy.api_url
#c.JupyterHub.proxy_api_port = 0
## DEPRECATED since version 0.8: Use ConfigurableHTTPProxy.auth_token
#c.JupyterHub.proxy_auth_token = ''
## Interval (in seconds) at which to check if the proxy is running.
#c.JupyterHub.proxy_check_interval = 30
## Select the Proxy API implementation.
#c.JupyterHub.proxy_class = 'jupyterhub.proxy.ConfigurableHTTPProxy'
## DEPRECATED since version 0.8. Use ConfigurableHTTPProxy.command
#c.JupyterHub.proxy_cmd = []
## Redirect user to server (if running), instead of control panel.
#c.JupyterHub.redirect_to_server = True
## Purge and reset the database.
#c.JupyterHub.reset_db = False
## Interval (in seconds) at which to check connectivity of services with web
# endpoints.
#c.JupyterHub.service_check_interval = 60
## Dict of token:servicename to be loaded into the database.
#
# Allows ahead-of-time generation of API tokens for use by externally managed
# services.
#c.JupyterHub.service_tokens = {}
## List of service specification dictionaries.
#
# A service
#
# For instance::
#
# services = [
# {
# 'name': 'cull_idle',
# 'command': ['/path/to/cull_idle_servers.py'],
# },
# {
# 'name': 'formgrader',
# 'url': 'http://127.0.0.1:1234',
# 'api_token': 'super-secret',
# 'environment':
# }
# ]
#c.JupyterHub.services = []
## The class to use for spawning single-user servers.
#
# Should be a subclass of Spawner.
#c.JupyterHub.spawner_class = 'dockerspawner.SystemUserSpawner'
#### c.JupyterHub.spawner_class = 'jupyterhub.spawner.LocalProcessSpawner'
#LocalProcessSpawner
## Path to SSL certificate file for the public facing interface of the proxy
#
# When setting this, you should also set ssl_key
#c.JupyterHub.ssl_cert = ''
## Path to SSL key file for the public facing interface of the proxy
#
# When setting this, you should also set ssl_cert
#c.JupyterHub.ssl_key = ''
## Host to send statsd metrics to. An empty string (the default) disables sending
# metrics.
#c.JupyterHub.statsd_host = ''
## Port on which to send statsd metrics about the hub
#c.JupyterHub.statsd_port = 8125
## Prefix to use for all metrics sent by jupyterhub to statsd
#c.JupyterHub.statsd_prefix = 'jupyterhub'
## Run single-user servers on subdomains of this host.
#
# This should be the full `https://hub.domain.tld[:port]`.
#
# Provides additional cross-site protections for javascript served by single-
# user servers.
#
# Requires `<username>.hub.domain.tld` to resolve to the same host as
# `hub.domain.tld`.
#
# In general, this is most easily achieved with wildcard DNS.
#
# When using SSL (i.e. always) this also requires a wildcard SSL certificate.
#c.JupyterHub.subdomain_host = ''
## Paths to search for jinja templates, before using the default templates.
#c.JupyterHub.template_paths = []
## Extra settings overrides to pass to the tornado application.
#c.JupyterHub.tornado_settings = {}
## Trust user-provided tokens (via JupyterHub.service_tokens) to have good
# entropy.
#
# If you are not inserting additional tokens via configuration file, this flag
# has no effect.
#
# In JupyterHub 0.8, internally generated tokens do not pass through additional
# hashing because the hashing is costly and does not increase the entropy of
# already-good UUIDs.
#
# User-provided tokens, on the other hand, are not trusted to have good entropy
# by default, and are passed through many rounds of hashing to stretch the
# entropy of the key (i.e. user-provided tokens are treated as passwords instead
# of random keys). These keys are more costly to check.
#
# If your inserted tokens are generated by a good-quality mechanism, e.g.
# `openssl rand -hex 32`, then you can set this flag to True to reduce the cost
# of checking authentication tokens.
#c.JupyterHub.trust_user_provided_tokens = False
## Upgrade the database automatically on start.
#
# Only safe if database is regularly backed up. Only SQLite databases will be
# backed up to a local file automatically.
#c.JupyterHub.upgrade_db = False
#------------------------------------------------------------------------------
# Spawner(LoggingConfigurable) configuration
#------------------------------------------------------------------------------
## Base class for spawning single-user notebook servers.
#
# Subclass this, and override the following methods:
#
# - load_state - get_state - start - stop - poll
#
# As JupyterHub supports multiple users, an instance of the Spawner subclass is
# created for each user. If there are 20 JupyterHub users, there will be 20
# instances of the subclass.
## Extra arguments to be passed to the single-user server.
#
# Some spawners allow shell-style expansion here, allowing you to use
# environment variables here. Most, including the default, do not. Consult the
# documentation for your spawner to verify!
#c.Spawner.args = []
## The command used for starting the single-user server.
#
# Provide either a string or a list containing the path to the startup script
# command. Extra arguments, other than this path, should be provided via `args`.
#
# This is usually set if you want to start the single-user server in a different
# python environment (with virtualenv/conda) than JupyterHub itself.
#
# Some spawners allow shell-style expansion here, allowing you to use
# environment variables. Most, including the default, do not. Consult the
# documentation for your spawner to verify!
#c.Spawner.cmd = ['jupyterhub-singleuser']
## Minimum number of cpu-cores a single-user notebook server is guaranteed to
# have available.
#
# If this value is set to 0.5, allows use of 50% of one CPU. If this value is
# set to 2, allows use of up to 2 CPUs.
#
# **This is a configuration setting. Your spawner must implement support for the
# limit to work.** The default spawner, `LocalProcessSpawner`, does **not**
# implement this support. A custom spawner **must** add support for this setting
# for it to be enforced.
#c.Spawner.cpu_guarantee = None
## Maximum number of cpu-cores a single-user notebook server is allowed to use.
#
# If this value is set to 0.5, allows use of 50% of one CPU. If this value is
# set to 2, allows use of up to 2 CPUs.
#
# The single-user notebook server will never be scheduled by the kernel to use
# more cpu-cores than this. There is no guarantee that it can access this many
# cpu-cores.
#
# **This is a configuration setting. Your spawner must implement support for the
# limit to work.** The default spawner, `LocalProcessSpawner`, does **not**
# implement this support. A custom spawner **must** add support for this setting
# for it to be enforced.
#c.Spawner.cpu_limit = None
## Enable debug-logging of the single-user server
#c.Spawner.debug = False
## The URL the single-user server should start in.
#
# `{username}` will be expanded to the user's username
#
# Example uses:
#
# - You can set `notebook_dir` to `/` and `default_url` to `/tree/home/{username}` to allow people to
# navigate the whole filesystem from their notebook server, but still start in their home directory.
# - Start with `/notebooks` instead of `/tree` if `default_url` points to a notebook instead of a directory.
# - You can set this to `/lab` to have JupyterLab start by default, rather than Jupyter Notebook.
#c.Spawner.default_url = ''
## Disable per-user configuration of single-user servers.
#
# When starting the user's single-user server, any config file found in the
# user's $HOME directory will be ignored.
#
# Note: a user could circumvent this if the user modifies their Python
# environment, such as when they have their own conda environments / virtualenvs
# / containers.
#c.Spawner.disable_user_config = False
## Whitelist of environment variables for the single-user server to inherit from
# the JupyterHub process.
#
# This whitelist is used to ensure that sensitive information in the JupyterHub
# process's environment (such as `CONFIGPROXY_AUTH_TOKEN`) is not passed to the
# single-user server's process.
#c.Spawner.env_keep = ['PATH', 'PYTHONPATH', 'CONDA_ROOT', 'CONDA_DEFAULT_ENV', 'VIRTUAL_ENV', 'LANG', 'LC_ALL']
#c.Spawner.cmd = ['/opt/conda/bin/jupyterhub-singleuser']
c.Spawner.env_keep = ['PATH', 'PYTHONPATH', 'CONDA_ROOT', 'CONDA_DEFAULT_ENV', 'VIRTUAL_ENV', 'LANG','LC_ALL',
'ALLGO_TOKEN', 'ALLGO_URL']
## Extra environment variables to set for the single-user server's process.
#
# Environment variables that end up in the single-user server's process come from 3 sources:
# - This `environment` configurable
# - The JupyterHub process' environment variables that are whitelisted in `env_keep`
# - Variables to establish contact between the single-user notebook and the hub (such as JUPYTERHUB_API_TOKEN)
#
# The `environment` configurable should be set by JupyterHub administrators to
# add installation specific environment variables. It is a dict where the key is
# the name of the environment variable, and the value can be a string or a
# callable. If it is a callable, it will be called with one parameter (the
# spawner instance), and should return a string fairly quickly (no blocking
# operations please!).
#
# Note that the spawner class' interface is not guaranteed to be exactly same
# across upgrades, so if you are using the callable take care to verify it
# continues to work after upgrades!
#c.Spawner.environment = {}
## Timeout (in seconds) before giving up on a spawned HTTP server
#
# Once a server has successfully been spawned, this is the amount of time we
# wait before assuming that the server is unable to accept connections.
#c.Spawner.http_timeout = 30
## The IP address (or hostname) the single-user server should listen on.
#
# The JupyterHub proxy implementation should be able to send packets to this
# interface.
#c.Spawner.ip = ''
## Minimum number of bytes a single-user notebook server is guaranteed to have
# available.
#
# Allows the following suffixes:
# - K -> Kilobytes
# - M -> Megabytes
# - G -> Gigabytes
# - T -> Terabytes
#
# **This is a configuration setting. Your spawner must implement support for the
# limit to work.** The default spawner, `LocalProcessSpawner`, does **not**
# implement this support. A custom spawner **must** add support for this setting
# for it to be enforced.
#c.Spawner.mem_guarantee = None
## Maximum number of bytes a single-user notebook server is allowed to use.
#
# Allows the following suffixes:
# - K -> Kilobytes
# - M -> Megabytes
# - G -> Gigabytes
# - T -> Terabytes
#
# If the single user server tries to allocate more memory than this, it will
# fail. There is no guarantee that the single-user notebook server will be able
# to allocate this much memory - only that it can not allocate more than this.
#
# **This is a configuration setting. Your spawner must implement support for the
# limit to work.** The default spawner, `LocalProcessSpawner`, does **not**
# implement this support. A custom spawner **must** add support for this setting
# for it to be enforced.
#c.Spawner.mem_limit = None
## Path to the notebook directory for the single-user server.
#
# The user sees a file listing of this directory when the notebook interface is
# started. The current interface does not easily allow browsing beyond the
# subdirectories in this directory's tree.
#
# `~` will be expanded to the home directory of the user, and {username} will be
# replaced with the name of the user.
#
# Note that this does *not* prevent users from accessing files outside of this
# path! They can do so with many other means.
#c.Spawner.notebook_dir = ''
## An HTML form for options a user can specify on launching their server.
#
# The surrounding `<form>` element and the submit button are already provided.
#
# For example:
#
# .. code:: html
#
# Set your key:
# <input name="key" val="default_key"></input>
# <br>
# Choose a letter:
# <select name="letter" multiple="true">
# <option value="A">The letter A</option>
# <option value="B">The letter B</option>
# </select>
#
# The data from this form submission will be passed on to your spawner in
# `self.user_options`
#
# Instead of a form snippet string, this could also be a callable that takes as
# one parameter the current spawner instance and returns a string. The callable
# will be called asynchronously if it returns a future, rather than a str. Note
# that the interface of the spawner class is not deemed stable across versions,
# so using this functionality might cause your JupyterHub upgrades to break.
#c.Spawner.options_form = traitlets.Undefined
## Interval (in seconds) on which to poll the spawner for single-user server's
# status.
#
# At every poll interval, each spawner's `.poll` method is called, which checks
# if the single-user server is still running. If it isn't running, then
# JupyterHub modifies its own state accordingly and removes appropriate routes
# from the configurable proxy.
#c.Spawner.poll_interval = 30
## The port for single-user servers to listen on.
#
# Defaults to `0`, which uses a randomly allocated port number each time.
#
# If set to a non-zero value, all Spawners will use the same port, which only
# makes sense if each server is on a different address, e.g. in containers.
#
# New in version 0.7.
#c.Spawner.port = 0
## An optional hook function that you can implement to do some bootstrapping work
# before the spawner starts. For example, create a directory for your user or
# load initial content.
#
# This can be set independent of any concrete spawner implementation.
#
# Example::
#
# from subprocess import check_call
# def my_hook(spawner):
# username = spawner.user.name
# check_call(['./examples/bootstrap-script/bootstrap.sh', username])
#
# c.Spawner.pre_spawn_hook = my_hook
#c.Spawner.pre_spawn_hook = None
## Timeout (in seconds) before giving up on starting of single-user server.
#
# This is the timeout for start to return, not the timeout for the server to
# respond. Callers of spawner.start will assume that startup has failed if it
# takes longer than this. start should return when the server process is started
# and its location is known.
#c.Spawner.start_timeout = 300
#------------------------------------------------------------------------------
# LocalProcessSpawner(Spawner) configuration
#------------------------------------------------------------------------------
## A Spawner that uses `subprocess.Popen` to start single-user servers as local
# processes.
#
# Requires local UNIX users matching the authenticated users to exist. Does not
# work on Windows.
#
# This is the default spawner for JupyterHub.
#
# Note: This spawner does not implement CPU / memory guarantees and limits.
## Seconds to wait for single-user server process to halt after SIGINT.
#
# If the process has not exited cleanly after this many seconds, a SIGTERM is
# sent.
#c.LocalProcessSpawner.interrupt_timeout = 10
## Seconds to wait for process to halt after SIGKILL before giving up.
#
# If the process does not exit cleanly after this many seconds of SIGKILL, it
# becomes a zombie process. The hub process will log a warning and then give up.
#c.LocalProcessSpawner.kill_timeout = 5
## Extra keyword arguments to pass to Popen
#
# when spawning single-user servers.
#
# For example::
#