Skip to content

Commit 545a58d

Browse files
[pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
1 parent 7349076 commit 545a58d

File tree

1 file changed

+39
-27
lines changed

1 file changed

+39
-27
lines changed

docs/source/standalone.md

Lines changed: 39 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2,42 +2,45 @@
22

33
# Spawning and proxying a web service from JupyterHub
44

5-
The `standalone` feature of Jupyter Server Proxy enables JupyterHub Admins to launch and proxy arbitrary web services
6-
directly, in place of the JupyterLab or Notebook. You can use Jupyter Server Proxy to spawn a single proxy,
7-
without it being attached to a Jupyter server. The proxy securely authenticates and restricts access to authorized
5+
The `standalone` feature of Jupyter Server Proxy enables JupyterHub Admins to launch and proxy arbitrary web services
6+
directly, in place of the JupyterLab or Notebook. You can use Jupyter Server Proxy to spawn a single proxy,
7+
without it being attached to a Jupyter server. The proxy securely authenticates and restricts access to authorized
88
users through JupyterHub, giving a unified way to securely provide arbitrary applications.
99

10-
This works similar to {ref}`proxying Server Processes <server-process>`, where a server process is started and proxied.
11-
The Proxy is usually started from the command line, often by modifying the `Spawner.cmd` in your
10+
This works similar to {ref}`proxying Server Processes <server-process>`, where a server process is started and proxied.
11+
The Proxy is usually started from the command line, often by modifying the `Spawner.cmd` in your
1212
[JupyterHub Configuration](https://jupyterhub.readthedocs.io/en/stable/tutorial/getting-started/spawners-basics.html).
1313

1414
This feature builds upon the work of [Dan Lester](https://github.com/danlester), who originally developed it in the
1515
[jhsingle-native-proxy](https://github.com/ideonate/jhsingle-native-proxy) package.
1616

1717
## Installation
18-
This feature has a dependency to JupyterHub and must be explicitly installed via an optional dependency:
18+
19+
This feature has a dependency to JupyterHub and must be explicitly installed via an optional dependency:
1920

2021
```shell
2122
pip install jupyter-server-proxy[standalone]
2223
```
2324

2425
## Usage
25-
The standalone proxy is controlled with the `jupyter standaloneproxy` command. You always need to specify the
26-
{ref}`command <server-process:cmd>` of the web service that will be launched and proxied. Let's use
26+
27+
The standalone proxy is controlled with the `jupyter standaloneproxy` command. You always need to specify the
28+
{ref}`command <server-process:cmd>` of the web service that will be launched and proxied. Let's use
2729
[voilà](https://github.com/voila-dashboards/voila) as an example here:
2830

2931
```shell
3032
jupyter standaloneproxy -- voila --no-browser --port={port} /path/to/some/Notebook.ipynb
3133
```
3234

3335
Executing this command will spawn a new HTTP Server, which will spawn the voilà dashboard and render the notebook.
34-
Any template strings (like the `--port={port}`) inside the command will be automatically replaced when the command is
36+
Any template strings (like the `--port={port}`) inside the command will be automatically replaced when the command is
3537
executed.
3638

3739
The CLI has multiple advanced options to customize the behavior of the proxy. Execute `jupyter standaloneproxy --help`
3840
to get a complete list of all arguments.
3941

4042
### Specify address and port
43+
4144
The proxy will try to extract the address and port from the `JUPYTERHUB_SERVICE_URL` environment variable, which is
4245
set if an application is launched by JupyterHub. Otherwise, it will be launched on `127.0.0.1:8888`.
4346
You can also explicitly overwrite these values:
@@ -47,15 +50,17 @@ jupyter standaloneproxy --address=localhost --port=8000 ...
4750
```
4851

4952
### Disable Authentication
53+
5054
For testing, it can be useful to disable the authentication with JupyterHub. Passing `--skip-authentication` will
5155
not triggering the login process when accessing the application.
5256

53-
```{warning} Disabling authentication will leave the application open to anyone! Be careful with it,
57+
```{warning} Disabling authentication will leave the application open to anyone! Be careful with it,
5458
especially on multi-user systems.
5559
```
5660

5761
## Usage with JupyterHub
58-
To launch a standalone proxy with JupyterHub, you need to customize the `Spawner` inside the configuration
62+
63+
To launch a standalone proxy with JupyterHub, you need to customize the `Spawner` inside the configuration
5964
using traitlets:
6065

6166
```python
@@ -92,12 +97,14 @@ creating a custom `spawner.html` page.
9297
```
9398

9499
## Technical Overview
100+
95101
The following section should serve as an explanation to developers of the standalone feature of jupyter-server-proxy.
96102
It outlines the basic functionality and will explain the different components of the code in more depth.
97103

98104
### JupyterHub and jupyterhub-singleuser
105+
99106
By default, JupyterHub will use the `jupyterhub-singleuser` executable when launching a new instance for a user.
100-
This executable is usually a wrapper around the `JupyterLab` or `Notebook` application, with some
107+
This executable is usually a wrapper around the `JupyterLab` or `Notebook` application, with some
101108
additions regarding authentication and multi-user systems.
102109
In the standalone feature, we try to mimic these additions, but instead of using `JupyterLab` or `Notebook`, we
103110
will wrap them around an arbitrary web application.
@@ -106,55 +113,60 @@ without needing a Jupyter server to be running in the background.
106113
The different additions will be discussed in more detail below.
107114

108115
### Structure
109-
The standalone feature is built on top of the `SuperviseAndProxyhandler`, which will spawn a process and proxy
110-
requests to this server. While this process is called *Server* in the documentation, I will call it *Application*
116+
117+
The standalone feature is built on top of the `SuperviseAndProxyhandler`, which will spawn a process and proxy
118+
requests to this server. While this process is called _Server_ in the documentation, I will call it _Application_
111119
here, to avoid confusion with the other server where the `SuperviseAndProxyhandler` is attached to.
112120
When using jupyter-server-proxy, the proxies are attached to the Jupyter server and will proxy requests
113121
to the application.
114-
Since we do not want to use the Jupyter server here, we instead require an alternative server, which will be used
122+
Since we do not want to use the Jupyter server here, we instead require an alternative server, which will be used
115123
to attach the `SuperviseAndProxyhandler` and all the required additions from `jupyterhub-singleuser`.
116124
For that, we use tornado `HTTPServer`.
117125

118126
### Login and Authentication
127+
119128
One central component is the authentication with the JupyterHub Server.
120129
Any client accessing the application will need to authenticate with the JupyterHub API, which will ensure only
121130
the user themselves (or otherwise allowed users, e.g., admins) can access the application.
122-
The Login process is started by deriving our `StandaloneProxyHandler` from
131+
The Login process is started by deriving our `StandaloneProxyHandler` from
123132
[jupyterub.services.auth.HubOAuthenticated](https://github.com/jupyterhub/jupyterhub/blob/5.0.0/jupyterhub/services/auth.py#L1541)
124133
and decorating any methods we want to authenticate with `tornado.web.authenticated`.
125134
For the proxy, we just decorate the `proxy` method with `web.authenticated`, which will authenticate all routes on all HTTP Methods.
126-
`HubOAuthenticated` will automatically provide the login URL for the authentication process and any
135+
`HubOAuthenticated` will automatically provide the login URL for the authentication process and any
127136
client accessing any path of our server will be redirected to the JupyterHub API.
128137

129-
After a client has been authenticated with the JupyterHub API, they will be redirected back to our server.
138+
After a client has been authenticated with the JupyterHub API, they will be redirected back to our server.
130139
This redirect will be received on the `/oauth_callback` path, from where we need to redirect the client back to the
131140
root of the application.
132-
We use the [HubOAuthCallbackHander](https://github.com/jupyterhub/jupyterhub/blob/5.0.0/jupyterhub/services/auth.py#L1547),
133-
another handler from the JupyterHub package, for this.
141+
We use the [HubOAuthCallbackHander](https://github.com/jupyterhub/jupyterhub/blob/5.0.0/jupyterhub/services/auth.py#L1547),
142+
another handler from the JupyterHub package, for this.
134143
It will also cache the received OAuth state from the login, so that we can skip authentication for the next requests
135144
and do not need to go through the whole login process for each request.
136145

137146
### SSL certificates
138-
In some JupyterHub configurations, the launched application will be configured to use an SSL certificate for request
139-
between the JupyterLab / Notebook and the JupyterHub API. The path of the certificate is given in the
140-
`JUPYTERHUB_SSL_*` environment variables. We use these variables to create a new SSL Context for both
141-
the `AsyncHTTPClient` (used for Activity Notification, see below) and the `HTTPServer`.
147+
148+
In some JupyterHub configurations, the launched application will be configured to use an SSL certificate for request
149+
between the JupyterLab / Notebook and the JupyterHub API. The path of the certificate is given in the
150+
`JUPYTERHUB_SSL_*` environment variables. We use these variables to create a new SSL Context for both
151+
the `AsyncHTTPClient` (used for Activity Notification, see below) and the `HTTPServer`.
142152

143153
### Activity Notifications
154+
144155
The `jupyterhub-singleuser` will periodically send an activity notification to the JupyterHub API and inform it that
145-
the currently running application is still active. Whether this information is actually used or not depends on the
156+
the currently running application is still active. Whether this information is actually used or not depends on the
146157
specific configuration of this JupyterHub.
147158

148159
### Environment Variables
160+
149161
JupyterHub uses a lot of environment variables to specify how the launched app should be run.
150162
This list is a small overview of all used variables and what they contain and are used for.
151163

152164
| Variable | Explanation | Typical Value |
153-
|---------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------|
165+
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
154166
| `JUPYTERHUB_SERVICE_URL` | URL where the server should be listening. Used to find the Address and Port to start the server on. | `http://127.0.0.1:5555` |
155167
| `JUPYTERHUB_SERVICE_PREFIX` | An URL Prefix where the root of the launched application should be hosted. E.g., when set to `/user/name/`, then the root of the proxied aplication should be `/user/name/index.html` | `/services/service-name/` or `/user/name/` |
156168
| `JUPYTERHUB_ACTIVITY_URL` | URL where to send activity notifications to. | `$JUPYTERHUB_API_URL/user/name/activity` |
157169
| `JUPYTERHUB_API_TOKEN` | Authorization Token for requests to the JupyterHub API. | |
158170
| `JUPYTERHUB_SERVER_NAME` | A name given to all apps launched by the JupyterHub. | |
159171
| `JUPYTERHUB_SSL_KEYFILE`, `JUPYTERHUB_SSL_CERTFILE`, `JUPYTERHUB_SSL_CLIENT_CA` | Paths to keyfile, certfile and client CA for the SSL configuration | |
160-
| `JUPYTERHUB_USER`, `JUPYTERHUB_GROUP` | Name and Group of the user for this application. Required for Authentication |
172+
| `JUPYTERHUB_USER`, `JUPYTERHUB_GROUP` | Name and Group of the user for this application. Required for Authentication |

0 commit comments

Comments
 (0)