diff --git a/_quarto.yml b/_quarto.yml index 6dd20c8..3853938 100644 --- a/_quarto.yml +++ b/_quarto.yml @@ -24,13 +24,15 @@ website: - text: "Home" href: index.Rmd - text: "JHub User Guide" - href: JHub-User-Guide.Rmd + href: posts/JHub-User-Guide.Rmd - text: "JHub Set-up" - href: Set-up-daskhub.Rmd + href: posts/Set-up-daskhub.Rmd - text: "Centos Set-up" - href: Set-up-centos.Rmd + href: posts/Set-up-centos.Rmd + - text: "Centos Set-up https" + href: posts/Set-up-centos-security.Rmd - text: "Set-up VM on mac" - href: set-up-vm.Rmd + href: posts/set-up-vm.Rmd format: html: diff --git a/ci/iorocker-standalone/Dockerfile b/ci/iorocker-standalone/Dockerfile index ae554cb..4f5b837 100644 --- a/ci/iorocker-standalone/Dockerfile +++ b/ci/iorocker-standalone/Dockerfile @@ -7,8 +7,12 @@ RUN pip3 install \ 'jupyterlab' USER root +ENV HOME=/home/jovyan +RUN usermod -d /home/jovyan rstudio RUN mkdir /home/jovyan RUN chown rstudio:rstudio /home/jovyan USER rstudio +WORKDIR /home/jovyan + CMD ["jupyterhub-singleuser"] \ No newline at end of file diff --git a/ci/iorocker-standalone/config.py b/ci/iorocker-standalone/config.py new file mode 100644 index 0000000..13d35e2 --- /dev/null +++ b/ci/iorocker-standalone/config.py @@ -0,0 +1,2473 @@ +Last login: Mon Oct 2 03:27:30 on ttys000 +eli.holmes@Elis-MacBook-Air-2 ~ % ssh -i ~/Downloads/Centos8.cer eeholmes@20.127.203.178 +Activate the web console with: systemctl enable --now cockpit.socket + + +Thank you for choosing this Microsoft sponsored CentOS image from OpenLogic! +_______ ______ _____ +__ __ \______________________ / _____________ ___(_)______ +_ / / /__ __ \ _ \_ __ \_ / _ __ \_ __ `/_ /_ ___/ +/ /_/ /__ /_/ / __/ / / / /___/ /_/ / /_/ /_ / / /__ +\____/ _ .___/\___//_/ /_//_____/\____/_\__, / /_/ \___/ + /_/ /____/ by Perforce + ____ _ ___ ____ ___ ____ + / ___|___ _ __ | |_ / _ \/ ___| ( _ ) | ___| + | | / _ \ '_ \| __| | | \___ \ / _ \ |___ \ + | |__| __/ | | | |_| |_| |___) | | (_) | ___) | + \____\___|_| |_|\__|\___/|____/ \___(_)____/ + (2111) + +While OpenLogic support is not including with this image, OpenLogic does +offer Silver (12x5) & Gold (24x7) support options and consulting for +enterprise and/or mission critical systems as well as over 400 open-source +packages. If interested, email info@perforce.com or call +1 612.517.2100. + +Last login: Thu Oct 5 05:25:13 2023 from 98.97.35.101 +(base) [eeholmes@Centos8-Server ~]$ pwd +/home/eeholmes +(base) [eeholmes@Centos8-Server ~]$ cd /etc +(base) [eeholmes@Centos8-Server etc]$ ls +adjtime fuse.conf man_db.conf rsyslog.conf +aliases fwupd mcelog rsyslog.d +alternatives gcrypt microcode_ctl rwtab.d +anacrontab gnupg mime.types samba +at.deny GREP_COLORS mke2fs.conf sasl2 +audit groff modprobe.d security +authselect group modules-load.d selinux +bash_completion.d group- motd services +bashrc grub2.cfg motd.d sestatus.conf +bindresvport.blacklist grub2-efi.cfg mtab shadow +binfmt.d grub.d nanorc shadow- +centos-release gshadow netconfig shells +centos-release-upstream gshadow- NetworkManager skel +chkconfig.d gss networks smartmontools +chrony.conf host.conf nftables sos +chrony.keys hostname nsswitch.conf ssh +cifs-utils hosts nsswitch.conf.bak ssl +cloud init.d nvme sssd +cockpit inittab openldap subgid +containerd inputrc opt subgid- +cron.d iproute2 os-release subuid +cron.daily issue pam.d subuid- +cron.deny issue.d passwd sudo.conf +cron.hourly issue.net passwd- sudoers +cron.monthly jupyterhub pinforc sudoers.d +crontab kdump pkcs11 sudo-ldap.conf +cron.weekly kdump.conf pki sysconfig +crypto-policies kernel pm sysctl.conf +crypttab krb5.conf polkit-1 sysctl.d +csh.cshrc krb5.conf.d popt.d systemd +csh.login ld.so.cache prelink.conf.d system-release +dbus-1 ld.so.conf printcap system-release-cpe +dconf ld.so.conf.d profile terminfo +default libaudit.conf profile.d tmpfiles.d +depmod.d libibverbs.d protocols trusted-key.key +dhcp libnl rc0.d tuned +DIR_COLORS libreport rc1.d udev +DIR_COLORS.256color libssh rc2.d updatedb.conf +DIR_COLORS.lightbgcolor libuser.conf rc3.d vconsole.conf +dnf locale.conf rc4.d vimrc +docker localtime rc5.d virc +dracut.conf login.defs rc6.d waagent.conf +dracut.conf.d logrotate.conf rc.d wgetrc +environment logrotate.d rc.local X11 +ethertypes lsm rdma xattr.conf +exports lvm redhat-release xdg +filesystems machine-id resolv.conf xinetd.d +firewalld magic rhsm yum +fprintd.conf mailcap rpc yum.conf +fstab makedumpfile.conf.sample rpm yum.repos.d +(base) [eeholmes@Centos8-Server etc]$ cd jupyterhub +(base) [eeholmes@Centos8-Server jupyterhub]$ ls +(base) [eeholmes@Centos8-Server jupyterhub]$ sudo ls +(base) [eeholmes@Centos8-Server jupyterhub]$ cd .. +(base) [eeholmes@Centos8-Server etc]$ ls +adjtime fuse.conf man_db.conf rsyslog.conf +aliases fwupd mcelog rsyslog.d +alternatives gcrypt microcode_ctl rwtab.d +anacrontab gnupg mime.types samba +at.deny GREP_COLORS mke2fs.conf sasl2 +audit groff modprobe.d security +authselect group modules-load.d selinux +bash_completion.d group- motd services +bashrc grub2.cfg motd.d sestatus.conf +bindresvport.blacklist grub2-efi.cfg mtab shadow +binfmt.d grub.d nanorc shadow- +centos-release gshadow netconfig shells +centos-release-upstream gshadow- NetworkManager skel +chkconfig.d gss networks smartmontools +chrony.conf host.conf nftables sos +chrony.keys hostname nsswitch.conf ssh +cifs-utils hosts nsswitch.conf.bak ssl +cloud init.d nvme sssd +cockpit inittab openldap subgid +containerd inputrc opt subgid- +cron.d iproute2 os-release subuid +cron.daily issue pam.d subuid- +cron.deny issue.d passwd sudo.conf +cron.hourly issue.net passwd- sudoers +cron.monthly jupyterhub pinforc sudoers.d +crontab kdump pkcs11 sudo-ldap.conf +cron.weekly kdump.conf pki sysconfig +crypto-policies kernel pm sysctl.conf +crypttab krb5.conf polkit-1 sysctl.d +csh.cshrc krb5.conf.d popt.d systemd +csh.login ld.so.cache prelink.conf.d system-release +dbus-1 ld.so.conf printcap system-release-cpe +dconf ld.so.conf.d profile terminfo +default libaudit.conf profile.d tmpfiles.d +depmod.d libibverbs.d protocols trusted-key.key +dhcp libnl rc0.d tuned +DIR_COLORS libreport rc1.d udev +DIR_COLORS.256color libssh rc2.d updatedb.conf +DIR_COLORS.lightbgcolor libuser.conf rc3.d vconsole.conf +dnf locale.conf rc4.d vimrc +docker localtime rc5.d virc +dracut.conf login.defs rc6.d waagent.conf +dracut.conf.d logrotate.conf rc.d wgetrc +environment logrotate.d rc.local X11 +ethertypes lsm rdma xattr.conf +exports lvm redhat-release xdg +filesystems machine-id resolv.conf xinetd.d +firewalld magic rhsm yum +fprintd.conf mailcap rpc yum.conf +fstab makedumpfile.conf.sample rpm yum.repos.d +(base) [eeholmes@Centos8-Server etc]$ /opt/miniconda3/envs/jupyterhub +-bash: /opt/miniconda3/envs/jupyterhub: Is a directory +(base) [eeholmes@Centos8-Server etc]$ cd /opt/miniconda3/envs/jupyterhub +(base) [eeholmes@Centos8-Server jupyterhub]$ ls +bin conda-meta include man ssl x86_64-conda-linux-gnu +compiler_compat etc lib share x86_64-conda_cos7-linux-gnu +(base) [eeholmes@Centos8-Server jupyterhub]$ cd etc +(base) [eeholmes@Centos8-Server etc]$ ls +jupyter jupyterhub systemd +(base) [eeholmes@Centos8-Server etc]$ cd jupyterhub +(base) [eeholmes@Centos8-Server jupyterhub]$ ls +jupyterhub_config.py jupyterhub_cookie_secret jupyterhub.sqlite +(base) [eeholmes@Centos8-Server jupyterhub]$ ls -la +total 188 +drwxr-xr-x. 2 root root 91 Oct 3 17:18 . +drwxr-xr-x. 5 root root 54 Oct 2 16:01 .. +-rw-r--r--. 1 root root 56549 Oct 4 20:16 jupyterhub_config.py +-rw-------. 1 root root 65 Oct 2 16:45 jupyterhub_cookie_secret +-rw-r--r--. 1 root root 131072 Oct 3 17:18 jupyterhub.sqlite +(base) [eeholmes@Centos8-Server jupyterhub]$ cat jupyterhub_cookie_secret +cat: jupyterhub_cookie_secret: Permission denied +(base) [eeholmes@Centos8-Server jupyterhub]$ cat jupyterhub_config.py +# Configuration file for jupyterhub. + +c = get_config() #noqa +c.JupyterHub.port = 8000 +c.JupyterHub.hub_bind_url = "http://0.0.0.0:8081" +c.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner' +c.DockerSpawner.remove = True +c.Spawner.http_timeout = 3600 +c.DockerSpawner.image_whitelist = { + 'iorocker': 'eeholmes/iorocker-standalone:20231003', + 'rocker-binder': 'eeholmes/rocker-binder:20231003', + 'openscapes-rocker': 'eeholmes/minimal-jhub:20231004', + 'datascience-r': 'jupyter/datascience-notebook:r-4.3.1', + 'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f', +} + +notebook_dir = '/home/jovyan' +c.DockerSpawner.notebook_dir = notebook_dir + +# Mount the real user's Docker volume on the host to the notebook user's +# notebook directory in the container +c.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir } + +#------------------------------------------------------------------------------ +# Application(SingletonConfigurable) configuration +#------------------------------------------------------------------------------ +## This is an application. + +## The date format used by logging formatters for %(asctime)s +# Default: '%Y-%m-%d %H:%M:%S' +# c.Application.log_datefmt = '%Y-%m-%d %H:%M:%S' + +## The Logging format template +# Default: '[%(name)s]%(highlevel)s %(message)s' +# c.Application.log_format = '[%(name)s]%(highlevel)s %(message)s' + +## Set the log level by value or name. +# Choices: any of [0, 10, 20, 30, 40, 50, 'DEBUG', 'INFO', 'WARN', 'ERROR', 'CRITICAL'] +# Default: 30 +# c.Application.log_level = 30 + +## Configure additional log handlers. +# +# The default stderr logs handler is configured by the log_level, log_datefmt +# and log_format settings. +# +# This configuration can be used to configure additional handlers (e.g. to +# output the log to a file) or for finer control over the default handlers. +# +# If provided this should be a logging configuration dictionary, for more +# information see: +# https://docs.python.org/3/library/logging.config.html#logging-config- +# dictschema +# +# This dictionary is merged with the base logging configuration which defines +# the following: +# +# * A logging formatter intended for interactive use called +# ``console``. +# * A logging handler that writes to stderr called +# ``console`` which uses the formatter ``console``. +# * A logger with the name of this application set to ``DEBUG`` +# level. +# +# This example adds a new handler that writes to a file: +# +# .. code-block:: python +# +# c.Application.logging_config = { +# 'handlers': { +# 'file': { +# 'class': 'logging.FileHandler', +# 'level': 'DEBUG', +# 'filename': '', +# } +# }, +# 'loggers': { +# '': { +# 'level': 'DEBUG', +# # NOTE: if you don't list the default "console" +# # handler here then it will be disabled +# 'handlers': ['console', 'file'], +# }, +# } +# } +# Default: {} +# c.Application.logging_config = {} + +## Instead of starting the Application, dump configuration to stdout +# Default: False +# c.Application.show_config = False + +## Instead of starting the Application, dump configuration to stdout (as JSON) +# Default: False +# c.Application.show_config_json = False + +#------------------------------------------------------------------------------ +# JupyterHub(Application) configuration +#------------------------------------------------------------------------------ +## An Application for starting a Multi-User Jupyter Notebook server. + +## Maximum number of concurrent servers that can be active at a time. +# +# Setting this can limit the total resources your users can consume. +# +# An active server is any server that's not fully stopped. It is considered +# active from the time it has been requested until the time that it has +# completely stopped. +# +# If this many user servers are active, users will not be able to launch new +# servers until a server is shutdown. Spawn requests will be rejected with a 429 +# error asking them to try again. +# +# If set to 0, no limit is enforced. +# Default: 0 +# c.JupyterHub.active_server_limit = 0 + +## Duration (in seconds) to determine the number of active users. +# Default: 1800 +# c.JupyterHub.active_user_window = 1800 + +## Resolution (in seconds) for updating activity +# +# If activity is registered that is less than activity_resolution seconds more +# recent than the current value, the new value will be ignored. +# +# This avoids too many writes to the Hub database. +# Default: 30 +# c.JupyterHub.activity_resolution = 30 + +## DEPRECATED since version 2.0.0. +# +# The default admin role has full permissions, use custom RBAC scopes instead to +# create restricted administrator roles. +# https://jupyterhub.readthedocs.io/en/stable/rbac/index.html +# Default: False +# c.JupyterHub.admin_access = False + +## DEPRECATED since version 0.7.2, use Authenticator.admin_users instead. +# Default: set() +# c.JupyterHub.admin_users = set() + +## Allow named single-user servers per user +# Default: False +# c.JupyterHub.allow_named_servers = False + +## Answer yes to any questions (e.g. confirm overwrite) +# Default: False +# c.JupyterHub.answer_yes = False + +## The default amount of records returned by a paginated endpoint +# Default: 50 +# c.JupyterHub.api_page_default_limit = 50 + +## The maximum amount of records that can be returned at once +# Default: 200 +# c.JupyterHub.api_page_max_limit = 200 + +## PENDING DEPRECATION: consider using services +# +# Dict of token:username to be loaded into the database. +# +# Allows ahead-of-time generation of API tokens for use by externally managed services, +# which authenticate as JupyterHub users. +# +# Consider using services for general services that talk to the +# JupyterHub API. +# Default: {} +# c.JupyterHub.api_tokens = {} + +## Authentication for prometheus metrics +# Default: True +# c.JupyterHub.authenticate_prometheus = True + +## Class for authenticating users. +# +# This should be a subclass of :class:`jupyterhub.auth.Authenticator` +# +# with an :meth:`authenticate` method that: +# +# - is a coroutine (asyncio or tornado) +# - returns username on success, None on failure +# - takes two arguments: (handler, data), +# where `handler` is the calling web.RequestHandler, +# and `data` is the POST form data from the login page. +# +# .. versionchanged:: 1.0 +# authenticators may be registered via entry points, +# e.g. `c.JupyterHub.authenticator_class = 'pam'` +# +# Currently installed: +# - default: jupyterhub.auth.PAMAuthenticator +# - dummy: jupyterhub.auth.DummyAuthenticator +# - null: jupyterhub.auth.NullAuthenticator +# - pam: jupyterhub.auth.PAMAuthenticator +# Default: 'jupyterhub.auth.PAMAuthenticator' +# c.JupyterHub.authenticator_class = 'jupyterhub.auth.PAMAuthenticator' + +## The base URL of the entire application. +# +# Add this to the beginning of all JupyterHub URLs. +# Use base_url to run JupyterHub within an existing website. +# +# .. deprecated: 0.9 +# Use JupyterHub.bind_url +# Default: '/' +# c.JupyterHub.base_url = '/' + +## The public facing URL of the whole JupyterHub application. +# +# This is the address on which the proxy will bind. +# Sets protocol, ip, base_url +# Default: 'http://:8000' +# c.JupyterHub.bind_url = 'http://:8000' +# c.JupyterHub.bind_url = 'http://20.127.203.178:8000' +## Whether to shutdown the proxy when the Hub shuts down. +# +# Disable if you want to be able to teardown the Hub while leaving the +# proxy running. +# +# Only valid if the proxy was starting by the Hub process. +# +# If both this and cleanup_servers are False, sending SIGINT to the Hub will +# only shutdown the Hub, leaving everything else running. +# +# The Hub should be able to resume from database state. +# Default: True +# c.JupyterHub.cleanup_proxy = True + +## Whether to shutdown single-user servers when the Hub shuts down. +# +# Disable if you want to be able to teardown the Hub while leaving the +# single-user servers running. +# +# If both this and cleanup_proxy are False, sending SIGINT to the Hub will +# only shutdown the Hub, leaving everything else running. +# +# The Hub should be able to resume from database state. +# Default: True +# c.JupyterHub.cleanup_servers = True + +## Maximum number of concurrent users that can be spawning at a time. +# +# Spawning lots of servers at the same time can cause performance problems for +# the Hub or the underlying spawning system. Set this limit to prevent bursts of +# logins from attempting to spawn too many servers at the same time. +# +# This does not limit the number of total running servers. See +# active_server_limit for that. +# +# If more than this many users attempt to spawn at a time, their requests will +# be rejected with a 429 error asking them to try again. Users will have to wait +# for some of the spawning services to finish starting before they can start +# their own. +# +# If set to 0, no limit is enforced. +# Default: 100 +# c.JupyterHub.concurrent_spawn_limit = 100 + +## The config file to load +# Default: 'jupyterhub_config.py' +# c.JupyterHub.config_file = 'jupyterhub_config.py' + +## DEPRECATED: does nothing +# Default: False +# c.JupyterHub.confirm_no_ssl = False + +## Number of days for a login cookie to be valid. +# Default is two weeks. +# Default: 14 +# c.JupyterHub.cookie_max_age_days = 14 + +## The cookie secret to use to encrypt cookies. +# +# Loaded from the JPY_COOKIE_SECRET env variable by default. +# +# Should be exactly 256 bits (32 bytes). +# Default: traitlets.Undefined +# c.JupyterHub.cookie_secret = traitlets.Undefined + +## File in which to store the cookie secret. +# Default: 'jupyterhub_cookie_secret' +# c.JupyterHub.cookie_secret_file = 'jupyterhub_cookie_secret' + +## Custom scopes to define. +# +# For use when defining custom roles, +# to grant users granular permissions +# +# All custom scopes must have a description, +# and must start with the prefix `custom:`. +# +# For example:: +# +# custom_scopes = { +# "custom:jupyter_server:read": { +# "description": "read-only access to a single-user server", +# }, +# } +# Default: {} +# c.JupyterHub.custom_scopes = {} + +## The location of jupyterhub data files (e.g. /usr/local/share/jupyterhub) +# Default: '/opt/miniconda3/envs/jupyterhub/share/jupyterhub' +# c.JupyterHub.data_files_path = '/opt/miniconda3/envs/jupyterhub/share/jupyterhub' + +## Include any kwargs to pass to the database connection. +# See sqlalchemy.create_engine for details. +# Default: {} +# c.JupyterHub.db_kwargs = {} + +## url for the database. e.g. `sqlite:///jupyterhub.sqlite` +# Default: 'sqlite:///jupyterhub.sqlite' +# c.JupyterHub.db_url = 'sqlite:///jupyterhub.sqlite' + +## log all database transactions. This has A LOT of output +# Default: False +# c.JupyterHub.debug_db = False + +## DEPRECATED since version 0.8: Use ConfigurableHTTPProxy.debug +# Default: False +# c.JupyterHub.debug_proxy = False + +## If named servers are enabled, default name of server to spawn or open when no +# server is specified, e.g. by user-redirect. +# +# Note: This has no effect if named servers are not enabled, and does _not_ +# change the existence or behavior of the default server named `''` (the empty +# string). This only affects which named server is launched when no server is +# specified, e.g. by links to `/hub/user-redirect/lab/tree/mynotebook.ipynb`. +# Default: '' +# c.JupyterHub.default_server_name = '' + +## The default URL for users when they arrive (e.g. when user directs to "/") +# +# By default, redirects users to their own server. +# +# Can be a Unicode string (e.g. '/hub/home') or a callable based on the handler +# object: +# +# :: +# +# def default_url_fn(handler): +# user = handler.current_user +# if user and user.admin: +# return '/hub/admin' +# return '/hub/home' +# +# c.JupyterHub.default_url = default_url_fn +# Default: traitlets.Undefined +# c.JupyterHub.default_url = traitlets.Undefined + +## Dict authority:dict(files). Specify the key, cert, and/or +# ca file for an authority. This is useful for externally managed +# proxies that wish to use internal_ssl. +# +# The files dict has this format (you must specify at least a cert):: +# +# { +# 'key': '/path/to/key.key', +# 'cert': '/path/to/cert.crt', +# 'ca': '/path/to/ca.crt' +# } +# +# The authorities you can override: 'hub-ca', 'notebooks-ca', +# 'proxy-api-ca', 'proxy-client-ca', and 'services-ca'. +# +# Use with internal_ssl +# Default: {} +# c.JupyterHub.external_ssl_authorities = {} + +## DEPRECATED. +# +# If you need to register additional HTTP endpoints please use services instead. +# Default: [] +# c.JupyterHub.extra_handlers = [] + +## DEPRECATED: use output redirection instead, e.g. +# +# jupyterhub &>> /var/log/jupyterhub.log +# Default: '' +# c.JupyterHub.extra_log_file = '' + +## Extra log handlers to set on JupyterHub logger +# Default: [] +# c.JupyterHub.extra_log_handlers = [] + +## Alternate header to use as the Host (e.g., X-Forwarded-Host) +# when determining whether a request is cross-origin +# +# This may be useful when JupyterHub is running behind a proxy that rewrites +# the Host header. +# Default: '' +# c.JupyterHub.forwarded_host_header = '' + +## Generate certs used for internal ssl +# Default: False +# c.JupyterHub.generate_certs = False + +## Generate default config file +# Default: False +# c.JupyterHub.generate_config = False + +## The URL on which the Hub will listen. This is a private URL for internal +# communication. Typically set in combination with hub_connect_url. If a unix +# socket, hub_connect_url **must** also be set. +# +# For example: +# +# "http://127.0.0.1:8081" +# "unix+http://%2Fsrv%2Fjupyterhub%2Fjupyterhub.sock" +# +# .. versionadded:: 0.9 +# Default: '' +# c.JupyterHub.hub_bind_url = '' + +## The ip or hostname for proxies and spawners to use +# for connecting to the Hub. +# +# Use when the bind address (`hub_ip`) is 0.0.0.0, :: or otherwise different +# from the connect address. +# +# Default: when `hub_ip` is 0.0.0.0 or ::, use `socket.gethostname()`, +# otherwise use `hub_ip`. +# +# Note: Some spawners or proxy implementations might not support hostnames. Check your +# spawner or proxy documentation to see if they have extra requirements. +# +# .. versionadded:: 0.8 +# Default: '' +# c.JupyterHub.hub_connect_ip = '' +# c.JupyterHub.hub_connect_ip = '20.127.203.178' +## DEPRECATED +# +# Use hub_connect_url +# +# .. versionadded:: 0.8 +# +# .. deprecated:: 0.9 +# Use hub_connect_url +# Default: 0 +# c.JupyterHub.hub_connect_port = 0 + +## The URL for connecting to the Hub. Spawners, services, and the proxy will use +# this URL to talk to the Hub. +# +# Only needs to be specified if the default hub URL is not connectable (e.g. +# using a unix+http:// bind url). +# +# .. seealso:: +# JupyterHub.hub_connect_ip +# JupyterHub.hub_bind_url +# +# .. versionadded:: 0.9 +# Default: '' +# c.JupyterHub.hub_connect_url = '' + +## The ip address for the Hub process to *bind* to. +# +# By default, the hub listens on localhost only. This address must be accessible from +# the proxy and user servers. You may need to set this to a public ip or '' for all +# interfaces if the proxy or user servers are in containers or on a different host. +# +# See `hub_connect_ip` for cases where the bind and connect address should differ, +# or `hub_bind_url` for setting the full bind URL. +# Default: '127.0.0.1' +# c.JupyterHub.hub_ip = '127.0.0.1' +# c.JupyterHub.hub_ip = '20.127.203.178' + +## The internal port for the Hub process. +# +# This is the internal port of the hub itself. It should never be accessed directly. +# See JupyterHub.port for the public port to use when accessing jupyterhub. +# It is rare that this port should be set except in cases of port conflict. +# +# See also `hub_ip` for the ip and `hub_bind_url` for setting the full +# bind URL. +# Default: 8081 +# c.JupyterHub.hub_port = 8081 + +## The routing prefix for the Hub itself. +# +# Override to send only a subset of traffic to the Hub. Default is to use the +# Hub as the default route for all requests. +# +# This is necessary for normal jupyterhub operation, as the Hub must receive +# requests for e.g. `/user/:name` when the user's server is not running. +# +# However, some deployments using only the JupyterHub API may want to handle +# these events themselves, in which case they can register their own default +# target with the proxy and set e.g. `hub_routespec = /hub/` to serve only the +# hub's own pages, or even `/hub/api/` for api-only operation. +# +# Note: hub_routespec must include the base_url, if any. +# +# .. versionadded:: 1.4 +# Default: '/' +# c.JupyterHub.hub_routespec = '/' + +## Trigger implicit spawns after this many seconds. +# +# When a user visits a URL for a server that's not running, +# they are shown a page indicating that the requested server +# is not running with a button to spawn the server. +# +# Setting this to a positive value will redirect the user +# after this many seconds, effectively clicking this button +# automatically for the users, +# automatically beginning the spawn process. +# +# Warning: this can result in errors and surprising behavior +# when sharing access URLs to actual servers, +# since the wrong server is likely to be started. +# Default: 0 +# c.JupyterHub.implicit_spawn_seconds = 0 + +## Timeout (in seconds) to wait for spawners to initialize +# +# Checking if spawners are healthy can take a long time if many spawners are +# active at hub start time. +# +# If it takes longer than this timeout to check, init_spawner will be left to +# complete in the background and the http server is allowed to start. +# +# A timeout of -1 means wait forever, which can mean a slow startup of the Hub +# but ensures that the Hub is fully consistent by the time it starts responding +# to requests. This matches the behavior of jupyterhub 1.0. +# +# .. versionadded: 1.1.0 +# Default: 10 +# c.JupyterHub.init_spawners_timeout = 10 + +## The location to store certificates automatically created by +# JupyterHub. +# +# Use with internal_ssl +# Default: 'internal-ssl' +# c.JupyterHub.internal_certs_location = 'internal-ssl' + +## Enable SSL for all internal communication +# +# This enables end-to-end encryption between all JupyterHub components. +# JupyterHub will automatically create the necessary certificate +# authority and sign notebook certificates as they're created. +# Default: False +# c.JupyterHub.internal_ssl = False + +## The public facing ip of the whole JupyterHub application +# (specifically referred to as the proxy). +# +# This is the address on which the proxy will listen. The default is to +# listen on all interfaces. This is the only address through which JupyterHub +# should be accessed by users. +# +# .. deprecated: 0.9 +# Use JupyterHub.bind_url +# Default: '' +# c.JupyterHub.ip = '' + +## Supply extra arguments that will be passed to Jinja environment. +# Default: {} +# c.JupyterHub.jinja_environment_options = {} + +## Interval (in seconds) at which to update last-activity timestamps. +# Default: 300 +# c.JupyterHub.last_activity_interval = 300 + +## Dict of 'group': ['usernames'] to load at startup. +# +# This strictly *adds* groups and users to groups. +# +# Loading one set of groups, then starting JupyterHub again with a different +# set will not remove users or groups from previous launches. +# That must be done through the API. +# Default: {} +# c.JupyterHub.load_groups = {} + +## List of predefined role dictionaries to load at startup. +# +# For instance:: +# +# load_roles = [ +# { +# 'name': 'teacher', +# 'description': 'Access to users' information and group membership', +# 'scopes': ['users', 'groups'], +# 'users': ['cyclops', 'gandalf'], +# 'services': [], +# 'groups': [] +# } +# ] +# +# All keys apart from 'name' are optional. +# See all the available scopes in the JupyterHub REST API documentation. +# +# Default roles are defined in roles.py. +# Default: [] +# c.JupyterHub.load_roles = [] + +## The date format used by logging formatters for %(asctime)s +# See also: Application.log_datefmt +# c.JupyterHub.log_datefmt = '%Y-%m-%d %H:%M:%S' + +## The Logging format template +# See also: Application.log_format +# c.JupyterHub.log_format = '[%(name)s]%(highlevel)s %(message)s' + +## Set the log level by value or name. +# See also: Application.log_level +# c.JupyterHub.log_level = 30 + +## +# See also: Application.logging_config +# c.JupyterHub.logging_config = {} + +## Specify path to a logo image to override the Jupyter logo in the banner. +# Default: '' +# c.JupyterHub.logo_file = '' + +## Maximum number of concurrent named servers that can be created by a user at a +# time. +# +# Setting this can limit the total resources a user can consume. +# +# If set to 0, no limit is enforced. +# +# Can be an integer or a callable/awaitable based on the handler object: +# +# :: +# +# def named_server_limit_per_user_fn(handler): +# user = handler.current_user +# if user and user.admin: +# return 0 +# return 5 +# +# c.JupyterHub.named_server_limit_per_user = named_server_limit_per_user_fn +# Default: 0 +# c.JupyterHub.named_server_limit_per_user = 0 + +## Expiry (in seconds) of OAuth access tokens. +# +# The default is to expire when the cookie storing them expires, +# according to `cookie_max_age_days` config. +# +# These are the tokens stored in cookies when you visit +# a single-user server or service. +# When they expire, you must re-authenticate with the Hub, +# even if your Hub authentication is still valid. +# If your Hub authentication is valid, +# logging in may be a transparent redirect as you refresh the page. +# +# This does not affect JupyterHub API tokens in general, +# which do not expire by default. +# Only tokens issued during the oauth flow +# accessing services and single-user servers are affected. +# +# .. versionadded:: 1.4 +# OAuth token expires_in was not previously configurable. +# .. versionchanged:: 1.4 +# Default now uses cookie_max_age_days so that oauth tokens +# which are generally stored in cookies, +# expire when the cookies storing them expire. +# Previously, it was one hour. +# Default: 0 +# c.JupyterHub.oauth_token_expires_in = 0 + +## File to write PID +# Useful for daemonizing JupyterHub. +# Default: '' +# c.JupyterHub.pid_file = '' + +## The public facing port of the proxy. +# +# This is the port on which the proxy will listen. +# This is the only port through which JupyterHub +# should be accessed by users. +# +# .. deprecated: 0.9 +# Use JupyterHub.bind_url +# Default: 8000 +# c.JupyterHub.port = 8000 + +## DEPRECATED since version 0.8 : Use ConfigurableHTTPProxy.api_url +# Default: '' +# c.JupyterHub.proxy_api_ip = '' + +## DEPRECATED since version 0.8 : Use ConfigurableHTTPProxy.api_url +# Default: 0 +# c.JupyterHub.proxy_api_port = 0 + +## DEPRECATED since version 0.8: Use ConfigurableHTTPProxy.auth_token +# Default: '' +# c.JupyterHub.proxy_auth_token = '' + +## DEPRECATED since version 0.8: Use ConfigurableHTTPProxy.check_running_interval +# Default: 5 +# c.JupyterHub.proxy_check_interval = 5 + +## The class to use for configuring the JupyterHub proxy. +# +# Should be a subclass of :class:`jupyterhub.proxy.Proxy`. +# +# .. versionchanged:: 1.0 +# proxies may be registered via entry points, +# e.g. `c.JupyterHub.proxy_class = 'traefik'` +# +# Currently installed: +# - configurable-http-proxy: jupyterhub.proxy.ConfigurableHTTPProxy +# - default: jupyterhub.proxy.ConfigurableHTTPProxy +# Default: 'jupyterhub.proxy.ConfigurableHTTPProxy' +# c.JupyterHub.proxy_class = 'jupyterhub.proxy.ConfigurableHTTPProxy' + +## DEPRECATED since version 0.8. Use ConfigurableHTTPProxy.command +# Default: [] +# c.JupyterHub.proxy_cmd = [] + +## Recreate all certificates used within JupyterHub on restart. +# +# Note: enabling this feature requires restarting all notebook servers. +# +# Use with internal_ssl +# Default: False +# c.JupyterHub.recreate_internal_certs = False + +## Redirect user to server (if running), instead of control panel. +# Default: True +# c.JupyterHub.redirect_to_server = True + +## Purge and reset the database. +# Default: False +# c.JupyterHub.reset_db = False + +## Interval (in seconds) at which to check connectivity of services with web +# endpoints. +# Default: 60 +# c.JupyterHub.service_check_interval = 60 + +## Dict of token:servicename to be loaded into the database. +# +# Allows ahead-of-time generation of API tokens for use by externally +# managed services. +# Default: {} +# c.JupyterHub.service_tokens = {} + +## List of service specification dictionaries. +# +# A service +# +# For instance:: +# +# services = [ +# { +# 'name': 'cull_idle', +# 'command': ['/path/to/cull_idle_servers.py'], +# }, +# { +# 'name': 'formgrader', +# 'url': 'http://127.0.0.1:1234', +# 'api_token': 'super-secret', +# 'environment': +# } +# ] +# Default: [] +# c.JupyterHub.services = [] + +## Instead of starting the Application, dump configuration to stdout +# See also: Application.show_config +# c.JupyterHub.show_config = False + +## Instead of starting the Application, dump configuration to stdout (as JSON) +# See also: Application.show_config_json +# c.JupyterHub.show_config_json = False + +## Shuts down all user servers on logout +# Default: False +# c.JupyterHub.shutdown_on_logout = False + +## The class to use for spawning single-user servers. +# +# Should be a subclass of :class:`jupyterhub.spawner.Spawner`. +# +# .. versionchanged:: 1.0 +# spawners may be registered via entry points, +# e.g. `c.JupyterHub.spawner_class = 'localprocess'` +# +# Currently installed: +# - default: jupyterhub.spawner.LocalProcessSpawner +# - localprocess: jupyterhub.spawner.LocalProcessSpawner +# - simple: jupyterhub.spawner.SimpleLocalProcessSpawner +# - docker: dockerspawner.DockerSpawner +# - docker-swarm: dockerspawner.SwarmSpawner +# - docker-system-user: dockerspawner.SystemUserSpawner +# Default: 'jupyterhub.spawner.LocalProcessSpawner' +# c.JupyterHub.spawner_class = 'jupyterhub.spawner.LocalProcessSpawner' + +## Path to SSL certificate file for the public facing interface of the proxy +# +# When setting this, you should also set ssl_key +# Default: '' +# c.JupyterHub.ssl_cert = '' + +## Path to SSL key file for the public facing interface of the proxy +# +# When setting this, you should also set ssl_cert +# Default: '' +# c.JupyterHub.ssl_key = '' + +## Host to send statsd metrics to. An empty string (the default) disables sending +# metrics. +# Default: '' +# c.JupyterHub.statsd_host = '' + +## Port on which to send statsd metrics about the hub +# Default: 8125 +# c.JupyterHub.statsd_port = 8125 + +## Prefix to use for all metrics sent by jupyterhub to statsd +# Default: 'jupyterhub' +# c.JupyterHub.statsd_prefix = 'jupyterhub' + +## Run single-user servers on subdomains of this host. +# +# This should be the full `https://hub.domain.tld[:port]`. +# +# Provides additional cross-site protections for javascript served by +# single-user servers. +# +# Requires `.hub.domain.tld` to resolve to the same host as +# `hub.domain.tld`. +# +# In general, this is most easily achieved with wildcard DNS. +# +# When using SSL (i.e. always) this also requires a wildcard SSL +# certificate. +# Default: '' +# c.JupyterHub.subdomain_host = '' + +## Paths to search for jinja templates, before using the default templates. +# Default: [] +# c.JupyterHub.template_paths = [] + +## Extra variables to be passed into jinja templates +# Default: {} +# c.JupyterHub.template_vars = {} + +## Extra settings overrides to pass to the tornado application. +# Default: {} +# c.JupyterHub.tornado_settings = {} + +## Trust user-provided tokens (via JupyterHub.service_tokens) +# to have good entropy. +# +# If you are not inserting additional tokens via configuration file, +# this flag has no effect. +# +# In JupyterHub 0.8, internally generated tokens do not +# pass through additional hashing because the hashing is costly +# and does not increase the entropy of already-good UUIDs. +# +# User-provided tokens, on the other hand, are not trusted to have good entropy by default, +# and are passed through many rounds of hashing to stretch the entropy of the key +# (i.e. user-provided tokens are treated as passwords instead of random keys). +# These keys are more costly to check. +# +# If your inserted tokens are generated by a good-quality mechanism, +# e.g. `openssl rand -hex 32`, then you can set this flag to True +# to reduce the cost of checking authentication tokens. +# Default: False +# c.JupyterHub.trust_user_provided_tokens = False + +## Names to include in the subject alternative name. +# +# These names will be used for server name verification. This is useful +# if JupyterHub is being run behind a reverse proxy or services using ssl +# are on different hosts. +# +# Use with internal_ssl +# Default: [] +# c.JupyterHub.trusted_alt_names = [] + +## Downstream proxy IP addresses to trust. +# +# This sets the list of IP addresses that are trusted and skipped when processing +# the `X-Forwarded-For` header. For example, if an external proxy is used for TLS +# termination, its IP address should be added to this list to ensure the correct +# client IP addresses are recorded in the logs instead of the proxy server's IP +# address. +# Default: [] +# c.JupyterHub.trusted_downstream_ips = [] + +## Upgrade the database automatically on start. +# +# Only safe if database is regularly backed up. +# Only SQLite databases will be backed up to a local file automatically. +# Default: False +# c.JupyterHub.upgrade_db = False + +## Return 503 rather than 424 when request comes in for a non-running server. +# +# Prior to JupyterHub 2.0, we returned a 503 when any request came in for a user +# server that was currently not running. By default, JupyterHub 2.0 will return +# a 424 - this makes operational metric dashboards more useful. +# +# JupyterLab < 3.2 expected the 503 to know if the user server is no longer +# running, and prompted the user to start their server. Set this config to true +# to retain the old behavior, so JupyterLab < 3.2 can continue to show the +# appropriate UI when the user server is stopped. +# +# This option will be removed in a future release. +# Default: False +# c.JupyterHub.use_legacy_stopped_server_status_code = False + +## Callable to affect behavior of /user-redirect/ +# +# Receives 4 parameters: 1. path - URL path that was provided after /user- +# redirect/ 2. request - A Tornado HTTPServerRequest representing the current +# request. 3. user - The currently authenticated user. 4. base_url - The +# base_url of the current hub, for relative redirects +# +# It should return the new URL to redirect to, or None to preserve current +# behavior. +# Default: None +# c.JupyterHub.user_redirect_hook = None + +#------------------------------------------------------------------------------ +# Spawner(LoggingConfigurable) configuration +#------------------------------------------------------------------------------ +## Base class for spawning single-user notebook servers. +# +# Subclass this, and override the following methods: +# +# - load_state +# - get_state +# - start +# - stop +# - poll +# +# As JupyterHub supports multiple users, an instance of the Spawner subclass +# is created for each user. If there are 20 JupyterHub users, there will be 20 +# instances of the subclass. + +## Extra arguments to be passed to the single-user server. +# +# Some spawners allow shell-style expansion here, allowing you to use +# environment variables here. Most, including the default, do not. Consult the +# documentation for your spawner to verify! +# Default: [] +# c.Spawner.args = [] + +## An optional hook function that you can implement to pass `auth_state` to the +# spawner after it has been initialized but before it starts. The `auth_state` +# dictionary may be set by the `.authenticate()` method of the authenticator. +# This hook enables you to pass some or all of that information to your spawner. +# +# Example:: +# +# def userdata_hook(spawner, auth_state): +# spawner.userdata = auth_state["userdata"] +# +# c.Spawner.auth_state_hook = userdata_hook +# Default: None +# c.Spawner.auth_state_hook = None + +## The command used for starting the single-user server. +# +# Provide either a string or a list containing the path to the startup script +# command. Extra arguments, other than this path, should be provided via `args`. +# +# This is usually set if you want to start the single-user server in a different +# python environment (with virtualenv/conda) than JupyterHub itself. +# +# Some spawners allow shell-style expansion here, allowing you to use +# environment variables. Most, including the default, do not. Consult the +# documentation for your spawner to verify! +# Default: ['jupyterhub-singleuser'] +# c.Spawner.cmd = ['jupyterhub-singleuser'] + +## Maximum number of consecutive failures to allow before shutting down +# JupyterHub. +# +# This helps JupyterHub recover from a certain class of problem preventing +# launch in contexts where the Hub is automatically restarted (e.g. systemd, +# docker, kubernetes). +# +# A limit of 0 means no limit and consecutive failures will not be tracked. +# Default: 0 +# c.Spawner.consecutive_failure_limit = 0 + +## Minimum number of cpu-cores a single-user notebook server is guaranteed to +# have available. +# +# If this value is set to 0.5, allows use of 50% of one CPU. If this value is +# set to 2, allows use of up to 2 CPUs. +# +# **This is a configuration setting. Your spawner must implement support for the +# limit to work.** The default spawner, `LocalProcessSpawner`, does **not** +# implement this support. A custom spawner **must** add support for this setting +# for it to be enforced. +# Default: None +# c.Spawner.cpu_guarantee = None + +## Maximum number of cpu-cores a single-user notebook server is allowed to use. +# +# If this value is set to 0.5, allows use of 50% of one CPU. If this value is +# set to 2, allows use of up to 2 CPUs. +# +# The single-user notebook server will never be scheduled by the kernel to use +# more cpu-cores than this. There is no guarantee that it can access this many +# cpu-cores. +# +# **This is a configuration setting. Your spawner must implement support for the +# limit to work.** The default spawner, `LocalProcessSpawner`, does **not** +# implement this support. A custom spawner **must** add support for this setting +# for it to be enforced. +# Default: None +# c.Spawner.cpu_limit = None + +## Enable debug-logging of the single-user server +# Default: False +# c.Spawner.debug = False + +## The URL the single-user server should start in. +# +# `{username}` will be expanded to the user's username +# +# Example uses: +# +# - You can set `notebook_dir` to `/` and `default_url` to `/tree/home/{username}` to allow people to +# navigate the whole filesystem from their notebook server, but still start in their home directory. +# - Start with `/notebooks` instead of `/tree` if `default_url` points to a notebook instead of a directory. +# - You can set this to `/lab` to have JupyterLab start by default, rather than Jupyter Notebook. +# Default: '' +# c.Spawner.default_url = '' + +## Disable per-user configuration of single-user servers. +# +# When starting the user's single-user server, any config file found in the +# user's $HOME directory will be ignored. +# +# Note: a user could circumvent this if the user modifies their Python +# environment, such as when they have their own conda environments / virtualenvs +# / containers. +# Default: False +# c.Spawner.disable_user_config = False + +## List of environment variables for the single-user server to inherit from the +# JupyterHub process. +# +# This list is used to ensure that sensitive information in the JupyterHub +# process's environment (such as `CONFIGPROXY_AUTH_TOKEN`) is not passed to the +# single-user server's process. +# Default: ['PATH', 'PYTHONPATH', 'CONDA_ROOT', 'CONDA_DEFAULT_ENV', 'VIRTUAL_ENV', 'LANG', 'LC_ALL', 'JUPYTERHUB_SINGLEUSER_APP'] +# c.Spawner.env_keep = ['PATH', 'PYTHONPATH', 'CONDA_ROOT', 'CONDA_DEFAULT_ENV', 'VIRTUAL_ENV', 'LANG', 'LC_ALL', 'JUPYTERHUB_SINGLEUSER_APP'] + +## Extra environment variables to set for the single-user server's process. +# +# Environment variables that end up in the single-user server's process come from 3 sources: +# - This `environment` configurable +# - The JupyterHub process' environment variables that are listed in `env_keep` +# - Variables to establish contact between the single-user notebook and the hub (such as JUPYTERHUB_API_TOKEN) +# +# The `environment` configurable should be set by JupyterHub administrators to +# add installation specific environment variables. It is a dict where the key is +# the name of the environment variable, and the value can be a string or a +# callable. If it is a callable, it will be called with one parameter (the +# spawner instance), and should return a string fairly quickly (no blocking +# operations please!). +# +# Note that the spawner class' interface is not guaranteed to be exactly same +# across upgrades, so if you are using the callable take care to verify it +# continues to work after upgrades! +# +# .. versionchanged:: 1.2 +# environment from this configuration has highest priority, +# allowing override of 'default' env variables, +# such as JUPYTERHUB_API_URL. +# Default: {} +# c.Spawner.environment = {} + +## Timeout (in seconds) before giving up on a spawned HTTP server +# +# Once a server has successfully been spawned, this is the amount of time we +# wait before assuming that the server is unable to accept connections. +# Default: 30 +# c.Spawner.http_timeout = 30 + +## The URL the single-user server should connect to the Hub. +# +# If the Hub URL set in your JupyterHub config is not reachable from spawned +# notebooks, you can set differnt URL by this config. +# +# Is None if you don't need to change the URL. +# Default: None +# c.Spawner.hub_connect_url = None + +## The IP address (or hostname) the single-user server should listen on. +# +# Usually either '127.0.0.1' (default) or '0.0.0.0'. +# +# The JupyterHub proxy implementation should be able to send packets to this +# interface. +# +# Subclasses which launch remotely or in containers should override the default +# to '0.0.0.0'. +# +# .. versionchanged:: 2.0 +# Default changed to '127.0.0.1', from ''. +# In most cases, this does not result in a change in behavior, +# as '' was interpreted as 'unspecified', +# which used the subprocesses' own default, itself usually '127.0.0.1'. +# Default: '127.0.0.1' +# c.Spawner.ip = '127.0.0.1' + +## Minimum number of bytes a single-user notebook server is guaranteed to have +# available. +# +# Allows the following suffixes: +# - K -> Kilobytes +# - M -> Megabytes +# - G -> Gigabytes +# - T -> Terabytes +# +# **This is a configuration setting. Your spawner must implement support for the +# limit to work.** The default spawner, `LocalProcessSpawner`, does **not** +# implement this support. A custom spawner **must** add support for this setting +# for it to be enforced. +# Default: None +# c.Spawner.mem_guarantee = None + +## Maximum number of bytes a single-user notebook server is allowed to use. +# +# Allows the following suffixes: +# - K -> Kilobytes +# - M -> Megabytes +# - G -> Gigabytes +# - T -> Terabytes +# +# If the single user server tries to allocate more memory than this, it will +# fail. There is no guarantee that the single-user notebook server will be able +# to allocate this much memory - only that it can not allocate more than this. +# +# **This is a configuration setting. Your spawner must implement support for the +# limit to work.** The default spawner, `LocalProcessSpawner`, does **not** +# implement this support. A custom spawner **must** add support for this setting +# for it to be enforced. +# Default: None +# c.Spawner.mem_limit = None + +## Path to the notebook directory for the single-user server. +# +# The user sees a file listing of this directory when the notebook interface is +# started. The current interface does not easily allow browsing beyond the +# subdirectories in this directory's tree. +# +# `~` will be expanded to the home directory of the user, and {username} will be +# replaced with the name of the user. +# +# Note that this does *not* prevent users from accessing files outside of this +# path! They can do so with many other means. +# Default: '' +# c.Spawner.notebook_dir = '' + +## Allowed scopes for oauth tokens issued by this server's oauth client. +# +# This sets the maximum and default scopes +# assigned to oauth tokens issued by a single-user server's +# oauth client (i.e. tokens stored in browsers after authenticating with the server), +# defining what actions the server can take on behalf of logged-in users. +# +# Default is an empty list, meaning minimal permissions to identify users, +# no actions can be taken on their behalf. +# +# If callable, will be called with the Spawner as a single argument. +# Callables may be async. +# Default: traitlets.Undefined +# c.Spawner.oauth_client_allowed_scopes = traitlets.Undefined + +## Allowed roles for oauth tokens. +# +# Deprecated in 3.0: use oauth_client_allowed_scopes +# +# This sets the maximum and default roles +# assigned to oauth tokens issued by a single-user server's +# oauth client (i.e. tokens stored in browsers after authenticating with the server), +# defining what actions the server can take on behalf of logged-in users. +# +# Default is an empty list, meaning minimal permissions to identify users, +# no actions can be taken on their behalf. +# Default: traitlets.Undefined +# c.Spawner.oauth_roles = traitlets.Undefined + +## An HTML form for options a user can specify on launching their server. +# +# The surrounding `
` element and the submit button are already provided. +# +# For example: +# +# .. code:: html +# +# Set your key: +# +#
+# Choose a letter: +# +# +# The data from this form submission will be passed on to your spawner in +# `self.user_options` +# +# Instead of a form snippet string, this could also be a callable that takes as +# one parameter the current spawner instance and returns a string. The callable +# will be called asynchronously if it returns a future, rather than a str. Note +# that the interface of the spawner class is not deemed stable across versions, +# so using this functionality might cause your JupyterHub upgrades to break. +# Default: traitlets.Undefined +# c.Spawner.options_form = traitlets.Undefined + +## Interpret HTTP form data +# +# Form data will always arrive as a dict of lists of strings. Override this +# function to understand single-values, numbers, etc. +# +# This should coerce form data into the structure expected by self.user_options, +# which must be a dict, and should be JSON-serializeable, though it can contain +# bytes in addition to standard JSON data types. +# +# This method should not have any side effects. Any handling of `user_options` +# should be done in `.start()` to ensure consistent behavior across servers +# spawned via the API and form submission page. +# +# Instances will receive this data on self.user_options, after passing through +# this function, prior to `Spawner.start`. +# +# .. versionchanged:: 1.0 +# user_options are persisted in the JupyterHub database to be reused +# on subsequent spawns if no options are given. +# user_options is serialized to JSON as part of this persistence +# (with additional support for bytes in case of uploaded file data), +# and any non-bytes non-jsonable values will be replaced with None +# if the user_options are re-used. +# Default: traitlets.Undefined +# c.Spawner.options_from_form = traitlets.Undefined + +## Interval (in seconds) on which to poll the spawner for single-user server's +# status. +# +# At every poll interval, each spawner's `.poll` method is called, which checks +# if the single-user server is still running. If it isn't running, then +# JupyterHub modifies its own state accordingly and removes appropriate routes +# from the configurable proxy. +# Default: 30 +# c.Spawner.poll_interval = 30 + +## The port for single-user servers to listen on. +# +# Defaults to `0`, which uses a randomly allocated port number each time. +# +# If set to a non-zero value, all Spawners will use the same port, which only +# makes sense if each server is on a different address, e.g. in containers. +# +# New in version 0.7. +# Default: 0 +# c.Spawner.port = 0 + +## An optional hook function that you can implement to do work after the spawner +# stops. +# +# This can be set independent of any concrete spawner implementation. +# Default: None +# c.Spawner.post_stop_hook = None + +## An optional hook function that you can implement to do some bootstrapping work +# before the spawner starts. For example, create a directory for your user or +# load initial content. +# +# This can be set independent of any concrete spawner implementation. +# +# This maybe a coroutine. +# +# Example:: +# +# from subprocess import check_call +# def my_hook(spawner): +# username = spawner.user.name +# check_call(['./examples/bootstrap-script/bootstrap.sh', username]) +# +# c.Spawner.pre_spawn_hook = my_hook +# Default: None +# c.Spawner.pre_spawn_hook = None + +## List of SSL alt names +# +# May be set in config if all spawners should have the same value(s), +# or set at runtime by Spawner that know their names. +# Default: [] +# c.Spawner.ssl_alt_names = [] + +## Whether to include DNS:localhost, IP:127.0.0.1 in alt names +# Default: True +# c.Spawner.ssl_alt_names_include_local = True + +## Timeout (in seconds) before giving up on starting of single-user server. +# +# This is the timeout for start to return, not the timeout for the server to +# respond. Callers of spawner.start will assume that startup has failed if it +# takes longer than this. start should return when the server process is started +# and its location is known. +# Default: 60 +# c.Spawner.start_timeout = 60 + +#------------------------------------------------------------------------------ +# Authenticator(LoggingConfigurable) configuration +#------------------------------------------------------------------------------ +## Base class for implementing an authentication provider for JupyterHub + +## Set of users that will have admin rights on this JupyterHub. +# +# Note: As of JupyterHub 2.0, full admin rights should not be required, and more +# precise permissions can be managed via roles. +# +# Admin users have extra privileges: +# - Use the admin panel to see list of users logged in +# - Add / remove users in some authenticators +# - Restart / halt the hub +# - Start / stop users' single-user servers +# - Can access each individual users' single-user server (if configured) +# +# Admin access should be treated the same way root access is. +# +# Defaults to an empty set, in which case no user has admin access. +# Default: set() +# c.Authenticator.admin_users = set() + +## Set of usernames that are allowed to log in. +# +# Use this with supported authenticators to restrict which users can log in. +# This is an additional list that further restricts users, beyond whatever +# restrictions the authenticator has in place. Any user in this list is granted +# the 'user' role on hub startup. +# +# If empty, does not perform any additional restriction. +# +# .. versionchanged:: 1.2 +# `Authenticator.whitelist` renamed to `allowed_users` +# Default: set() +# c.Authenticator.allowed_users = set() + +## The max age (in seconds) of authentication info +# before forcing a refresh of user auth info. +# +# Refreshing auth info allows, e.g. requesting/re-validating auth +# tokens. +# +# See :meth:`.refresh_user` for what happens when user auth info is refreshed +# (nothing by default). +# Default: 300 +# c.Authenticator.auth_refresh_age = 300 + +## Automatically begin the login process +# +# rather than starting with a "Login with..." link at `/hub/login` +# +# To work, `.login_url()` must give a URL other than the default `/hub/login`, +# such as an oauth handler or another automatic login handler, +# registered with `.get_handlers()`. +# +# .. versionadded:: 0.8 +# Default: False +# c.Authenticator.auto_login = False + +## Automatically begin login process for OAuth2 authorization requests +# +# When another application is using JupyterHub as OAuth2 provider, it sends +# users to `/hub/api/oauth2/authorize`. If the user isn't logged in already, and +# auto_login is not set, the user will be dumped on the hub's home page, without +# any context on what to do next. +# +# Setting this to true will automatically redirect users to login if they aren't +# logged in *only* on the `/hub/api/oauth2/authorize` endpoint. +# +# .. versionadded:: 1.5 +# Default: False +# c.Authenticator.auto_login_oauth2_authorize = False + +## Set of usernames that are not allowed to log in. +# +# Use this with supported authenticators to restrict which users can not log in. +# This is an additional block list that further restricts users, beyond whatever +# restrictions the authenticator has in place. +# +# If empty, does not perform any additional restriction. +# +# .. versionadded: 0.9 +# +# .. versionchanged:: 1.2 +# `Authenticator.blacklist` renamed to `blocked_users` +# Default: set() +# c.Authenticator.blocked_users = set() + +## Delete any users from the database that do not pass validation +# +# When JupyterHub starts, `.add_user` will be called +# on each user in the database to verify that all users are still valid. +# +# If `delete_invalid_users` is True, +# any users that do not pass validation will be deleted from the database. +# Use this if users might be deleted from an external system, +# such as local user accounts. +# +# If False (default), invalid users remain in the Hub's database +# and a warning will be issued. +# This is the default to avoid data loss due to config changes. +# Default: False +# c.Authenticator.delete_invalid_users = False + +## Enable persisting auth_state (if available). +# +# auth_state will be encrypted and stored in the Hub's database. +# This can include things like authentication tokens, etc. +# to be passed to Spawners as environment variables. +# +# Encrypting auth_state requires the cryptography package. +# +# Additionally, the JUPYTERHUB_CRYPT_KEY environment variable must +# contain one (or more, separated by ;) 32B encryption keys. +# These can be either base64 or hex-encoded. +# +# If encryption is unavailable, auth_state cannot be persisted. +# +# New in JupyterHub 0.8 +# Default: False +# c.Authenticator.enable_auth_state = False + +## Let authenticator manage user groups +# +# If True, Authenticator.authenticate and/or .refresh_user +# may return a list of group names in the 'groups' field, +# which will be assigned to the user. +# +# All group-assignment APIs are disabled if this is True. +# Default: False +# c.Authenticator.manage_groups = False + +## An optional hook function that you can implement to do some bootstrapping work +# during authentication. For example, loading user account details from an +# external system. +# +# This function is called after the user has passed all authentication checks +# and is ready to successfully authenticate. This function must return the +# authentication dict reguardless of changes to it. +# +# This maybe a coroutine. +# +# .. versionadded: 1.0 +# +# Example:: +# +# import os, pwd +# def my_hook(authenticator, handler, authentication): +# user_data = pwd.getpwnam(authentication['name']) +# spawn_data = { +# 'pw_data': user_data +# 'gid_list': os.getgrouplist(authentication['name'], user_data.pw_gid) +# } +# +# if authentication['auth_state'] is None: +# authentication['auth_state'] = {} +# authentication['auth_state']['spawn_data'] = spawn_data +# +# return authentication +# +# c.Authenticator.post_auth_hook = my_hook +# Default: None +# c.Authenticator.post_auth_hook = None + +## Force refresh of auth prior to spawn. +# +# This forces :meth:`.refresh_user` to be called prior to launching +# a server, to ensure that auth state is up-to-date. +# +# This can be important when e.g. auth tokens that may have expired +# are passed to the spawner via environment variables from auth_state. +# +# If refresh_user cannot refresh the user auth data, +# launch will fail until the user logs in again. +# Default: False +# c.Authenticator.refresh_pre_spawn = False + +## Dictionary mapping authenticator usernames to JupyterHub users. +# +# Primarily used to normalize OAuth user names to local users. +# Default: {} +# c.Authenticator.username_map = {} + +## Regular expression pattern that all valid usernames must match. +# +# If a username does not match the pattern specified here, authentication will +# not be attempted. +# +# If not set, allow any username. +# Default: '' +# c.Authenticator.username_pattern = '' + +## Deprecated, use `Authenticator.allowed_users` +# Default: set() +# c.Authenticator.whitelist = set() + +#------------------------------------------------------------------------------ +# CryptKeeper(SingletonConfigurable) configuration +#------------------------------------------------------------------------------ +## Encapsulate encryption configuration +# +# Use via the encryption_config singleton below. + +# Default: [] +# c.CryptKeeper.keys = [] + +## The number of threads to allocate for encryption +# Default: 2 +# c.CryptKeeper.n_threads = 2 +(base) [eeholmes@Centos8-Server jupyterhub]$ ls -la +total 188 +drwxr-xr-x. 2 root root 91 Oct 3 17:18 . +drwxr-xr-x. 5 root root 54 Oct 2 16:01 .. +-rw-r--r--. 1 root root 56549 Oct 4 20:16 jupyterhub_config.py +-rw-------. 1 root root 65 Oct 2 16:45 jupyterhub_cookie_secret +-rw-r--r--. 1 root root 131072 Oct 3 17:18 jupyterhub.sqlite +(base) [eeholmes@Centos8-Server jupyterhub]$ cd .. +(base) [eeholmes@Centos8-Server etc]$ ls +jupyter jupyterhub systemd +(base) [eeholmes@Centos8-Server etc]$ ls jupyter +jupyter_notebook_config.d jupyter_server_config.d +(base) [eeholmes@Centos8-Server etc]$ ls -la jupyter +total 0 +drwxr-xr-x. 4 root root 70 Oct 2 13:40 . +drwxr-xr-x. 5 root root 54 Oct 2 16:01 .. +drwxr-xr-x. 2 root root 61 Oct 2 13:40 jupyter_notebook_config.d +drwxr-xr-x. 2 root root 143 Oct 2 13:40 jupyter_server_config.d +(base) [eeholmes@Centos8-Server etc]$ cd jupyter +(base) [eeholmes@Centos8-Server jupyter]$ cd jupyter_server_config.d +(base) [eeholmes@Centos8-Server jupyter_server_config.d]$ ls +jupyterlab.json jupyter_server_ydoc.json notebook_shim.json +jupyter_server_fileid.json nbclassic.json +(base) [eeholmes@Centos8-Server jupyter_server_config.d]$ cd .. +(base) [eeholmes@Centos8-Server jupyter]$ cd .. +(base) [eeholmes@Centos8-Server etc]$ ls +jupyter jupyterhub systemd +(base) [eeholmes@Centos8-Server etc]$ cd systemd +(base) [eeholmes@Centos8-Server systemd]$ ls -la +total 4 +drwxr-xr-x. 2 root root 32 Oct 2 16:00 . +drwxr-xr-x. 5 root root 54 Oct 2 16:01 .. +-rw-r--r--. 1 root root 362 Oct 2 16:12 jupyterhub.service +(base) [eeholmes@Centos8-Server systemd]$ +(base) [eeholmes@Centos8-Server systemd]$ systemctl start jupyterhub.service +==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ==== +Authentication is required to start 'jupyterhub.service'. +Authenticating as: root +Password: +polkit-agent-helper-1: pam_authenticate failed: Authentication failure +==== AUTHENTICATION FAILED ==== +Failed to start jupyterhub.service: Access denied +See system logs and 'systemctl status jupyterhub.service' for details. +(base) [eeholmes@Centos8-Server systemd]$ sudo systemctl start jupyterhub.service +(base) [eeholmes@Centos8-Server systemd]$ ps -ef +UID PID PPID C STIME TTY TIME CMD +root 1 0 0 Oct02 ? 00:01:10 /usr/lib/systemd/systemd --system --deserializ +root 2 0 0 Oct02 ? 00:00:00 [kthreadd] +root 3 2 0 Oct02 ? 00:00:00 [rcu_gp] +root 4 2 0 Oct02 ? 00:00:00 [rcu_par_gp] +root 6 2 0 Oct02 ? 00:00:00 [kworker/0:0H-events_highpri] +root 9 2 0 Oct02 ? 00:00:00 [mm_percpu_wq] +root 10 2 0 Oct02 ? 00:00:04 [ksoftirqd/0] +root 11 2 0 Oct02 ? 00:01:14 [rcu_sched] +root 12 2 0 Oct02 ? 00:00:00 [migration/0] +root 13 2 0 Oct02 ? 00:00:00 [watchdog/0] +root 14 2 0 Oct02 ? 00:00:00 [cpuhp/0] +root 15 2 0 Oct02 ? 00:00:00 [cpuhp/1] +root 16 2 0 Oct02 ? 00:00:00 [watchdog/1] +root 17 2 0 Oct02 ? 00:00:00 [migration/1] +root 18 2 0 Oct02 ? 00:00:12 [ksoftirqd/1] +root 20 2 0 Oct02 ? 00:00:00 [kworker/1:0H-events_highpri] +root 23 2 0 Oct02 ? 00:00:00 [kdevtmpfs] +root 24 2 0 Oct02 ? 00:00:00 [netns] +root 25 2 0 Oct02 ? 00:00:00 [rcu_tasks_trace] +root 26 2 0 Oct02 ? 00:00:00 [rcu_tasks_rude_] +root 27 2 0 Oct02 ? 00:00:01 [kauditd] +root 28 2 0 Oct02 ? 00:00:00 [khungtaskd] +root 29 2 0 Oct02 ? 00:00:00 [oom_reaper] +root 30 2 0 Oct02 ? 00:00:00 [writeback] +root 31 2 0 Oct02 ? 00:00:00 [kcompactd0] +root 32 2 0 Oct02 ? 00:00:00 [ksmd] +root 33 2 0 Oct02 ? 00:00:11 [khugepaged] +root 34 2 0 Oct02 ? 00:00:00 [crypto] +root 35 2 0 Oct02 ? 00:00:00 [kintegrityd] +root 36 2 0 Oct02 ? 00:00:00 [kblockd] +root 37 2 0 Oct02 ? 00:00:00 [blkcg_punt_bio] +root 38 2 0 Oct02 ? 00:00:00 [tpm_dev_wq] +root 39 2 0 Oct02 ? 00:00:00 [md] +root 40 2 0 Oct02 ? 00:00:00 [edac-poller] +root 41 2 0 Oct02 ? 00:00:00 [watchdogd] +root 43 2 0 Oct02 ? 00:00:07 [kworker/0:1H-kblockd] +root 76 2 0 Oct02 ? 00:00:10 [kswapd0] +root 178 2 0 Oct02 ? 00:00:00 [kthrotld] +root 179 2 0 Oct02 ? 00:00:00 [acpi_thermal_pm] +root 180 2 0 Oct02 ? 00:00:00 [kmpath_rdacd] +root 181 2 0 Oct02 ? 00:00:00 [kaluad] +root 183 2 0 Oct02 ? 00:00:02 [kworker/1:1H-kblockd] +root 184 2 0 Oct02 ? 00:00:00 [ipv6_addrconf] +root 185 2 0 Oct02 ? 00:00:00 [kstrp] +root 416 2 0 Oct02 ? 00:00:00 [hv_vmbus_con] +root 418 2 0 Oct02 ? 00:00:00 [hv_pri_chan] +root 420 2 0 Oct02 ? 00:00:00 [hv_sub_chan] +root 430 2 0 Oct02 ? 00:00:00 [ata_sff] +root 433 2 0 Oct02 ? 00:00:00 [scsi_eh_0] +root 434 2 0 Oct02 ? 00:00:00 [scsi_eh_1] +root 436 2 0 Oct02 ? 00:00:00 [scsi_eh_2] +root 437 2 0 Oct02 ? 00:00:00 [scsi_tmf_1] +root 438 2 0 Oct02 ? 00:00:00 [scsi_tmf_0] +root 439 2 0 Oct02 ? 00:00:00 [scsi_tmf_2] +root 440 2 0 Oct02 ? 00:00:00 [scsi_eh_3] +root 442 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 443 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 445 2 0 Oct02 ? 00:00:00 [scsi_eh_4] +root 446 2 0 Oct02 ? 00:00:00 [scsi_tmf_3] +root 447 2 0 Oct02 ? 00:00:00 [scsi_eh_5] +root 448 2 0 Oct02 ? 00:00:00 [scsi_tmf_4] +root 449 2 0 Oct02 ? 00:00:00 [scsi_tmf_5] +root 450 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 451 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 471 2 0 Oct02 ? 00:00:00 [xfsalloc] +root 472 2 0 Oct02 ? 00:00:00 [xfs_mru_cache] +root 473 2 0 Oct02 ? 00:00:00 [xfs-buf/sdb2] +root 474 2 0 Oct02 ? 00:00:00 [xfs-conv/sdb2] +root 475 2 0 Oct02 ? 00:00:00 [xfs-cil/sdb2] +root 476 2 0 Oct02 ? 00:00:00 [xfs-reclaim/sdb] +root 477 2 0 Oct02 ? 00:00:00 [xfs-eofblocks/s] +root 478 2 0 Oct02 ? 00:00:00 [xfs-log/sdb2] +root 479 2 0 Oct02 ? 00:01:03 [xfsaild/sdb2] +root 578 1 0 Oct02 ? 00:00:14 /usr/lib/systemd/systemd-journald +root 607 1 0 Oct02 ? 00:00:02 /usr/lib/systemd/systemd-udevd +root 621 2 0 Oct02 ? 00:00:07 [hv_balloon] +root 658 2 0 Oct02 ? 00:00:00 [xfs-buf/sdb1] +root 659 2 0 Oct02 ? 00:00:00 [xfs-conv/sdb1] +root 662 2 0 Oct02 ? 00:00:00 [xfs-cil/sdb1] +root 665 2 0 Oct02 ? 00:00:00 [xfs-reclaim/sdb] +root 666 2 0 Oct02 ? 00:00:00 [xfs-eofblocks/s] +root 670 2 0 Oct02 ? 00:00:00 [xfs-log/sdb1] +root 672 2 0 Oct02 ? 00:00:00 [xfsaild/sdb1] +root 675 2 0 Oct02 ? 00:00:00 [nfit] +systemd+ 711 1 0 Oct02 ? 00:00:01 /usr/lib/systemd/systemd-resolved +root 712 1 0 Oct02 ? 00:00:03 /sbin/auditd +polkitd 736 1 0 Oct02 ? 00:00:07 /usr/lib/polkit-1/polkitd --no-debug +root 737 1 0 Oct02 ? 00:00:00 /usr/sbin/sssd -i --logger=files +root 739 1 0 Oct02 ? 00:00:19 /usr/sbin/irqbalance --foreground +root 741 1 0 Oct02 ? 00:00:00 /usr/sbin/smartd -n -q never +dbus 745 1 0 Oct02 ? 00:00:12 /usr/bin/dbus-daemon --system --address=system +libstor+ 747 1 0 Oct02 ? 00:00:01 /usr/bin/lsmd -d +root 751 1 0 Oct02 ? 00:00:00 /usr/sbin/mcelog --ignorenodev --daemon --fore +chrony 760 1 0 Oct02 ? 00:02:19 /usr/sbin/chronyd +rngd 779 1 0 Oct02 ? 00:01:14 /usr/sbin/rngd -f --fill-watermark=0 +root 794 737 0 Oct02 ? 00:00:05 /usr/libexec/sssd/sssd_be --domain implicit_fi +root 798 737 0 Oct02 ? 00:00:27 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --l +root 801 1 0 Oct02 ? 00:00:03 /usr/lib/systemd/systemd-logind +root 863 1 0 Oct02 ? 00:00:12 /usr/sbin/NetworkManager --no-daemon +root 866 1 0 Oct02 ? 00:07:06 /usr/sbin/hypervkvpd -n +root 867 1 0 Oct02 ? 00:04:13 /usr/libexec/platform-python -Es /usr/sbin/tun +root 975 2 0 Oct02 ? 00:00:00 [jbd2/sda1-8] +root 976 2 0 Oct02 ? 00:00:00 [ext4-rsv-conver] +root 1042 1 0 Oct02 ? 00:00:00 /usr/bin/python3.6 -u /usr/sbin/waagent -daemo +root 1043 1 0 Oct02 ? 00:00:38 /usr/sbin/rsyslogd -n +root 1055 1 0 Oct02 ? 00:00:01 /usr/sbin/crond -n +root 1056 1 0 Oct02 ttyS0 00:00:00 /sbin/agetty -o -p -- \u --keep-baud 115200,38 +root 1058 1 0 Oct02 ? 00:00:00 /usr/sbin/atd -f +root 1062 1 0 Oct02 tty1 00:00:00 /sbin/agetty -o -p -- \u --noclear tty1 linux +root 1292 1 0 Oct02 ? 00:00:04 /usr/sbin/sshd -D -oCiphers=aes256-gcm@openssh +root 3284 1042 0 Oct02 ? 00:20:35 /usr/bin/python3.6 -u bin/WALinuxAgent-2.10.0. +root 5496 1 0 Oct02 ? 00:00:00 /bin/bash /var/lib/waagent/Microsoft.GuestConf +root 5497 5496 0 Oct02 ? 00:01:31 /var/lib/waagent/Microsoft.GuestConfiguration. +eeholmes 6547 1 0 Oct02 ? 00:01:06 /usr/lib/systemd/systemd --user +eeholmes 6551 6547 0 Oct02 ? 00:00:00 (sd-pam) +root 7300 1 0 Oct02 ? 00:00:18 /usr/libexec/platform-python -s /usr/sbin/fire +jhub 42239 1 0 Oct02 ? 00:00:36 /opt/miniconda3/envs/jupyterhub/bin/python /op +root 74481 1 0 Oct02 ? 00:02:43 /usr/bin/containerd +root 397323 1 0 Oct04 ? 00:03:36 /usr/bin/dockerd -H fd:// --containerd=/run/co +root 580957 2 0 18:22 ? 00:00:00 [kworker/u4:1-events_unbound] +root 581214 2 0 18:41 ? 00:00:00 [kworker/u4:0-events_unbound] +root 581977 2 0 19:01 ? 00:00:00 [kworker/0:0-events_power_efficient] +root 582275 1292 0 19:14 ? 00:00:00 sshd: eeholmes [priv] +eeholmes 582278 582275 0 19:14 ? 00:00:00 sshd: eeholmes@pts/1 +eeholmes 582279 582278 0 19:14 pts/1 00:00:00 -bash +root 582459 1 0 19:22 ? 00:00:01 /opt/miniconda3/envs/jupyterhub/bin/python /op +root 582464 582459 0 19:22 ? 00:00:02 node /opt/miniconda3/envs/jupyterhub/bin/confi +root 582636 397323 0 19:28 ? 00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip 127. +root 582649 1 0 19:28 ? 00:00:00 /usr/bin/containerd-shim-runc-v2 -namespace mo +eeholmes 582668 582649 1 19:28 ? 00:00:17 /srv/conda/envs/notebook/bin/python3.9 /srv/co +eeholmes 582718 582668 0 19:29 ? 00:00:00 /bin/bash -l +eeholmes 582761 582668 0 19:31 ? 00:00:01 rserver --auth-none=1 --www-frame-origin=same +eeholmes 582790 582761 0 19:31 ? 00:00:05 /usr/lib/rstudio-server/bin/rsession -u rstudi +eeholmes 582862 582790 0 19:31 pts/1 00:00:00 bash -l +root 582891 2 0 19:32 ? 00:00:00 [kworker/1:2-ata_sff] +root 582923 582668 0 19:34 ? 00:00:00 [sudo] +root 582934 582668 0 19:35 ? 00:00:00 [sudo] +root 582943 582668 0 19:36 ? 00:00:00 [sudo] +root 582946 582668 0 19:36 ? 00:00:00 [sudo] +root 582955 582668 0 19:36 ? 00:00:00 [sudo] +root 582964 582668 0 19:36 ? 00:00:00 [sudo] +root 582974 582668 0 19:37 ? 00:00:00 [sudo] +root 582988 2 0 19:38 ? 00:00:00 [kworker/1:1-ata_sff] +root 582996 2 0 19:39 ? 00:00:00 [kworker/0:1-events_power_efficient] +root 583082 2 0 19:43 ? 00:00:00 [kworker/1:0-mm_percpu_wq] +root 583140 5497 1 19:44 ? 00:00:00 /var/lib/waagent/Microsoft.GuestConfiguration. +root 583148 583140 0 19:44 ? 00:00:00 sh -c bash /var/lib/GuestConfig/Configuration/ +root 583149 583148 0 19:44 ? 00:00:00 bash /var/lib/GuestConfig/Configuration/AzureL +root 583154 583149 5 19:44 ? 00:00:00 python3 /var/lib/GuestConfig/Configuration/Azu +eeholmes 583155 582279 0 19:44 pts/1 00:00:00 ps -ef +(base) [eeholmes@Centos8-Server systemd]$ ps -ef +UID PID PPID C STIME TTY TIME CMD +root 1 0 0 Oct02 ? 00:01:10 /usr/lib/systemd/systemd --system --deserialize 20 +root 2 0 0 Oct02 ? 00:00:00 [kthreadd] +root 3 2 0 Oct02 ? 00:00:00 [rcu_gp] +root 4 2 0 Oct02 ? 00:00:00 [rcu_par_gp] +root 6 2 0 Oct02 ? 00:00:00 [kworker/0:0H-events_highpri] +root 9 2 0 Oct02 ? 00:00:00 [mm_percpu_wq] +root 10 2 0 Oct02 ? 00:00:04 [ksoftirqd/0] +root 11 2 0 Oct02 ? 00:01:15 [rcu_sched] +root 12 2 0 Oct02 ? 00:00:00 [migration/0] +root 13 2 0 Oct02 ? 00:00:00 [watchdog/0] +root 14 2 0 Oct02 ? 00:00:00 [cpuhp/0] +root 15 2 0 Oct02 ? 00:00:00 [cpuhp/1] +root 16 2 0 Oct02 ? 00:00:00 [watchdog/1] +root 17 2 0 Oct02 ? 00:00:00 [migration/1] +root 18 2 0 Oct02 ? 00:00:12 [ksoftirqd/1] +root 20 2 0 Oct02 ? 00:00:00 [kworker/1:0H-events_highpri] +root 23 2 0 Oct02 ? 00:00:00 [kdevtmpfs] +root 24 2 0 Oct02 ? 00:00:00 [netns] +root 25 2 0 Oct02 ? 00:00:00 [rcu_tasks_trace] +root 26 2 0 Oct02 ? 00:00:00 [rcu_tasks_rude_] +root 27 2 0 Oct02 ? 00:00:01 [kauditd] +root 28 2 0 Oct02 ? 00:00:00 [khungtaskd] +root 29 2 0 Oct02 ? 00:00:00 [oom_reaper] +root 30 2 0 Oct02 ? 00:00:00 [writeback] +root 31 2 0 Oct02 ? 00:00:00 [kcompactd0] +root 32 2 0 Oct02 ? 00:00:00 [ksmd] +root 33 2 0 Oct02 ? 00:00:11 [khugepaged] +root 34 2 0 Oct02 ? 00:00:00 [crypto] +root 35 2 0 Oct02 ? 00:00:00 [kintegrityd] +root 36 2 0 Oct02 ? 00:00:00 [kblockd] +root 37 2 0 Oct02 ? 00:00:00 [blkcg_punt_bio] +root 38 2 0 Oct02 ? 00:00:00 [tpm_dev_wq] +root 39 2 0 Oct02 ? 00:00:00 [md] +root 40 2 0 Oct02 ? 00:00:00 [edac-poller] +root 41 2 0 Oct02 ? 00:00:00 [watchdogd] +root 43 2 0 Oct02 ? 00:00:07 [kworker/0:1H-kblockd] +root 76 2 0 Oct02 ? 00:00:10 [kswapd0] +root 178 2 0 Oct02 ? 00:00:00 [kthrotld] +root 179 2 0 Oct02 ? 00:00:00 [acpi_thermal_pm] +root 180 2 0 Oct02 ? 00:00:00 [kmpath_rdacd] +root 181 2 0 Oct02 ? 00:00:00 [kaluad] +root 183 2 0 Oct02 ? 00:00:02 [kworker/1:1H-kblockd] +root 184 2 0 Oct02 ? 00:00:00 [ipv6_addrconf] +root 185 2 0 Oct02 ? 00:00:00 [kstrp] +root 416 2 0 Oct02 ? 00:00:00 [hv_vmbus_con] +root 418 2 0 Oct02 ? 00:00:00 [hv_pri_chan] +root 420 2 0 Oct02 ? 00:00:00 [hv_sub_chan] +root 430 2 0 Oct02 ? 00:00:00 [ata_sff] +root 433 2 0 Oct02 ? 00:00:00 [scsi_eh_0] +root 434 2 0 Oct02 ? 00:00:00 [scsi_eh_1] +root 436 2 0 Oct02 ? 00:00:00 [scsi_eh_2] +root 437 2 0 Oct02 ? 00:00:00 [scsi_tmf_1] +root 438 2 0 Oct02 ? 00:00:00 [scsi_tmf_0] +root 439 2 0 Oct02 ? 00:00:00 [scsi_tmf_2] +root 440 2 0 Oct02 ? 00:00:00 [scsi_eh_3] +root 442 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 443 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 445 2 0 Oct02 ? 00:00:00 [scsi_eh_4] +root 446 2 0 Oct02 ? 00:00:00 [scsi_tmf_3] +root 447 2 0 Oct02 ? 00:00:00 [scsi_eh_5] +root 448 2 0 Oct02 ? 00:00:00 [scsi_tmf_4] +root 449 2 0 Oct02 ? 00:00:00 [scsi_tmf_5] +root 450 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 451 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 471 2 0 Oct02 ? 00:00:00 [xfsalloc] +root 472 2 0 Oct02 ? 00:00:00 [xfs_mru_cache] +root 473 2 0 Oct02 ? 00:00:00 [xfs-buf/sdb2] +root 474 2 0 Oct02 ? 00:00:00 [xfs-conv/sdb2] +root 475 2 0 Oct02 ? 00:00:00 [xfs-cil/sdb2] +root 476 2 0 Oct02 ? 00:00:00 [xfs-reclaim/sdb] +root 477 2 0 Oct02 ? 00:00:00 [xfs-eofblocks/s] +root 478 2 0 Oct02 ? 00:00:00 [xfs-log/sdb2] +root 479 2 0 Oct02 ? 00:01:03 [xfsaild/sdb2] +root 578 1 0 Oct02 ? 00:00:14 /usr/lib/systemd/systemd-journald +root 607 1 0 Oct02 ? 00:00:02 /usr/lib/systemd/systemd-udevd +root 621 2 0 Oct02 ? 00:00:07 [hv_balloon] +root 658 2 0 Oct02 ? 00:00:00 [xfs-buf/sdb1] +root 659 2 0 Oct02 ? 00:00:00 [xfs-conv/sdb1] +root 662 2 0 Oct02 ? 00:00:00 [xfs-cil/sdb1] +root 665 2 0 Oct02 ? 00:00:00 [xfs-reclaim/sdb] +root 666 2 0 Oct02 ? 00:00:00 [xfs-eofblocks/s] +root 670 2 0 Oct02 ? 00:00:00 [xfs-log/sdb1] +root 672 2 0 Oct02 ? 00:00:00 [xfsaild/sdb1] +root 675 2 0 Oct02 ? 00:00:00 [nfit] +systemd+ 711 1 0 Oct02 ? 00:00:01 /usr/lib/systemd/systemd-resolved +root 712 1 0 Oct02 ? 00:00:03 /sbin/auditd +polkitd 736 1 0 Oct02 ? 00:00:07 /usr/lib/polkit-1/polkitd --no-debug +root 737 1 0 Oct02 ? 00:00:00 /usr/sbin/sssd -i --logger=files +root 739 1 0 Oct02 ? 00:00:19 /usr/sbin/irqbalance --foreground +root 741 1 0 Oct02 ? 00:00:00 /usr/sbin/smartd -n -q never +dbus 745 1 0 Oct02 ? 00:00:12 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --sy +libstor+ 747 1 0 Oct02 ? 00:00:01 /usr/bin/lsmd -d +root 751 1 0 Oct02 ? 00:00:00 /usr/sbin/mcelog --ignorenodev --daemon --foreground +chrony 760 1 0 Oct02 ? 00:02:19 /usr/sbin/chronyd +rngd 779 1 0 Oct02 ? 00:01:14 /usr/sbin/rngd -f --fill-watermark=0 +root 794 737 0 Oct02 ? 00:00:05 /usr/libexec/sssd/sssd_be --domain implicit_files --uid 0 --gid 0 --logger=files +root 798 737 0 Oct02 ? 00:00:27 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files +root 801 1 0 Oct02 ? 00:00:03 /usr/lib/systemd/systemd-logind +root 863 1 0 Oct02 ? 00:00:12 /usr/sbin/NetworkManager --no-daemon +root 866 1 0 Oct02 ? 00:07:06 /usr/sbin/hypervkvpd -n +root 867 1 0 Oct02 ? 00:04:13 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P +root 975 2 0 Oct02 ? 00:00:00 [jbd2/sda1-8] +root 976 2 0 Oct02 ? 00:00:00 [ext4-rsv-conver] +root 1042 1 0 Oct02 ? 00:00:00 /usr/bin/python3.6 -u /usr/sbin/waagent -daemon +root 1043 1 0 Oct02 ? 00:00:38 /usr/sbin/rsyslogd -n +root 1055 1 0 Oct02 ? 00:00:01 /usr/sbin/crond -n +root 1056 1 0 Oct02 ttyS0 00:00:00 /sbin/agetty -o -p -- \u --keep-baud 115200,38400,9600 ttyS0 vt220 +root 1058 1 0 Oct02 ? 00:00:00 /usr/sbin/atd -f +root 1062 1 0 Oct02 tty1 00:00:00 /sbin/agetty -o -p -- \u --noclear tty1 linux +root 1292 1 0 Oct02 ? 00:00:04 /usr/sbin/sshd -D -oCiphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes +root 3284 1042 0 Oct02 ? 00:20:35 /usr/bin/python3.6 -u bin/WALinuxAgent-2.10.0.3-py3.9.egg -run-exthandlers +root 5496 1 0 Oct02 ? 00:00:00 /bin/bash /var/lib/waagent/Microsoft.GuestConfiguration.ConfigurationforLinux-1.26.50/GCAgent/G +root 5497 5496 0 Oct02 ? 00:01:31 /var/lib/waagent/Microsoft.GuestConfiguration.ConfigurationforLinux-1.26.50/GCAgent/GC/gc_linux +eeholmes 6547 1 0 Oct02 ? 00:01:06 /usr/lib/systemd/systemd --user +eeholmes 6551 6547 0 Oct02 ? 00:00:00 (sd-pam) +root 7300 1 0 Oct02 ? 00:00:18 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid +jhub 42239 1 0 Oct02 ? 00:00:36 /opt/miniconda3/envs/jupyterhub/bin/python /opt/miniconda3/envs/jupyterhub/bin/jupyterhub-singl +root 74481 1 0 Oct02 ? 00:02:43 /usr/bin/containerd +root 397323 1 0 Oct04 ? 00:03:36 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock +root 580957 2 0 18:22 ? 00:00:00 [kworker/u4:1-xfs-cil/sdb2] +root 581214 2 0 18:41 ? 00:00:00 [kworker/u4:0-events_unbound] +root 581977 2 0 19:01 ? 00:00:00 [kworker/0:0-events_power_efficient] +root 582275 1292 0 19:14 ? 00:00:00 sshd: eeholmes [priv] +eeholmes 582278 582275 0 19:14 ? 00:00:00 sshd: eeholmes@pts/1 +eeholmes 582279 582278 0 19:14 pts/1 00:00:00 -bash +root 582459 1 0 19:22 ? 00:00:01 /opt/miniconda3/envs/jupyterhub/bin/python /opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /o +root 582464 582459 0 19:22 ? 00:00:02 node /opt/miniconda3/envs/jupyterhub/bin/configurable-http-proxy --ip --port 8000 --api-ip 127 +root 582636 397323 0 19:28 ? 00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 32791 -container-ip 172.17.0.2 - +root 582649 1 0 19:28 ? 00:00:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id e63639dbbb5a86b962f4f310c1de9ffe675bd8dbf7 +eeholmes 582668 582649 1 19:28 ? 00:00:17 /srv/conda/envs/notebook/bin/python3.9 /srv/conda/envs/notebook/bin/jupyterhub-singleuser +eeholmes 582718 582668 0 19:29 ? 00:00:00 /bin/bash -l +eeholmes 582761 582668 0 19:31 ? 00:00:01 rserver --auth-none=1 --www-frame-origin=same --www-port=41243 --www-verify-user-agent=0 --secu +eeholmes 582790 582761 0 19:31 ? 00:00:05 /usr/lib/rstudio-server/bin/rsession -u rstudio --session-use-secure-cookies 0 --session-root-p +eeholmes 582862 582790 0 19:31 pts/1 00:00:00 bash -l +root 582891 2 0 19:32 ? 00:00:00 [kworker/1:2-ata_sff] +root 582923 582668 0 19:34 ? 00:00:00 [sudo] +root 582934 582668 0 19:35 ? 00:00:00 [sudo] +root 582943 582668 0 19:36 ? 00:00:00 [sudo] +root 582946 582668 0 19:36 ? 00:00:00 [sudo] +root 582955 582668 0 19:36 ? 00:00:00 [sudo] +root 582964 582668 0 19:36 ? 00:00:00 [sudo] +root 582974 582668 0 19:37 ? 00:00:00 [sudo] +root 582988 2 0 19:38 ? 00:00:00 [kworker/1:1-events] +root 582996 2 0 19:39 ? 00:00:00 [kworker/0:1-events_freezable_power_] +root 583082 2 0 19:43 ? 00:00:00 [kworker/1:0-ata_sff] +root 583140 5497 0 19:44 ? 00:00:00 /var/lib/waagent/Microsoft.GuestConfiguration.ConfigurationforLinux-1.26.50/GCAgent/GC/../GC/gc +root 583148 583140 0 19:44 ? 00:00:00 sh -c bash /var/lib/GuestConfig/Configuration/AzureLinuxVMEncryptionCompliance/Modules/helper/e +root 583149 583148 0 19:44 ? 00:00:00 bash /var/lib/GuestConfig/Configuration/AzureLinuxVMEncryptionCompliance/Modules/helper/extensi +root 583154 583149 0 19:44 ? 00:00:00 python3 /var/lib/GuestConfig/Configuration/AzureLinuxVMEncryptionCompliance/Modules/helper/MdcH +root 583156 2 0 19:44 ? 00:00:00 [kworker/u4:2] +root 583159 2 0 19:44 ? 00:00:00 [kworker/0:2] +eeholmes 583244 582279 0 19:44 pts/1 00:00:00 ps -ef +(base) [eeholmes@Centos8-Server systemd]$ ps -ef +UID PID PPID C STIME TTY TIME CMD +root 1 0 0 Oct02 ? 00:01:10 /usr/lib/systemd/systemd --system --deserialize 20 +root 2 0 0 Oct02 ? 00:00:00 [kthreadd] +root 3 2 0 Oct02 ? 00:00:00 [rcu_gp] +root 4 2 0 Oct02 ? 00:00:00 [rcu_par_gp] +root 6 2 0 Oct02 ? 00:00:00 [kworker/0:0H-events_highpri] +root 9 2 0 Oct02 ? 00:00:00 [mm_percpu_wq] +root 10 2 0 Oct02 ? 00:00:04 [ksoftirqd/0] +root 11 2 0 Oct02 ? 00:01:15 [rcu_sched] +root 12 2 0 Oct02 ? 00:00:00 [migration/0] +root 13 2 0 Oct02 ? 00:00:00 [watchdog/0] +root 14 2 0 Oct02 ? 00:00:00 [cpuhp/0] +root 15 2 0 Oct02 ? 00:00:00 [cpuhp/1] +root 16 2 0 Oct02 ? 00:00:00 [watchdog/1] +root 17 2 0 Oct02 ? 00:00:00 [migration/1] +root 18 2 0 Oct02 ? 00:00:12 [ksoftirqd/1] +root 20 2 0 Oct02 ? 00:00:00 [kworker/1:0H-events_highpri] +root 23 2 0 Oct02 ? 00:00:00 [kdevtmpfs] +root 24 2 0 Oct02 ? 00:00:00 [netns] +root 25 2 0 Oct02 ? 00:00:00 [rcu_tasks_trace] +root 26 2 0 Oct02 ? 00:00:00 [rcu_tasks_rude_] +root 27 2 0 Oct02 ? 00:00:01 [kauditd] +root 28 2 0 Oct02 ? 00:00:00 [khungtaskd] +root 29 2 0 Oct02 ? 00:00:00 [oom_reaper] +root 30 2 0 Oct02 ? 00:00:00 [writeback] +root 31 2 0 Oct02 ? 00:00:00 [kcompactd0] +root 32 2 0 Oct02 ? 00:00:00 [ksmd] +root 33 2 0 Oct02 ? 00:00:11 [khugepaged] +root 34 2 0 Oct02 ? 00:00:00 [crypto] +root 35 2 0 Oct02 ? 00:00:00 [kintegrityd] +root 36 2 0 Oct02 ? 00:00:00 [kblockd] +root 37 2 0 Oct02 ? 00:00:00 [blkcg_punt_bio] +root 38 2 0 Oct02 ? 00:00:00 [tpm_dev_wq] +root 39 2 0 Oct02 ? 00:00:00 [md] +root 40 2 0 Oct02 ? 00:00:00 [edac-poller] +root 41 2 0 Oct02 ? 00:00:00 [watchdogd] +root 43 2 0 Oct02 ? 00:00:07 [kworker/0:1H-kblockd] +root 76 2 0 Oct02 ? 00:00:10 [kswapd0] +root 178 2 0 Oct02 ? 00:00:00 [kthrotld] +root 179 2 0 Oct02 ? 00:00:00 [acpi_thermal_pm] +root 180 2 0 Oct02 ? 00:00:00 [kmpath_rdacd] +root 181 2 0 Oct02 ? 00:00:00 [kaluad] +root 183 2 0 Oct02 ? 00:00:02 [kworker/1:1H-kblockd] +root 184 2 0 Oct02 ? 00:00:00 [ipv6_addrconf] +root 185 2 0 Oct02 ? 00:00:00 [kstrp] +root 416 2 0 Oct02 ? 00:00:00 [hv_vmbus_con] +root 418 2 0 Oct02 ? 00:00:00 [hv_pri_chan] +root 420 2 0 Oct02 ? 00:00:00 [hv_sub_chan] +root 430 2 0 Oct02 ? 00:00:00 [ata_sff] +root 433 2 0 Oct02 ? 00:00:00 [scsi_eh_0] +root 434 2 0 Oct02 ? 00:00:00 [scsi_eh_1] +root 436 2 0 Oct02 ? 00:00:00 [scsi_eh_2] +root 437 2 0 Oct02 ? 00:00:00 [scsi_tmf_1] +root 438 2 0 Oct02 ? 00:00:00 [scsi_tmf_0] +root 439 2 0 Oct02 ? 00:00:00 [scsi_tmf_2] +root 440 2 0 Oct02 ? 00:00:00 [scsi_eh_3] +root 442 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 443 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 445 2 0 Oct02 ? 00:00:00 [scsi_eh_4] +root 446 2 0 Oct02 ? 00:00:00 [scsi_tmf_3] +root 447 2 0 Oct02 ? 00:00:00 [scsi_eh_5] +root 448 2 0 Oct02 ? 00:00:00 [scsi_tmf_4] +root 449 2 0 Oct02 ? 00:00:00 [scsi_tmf_5] +root 450 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 451 2 0 Oct02 ? 00:00:00 [storvsc_error_w] +root 471 2 0 Oct02 ? 00:00:00 [xfsalloc] +root 472 2 0 Oct02 ? 00:00:00 [xfs_mru_cache] +root 473 2 0 Oct02 ? 00:00:00 [xfs-buf/sdb2] +root 474 2 0 Oct02 ? 00:00:00 [xfs-conv/sdb2] +root 475 2 0 Oct02 ? 00:00:00 [xfs-cil/sdb2] +root 476 2 0 Oct02 ? 00:00:00 [xfs-reclaim/sdb] +root 477 2 0 Oct02 ? 00:00:00 [xfs-eofblocks/s] +root 478 2 0 Oct02 ? 00:00:00 [xfs-log/sdb2] +root 479 2 0 Oct02 ? 00:01:03 [xfsaild/sdb2] +root 578 1 0 Oct02 ? 00:00:14 /usr/lib/systemd/systemd-journald +root 607 1 0 Oct02 ? 00:00:02 /usr/lib/systemd/systemd-udevd +root 621 2 0 Oct02 ? 00:00:07 [hv_balloon] +root 658 2 0 Oct02 ? 00:00:00 [xfs-buf/sdb1] +root 659 2 0 Oct02 ? 00:00:00 [xfs-conv/sdb1] +root 662 2 0 Oct02 ? 00:00:00 [xfs-cil/sdb1] +root 665 2 0 Oct02 ? 00:00:00 [xfs-reclaim/sdb] +root 666 2 0 Oct02 ? 00:00:00 [xfs-eofblocks/s] +root 670 2 0 Oct02 ? 00:00:00 [xfs-log/sdb1] +root 672 2 0 Oct02 ? 00:00:00 [xfsaild/sdb1] +root 675 2 0 Oct02 ? 00:00:00 [nfit] +systemd+ 711 1 0 Oct02 ? 00:00:01 /usr/lib/systemd/systemd-resolved +root 712 1 0 Oct02 ? 00:00:03 /sbin/auditd +polkitd 736 1 0 Oct02 ? 00:00:07 /usr/lib/polkit-1/polkitd --no-debug +root 737 1 0 Oct02 ? 00:00:00 /usr/sbin/sssd -i --logger=files +root 739 1 0 Oct02 ? 00:00:19 /usr/sbin/irqbalance --foreground +root 741 1 0 Oct02 ? 00:00:00 /usr/sbin/smartd -n -q never +dbus 745 1 0 Oct02 ? 00:00:12 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only +libstor+ 747 1 0 Oct02 ? 00:00:01 /usr/bin/lsmd -d +root 751 1 0 Oct02 ? 00:00:00 /usr/sbin/mcelog --ignorenodev --daemon --foreground +chrony 760 1 0 Oct02 ? 00:02:19 /usr/sbin/chronyd +rngd 779 1 0 Oct02 ? 00:01:14 /usr/sbin/rngd -f --fill-watermark=0 +root 794 737 0 Oct02 ? 00:00:05 /usr/libexec/sssd/sssd_be --domain implicit_files --uid 0 --gid 0 --logger=files +root 798 737 0 Oct02 ? 00:00:27 /usr/libexec/sssd/sssd_nss --uid 0 --gid 0 --logger=files +root 801 1 0 Oct02 ? 00:00:03 /usr/lib/systemd/systemd-logind +root 863 1 0 Oct02 ? 00:00:12 /usr/sbin/NetworkManager --no-daemon +root 866 1 0 Oct02 ? 00:07:06 /usr/sbin/hypervkvpd -n +root 867 1 0 Oct02 ? 00:04:13 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P +root 975 2 0 Oct02 ? 00:00:00 [jbd2/sda1-8] +root 976 2 0 Oct02 ? 00:00:00 [ext4-rsv-conver] +root 1042 1 0 Oct02 ? 00:00:00 /usr/bin/python3.6 -u /usr/sbin/waagent -daemon +root 1043 1 0 Oct02 ? 00:00:38 /usr/sbin/rsyslogd -n +root 1055 1 0 Oct02 ? 00:00:01 /usr/sbin/crond -n +root 1056 1 0 Oct02 ttyS0 00:00:00 /sbin/agetty -o -p -- \u --keep-baud 115200,38400,9600 ttyS0 vt220 +root 1058 1 0 Oct02 ? 00:00:00 /usr/sbin/atd -f +root 1062 1 0 Oct02 tty1 00:00:00 /sbin/agetty -o -p -- \u --noclear tty1 linux +root 1292 1 0 Oct02 ? 00:00:04 /usr/sbin/sshd -D -oCiphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc -oMA +root 3284 1042 0 Oct02 ? 00:20:35 /usr/bin/python3.6 -u bin/WALinuxAgent-2.10.0.3-py3.9.egg -run-exthandlers +root 5496 1 0 Oct02 ? 00:00:00 /bin/bash /var/lib/waagent/Microsoft.GuestConfiguration.ConfigurationforLinux-1.26.50/GCAgent/GC/run_service.sh +root 5497 5496 0 Oct02 ? 00:01:31 /var/lib/waagent/Microsoft.GuestConfiguration.ConfigurationforLinux-1.26.50/GCAgent/GC/gc_linux_service +eeholmes 6547 1 0 Oct02 ? 00:01:06 /usr/lib/systemd/systemd --user +eeholmes 6551 6547 0 Oct02 ? 00:00:00 (sd-pam) +root 7300 1 0 Oct02 ? 00:00:18 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid +jhub 42239 1 0 Oct02 ? 00:00:36 /opt/miniconda3/envs/jupyterhub/bin/python /opt/miniconda3/envs/jupyterhub/bin/jupyterhub-singleuser +root 74481 1 0 Oct02 ? 00:02:43 /usr/bin/containerd +root 397323 1 0 Oct04 ? 00:03:36 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock +root 580957 2 0 18:22 ? 00:00:00 [kworker/u4:1-xfs-cil/sdb2] +root 581214 2 0 18:41 ? 00:00:00 [kworker/u4:0-events_unbound] +root 581977 2 0 19:01 ? 00:00:00 [kworker/0:0-events] +root 582275 1292 0 19:14 ? 00:00:00 sshd: eeholmes [priv] +eeholmes 582278 582275 0 19:14 ? 00:00:00 sshd: eeholmes@pts/1 +eeholmes 582279 582278 0 19:14 pts/1 00:00:00 -bash +root 582459 1 0 19:22 ? 00:00:01 /opt/miniconda3/envs/jupyterhub/bin/python /opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_c +root 582464 582459 0 19:22 ? 00:00:02 node /opt/miniconda3/envs/jupyterhub/bin/configurable-http-proxy --ip --port 8000 --api-ip 127.0.0.1 --api-port 8001 --error-target http://Centos8-Serv +root 582636 397323 0 19:28 ? 00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 32791 -container-ip 172.17.0.2 -container-port 8888 +root 582649 1 0 19:28 ? 00:00:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id e63639dbbb5a86b962f4f310c1de9ffe675bd8dbf73acb4330d98dd4e8e60f96 -address /run/containerd/container +eeholmes 582668 582649 1 19:28 ? 00:00:17 /srv/conda/envs/notebook/bin/python3.9 /srv/conda/envs/notebook/bin/jupyterhub-singleuser +eeholmes 582718 582668 0 19:29 ? 00:00:00 /bin/bash -l +eeholmes 582761 582668 0 19:31 ? 00:00:01 rserver --auth-none=1 --www-frame-origin=same --www-port=41243 --www-verify-user-agent=0 --secure-cookie-key-file=/tmp/tmp9yjf_o8j --server-user=rstudio +eeholmes 582790 582761 0 19:31 ? 00:00:05 /usr/lib/rstudio-server/bin/rsession -u rstudio --session-use-secure-cookies 0 --session-root-path /user/jhub/rstudio/ --session-same-site 0 --session-u +eeholmes 582862 582790 0 19:31 pts/1 00:00:00 bash -l +root 582891 2 0 19:32 ? 00:00:00 [kworker/1:2-ata_sff] +root 582923 582668 0 19:34 ? 00:00:00 [sudo] +root 582934 582668 0 19:35 ? 00:00:00 [sudo] +root 582943 582668 0 19:36 ? 00:00:00 [sudo] +root 582946 582668 0 19:36 ? 00:00:00 [sudo] +root 582955 582668 0 19:36 ? 00:00:00 [sudo] +root 582964 582668 0 19:36 ? 00:00:00 [sudo] +root 582974 582668 0 19:37 ? 00:00:00 [sudo] +root 582988 2 0 19:38 ? 00:00:00 [kworker/1:1-events] +root 582996 2 0 19:39 ? 00:00:00 [kworker/0:1-events_freezable_power_] +root 583082 2 0 19:43 ? 00:00:00 [kworker/1:0-ata_sff] +root 583140 5497 0 19:44 ? 00:00:00 /var/lib/waagent/Microsoft.GuestConfiguration.ConfigurationforLinux-1.26.50/GCAgent/GC/../GC/gc_worker -a AzureLinuxVMEncryptionCompliance -c NonComplia +root 583156 2 0 19:44 ? 00:00:00 [kworker/u4:2] +root 583159 2 0 19:44 ? 00:00:00 [kworker/0:2] +root 583251 583140 0 19:44 ? 00:00:00 sh -c bash /var/lib/GuestConfig/Configuration/AzureLinuxVMEncryptionCompliance/Modules/helper/extension_shim.sh -c "/var/lib/GuestConfig/Configuration/A +root 583252 583251 0 19:44 ? 00:00:00 bash /var/lib/GuestConfig/Configuration/AzureLinuxVMEncryptionCompliance/Modules/helper/extension_shim.sh -c /var/lib/GuestConfig/Configuration/AzureLin +root 583257 583252 1 19:44 ? 00:00:00 python3 /var/lib/GuestConfig/Configuration/AzureLinuxVMEncryptionCompliance/Modules/helper/MdcHandler.py --install /var/lib/GuestConfig/Configuration/Az +eeholmes 583280 582279 0 19:45 pts/1 00:00:00 ps -ef +(base) [eeholmes@Centos8-Server systemd]$ ps -ef | grep jupyter +jhub 42239 1 0 Oct02 ? 00:00:36 /opt/miniconda3/envs/jupyterhub/bin/python /opt/miniconda3/envs/jupyterhub/bin/jupyterhub-singleuser +root 582459 1 0 19:22 ? 00:00:01 /opt/miniconda3/envs/jupyterhub/bin/python /opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py +root 582464 582459 0 19:22 ? 00:00:02 node /opt/miniconda3/envs/jupyterhub/bin/configurable-http-proxy --ip --port 8000 --api-ip 127.0.0.1 --api-port 8001 --error-target http://Centos8-Server:8081/hub/error --log-level info +eeholmes 582668 582649 1 19:28 ? 00:00:17 /srv/conda/envs/notebook/bin/python3.9 /srv/conda/envs/notebook/bin/jupyterhub-singleuser +eeholmes 583460 582279 0 19:45 pts/1 00:00:00 grep --color=auto jupyter +(base) [eeholmes@Centos8-Server systemd]$ sudo systemctl stop jupyterhub.service +(base) [eeholmes@Centos8-Server systemd]$ docker pull eeholmes/iorocker-standalone:20231003 +permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/images/create?fromImage=eeholmes%2Fiorocker-standalone&tag=20231003": dial unix /var/run/docker.sock: connect: permission denied +(base) [eeholmes@Centos8-Server systemd]$ sudo docker pull eeholmes/iorocker-standalone:20231003 +20231003: Pulling from eeholmes/iorocker-standalone +677076032cca: Already exists +57ac375b7e72: Already exists +fa3da39658a5: Already exists +d40d6aff2870: Already exists +d244b2a48849: Already exists +8dd7648c6f34: Already exists +473bb2d66f20: Already exists +56c2a2a870ea: Already exists +6b49bfccb1f2: Already exists +122134646c4e: Already exists +4e4c63f03d6b: Already exists +2c2c58e1b970: Already exists +5843f3e28fdb: Already exists +21c59a9d8c35: Already exists +32f45bb34a59: Already exists +7413d59219b4: Already exists +b29bf39a1773: Already exists +a57c85c78d42: Already exists +4f4fb700ef54: Pull complete +5f6744ad761b: Already exists +da9cecf70703: Already exists +fa5589fef4fc: Already exists +f18a29275d33: Already exists +54f4d7aa092a: Already exists +57743580e084: Already exists +66c25d964e4f: Already exists +18d77976236c: Already exists +f2b56d955f66: Pull complete +bb5e3be618f3: Pull complete +Digest: sha256:7b5ca3c3d5a273b92fdcbf1c9fab41f9e4bde877180548a245cf64d8dc02a5b3 +Status: Downloaded newer image for eeholmes/iorocker-standalone:20231003 +docker.io/eeholmes/iorocker-standalone:20231003 +(base) [eeholmes@Centos8-Server systemd]$ sudo -i +(base) [root@Centos8-Server ~]# sudo systemctl start jupyterhub.service +(base) [root@Centos8-Server ~]# sudo systemctl stop jupyterhub.service +(base) [root@Centos8-Server ~]# sudo docker pull eeholmes/iorocker-standalone:20231003 +20231003: Pulling from eeholmes/iorocker-standalone +677076032cca: Already exists +57ac375b7e72: Already exists +fa3da39658a5: Already exists +d40d6aff2870: Already exists +d244b2a48849: Already exists +8dd7648c6f34: Already exists +473bb2d66f20: Already exists +56c2a2a870ea: Already exists +6b49bfccb1f2: Already exists +122134646c4e: Already exists +4e4c63f03d6b: Already exists +2c2c58e1b970: Already exists +5843f3e28fdb: Already exists +21c59a9d8c35: Already exists +32f45bb34a59: Already exists +7413d59219b4: Already exists +b29bf39a1773: Already exists +a57c85c78d42: Already exists +4f4fb700ef54: Pull complete +5f6744ad761b: Already exists +da9cecf70703: Already exists +fa5589fef4fc: Already exists +f18a29275d33: Already exists +54f4d7aa092a: Already exists +57743580e084: Already exists +66c25d964e4f: Already exists +18d77976236c: Already exists +9d361bd7445c: Pull complete +06fb9504fc5e: Pull complete +Digest: sha256:e72e399d2bfba26016090dd12a341587fcc0a2d894272f731124d000f5f5c36a +Status: Downloaded newer image for eeholmes/iorocker-standalone:20231003 +docker.io/eeholmes/iorocker-standalone:20231003 +(base) [root@Centos8-Server ~]# sudo systemctl start jupyterhub.service +(base) [root@Centos8-Server ~]# sudo systemctl stop jupyterhub.service +(base) [root@Centos8-Server ~]# c.JupyterHub.ssl_key = '/etc/letsencrypt/live/example.com/privkey.pem' +-bash: c.JupyterHub.ssl_key: command not found +(base) [root@Centos8-Server ~]# cd /opt/miniconda3/envs/jupyterhub/etc/jupyterhub +(base) [root@Centos8-Server jupyterhub]# nano jupyter_config.py +(base) [root@Centos8-Server jupyterhub]# ls +jupyterhub_config.py jupyterhub_cookie_secret jupyterhub.sqlite +(base) [root@Centos8-Server jupyterhub]# nano jupyterhub_config.py +(base) [root@Centos8-Server jupyterhub]# sudo systemctl start jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo systemctl status jupyterhub.service +● jupyterhub.service - JupyterHub + Loaded: loaded (/opt/miniconda3/envs/jupyterhub/etc/systemd/jupyterhub.service; enabled; vendor preset: disabled) + Active: failed (Result: exit-code) since Mon 2023-10-09 21:58:39 UTC; 1min 15s ago + Process: 587750 ExecStart=/opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py (code=exited, status=1/FAILURE) + Main PID: 587750 (code=exited, status=1/FAILURE) + +Oct 09 21:58:39 Centos8-Server jupyterhub[587750]: File "/opt/miniconda3/envs/jupyterhub/lib/python3.11/site-packages/jupyterhub/app.py", line 3089, in start +Oct 09 21:58:39 Centos8-Server jupyterhub[587750]: await self.proxy.start() +Oct 09 21:58:39 Centos8-Server jupyterhub[587750]: File "/opt/miniconda3/envs/jupyterhub/lib/python3.11/site-packages/jupyterhub/proxy.py", line 778, in start +Oct 09 21:58:39 Centos8-Server jupyterhub[587750]: _check_process() +Oct 09 21:58:39 Centos8-Server jupyterhub[587750]: File "/opt/miniconda3/envs/jupyterhub/lib/python3.11/site-packages/jupyterhub/proxy.py", line 774, in _check_process +Oct 09 21:58:39 Centos8-Server jupyterhub[587750]: raise e from None +Oct 09 21:58:39 Centos8-Server jupyterhub[587750]: RuntimeError: Proxy failed to start with exit code 1 +Oct 09 21:58:39 Centos8-Server jupyterhub[587750]: +Oct 09 21:58:39 Centos8-Server systemd[1]: jupyterhub.service: Main process exited, code=exited, status=1/FAILURE +Oct 09 21:58:39 Centos8-Server systemd[1]: jupyterhub.service: Failed with result 'exit-code'. +(base) [root@Centos8-Server jupyterhub]# sudo systemctl start jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo systemctl status jupyterhub.service +● jupyterhub.service - JupyterHub + Loaded: loaded (/opt/miniconda3/envs/jupyterhub/etc/systemd/jupyterhub.service; enabled; vendor preset: disabled) + Active: active (running) since Mon 2023-10-09 22:00:12 UTC; 1s ago + Main PID: 587786 (jupyterhub) + Tasks: 2 (limit: 23678) + Memory: 71.1M + CGroup: /system.slice/jupyterhub.service + └─587786 /opt/miniconda3/envs/jupyterhub/bin/python /opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py + +Oct 09 22:00:13 Centos8-Server jupyterhub[587786]: at Error (native) +Oct 09 22:00:13 Centos8-Server jupyterhub[587786]: at Object.fs.openSync (fs.js:642:18) +Oct 09 22:00:13 Centos8-Server jupyterhub[587786]: at Object.fs.readFileSync (fs.js:510:33) +Oct 09 22:00:13 Centos8-Server jupyterhub[587786]: at Object. (/opt/miniconda3/envs/jupyterhub/lib/node_modules/configurable-http-proxy/bin/configurable-http-proxy:144:26) +Oct 09 22:00:13 Centos8-Server jupyterhub[587786]: at Module._compile (module.js:577:32) +Oct 09 22:00:13 Centos8-Server jupyterhub[587786]: at Object.Module._extensions..js (module.js:586:10) +Oct 09 22:00:13 Centos8-Server jupyterhub[587786]: at Module.load (module.js:494:32) +Oct 09 22:00:13 Centos8-Server jupyterhub[587786]: at tryModuleLoad (module.js:453:12) +Oct 09 22:00:13 Centos8-Server jupyterhub[587786]: at Function.Module._load (module.js:445:3) +Oct 09 22:00:13 Centos8-Server jupyterhub[587786]: at Module.runMain (module.js:611:10) +(base) [root@Centos8-Server jupyterhub]# sudo systemctl stop jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo systemctl start jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo systemctl status jupyterhub.service +● jupyterhub.service - JupyterHub + Loaded: loaded (/opt/miniconda3/envs/jupyterhub/etc/systemd/jupyterhub.service; enabled; vendor preset: disabled) + Active: failed (Result: exit-code) since Mon 2023-10-09 22:00:49 UTC; 687ms ago + Process: 587813 ExecStart=/opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py (code=exited, status=1/FAILURE) + Main PID: 587813 (code=exited, status=1/FAILURE) + +Oct 09 22:00:49 Centos8-Server jupyterhub[587813]: File "/opt/miniconda3/envs/jupyterhub/lib/python3.11/site-packages/jupyterhub/app.py", line 3089, in start +Oct 09 22:00:49 Centos8-Server jupyterhub[587813]: await self.proxy.start() +Oct 09 22:00:49 Centos8-Server jupyterhub[587813]: File "/opt/miniconda3/envs/jupyterhub/lib/python3.11/site-packages/jupyterhub/proxy.py", line 778, in start +Oct 09 22:00:49 Centos8-Server jupyterhub[587813]: _check_process() +Oct 09 22:00:49 Centos8-Server jupyterhub[587813]: File "/opt/miniconda3/envs/jupyterhub/lib/python3.11/site-packages/jupyterhub/proxy.py", line 774, in _check_process +Oct 09 22:00:49 Centos8-Server jupyterhub[587813]: raise e from None +Oct 09 22:00:49 Centos8-Server jupyterhub[587813]: RuntimeError: Proxy failed to start with exit code 1 +Oct 09 22:00:49 Centos8-Server jupyterhub[587813]: +Oct 09 22:00:49 Centos8-Server systemd[1]: jupyterhub.service: Main process exited, code=exited, status=1/FAILURE +Oct 09 22:00:49 Centos8-Server systemd[1]: jupyterhub.service: Failed with result 'exit-code'. +(base) [root@Centos8-Server jupyterhub]# sudo systemctl stop jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# nano jupyterhub_config.py +(base) [root@Centos8-Server jupyterhub]# cd /etc +(base) [root@Centos8-Server etc]# ls +adjtime cron.d docker grub.d ld.so.cache man_db.conf os-release rc5.d shadow- system-release +aliases cron.daily dracut.conf gshadow ld.so.conf mcelog pam.d rc6.d shells system-release-cpe +alternatives cron.deny dracut.conf.d gshadow- ld.so.conf.d microcode_ctl passwd rc.d skel terminfo +anacrontab cron.hourly environment gss libaudit.conf mime.types passwd- rc.local smartmontools tmpfiles.d +at.deny cron.monthly ethertypes host.conf libibverbs.d mke2fs.conf pinforc rdma sos trusted-key.key +audit crontab exports hostname libnl modprobe.d pkcs11 redhat-release ssh tuned +authselect cron.weekly filesystems hosts libreport modules-load.d pki resolv.conf ssl udev +bash_completion.d crypto-policies firewalld init.d libssh motd pm rhsm sssd updatedb.conf +bashrc crypttab fprintd.conf inittab libuser.conf motd.d polkit-1 rpc subgid vconsole.conf +bindresvport.blacklist csh.cshrc fstab inputrc locale.conf mtab popt.d rpm subgid- vimrc +binfmt.d csh.login fuse.conf iproute2 localtime nanorc prelink.conf.d rsyslog.conf subuid virc +centos-release dbus-1 fwupd issue login.defs netconfig printcap rsyslog.d subuid- waagent.conf +centos-release-upstream dconf gcrypt issue.d logrotate.conf NetworkManager profile rwtab.d sudo.conf wgetrc +chkconfig.d default gnupg issue.net logrotate.d networks profile.d samba sudoers X11 +chrony.conf depmod.d GREP_COLORS jupyterhub lsm nftables protocols sasl2 sudoers.d xattr.conf +chrony.keys dhcp groff kdump lvm nsswitch.conf rc0.d security sudo-ldap.conf xdg +cifs-utils DIR_COLORS group kdump.conf machine-id nsswitch.conf.bak rc1.d selinux sysconfig xinetd.d +cloud DIR_COLORS.256color group- kernel magic nvme rc2.d services sysctl.conf yum +cockpit DIR_COLORS.lightbgcolor grub2.cfg krb5.conf mailcap openldap rc3.d sestatus.conf sysctl.d yum.conf +containerd dnf grub2-efi.cfg krb5.conf.d makedumpfile.conf.sample opt rc4.d shadow systemd yum.repos.d +(base) [root@Centos8-Server etc]# sudo systemctl stop jupyterhub.service +(base) [root@Centos8-Server etc]# nano jupyterhub_config.py +(base) [root@Centos8-Server etc]# ls +adjtime cron.d docker grub.d ld.so.cache man_db.conf os-release rc5.d shadow- system-release +aliases cron.daily dracut.conf gshadow ld.so.conf mcelog pam.d rc6.d shells system-release-cpe +alternatives cron.deny dracut.conf.d gshadow- ld.so.conf.d microcode_ctl passwd rc.d skel terminfo +anacrontab cron.hourly environment gss libaudit.conf mime.types passwd- rc.local smartmontools tmpfiles.d +at.deny cron.monthly ethertypes host.conf libibverbs.d mke2fs.conf pinforc rdma sos trusted-key.key +audit crontab exports hostname libnl modprobe.d pkcs11 redhat-release ssh tuned +authselect cron.weekly filesystems hosts libreport modules-load.d pki resolv.conf ssl udev +bash_completion.d crypto-policies firewalld init.d libssh motd pm rhsm sssd updatedb.conf +bashrc crypttab fprintd.conf inittab libuser.conf motd.d polkit-1 rpc subgid vconsole.conf +bindresvport.blacklist csh.cshrc fstab inputrc locale.conf mtab popt.d rpm subgid- vimrc +binfmt.d csh.login fuse.conf iproute2 localtime nanorc prelink.conf.d rsyslog.conf subuid virc +centos-release dbus-1 fwupd issue login.defs netconfig printcap rsyslog.d subuid- waagent.conf +centos-release-upstream dconf gcrypt issue.d logrotate.conf NetworkManager profile rwtab.d sudo.conf wgetrc +chkconfig.d default gnupg issue.net logrotate.d networks profile.d samba sudoers X11 +chrony.conf depmod.d GREP_COLORS jupyterhub lsm nftables protocols sasl2 sudoers.d xattr.conf +chrony.keys dhcp groff kdump lvm nsswitch.conf rc0.d security sudo-ldap.conf xdg +cifs-utils DIR_COLORS group kdump.conf machine-id nsswitch.conf.bak rc1.d selinux sysconfig xinetd.d +cloud DIR_COLORS.256color group- kernel magic nvme rc2.d services sysctl.conf yum +cockpit DIR_COLORS.lightbgcolor grub2.cfg krb5.conf mailcap openldap rc3.d sestatus.conf sysctl.d yum.conf +containerd dnf grub2-efi.cfg krb5.conf.d makedumpfile.conf.sample opt rc4.d shadow systemd yum.repos.d +(base) [root@Centos8-Server etc]# cd /opt/miniconda3/envs/jupyterhub/etc/jupyterhub +(base) [root@Centos8-Server jupyterhub]# ls +jupyterhub_config.py jupyterhub_cookie_secret jupyterhub.sqlite +(base) [root@Centos8-Server jupyterhub]# nano jupyterhub_config.py +(base) [root@Centos8-Server jupyterhub]# sudo systemctl start jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo systemctl stop jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo docker pull eeholmes/rocker-binder:20231003 +20231003: Pulling from eeholmes/rocker-binder +445a6a12be2b: Already exists +f8a8a73072b2: Already exists +d3d3b61dd2d8: Already exists +aebdae687b7f: Already exists +a620600b1125: Already exists +34681bd03ee9: Already exists +845030b6be62: Already exists +4a529b388f48: Already exists +ee3f9af59c20: Already exists +35c0c9ef2ed9: Already exists +764b2d3a2a42: Already exists +c4cccc62f7c2: Already exists +4f4fb700ef54: Pull complete +Digest: sha256:2b115bca0c73156d24a3c0d70a272055e37f5a972972c57e44c61aa94ebb3f3f +Status: Downloaded newer image for eeholmes/rocker-binder:20231003 +docker.io/eeholmes/rocker-binder:20231003 +(base) [root@Centos8-Server jupyterhub]# sudo systemctl start jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo systemctl stop jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo docker pull eeholmes/rocker-binder:20231003 +20231003: Pulling from eeholmes/rocker-binder +445a6a12be2b: Already exists +f8a8a73072b2: Already exists +d3d3b61dd2d8: Already exists +aebdae687b7f: Already exists +a620600b1125: Already exists +34681bd03ee9: Already exists +845030b6be62: Already exists +4a529b388f48: Already exists +ee3f9af59c20: Already exists +35c0c9ef2ed9: Already exists +764b2d3a2a42: Already exists +c4cccc62f7c2: Already exists +4f4fb700ef54: Already exists +96d0a1702dcf: Pull complete +Digest: sha256:91f1e699ed6a6d928894af2803021f4d9fc89c3ea45bd47b3a531e7970045113 +Status: Downloaded newer image for eeholmes/rocker-binder:20231003 +docker.io/eeholmes/rocker-binder:20231003 +(base) [root@Centos8-Server jupyterhub]# sudo systemctl start jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo systemctl stop jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo docker pull eeholmes/rocker-binder:20231003 +20231003: Pulling from eeholmes/rocker-binder +Digest: sha256:2b115bca0c73156d24a3c0d70a272055e37f5a972972c57e44c61aa94ebb3f3f +Status: Downloaded newer image for eeholmes/rocker-binder:20231003 +docker.io/eeholmes/rocker-binder:20231003 +(base) [root@Centos8-Server jupyterhub]# sudo systemctl start jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo systemctl stop jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# sudo docker pull eeholmes/rocker-binder:20231003 +20231003: Pulling from eeholmes/rocker-binder +445a6a12be2b: Already exists +f8a8a73072b2: Already exists +d3d3b61dd2d8: Already exists +aebdae687b7f: Already exists +a620600b1125: Already exists +34681bd03ee9: Already exists +845030b6be62: Already exists +4a529b388f48: Already exists +ee3f9af59c20: Already exists +35c0c9ef2ed9: Already exists +764b2d3a2a42: Already exists +c4cccc62f7c2: Already exists +4f4fb700ef54: Already exists +Digest: sha256:a32c69060c35a877a53c6c32c6eeefa027d574369089b283eb8552559f20f547 +Status: Downloaded newer image for eeholmes/rocker-binder:20231003 +docker.io/eeholmes/rocker-binder:20231003 +(base) [root@Centos8-Server jupyterhub]# sudo systemctl start jupyterhub.service +(base) [root@Centos8-Server jupyterhub]# nano jupyterhub_config.py + + GNU nano 2.9.8 jupyterhub_config.py + +# c.Authenticator.username_pattern = '' + +## Deprecated, use `Authenticator.allowed_users` +# Default: set() +# c.Authenticator.whitelist = set() + +#------------------------------------------------------------------------------ +# CryptKeeper(SingletonConfigurable) configuration +#------------------------------------------------------------------------------ +## Encapsulate encryption configuration +# +# Use via the encryption_config singleton below. + +# Default: [] +# c.CryptKeeper.keys = [] + +## The number of threads to allocate for encryption +# Default: 2 +# c.CryptKeeper.n_threads = 2 diff --git a/ci/iorocker/Dockerfile b/ci/iorocker/Dockerfile index 041f85c..aea5528 100644 --- a/ci/iorocker/Dockerfile +++ b/ci/iorocker/Dockerfile @@ -1,4 +1,6 @@ FROM openscapes/rocker:a7596b5 +# tell RStudio the right path so it is in the conda environment +RUN echo "PATH=${PATH}" >>"${R_HOME}/etc/Renviron.site" # install additional package... @@ -29,4 +31,4 @@ RUN R -e 'install.packages(c("geodata", "ggspatial", "rnaturalearth"))' RUN R -e 'install.packages(c("corrplot", "here", "matrixcalc", "cmocean", "DT", "janitor"))' # ENV JUPYTERHUB_HTTP_REFERER=https://dhub.opensci.live/ -ENV JUPYTERHUB_HTTP_REFERER=https://itcoocean.2i2c.cloud/ +# ENV JUPYTERHUB_HTTP_REFERER=https://itcoocean.2i2c.cloud/ diff --git a/ci/py-rocket/Dockerfile b/ci/py-rocket/Dockerfile index 3d2703d..65b19c6 100644 --- a/ci/py-rocket/Dockerfile +++ b/ci/py-rocket/Dockerfile @@ -20,6 +20,8 @@ ENV NB_PYTHON_PREFIX=${CONDA_DIR}/envs/${CONDA_ENV} \ # it loads the python in the notebook conda environment, as that comes # first here. ENV PATH=${NB_PYTHON_PREFIX}/bin:${CONDA_DIR}/bin:${PATH} +# Tell R and RStudio about the PATH +RUN echo "PATH=${PATH}" >>"${R_HOME}/etc/Renviron.site" # Ask dask to read config from ${CONDA_DIR}/etc rather than # the default of /etc, since the non-root jovyan user can write @@ -50,21 +52,17 @@ RUN echo "Installing Mambaforge..." \ && find ${CONDA_DIR} -follow -type f -name '*.a' -delete \ && find ${CONDA_DIR} -follow -type f -name '*.pyc' -delete -RUN echo "Checking for 'conda-linux-64.lock' or 'environment.yml'..." \ - ; if test -f "conda-linux-64.lock" ; then \ - mamba create --name ${CONDA_ENV} --file conda-linux-64.lock \ - ; elif test -f "environment.yml" ; then \ - mamba env create --name ${CONDA_ENV} -f environment.yml \ - ; else echo "No conda-linux-64.lock or environment.yml! *creating default env*" ; \ - mamba create --name ${CONDA_ENV} pangeo-notebook \ - ; fi \ - && mamba clean -yaf \ - && find ${CONDA_DIR} -follow -type f -name '*.a' -delete \ - && find ${CONDA_DIR} -follow -type f -name '*.pyc' -delete \ - && find ${CONDA_DIR} -follow -type f -name '*.js.map' -delete \ - ; if [ -d ${NB_PYTHON_PREFIX}/lib/python*/site-packages/bokeh/server/static ]; then \ - find ${NB_PYTHON_PREFIX}/lib/python*/site-packages/bokeh/server/static -follow -type f -name '*.js' ! -name '*.min.js' -delete \ - ; fi +RUN echo "Creating conda environment ..." \ + && URL="https://github.com/conda-forge/miniforge/releases/latest/download/Mambaforge-Linux-x86_64.sh" \ + && wget --quiet ${URL} -O installer.sh \ + && mamba env create --name ${CONDA_ENV} -f environment.yml \ + && mamba clean -yaf \ + && find ${CONDA_DIR} -follow -type f -name '*.a' -delete \ + && find ${CONDA_DIR} -follow -type f -name '*.pyc' -delete \ + && find ${CONDA_DIR} -follow -type f -name '*.js.map' -delete \ + ; if [ -d ${NB_PYTHON_PREFIX}/lib/python*/site-packages/bokeh/server/static ]; then \ + find ${NB_PYTHON_PREFIX}/lib/python*/site-packages/bokeh/server/static -follow -type f -name '*.js' ! -name '*.min.js' -delete \ + ; fi RUN pip install jupyter-rsession-proxy diff --git a/ci/py-rocket/environment.yml b/ci/py-rocket/environment.yml new file mode 100644 index 0000000..ee45a05 --- /dev/null +++ b/ci/py-rocket/environment.yml @@ -0,0 +1,79 @@ +name: openscapes +channels: + - conda-forge +dependencies: + - python=3.10 + - dask + - dask-gateway + - distributed + - rioxarray + - xarray>=2022.12 + - h5netcdf + - netcdf4>=1.6.4 + - h5py + - gdal~=3.6 + - libgdal + - geoviews + - holoviews=1.16.2 + - matplotlib-base + - seaborn + - intake + - hvplot + - datashader + - pyproj + - bqplot + - geopandas + - zarr + - cartopy + - pynco + - rasterio + - shapely + - pyresample + - icepyx + - joblib + - pystac-client + - pydap + - lxml + - ipyleaflet + # when jlab 4 gets released we can upgrade dask-labextension + # - dask-labextension + - dask-labextension==6.2.0 + - jupyter-server-proxy + - ipywidgets + - jupyter-book + - jupyterlab<4 + - jupyterlab-myst + - jupyterhub-singleuser + - jupyterlab-geojson + - jupyterlab-favorites + - jupyterlab-git + - jupyter-resource-usage<1.0.0a + - jupyterlab-h5web<8.0 + # - hdf5plugin + - ipympl + - conda-lock + - pooch + - earthaccess>=0.8.2 + - sliderule>=3.6.0 + - qgis + - h5coro + - itslive + - rasterstats + - kerchunk + - rechunker + - pqdm + - spectral + - scikit-image + - coiled + - s3fs + - nbgitpuller + - awscliv2 + - jupyter-server-proxy + - jupyter-vscode-proxy + - code-server >=3.2 + - websockify + - pyopencl + - ocl-icd-system + - pip +platforms: + - linux-64 \ No newline at end of file diff --git a/ci/py-rocket/instructions.md b/ci/py-rocket/instructions.md new file mode 100644 index 0000000..f2f0030 --- /dev/null +++ b/ci/py-rocket/instructions.md @@ -0,0 +1,134 @@ +# This is based on the openscapes/py-rocket + + + +The one to use is the dated one. The `main` tag doesn't seem to always be recognized as a new tag when it changes. + +# Requirements + +Docker installed. For example, if doing on a Mac or PC, you need Docker Desktop. On VMs, docker will already be installed. + +A DockerHub user account. The instructions are using EEH's. + +# Add new packages + +Add to Dockerfile something like +``` +RUN R -e 'install.packages("gtools", repos = "http://cran.us.r-project.org")' +``` + +# Rebuild and push the Docker image + +1. Make sure Docker app is running, not just installed. So if you are on a local computer, start up the app (open it). +1. Go to a terminal and cd to the directory with the Dockerfile. So to the `ci` directory in the `nmfs-jhub` repo. +``` +cd ci/iorocker +``` +2. Update the docker tag to the date. +``` +DOCKER_TAG="20230901" +``` +2. Build the image. `.` means current directory. `eeholmes/iorocker` is the name of the repo on DockerHub. `--platform` is added if you are building on an Mac with Apple chip. +``` +docker build --platform linux/amd64 -t eeholmes/iorocker:${DOCKER_TAG} -t eeholmes/iorocker:main . +``` + +3. Push the image up to DockerHub. Make sure you are logged into DockerHub in the Docker app otherwise you'll get "access denied". Open the Docker app and look that it shows that you are signed in. +``` +docker push eeholmes/iorocker:${DOCKER_TAG} +docker push eeholmes/iorocker:main +``` + +Notes: https://help.valohai.com/hc/en-us/articles/4421364087569-Build-your-own-Docker-image + + +# Stop any running the Jupyter Lab instances + +Log in. File > Hub Control > Stop my server + +# Run `helm upgrade` + +Log into Azure portal, go to DaskHub, Connect, Cloud Shell, and run this command. Note, this assumes that `eeholmes/iorocker:main` is still the image to use. If not, edit `dconfig2.yaml` (`nano dconfig2.yaml`) and then upgrade. + +``` +helm upgrade --cleanup-on-fail --render-subchart-notes dhub dask/daskhub --namespace dhub --version=2023.1.0 --values dconfig2.yaml +``` + + +# Asides + +## To set docker tag to latest commit + +``` +SHA7="$(git rev-parse --short HEAD)" +DOCKER_TAG=$SHA7 +``` +I am not doing that since this repo has lots of commits unrelated to the docker image. + +## To set up your own Docker repo + +1. Make an account on DockerHub. Free is fine. +2. Create a repo and give it a name. For example, for this project, my account is `eeholmes` and my repo is `iopython` (Indian Ocean Python) as it is specific a particular project I am working on. + +DockerHub will want to you to buy the premium account but you only need that if you are doing continuous integration, like using a GitHub Action to autobuild your image. If you are manually building, you don't need this. + +## Why is `--platform` needed in the build command + +You won't see this on docker build tutorials. But if you are on a Mac with Apple chip, then you'll build arm64 images and that's not going to work on Ubuntu VMs. The vanilla images you see are amd64 so we want to make sure we are building for that platform. This only matters if you are on a Mac with Apple chip, but it won't break things for unix and PC so I added to make the instructions more robust. + +## If an specific image tag is in config + +The JupyterHub has a config file that specifies what images are being used. If the image is say `eeholmes/iopython:hublatest`, then whenever the a image with tag `hublatest` is pushed, the hub will use that. If on the otherhand, you config file has a specific, an unique tag that you don't overwrite, then you'll have to update the file in the config file on the cluster (log into Azure, go to cluster, connect to cloud shell, `nano dconfig2.yaml`) and upgrade the installation of the JupyterHub. + +Why not `eeholmes/iopython:latest`? There is nothing special about `latest`. It is the default tag used if you don't specify `-t` and `:` in your build call. So it is a bit too easy to accidentally update "latest" and thus update the image for you hub when you didn't intend to do that. You just forgot to specify a tag. + +To update if you are using a specific tag, like `20230615` rather than one you keep updating like `hublatest` or `latest`: + +### Step 1 + +Edit the config file. Mine is called `dconfig2.yaml`. Yours is probably `config.yaml`. Name is unimportant. + +``` +nano dconfig2.yaml +``` + +Inside `dconfig2.yaml` is this info. This shows a fixed tag. So if I update, I need to change the `20230615` part. +``` + singleuser: + image: + name: eeholmes/iopython + tag: 20230615 +``` +Save the changes. In nano, it cmd-O, return, cmd-X. + +### run `helm upgrade` + +``` +helm upgrade --cleanup-on-fail --render-subchart-notes dhub dask/daskhub --namespace dhub --version=2023.1.0 --values dconfig2.yaml +``` + +### The helm upgrade command + +``` +helm upgrade --cleanup-on-fail --render-subchart-notes dhub dask/daskhub --namespace dhub --version=2023.1.0 --values dconfig2.yaml +``` + +A helm is what runs the commands to upgrade (and install in the beginning) our JupyterHub. `dask/daskhub` is point to the repo with the "helm chart" (the instructions). `--value dconfig2.yaml` is telling it where the config file is. + +* `upgrade` upgrade an existing installation with the values in `dconfig2.yaml` +* `--render-subchart-notes` the dask/daskhub helm chart has subcharts (jupyterhub) and you need to render these too. Not all helm charts have this. +* `dask/daskhub` the name of the repo that has the helm chart. The first time you reference this, you need to tell help about the repo by giving it the url. [Read how here](https://blog.dask.org/2020/08/31/helm_daskhub) +* `--version=2023.1.0` version of the helm chart. Update when the helm chart (instructions for installing the jupyterhub) changes. + +## Adding packages with newpackages.yml + +When the openscapes image is used, we are in a conda env called 'notebook'. We want to +update that with the packages in newpackages.yml but need to get that file into the container. For now, +I just hard code in the pip install commands. + +Add to Docker file +``` +# it can't find new.yml in home/joyvan/.kernels +# need to get that into the container somehow (git clone?) +# RUN conda env update --file new.yml +``` \ No newline at end of file diff --git a/ci/rocker-binder2/Dockerfile b/ci/rocker-binder2/Dockerfile new file mode 100644 index 0000000..b2d3ea7 --- /dev/null +++ b/ci/rocker-binder2/Dockerfile @@ -0,0 +1,12 @@ +FROM rocker/binder:4.3 + +USER root +RUN mkdir /home/jovyan +RUN usermod -d /home/jovyan rstudio +RUN chown rstudio:rstudio /home/jovyan +RUN rm -r /home/rstudio +USER rstudio + +WORKDIR /home/jovyan + +CMD ["jupyterhub-singleuser"] \ No newline at end of file diff --git a/docs/JHub-User-Guide.html b/docs/JHub-User-Guide.html index e488925..c1082a0 100644 --- a/docs/JHub-User-Guide.html +++ b/docs/JHub-User-Guide.html @@ -128,6 +128,12 @@ Centos Set-up + +
  • +
    + + Centos Set-up https +
  • diff --git a/docs/Set-up-centos-security.html b/docs/Set-up-centos-security.html new file mode 100644 index 0000000..2f18739 --- /dev/null +++ b/docs/Set-up-centos-security.html @@ -0,0 +1,718 @@ + + + + + + + + + + +Eli’s JupyterHub notes - Set-up CentOS https + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    + +
    + +
    + + +
    + + + +
    + +
    +
    +

    Set-up CentOS https

    +
    + +
    +
    +

    Securing our JupyterHub on our Centos server

    +
    +
    + + +
    + + + + +
    + + +
    + +

    Now that our basic JupyterHub is running, we want to secure it. We are going to use Let’s Encrypt. Prerequisites:

    +
      +
    • We need to have set up a domain (URL) that points to the public IP of our JupyterHub
      • +
    • We need to ssh into our server and have sudo access
      • +
    • We need to open port 80 (temporarily)
      • +
    +

    References:

    + +
    +

    Create a domain name

    +

    Find a domain name provider and set one up. It is not expensive. I used GoDaddy. You only need one. Later you can use it for multiple hubs using subdomains where are created by the next step (DNS entry). For example, let’s say you get the domain bluemountain123.live. You can have as many subdomains as you want and they will be subdomain.bluemountain123.live.

    +
    +

    Create a DNS entry

    +

    Let’s pretend you set up bluemountain123.live as the domain. Go to the DNS settings for your domain. Add a type A record. This will do 2 things. First this will create the subdomain that you will use to access your JupyterHub. So let’s say you create, dhub as the type A DNS entry. Put dhub in the name and the public IP address of the server (leaving off :8000) in the value section. Then dhub.bluemountain123.live will be the url.

    +

    +
    +
    +

    Test if the url is working

    +

    http:\\dhub.bluemountain123.live:8000 would be the url using the example domain above. Test that it is working (shows a JupyterHub login) before moving on. This is what you should see:

    +

    +
    +
    +
    +

    Prep the server

    +
    +

    Open port 80

    +

    This is the default port for http and certbot is going to spin up a temporary webserver on this port and get the SSL certificates. We will close this port when we are done.

    +
      +
    • Go to the Azure dashboard (Networking section) for your CentOS server and make sure port 80 is open.
      • +
    • Check that the firewall is not blocking port 80: sudo firewall-cmd --list-ports. If 80 is not listed, we need to add it and reload:
      • +
    +
    +
    sudo firewall-cmd  --permanent --add-port 80/tcp
+sudo firewall-cmd --reload
+sudo firewall-cmd --list-ports
    +
    +
    +
    +

    Stop our JupyterHub

    +
    +
    sudo systemctl start jupyterhub.service
    +
    +
    +
    +
    +

    Install certbot

    +

    Per Let’s Encrypt recommendations, we will use certbot to get our SSL certificates. https://certbot.eff.org/.

    +

    Here are the instructions for certbot on CentOS 8: https://certbot.eff.org/instructions?ws=other&os=centosrhel8 We choose “other” as the software.

    +
    +

    Update the CentOS repos

    +

    I am using an End-of-Life CentOS distribution (sigh), and the repositories have been archived. This solution worked.

    +
    +
    dnf --disablerepo '*' --enablerepo=extras swap centos-linux-repos centos-stream-repos
+dnf distro-sync
    +
    +

    Note the last line, suggesting updating a bunch of packages and I said NO to that.

    +
    +
    +

    Install snap

    +

    Per instructions here: https://snapcraft.io/docs/installing-snap-on-centos This updated some SELinux packages, which seemed a bit alarming but nothing seemed to break.

    +
    +
    sudo yum install snapd
+sudo systemctl enable --now snapd.socket
+sudo ln -s /var/lib/snapd/snap /snap
    +
    +
    +
    +

    Install certbot

    +

    I had to run this twice. First time it complained.

    +
    +
    sudo snap install --classic certbot
+sudo ln -s /snap/bin/certbot /usr/bin/certbot
    +
    +
    +
    +

    Create the SSL certs.

    +

    Have certbot create the SSL certs by spinning up a temporary webserver listening on port 80. Per instructions on the certbot website.

    +
    +
    sudo certbot certonly --standalone
    +
    +

    It’ll ask for your email and the URL of your website. In my toy example, I created the domain dhub.bluemountain123.live.

    +
    +
    +

    SSL cert renewal

    +

    With certbot running, the certificates should auto renew, but I haven’t tested this.

    +
    +
    +
    +

    Update the JupyterHub config file

    +

    Edit with something like

    +
    +
    cd /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/
+nano jupyterhub_config.py
    +
    +

    Then add this to the config file. The port that is configured for SSL by default is 443. https is not going to work on 8000 which we had configured for http (on Azure).

    +
    c.JupyterHub.port = 443
+c.JupyterHub.ssl_key = '/etc/letsencrypt/live/dhub.bluemountain123.live/privkey.pem'
+c.JupyterHub.ssl_cert = '/etc/letsencrypt/live/dhub.bluemountain123.live/fullchain.pem'
    +
    +

    Restart and Test

    +

    We need to open 443 in the firewall, and we can close 80 and 8000 now.

    +
    +
    sudo firewall-cmd  --permanent --add-port 443/tcp
+sudo firewall-cmd  --permanent --remove-port=80/tcp
+sudo firewall-cmd  --permanent --remove-port=8000/tcp
+sudo firewall-cmd --reload
+sudo firewall-cmd --list-ports
    +
    +

    Next we restart our JupyterHub service.

    +
    +
    sudo systemctl start jupyterhub.service
    +
    +

    Try https:\\dhub.bluemountain123.live and you should see the JupyterHub login without the http warning.

    + + +
    +
    + +
    + + +
    +
    +
    +
    +   +
    +
    NMFS OpenSci logo
    NMFS OpenSci (2023)
    +
    +   +
    +
    +
    + + + + \ No newline at end of file diff --git a/docs/Set-up-centos-tljh.html b/docs/Set-up-centos-tljh.html new file mode 100644 index 0000000..078829d --- /dev/null +++ b/docs/Set-up-centos-tljh.html @@ -0,0 +1,1194 @@ + + + + + + + + + + +Eli’s JupyterHub notes - Centos Set-up with TLJH + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    +
    + +
    + +
    + + +
    + + + +
    + +
    +
    +

    Centos Set-up with TLJH

    +
    + +
    +
    +

    Setting up a multi-user JupyterHub on Centos 7 VM

    +
    +
    + + +
    + + + + +
    + + +
    + +

    This is my notes for setting this up on a Centos 8 (Linux distribution) server. Jump to the “Summary” section to see only the instructions without explanations.

    +

    All the commands are run in a shell (bash)

    +

    References:

    + +
    +

    Set up VM on Azure

    +
      +
    • Created a Centos 8.3 server on Azure: https://portal.azure.com/#create/cloud-infrastructure-services.centos-8-3centos-8-3
      • +
    • I didn’t do anything special for set-up. Choose SSH with key.
      • +
    • Once it is created, I went to the dashboard and selected my VM. The dashboard has a “Connect” button to get to the shell and it shows the public IP address.
      • +
    • I had to create a special security rule to allow me to ssh into the public IP address to connect. Normally I use the cloud shell to connect, but Azure would not let me connect via the cloud shell for a server since it wanted upgraded security package and I cannot do that with my work subscription.
      • +
    • Then I saved the key somewhere on my computer and
      • +
    +
    +
    chmod 400 ~/<key location>
+ssh -i ~/<key location>/Centos8.cer <vm-username>@<public ip-address>
    +
    + +
    +
    +

    On VM check set-up

    +

    I ssh-ed into the VM with

    +
    +
    ssh -i <path to key downloaded from Azure> eeholmes@<public ip address>
    +
    +
    +

    Make sure you are root

    +

    Getting the JupyterHub set up needs to be done as root. First make sure you have an admin password. When I set up my Azure VM, I did not set a password. So first

    +
    +
    sudo passwd <your username>
    +
    +

    and set a password. Then switch to root if you are not signed in as root

    +
    +
    sudo -i
    +
    +
    +
    +

    Check for Python

    +

    You will need Python 3.6+ installed. Open a terminal window and run python3 --version or python --version to see if Python is installed and what the version is.

    +

    Check your operating system (OS) with

    +
    +
    cat /etc/os-release
    +
    +
    +
    +

    Check for conda

    +

    You will need conda (or miniconda) for these instructions. conda (and miniconda) take care of checking that all our packages will be inter-operable. It is best to install JupyterHub into a clean environment. That way you minimize chances of conflicts and your environment will solve (figure out any conflicts) much much faster.

    +

    Check for conda with

    +
    +
    conda list
    +
    +

    If it doesn’t show a list of environments, then you need to install miniconda. Installation instructions. Read about miniconda for scientists from Software Carpentries here.

    +

    This is what I used to install miniconda from these instructions. Note install miniconda in some place like /opt/miniconda3 where all users will have access to `/opt/miniconda3/bin. We don’t want to install in /root/ for example or the admin users home directory.

    +
    +
    mkdir -p /opt/miniconda3
+wget https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh -O /opt/miniconda3/miniconda.sh
+bash /opt/miniconda3/miniconda.sh -b -u -p /opt/miniconda3
+rm -rf /opt/miniconda3/miniconda.sh
    +
    +

    Then initialize to set up the path. Note I am using bash. You’ll need to change if you are using zsh.

    +
    +
    /opt/miniconda3/bin/conda init bash
+source ~/.bashrc
    +
    +

    note will need to do something else to add the conda binary to all the users’ paths

    +
    +
    +
    +

    Create the conda environment

    +

    Create the conda environment for the jupyterhub installation. Installation will be in a directory with all the files for packages. Then activate it (enter it), and get the location of the environment (folder).

    +

    All the commands below are in the terminal window on your VM/server.

    +

    Create the environment named jupyterhub with python and jupyterhub (module). After creating, activate (enter) that environment. Then install jupyterlab, notebook and dockerspawner into the environment. Note the jupyterhub after -n is the name of the environment.

    +
    +
    conda create -n jupyterhub python
    +
    +

    Then activate (enter) that environment

    +
    +
    conda activate jupyterhub
    +
    +

    Then install jupyterhub here

    +
    +
    conda install -c conda-forge jupyterhub
    +
    +

    and then jupyterlab

    +
    +
    conda install -c conda-forge jupyterlab notebook
    +
    +
    +

    Set a variable for env path

    +

    The environment has a folder with all the packages and binaries that we install. We are going to need to know the location of that folder. Get the location with

    +
    +
    conda env list
    +
    +

    On the VM I set up, the folder location is

    +
    +
    /opt/miniconda3/envs/jupyterhub
    +
    +

    Yours could be something entirely different. On another server with anaconda (a not-free conda package resolver), the folder was

    +
    +
    /SHARE/anaconda3/envs/jupterhub/
    +
    +

    We are going to be saving the configuration files for our JupyterHub in this folder. Let’s save the path to a variable so we don’t have to keep entering the whole path.

    +
    +
    JHUBENV=/opt/miniconda3/envs/jupyterhub
    +
    +

    Make sure users can read and execute this folder. They need to in order to be able to spawn instances for the hub.

    +
    +
    chmod 755 $JHUBENV
    +
    +

    You should now be able to start the hub, but you will not be able to access it yet because you need to open the 8000 port. Type

    +
    +
    $JHUBENV/bin/jupyterhub
    +
    +

    and check that it starts. Then use Cntl-C to stop the hub.

    +
    +
    +
    +

    Create a user on the VM

    +

    By default, any user on the server will be able to login. Let’s create a test user so that we are not logging into our hub with the root user password. We will be using “http” until we secure it so passwords are potentially exposed.

    +
    +
    useradd jhub
    +
    +

    and give it a password when it asks.

    +
    +
    +

    Open the 8000 port

    +

    FirewallD was not running on my Azure Centos server, so I started it up to manage the ports.

    +
    +
    sudo systemctl enable firewalld
+sudo systemctl start firewalld
    +
    +

    Find out the Public IP address for the server you are on; it’s listed on the Azure overview and networking page for the VM in the Azure portal. Then open the 8000 port.

    +

    First find out what ports are open through the firewall

    +
    +
    sudo firewall-cmd --list-ports
    +
    +

    Add the 8000 port, reload and recheck that it appears.

    +
    +
    sudo firewall-cmd  --permanent --add-port 8000/tcp
+sudo firewall-cmd --reload
+sudo firewall-cmd --list-ports
    +
    +

    Because I am on an Azure VM, I also have to set up a networking rule to allow the 8000 port. By default, all public access to the server is blocked. Go to the Azure dashboard, select your VM, then select Networking under Settings, and then click Add Inbound Port rule. I am pretty sure you need to select “http” instead of “https”.

    +

    Once the port is open, you should be able to reach your JupyterHub at http://XXX.XX.XX.XX:8000 (replace the XX’s with the Public IP address).

    +

    Background

    +

    The JupyterhHub is running by default on http://localhost:8000. This means that if you start the hub on a machine that you are logged into, you should be able to open a browser on that machine, enter http://localhost:8000 and the hub login page will appear. There are a few reasons that might not work

    +
      +
    • You are ssh-ing into a server and don’t have a browser to open. The browser on the computer that you are ssh-ing from is the “localhost” in this case and you need the “localhost” to be the server.
      • +
    • You are logged directly into your server, but it doesn’t have a browser installed.
      • +
    +

    However http://localhost:8000 is actually not very useful. We are trying to create a hub that others can log into from their browsers.

    +

    So you need to determine the Public IP address for the server you are on. This is the IP address that you could enter into a browser. If you enter http://XXX.XX.XX.XX (replace with actual IP), then you should see a page of some sort. This indicates that the server is working. If you are on an internal network, then you will only be able to load the address if you are also on that network. But for security reason, ports will not be open by default. You need to open the 8000 port so that http://XXX.XX.XX.XX:8000 will be found.

    +
    +
    +

    Log in!

    +

    At this point, you should be able to login with the jhub test account.

    +
    +
    +

    Set up a configuration file

    +

    So far, we have started the hub with the default configuration. We are going to need to customize it. For that we need a configuration file. We will create this in the folder where the environment files are.

    +
    +
    sudo mkdir -p $JHUBENV/etc/jupyterhub/
+cd $JHUBENV/etc/jupyterhub/
    +
    +

    Next create the default configuration file jupyterhub_config.py.

    +
    +
    sudo $JHUBENV/bin/jupyterhub --generate-config
    +
    +

    Because we cd-d into the $JHUBENV/etc/jupyterhub/ directory, the file is created there. This default file is very long. Open up with

    +
    +
    nano jupyterhub_config.py
    +
    +

    Use F6 to find lines. Uncomment these two lines and save (Cntl-O, Enter, Cntl-X).

    +
    +
    c.Spawner.http_timeout = 3600
    +
    +
    +
    +

    Make a new server service

    +
    +

    Create the new unit file

    +

    At this point, after opening the port, you should be able to get to your JupyterHub by starting it with jupyterhub --ip XXX.XX.XX.XX --port=8000 and then browsing to http://XXX.XX.XX.XX:8000. But you hub is going to be stopped whenever the server is rebooted. So next we need to set up a service for your service so that our hub starts automatically.

    +

    Create a new directory for the service unit file,

    +
    +
    sudo mkdir -p $JHUBENV/etc/systemd
+cd $JHUBENV/etc/systemd
    +
    +

    Create the file and name jupyterhub.service. For example, using nano editor, we do

    +
    +
    nano jupyterhub.service
    +
    +

    And into that file we put the following. Replace /opt/miniconda3/envs/jupyterhub with the actual path to the jupyterhub environment folder.

    +
    +
    [Unit]
+Description=JupyterHub
+After=syslog.target network.target
+
+[Service]
+User=root
+Environment="PATH=/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/opt/miniconda3/envs/jupyterhub/bin"
+ExecStart=/opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py
+
+[Install]
+WantedBy=multi-user.target
    +
    +

    Next we make systemd aware of the new service.

    +

    Create a symlink file in the folder where all the server services are kept. And tell systemd to reload its configuration files

    +
    +
    sudo ln -s $JHUBENV/etc/systemd/jupyterhub.service /etc/systemd/system/jupyterhub.service
+sudo systemctl daemon-reload
    +
    +
    +
    +

    Make sure SELinux doesn’t block our service

    +

    SELinux (security for the server) checks that files that are used have the correct label. All our files have generic file labels. If you do,

    +
    +
    ls -Z $JHUBENV/etc/systemd/
    +
    +

    You will see that the file label is unconfined_u:object_r:usr_t:s0. We need it to be

    +
    +
    systemd_unit_file_t
    +
    +

    We change the file label with

    +
    +
    sudo chcon system_u:object_r:systemd_unit_file_t:s0 $JHUBENV/etc/systemd/jupyterhub.service
    +
    +

    SELinux will also object to the file label on all the binaries that we use to start up the JupyterHub (like jupyterhub) so we need to fix those file labels.

    +

    This will add bin_t label to all the binaries and check that it worked.

    +
    +
    sudo find $JHUBENV/bin -type f -exec chcon system_u:object_r:bin_t:s0 {} \;
+ls -Z $JHUBENV/bin
    +
    +

    It got all the binaries but not the simlinks. Nonetheless it seemed to run ok.

    +
    +
    +

    Enable our new service

    +
    +
    sudo systemctl enable jupyterhub.service
    +
    +

    The service will start on reboot, but we can start it straight away using start:

    +
    +
    sudo systemctl start jupyterhub.service
    +
    +

    Check that it is running.

    +
    +
    sudo systemctl status jupyterhub.service
    +
    +

    If it fails, try

    +
    +
    audit2why < /var/log/audit/audit.log
    +
    +

    to debug. It is likely to be an issue with SELinux blocking the service from starting.

    +

    Now our hub should be available on http:\\XXX.XX.XX.XX:8000. You can double check that it is listen on this port by running

    +
    +
    netstat -tuln
    +
    +

    At this point, you will need to address security if your hub is open to the web, as opposed to being on an internal network and only accessible to that network. Learn about that here.

    +
    +
    +
    +

    Set up Docker for user environment

    +

    When you log in the jupyter notebooks will be trying to use the Python environment that was created to install JupyterHub, this is not what we want. We will use a docker image to “spawn” the user environment. Read here for other approaches.

    +

    We are going to use dockerspawner so that we can use a docker image for our user environments. The user will work in these containerized environments and they won’t have access to any other files in the server. In order to share their work with others, the normal workflow would be to work in Git repos and share those repos to a GitHub (or GitLab server). Each user will have a home directory on the server for their files, but they won’t have access to other hub user directories nor will they have access to any other directories on the server.

    +
    +

    Install docker

    +

    I am using Centos in this example

    +
    +
    sudo yum install -y yum-utils
+sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
    +
    +

    Then we need to start docker

    +
    +
    sudo systemctl start docker
    +
    +
    +
    +

    Install dockerspawner

    +

    I am going to be creating the user environment from a docker image, so I also want dockerspawner. Note dockerspawner installed docker-py but it was really old and threw errors so I installed separately to get the latest version. Note make sure you are in the jupyterhub conda env. You can run conda env list and use conda activate jupyterhub if you are not in it.

    +
    +
    conda install -c conda-forge dockerspawner
+conda install -c conda-forge docker-py
    +
    +
    +
    +

    Jupyter images

    +

    The image that we use must have the jupyterhub and notebook module installed. The jupyterhub version needs to also match what you have on your hub.

    +

    Check the version on your server:

    +
    +
    $JHUBENV/bin/jupyterhub -V
    +
    +

    For demo purposes, we will use the jupyter images on DockerHub. We want to find an image with the same version of jupyterhub as we have on our server.

    +
    +
    +

    Edit the config file

    +

    Edit the jupyterhub_config.py file in $JHUB-ENV/etc/jupyterhub/ to add that we want to use DockerSpawner and specify the images that users should have access to. Users will get a drop down menu. Add these lines to jupyterhub_config.py. The hub bind url needs to be 0.0.0.0 because we are using a docker container for the individual user environments.

    +
      +
    • https://discourse.jupyter.org/t/whats-the-main-difference-between-hub-connect-url-vs-hub-bind-url/3596/2
      • +
    • Note image_whitelist is deprecated as of dockerspawner 12.0. New name is allowed_images.
      • +
    +
    +
    c = get_config()  #noqa
+c.JupyterHub.port = 8000
+c.JupyterHub.hub_bind_url = "http://0.0.0.0:8081"
+c.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'
+c.DockerSpawner.remove = True
+c.Spawner.http_timeout = 3600
+c.DockerSpawner.image_whitelist = {
+    'datascience-r': 'jupyter/datascience-notebook:r-4.3.1',
+    'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f',
+}
    +
    +

    Do a docker pull of the images so that they don’t have to be pulled the first time that a user chooses that image.

    +
    +
    docker pull jupyter/datascience-notebook:r-4.3.1
+docker pull jupyter/scipy-notebook:7e1a19a8427f
    +
    +

    Now you can restart the service and the user can start a notebook with the specified images.

    +
    +
    +

    Create your own Docker images

    +

    Docker images that work with JupyterHub with Kubernetes will work with this set-up with the addition of jupyterhub and notebook.

    +

    Add the following to your Docker image

    +
    +
    RUN pip3 install \
+    'jupyter-rsession-proxy' \
+    'jupyterhub==3.1.*' \
+    'notebook==6.*' \
+    'jupyterlab'
+
+CMD ["jupyterhub-singleuser"]
    +
    +

    Example using rocker image. Code added to make the home directory home/jovyan.

    +
    +
    FROM rocker/binder:4.3
+
+USER root
+RUN usermod -d /home/jovyan rstudio
+RUN mkdir /home/jovyan
+RUN chown rstudio:rstudio /home/jovyan
+USER rstudio
+
+RUN pip3 install \
+    'jupyter-rsession-proxy' \
+    'jupyterhub==3.1.*' \
+    'notebook==6.*' \
+    'jupyterlab'
+
+WORKDIR /home/jovyan
+
+CMD ["jupyterhub-singleuser"]
    +
    +

    Example using openscapes/rocker

    +
    +
    FROM openscapes/rocker:a7596b5
+
+RUN pip3 install \
+    'jupyter-rsession-proxy' \
+    'jupyterhub==3.1.*' \
+    'notebook==6.*' \
+    'jupyterlab'
+
+USER root
+RUN mkdir /home/jovyan
+RUN chown rstudio:rstudio /home/jovyan
+USER rstudio
+
+CMD ["jupyterhub-singleuser"]
    +
    +
    +
    +

    Special note regarding rocker images

    +

    The default home directory for rocker images is home/rstudio but the default for JupyterHub is home/jovyan.

    +
    +
    +
    +

    Persistent volume

    +

    Add the following to the config file to create a persistent volume.

    +
    +
    notebook_dir = '/home/jovyan'
+c.DockerSpawner.notebook_dir = notebook_dir
+
+# Mount the real user's Docker volume on the host to the notebook user's
+# notebook directory in the container
+c.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir }
    +
    +
    +
    +

    User environment customization

    +
    +

    Memory limits and guarantees

    +

    You can set memory limits on the containers that are spawned for users by adding limits. Read the documentation here.

    +

    For example:

    +
    +
    c.DockerSpawner.mem_limit = '8G'
+c.DockerSpawner.mem_guarantee = '1G'
+c.DockerSpawner.cpu_guarantee = 0.5
+c.DockerSpawner.cpu_limit = 1
    +
    +

    If that doesn’t work try

    +
    +
    c.Spawner.mem_limit = '2G'
    +
    +

    I believe you can specify as a drop-down to give the user choices:

    +
    +
    c.DockerSpawner.mem_guarantee = {
+    '1G': '1G',
+    '2G': '2G',
+    '8G': '8G',
+}
    +
    +
    +
    +

    Creating a shared volume

    +

    One read-only shared volume:

    +

    https://github.com/jupyterhub/dockerspawner/issues/172

    +
    +
    c.DockerSpawner.volumes = {  'jupyterhub-user-{username}':'/home/jovyan',   '/path/to/shared': {"bind": '/home/jovyan/shared', "mode": "ro"} }
    +
    +

    A volume that is read-only for some and read-write for others:

    +

    https://github.com/jupyterhub/dockerspawner/issues/172

    +

    More discussions around shared volumes

    +

    https://github.com/jupyterhub/dockerspawner/issues/453

    +
    +
    +
    +

    Setting up https

    +

    If you are using a public IP address, rather than being on a private network, you will want to set up https.

    +
    +

    Create a domain name

    +

    Find a domain name provider and set one up. It is not expensive. I used GoDaddy. You only need one. Later you can use it for multiple hubs using subdomains where are created by the next step (DNS entry). For example, let’s say you get the domain bluemountain123.live. You can have as many subdomains as you want and they will be subdomain.bluemountain123.live.

    +
    +
    +

    Create a DNS entry

    +

    Let’s pretend you set up bluemountain123.live as the domain. Go to the DNS settings for your domain. Add a type A record. This will do 2 things. First this will create the subdomain that you will use to access your JupyterHub. So let’s say you create, dhub as the type A DNS entry. Put dhub in the name and the public IP address of the server (leaving off :8000) in the value section. Then dhub.bluemountain123.live will be the url.

    +

    +
    +
    +

    Test if the url is working

    +

    http:\\dhub.bluemountain123.live:8000 would be the url using the example domain above. Test that it is working (shows a JupyterHub login) before moving on. This is what you should see:

    +

    +
    +
    +

    Set-up https on your JupyterHub

    +

    Log back into your Kubernetes cluster: go to portal.azure.com, click on your Kubernetes cluster name, and then click on “Connect”. Then click on “Open Cloud Shell”. Read documentation about https

    +

    Once you are on the shell, type

    +
    nano dconfig.yaml
    +

    to edit the config file. Paste this in and save. Note the additional jupyterhub: in the yaml file. This is not in a plain JupyterHub with Kubernetes config file (i.e. in a non-daskhub, the jupyterhub: bit is not there and everything is moved to left by 2 spaces).

    +
    jupyterhub:
+  proxy:
+    https:
+      enabled: true
+      hosts:
+        - dhub.bluemountain123.live
+      letsencrypt:
+        contactEmail: your@email.com
    +
    +
    +

    Update the JupyterHub installation

    +

    Anytime you change dconfig.yaml you need to run this code.

    +
    helm upgrade --cleanup-on-fail --render-subchart-notes dhub dask/daskhub --namespace dhub --version=2023.1.0 --values dconfig.yaml
    +
    +
    +

    Test if https is working

    +

    Try https:\\dhub.bluemountain123.live and you should see the JupyterHub login without that http warning.

    +
    +
    +
    +

    Authentication

    +

    https://oauthenticator.readthedocs.io/en/latest/tutorials/provider-specific-setup/providers/github.html

    +
    +
    +

    Summary

    +

    Only the instructions. Make sure you are installing as the root user. I assume you have Python and conda installed.

    +

    Create the conda environment

    +
    +
    sudo -i
+
+conda create -n jupyterhub python --yes
+conda activate jupyterhub
+conda install -c conda-forge jupyterhub --yes
+conda install -c conda-forge jupyterlab notebook --yes
+
+JHUBENV=/opt/miniconda3/envs/jupyterhub
+chmod 755 $JHUBENV
    +
    +

    Create user

    +
    +
    useradd jhub
    +
    +

    Open the 8000 port for access to the application.

    +
    +
    #sudo systemctl enable firewalld
+#sudo systemctl start firewalld
+
+sudo firewall-cmd  --permanent --add-port 8000/tcp
+sudo firewall-cmd --reload
+sudo firewall-cmd --list-ports
    +
    +

    Create the configuration file. Will be editted at end.

    +
    +
    sudo mkdir -p $JHUBENV/etc/jupyterhub/
+cd $JHUBENV/etc/jupyterhub/
+sudo $JHUBENV/bin/jupyterhub --generate-config
    +
    +

    Install docker if needed

    +
    +
    sudo yum install -y yum-utils
+sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
+
+sudo systemctl start docker
    +
    +

    Not sure this is needed.

    +
    +
    sudo firewall-cmd --zone=docker --add-port=8081/tcp
+sudo firewall-cmd --reload
+sudo systemctl restart docker
    +
    +

    Install dockerspawner

    +
    +
    conda install -c conda-forge dockerspawner --yes
+conda install -c conda-forge docker-py --yes
    +
    +

    Edit the configuration file.

    +
    +
    cd $JHUBENV/etc/jupyterhub/
+nano jupyterhub_config.py
    +
    +

    Paste this in

    +
    +
    # Configuration file for jupyterhub.
+
+c = get_config()  #noqa
+c.JupyterHub.port = 8000
+c.JupyterHub.hub_bind_url = "http://0.0.0.0:8081"
+c.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'
+c.DockerSpawner.remove = True
+c.Spawner.http_timeout = 3600
+c.DockerSpawner.image_whitelist = {
+    'iorocker': 'eeholmes/iorocker-standalone:20231003',
+    'rocker-binder': 'eeholmes/rocker-binder:20231003',
+    'openscapes-rocker': 'eeholmes/minimal-jhub:20231004',
+    'datascience-r': 'jupyter/datascience-notebook:r-4.3.1',
+    'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f',
+}
+
+notebook_dir = '/home/jovyan'
+c.DockerSpawner.notebook_dir = notebook_dir
+
+# Mount the real user's Docker volume on the host to the notebook user's
+# notebook directory in the container
+c.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir }
    +
    +

    Docker pull of the images. Do all.

    +
    +
    docker pull jupyter/datascience-notebook:r-4.3.1
+docker pull jupyter/scipy-notebook:7e1a19a8427f
    +
    +

    Make a new server service

    +
    +
    sudo mkdir -p $JHUBENV/etc/systemd
+cd $JHUBENV/etc/systemd
+nano jupyterhub.service
    +
    +

    Paste this in

    +
    +
    [Unit]
+Description=JupyterHub
+After=syslog.target network.target
+
+[Service]
+User=root
+Environment="PATH=/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/opt/miniconda3/envs/jupyterhub/bin"
+ExecStart=/opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py
+
+[Install]
+WantedBy=multi-user.target
    +
    +

    Make sure SELinux doesn’t block our service

    +
    +
    ls -Z $JHUBENV/etc/systemd/
+sudo chcon system_u:object_r:systemd_unit_file_t:s0 $JHUBENV/etc/systemd/jupyterhub.service
+sudo find $JHUBENV/bin -type f -exec chcon system_u:object_r:bin_t:s0 {} \;
    +
    +

    Enable our new service

    +
    +
    sudo ln -s $JHUBENV/etc/systemd/jupyterhub.service /etc/systemd/system/jupyterhub.service
+sudo systemctl daemon-reload
+sudo systemctl enable jupyterhub.service
+sudo systemctl start jupyterhub.service
    +
    +

    Done! See the long instructions if anything is not working.

    + + +
    + +
    + +
    +
    +
    +
    +   +
    +
    NMFS OpenSci logo
    NMFS OpenSci (2023)
    +
    +   +
    +
    +
    + + + + \ No newline at end of file diff --git a/docs/Set-up-centos.html b/docs/Set-up-centos.html index 0d2301a..a7a57b8 100644 --- a/docs/Set-up-centos.html +++ b/docs/Set-up-centos.html @@ -64,7 +64,7 @@ - + @@ -162,6 +162,12 @@ Centos Set-up
    +
    • +
  • +
    + + Centos Set-up https +
  • @@ -189,6 +195,9 @@

    On this page

  • Make a new server service
  • Set up Docker for user environment
  • Persistent volume
    • +
  • User environment customization
    • +
  • Setting up https
    • +
  • GitHub authentication
  • Summary

    • Edit this page

    Report an issue

    View source

    @@ -218,7 +227,7 @@

    Centos Set-up

    -

    This is my notes for setting this up on a Centos 7 (Linux distribution) server. Jump to the “Summary” section to see only the instructions without explanations.

    +

    This is my notes for setting this up on a Centos 8 (Linux distribution) server. Jump to the “Summary” section to see only the instructions without explanations.

    All the commands are run in a shell (bash)

    References:

      @@ -231,12 +240,12 @@

      Set up VM on Azure

    • Created a Centos 8.3 server on Azure: https://portal.azure.com/#create/cloud-infrastructure-services.centos-8-3centos-8-3
    • I didn’t do anything special for set-up. Choose SSH with key.
    • Once it is created, I went to the dashboard and selected my VM. The dashboard has a “Connect” button to get to the shell and it shows the public IP address.
      • -
    • I had to create a special security rule to allow me to ssh into the public IP address to connect. Normally I use the cloud shell to connect, but Azure would not let me connect via the cloud shell for a server since it wanted upgraded security and I cannot do that with my work subscription.
      • +
    • I had to create a special security rule to allow me to ssh into the public IP address to connect. Normally I use the cloud shell to connect, but Azure would not let me connect via the cloud shell for a server since it wanted upgraded security package and I cannot do that with my work subscription.
    • Then I saved the key somewhere on my computer and
    chmod 400 ~/<key location>
-ssh -i ~/<key location> <vm-username>@<public key>
    +ssh -i ~/<key location>/Centos8.cer <vm-username>@<public ip-address>
    + +
    +

    User environment customization

    +
    +

    Memory limits and guarantees

    +

    You can set memory limits on the containers that are spawned for users by adding limits. Read the documentation here.

    +

    For example:

    +
    +
    c.DockerSpawner.mem_limit = '8G'
+c.DockerSpawner.mem_guarantee = '1G'
+c.DockerSpawner.cpu_guarantee = 0.5
+c.DockerSpawner.cpu_limit = 1
    +
    +

    If that doesn’t work try

    +
    +
    c.Spawner.mem_limit = '2G'
    +
    +

    I believe you can specify as a drop-down to give the user choices:

    +
    +
    c.DockerSpawner.mem_guarantee = {
+    '1G': '1G',
+    '2G': '2G',
+    '8G': '8G',
+}
    +
    +
    +
    +

    Creating a shared volume

    +

    One read-only shared volume:

    +

    https://github.com/jupyterhub/dockerspawner/issues/172

    +
    +
    c.DockerSpawner.volumes = {  'jupyterhub-user-{username}':'/home/jovyan',   '/path/to/shared': {"bind": '/home/jovyan/shared', "mode": "ro"} }
    +
    +

    A volume that is read-only for some and read-write for others:

    +

    https://github.com/jupyterhub/dockerspawner/issues/172

    +

    More discussions around shared volumes

    +

    https://github.com/jupyterhub/dockerspawner/issues/453

    +
    +
    +
    +

    Setting up https

    +

    If you are using a public IP address, rather than being on a private network, you need to set up https so that content (passwords and everything else) is not visible. Read how to do that here.

    +

    These instructions set up this url: https:\\dhub.bluemountain123.live

    +
    +
    +

    GitHub authentication

    +

    After you have https set-up, we can set up authentication via a GitHub teams in a GitHub organization. Read other ways to authenticate (create users) here.

    +

    https://oauthenticator.readthedocs.io/en/latest/tutorials/provider-specific-setup/providers/github.html

    +
    +

    Create a new Oauth Application on GitHub

    +

    This Oauth application is going to be associated with your (personal) GitHub account, but you will use a team on a GitHub organization that you are owner of for the users who are allowed to log into your JupyterHub.

    +

    Log into GitHub and go to GitHub > Settings > Developer Settings > New Oauth Application

    +

    Look carefully at how I filled in the boxes. Change the URL and the name of the application.

    +

    +

    Next you will see something like this

    +

    +

    You need to copy the ID and then click the create secrets button and save the secret. You will need those in the next step.

    +
    +
    +

    Create a team in your GitHub organization

    +

    You will be added by default and add anyone else who needs access to the hub. Let’s say your GitHub organization is MyOrg and the team is called JHub. So then the allowed organization is MyOrg:JHub. You can leave off :JHub if you want to allow all members of the organization to log in.

    +
    +
    +

    Edit the jupyterhub_config.py file

    +
    c.JupyterHub.authenticator_class = "github"
+c.OAuthenticator.oauth_callback_url = "https:\\dhub.bluemountain123.live/hub/oauth_callback"
+c.OAuthenticator.client_id = "your oauth2 application id"
+c.OAuthenticator.client_secret = "your oauth2 application secret"
+c.GitHubOAuthenticator.allowed_organizations = "MyOrg:JHub"
+c.GitHubOAuthenticator.scope = "read:org"
    +

    Replace the id, secret and url with your values.

    @@ -630,139 +695,123 @@

    Summary

    Only the instructions. Make sure you are installing as the root user. I assume you have Python and conda installed.

    Create the conda environment

    -
    sudo -i
-
-conda create -n jupyterhub python --yes
-conda activate jupyterhub
-conda install -c conda-forge jupyterhub --yes
-conda install -c conda-forge jupyterlab notebook --yes
-
-JHUBENV=/opt/miniconda3/envs/jupyterhub
-chmod 755 $JHUBENV
    +
    sudo -i
+
+conda create -n jupyterhub python --yes
+conda activate jupyterhub
+conda install -c conda-forge jupyterhub --yes
+conda install -c conda-forge jupyterlab notebook --yes
+
+JHUBENV=/opt/miniconda3/envs/jupyterhub
+chmod 755 $JHUBENV

    Create user

    -
    useradd jhub
    +
    useradd jhub

    Open the 8000 port for access to the application.

    -
    #sudo systemctl enable firewalld
-#sudo systemctl start firewalld
-
-sudo firewall-cmd  --permanent --add-port 8000/tcp
-sudo firewall-cmd --reload
-sudo firewall-cmd --list-ports
    -
    -

    Create the configuration file. Will be editted at end.

    +
    #sudo systemctl enable firewalld
+#sudo systemctl start firewalld
+
+sudo firewall-cmd  --permanent --add-port 8000/tcp
+sudo firewall-cmd --reload
+sudo firewall-cmd --list-ports
    + +

    Create the configuration file. Will be edited at end.

    -
    sudo mkdir -p $JHUBENV/etc/jupyterhub/
-cd $JHUBENV/etc/jupyterhub/
-sudo $JHUBENV/bin/jupyterhub --generate-config
    +
    sudo mkdir -p $JHUBENV/etc/jupyterhub/
+cd $JHUBENV/etc/jupyterhub/
+sudo $JHUBENV/bin/jupyterhub --generate-config

    Install docker if needed

    -
    sudo yum install -y yum-utils
-sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
-
-sudo systemctl start docker
    +
    sudo yum install -y yum-utils
+sudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
+
+sudo systemctl start docker

    Not sure this is needed.

    -
    sudo firewall-cmd --zone=docker --add-port=8081/tcp
-sudo firewall-cmd --reload
-sudo systemctl restart docker
    +
    sudo firewall-cmd --zone=docker --add-port=8081/tcp
+sudo firewall-cmd --reload
+sudo systemctl restart docker

    Install dockerspawner

    -
    conda install -c conda-forge dockerspawner --yes
-conda install -c conda-forge docker-py --yes
    +
    conda install -c conda-forge dockerspawner --yes
+conda install -c conda-forge docker-py --yes

    Edit the configuration file.

    -
    cd $JHUBENV/etc/jupyterhub/
-nano jupyterhub_config.py
    +
    cd $JHUBENV/etc/jupyterhub/
+nano jupyterhub_config.py

    Paste this in

    -
    # Configuration file for jupyterhub.
-
-c = get_config()  #noqa
-c.JupyterHub.port = 8000
-c.JupyterHub.hub_bind_url = "http://0.0.0.0:8081"
-c.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'
-c.DockerSpawner.remove = True
-c.Spawner.http_timeout = 3600
-c.DockerSpawner.image_whitelist = {
-    'iorocker': 'eeholmes/iorocker-standalone:20231003',
-    'rocker-binder': 'eeholmes/rocker-binder:20231003',
-    'openscapes-rocker': 'eeholmes/minimal-jhub:20231004',
-    'datascience-r': 'jupyter/datascience-notebook:r-4.3.1',
-    'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f',
-}
-
-notebook_dir = '/home/jovyan'
-c.DockerSpawner.notebook_dir = notebook_dir
-
-# Mount the real user's Docker volume on the host to the notebook user's
-# notebook directory in the container
-c.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir }
    +
    # Configuration file for jupyterhub.
+
+c = get_config()  #noqa
+c.JupyterHub.port = 8000
+c.JupyterHub.hub_bind_url = "http://0.0.0.0:8081"
+c.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'
+c.DockerSpawner.remove = True
+c.Spawner.http_timeout = 3600
+c.DockerSpawner.image_whitelist = {
+    'iorocker': 'eeholmes/iorocker-standalone:20231003',
+    'rocker-binder': 'eeholmes/rocker-binder:20231003',
+    'openscapes-rocker': 'eeholmes/minimal-jhub:20231004',
+    'datascience-r': 'jupyter/datascience-notebook:r-4.3.1',
+    'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f',
+}
+
+notebook_dir = '/home/jovyan'
+c.DockerSpawner.notebook_dir = notebook_dir
+
+# Mount the real user's Docker volume on the host to the notebook user's
+# notebook directory in the container
+c.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir }

    Docker pull of the images. Do all.

    -
    docker pull jupyter/datascience-notebook:r-4.3.1
-docker pull jupyter/scipy-notebook:7e1a19a8427f
    +
    docker pull jupyter/datascience-notebook:r-4.3.1
+docker pull jupyter/scipy-notebook:7e1a19a8427f

    Make a new server service

    -
    sudo mkdir -p $JHUBENV/etc/systemd
-cd $JHUBENV/etc/systemd
-nano jupyterhub.service
    +
    sudo mkdir -p $JHUBENV/etc/systemd
+cd $JHUBENV/etc/systemd
+nano jupyterhub.service

    Paste this in

    -
    [Unit]
-Description=JupyterHub
-After=syslog.target network.target
-
-[Service]
-User=root
-Environment="PATH=/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/opt/miniconda3/envs/jupyterhub/bin"
-ExecStart=/opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py
-
-[Install]
-WantedBy=multi-user.target
    +
    [Unit]
+Description=JupyterHub
+After=syslog.target network.target
+
+[Service]
+User=root
+Environment="PATH=/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/opt/miniconda3/envs/jupyterhub/bin"
+ExecStart=/opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py
+
+[Install]
+WantedBy=multi-user.target

    Make sure SELinux doesn’t block our service

    -
    ls -Z $JHUBENV/etc/systemd/
-sudo chcon system_u:object_r:systemd_unit_file_t:s0 $JHUBENV/etc/systemd/jupyterhub.service
-sudo find $JHUBENV/bin -type f -exec chcon system_u:object_r:bin_t:s0 {} \;
    +
    ls -Z $JHUBENV/etc/systemd/
+sudo chcon system_u:object_r:systemd_unit_file_t:s0 $JHUBENV/etc/systemd/jupyterhub.service
+sudo find $JHUBENV/bin -type f -exec chcon system_u:object_r:bin_t:s0 {} \;

    Enable our new service

    -
    sudo ln -s $JHUBENV/etc/systemd/jupyterhub.service /etc/systemd/system/jupyterhub.service
-sudo systemctl daemon-reload
-sudo systemctl enable jupyterhub.service
-sudo systemctl start jupyterhub.service
    +
    sudo ln -s $JHUBENV/etc/systemd/jupyterhub.service /etc/systemd/system/jupyterhub.service
+sudo systemctl daemon-reload
+sudo systemctl enable jupyterhub.service
+sudo systemctl start jupyterhub.service

    Done! See the long instructions if anything is not working.

    - +

    Now go through the https and GitHub authentication steps if you need that.

    @@ -1123,8 +1172,8 @@

    Summary

    - - Set-up VM on mac + + Centos Set-up https
    diff --git a/docs/Set-up-daskhub.html b/docs/Set-up-daskhub.html index 1fc9cd1..f7c9d9d 100644 --- a/docs/Set-up-daskhub.html +++ b/docs/Set-up-daskhub.html @@ -128,6 +128,12 @@ Centos Set-up + +
  • +
    + + Centos Set-up https +
  • diff --git a/docs/Setup-Notes.html b/docs/Setup-Notes.html index 2a60df9..cbe843e 100644 --- a/docs/Setup-Notes.html +++ b/docs/Setup-Notes.html @@ -125,6 +125,12 @@ Centos Set-up
    +
    • +
  • +
    + + Centos Set-up https +
  • diff --git a/docs/ci/iopython-tf/instructions.html b/docs/ci/iopython-tf/instructions.html index 9968b93..9990997 100644 --- a/docs/ci/iopython-tf/instructions.html +++ b/docs/ci/iopython-tf/instructions.html @@ -125,6 +125,12 @@ Centos Set-up
    +
    • +
  • +
    + + Centos Set-up https +
  • diff --git a/docs/ci/iopython/instructions.html b/docs/ci/iopython/instructions.html index fc7977f..71397ae 100644 --- a/docs/ci/iopython/instructions.html +++ b/docs/ci/iopython/instructions.html @@ -125,6 +125,12 @@ Centos Set-up
    +
    • +
  • +
    + + Centos Set-up https +
  • diff --git a/docs/ci/iorocker/instructions.html b/docs/ci/iorocker/instructions.html index e2d41a9..79bb4c3 100644 --- a/docs/ci/iorocker/instructions.html +++ b/docs/ci/iorocker/instructions.html @@ -125,6 +125,12 @@ Centos Set-up
    +
    • +
  • +
    + + Centos Set-up https +
  • diff --git a/docs/ci/iosdmTMB/instructions.html b/docs/ci/iosdmTMB/instructions.html index 97aacc1..d4e9b90 100644 --- a/docs/ci/iosdmTMB/instructions.html +++ b/docs/ci/iosdmTMB/instructions.html @@ -125,6 +125,12 @@ Centos Set-up
    +
    • +
  • +
    + + Centos Set-up https +
  • diff --git a/docs/index.html b/docs/index.html index 50534d5..a638fde 100644 --- a/docs/index.html +++ b/docs/index.html @@ -126,6 +126,12 @@ Centos Set-up
    +
    • +
  • +
    + + Centos Set-up https +
  • diff --git a/docs/search.json b/docs/search.json index 1660ee1..9876c00 100644 --- a/docs/search.json +++ b/docs/search.json @@ -1,4 +1,109 @@ [ + { + "objectID": "Set-up-centos-tljh.html", + "href": "Set-up-centos-tljh.html", + "title": "Centos Set-up with TLJH", + "section": "", + "text": "This is my notes for setting this up on a Centos 8 (Linux distribution) server. Jump to the “Summary” section to see only the instructions without explanations.\nAll the commands are run in a shell (bash)\nReferences:" + }, + { + "objectID": "Set-up-centos-tljh.html#set-up-vm-on-azure", + "href": "Set-up-centos-tljh.html#set-up-vm-on-azure", + "title": "Centos Set-up with TLJH", + "section": "Set up VM on Azure", + "text": "Set up VM on Azure\n\nCreated a Centos 8.3 server on Azure: https://portal.azure.com/#create/cloud-infrastructure-services.centos-8-3centos-8-3\nI didn’t do anything special for set-up. Choose SSH with key.\nOnce it is created, I went to the dashboard and selected my VM. The dashboard has a “Connect” button to get to the shell and it shows the public IP address.\nI had to create a special security rule to allow me to ssh into the public IP address to connect. Normally I use the cloud shell to connect, but Azure would not let me connect via the cloud shell for a server since it wanted upgraded security package and I cannot do that with my work subscription.\nThen I saved the key somewhere on my computer and\n\n\nchmod 400 ~/<key location>\nssh -i ~/<key location>/Centos8.cer <vm-username>@<public ip-address>" + }, + { + "objectID": "Set-up-centos-tljh.html#on-vm-check-set-up", + "href": "Set-up-centos-tljh.html#on-vm-check-set-up", + "title": "Centos Set-up with TLJH", + "section": "On VM check set-up", + "text": "On VM check set-up\nI ssh-ed into the VM with\n\nssh -i <path to key downloaded from Azure> eeholmes@<public ip address>\n\n\nMake sure you are root\nGetting the JupyterHub set up needs to be done as root. First make sure you have an admin password. When I set up my Azure VM, I did not set a password. So first\n\nsudo passwd <your username>\n\nand set a password. Then switch to root if you are not signed in as root\n\nsudo -i\n\n\n\nCheck for Python\nYou will need Python 3.6+ installed. Open a terminal window and run python3 --version or python --version to see if Python is installed and what the version is.\nCheck your operating system (OS) with\n\ncat /etc/os-release\n\n\n\nCheck for conda\nYou will need conda (or miniconda) for these instructions. conda (and miniconda) take care of checking that all our packages will be inter-operable. It is best to install JupyterHub into a clean environment. That way you minimize chances of conflicts and your environment will solve (figure out any conflicts) much much faster.\nCheck for conda with\n\nconda list\n\nIf it doesn’t show a list of environments, then you need to install miniconda. Installation instructions. Read about miniconda for scientists from Software Carpentries here.\nThis is what I used to install miniconda from these instructions. Note install miniconda in some place like /opt/miniconda3 where all users will have access to `/opt/miniconda3/bin. We don’t want to install in /root/ for example or the admin users home directory.\n\nmkdir -p /opt/miniconda3\nwget https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh -O /opt/miniconda3/miniconda.sh\nbash /opt/miniconda3/miniconda.sh -b -u -p /opt/miniconda3\nrm -rf /opt/miniconda3/miniconda.sh\n\nThen initialize to set up the path. Note I am using bash. You’ll need to change if you are using zsh.\n\n/opt/miniconda3/bin/conda init bash\nsource ~/.bashrc\n\nnote will need to do something else to add the conda binary to all the users’ paths" + }, + { + "objectID": "Set-up-centos-tljh.html#create-the-conda-environment", + "href": "Set-up-centos-tljh.html#create-the-conda-environment", + "title": "Centos Set-up with TLJH", + "section": "Create the conda environment", + "text": "Create the conda environment\nCreate the conda environment for the jupyterhub installation. Installation will be in a directory with all the files for packages. Then activate it (enter it), and get the location of the environment (folder).\nAll the commands below are in the terminal window on your VM/server.\nCreate the environment named jupyterhub with python and jupyterhub (module). After creating, activate (enter) that environment. Then install jupyterlab, notebook and dockerspawner into the environment. Note the jupyterhub after -n is the name of the environment.\n\nconda create -n jupyterhub python\n\nThen activate (enter) that environment\n\nconda activate jupyterhub\n\nThen install jupyterhub here\n\nconda install -c conda-forge jupyterhub\n\nand then jupyterlab\n\nconda install -c conda-forge jupyterlab notebook\n\n\nSet a variable for env path\nThe environment has a folder with all the packages and binaries that we install. We are going to need to know the location of that folder. Get the location with\n\nconda env list\n\nOn the VM I set up, the folder location is\n\n/opt/miniconda3/envs/jupyterhub\n\nYours could be something entirely different. On another server with anaconda (a not-free conda package resolver), the folder was\n\n/SHARE/anaconda3/envs/jupterhub/\n\nWe are going to be saving the configuration files for our JupyterHub in this folder. Let’s save the path to a variable so we don’t have to keep entering the whole path.\n\nJHUBENV=/opt/miniconda3/envs/jupyterhub\n\nMake sure users can read and execute this folder. They need to in order to be able to spawn instances for the hub.\n\nchmod 755 $JHUBENV\n\nYou should now be able to start the hub, but you will not be able to access it yet because you need to open the 8000 port. Type\n\n$JHUBENV/bin/jupyterhub\n\nand check that it starts. Then use Cntl-C to stop the hub." + }, + { + "objectID": "Set-up-centos-tljh.html#create-a-user-on-the-vm", + "href": "Set-up-centos-tljh.html#create-a-user-on-the-vm", + "title": "Centos Set-up with TLJH", + "section": "Create a user on the VM", + "text": "Create a user on the VM\nBy default, any user on the server will be able to login. Let’s create a test user so that we are not logging into our hub with the root user password. We will be using “http” until we secure it so passwords are potentially exposed.\n\nuseradd jhub\n\nand give it a password when it asks." + }, + { + "objectID": "Set-up-centos-tljh.html#open-the-8000-port", + "href": "Set-up-centos-tljh.html#open-the-8000-port", + "title": "Centos Set-up with TLJH", + "section": "Open the 8000 port", + "text": "Open the 8000 port\nFirewallD was not running on my Azure Centos server, so I started it up to manage the ports.\n\nsudo systemctl enable firewalld\nsudo systemctl start firewalld\n\nFind out the Public IP address for the server you are on; it’s listed on the Azure overview and networking page for the VM in the Azure portal. Then open the 8000 port.\nFirst find out what ports are open through the firewall\n\nsudo firewall-cmd --list-ports\n\nAdd the 8000 port, reload and recheck that it appears.\n\nsudo firewall-cmd --permanent --add-port 8000/tcp\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-ports\n\nBecause I am on an Azure VM, I also have to set up a networking rule to allow the 8000 port. By default, all public access to the server is blocked. Go to the Azure dashboard, select your VM, then select Networking under Settings, and then click Add Inbound Port rule. I am pretty sure you need to select “http” instead of “https”.\nOnce the port is open, you should be able to reach your JupyterHub at http://XXX.XX.XX.XX:8000 (replace the XX’s with the Public IP address).\nBackground\nThe JupyterhHub is running by default on http://localhost:8000. This means that if you start the hub on a machine that you are logged into, you should be able to open a browser on that machine, enter http://localhost:8000 and the hub login page will appear. There are a few reasons that might not work\n\nYou are ssh-ing into a server and don’t have a browser to open. The browser on the computer that you are ssh-ing from is the “localhost” in this case and you need the “localhost” to be the server.\nYou are logged directly into your server, but it doesn’t have a browser installed.\n\nHowever http://localhost:8000 is actually not very useful. We are trying to create a hub that others can log into from their browsers.\nSo you need to determine the Public IP address for the server you are on. This is the IP address that you could enter into a browser. If you enter http://XXX.XX.XX.XX (replace with actual IP), then you should see a page of some sort. This indicates that the server is working. If you are on an internal network, then you will only be able to load the address if you are also on that network. But for security reason, ports will not be open by default. You need to open the 8000 port so that http://XXX.XX.XX.XX:8000 will be found." + }, + { + "objectID": "Set-up-centos-tljh.html#log-in", + "href": "Set-up-centos-tljh.html#log-in", + "title": "Centos Set-up with TLJH", + "section": "Log in!", + "text": "Log in!\nAt this point, you should be able to login with the jhub test account." + }, + { + "objectID": "Set-up-centos-tljh.html#set-up-a-configuration-file", + "href": "Set-up-centos-tljh.html#set-up-a-configuration-file", + "title": "Centos Set-up with TLJH", + "section": "Set up a configuration file", + "text": "Set up a configuration file\nSo far, we have started the hub with the default configuration. We are going to need to customize it. For that we need a configuration file. We will create this in the folder where the environment files are.\n\nsudo mkdir -p $JHUBENV/etc/jupyterhub/\ncd $JHUBENV/etc/jupyterhub/\n\nNext create the default configuration file jupyterhub_config.py.\n\nsudo $JHUBENV/bin/jupyterhub --generate-config\n\nBecause we cd-d into the $JHUBENV/etc/jupyterhub/ directory, the file is created there. This default file is very long. Open up with\n\nnano jupyterhub_config.py\n\nUse F6 to find lines. Uncomment these two lines and save (Cntl-O, Enter, Cntl-X).\n\nc.Spawner.http_timeout = 3600" + }, + { + "objectID": "Set-up-centos-tljh.html#make-a-new-server-service", + "href": "Set-up-centos-tljh.html#make-a-new-server-service", + "title": "Centos Set-up with TLJH", + "section": "Make a new server service", + "text": "Make a new server service\n\nCreate the new unit file\nAt this point, after opening the port, you should be able to get to your JupyterHub by starting it with jupyterhub --ip XXX.XX.XX.XX --port=8000 and then browsing to http://XXX.XX.XX.XX:8000. But you hub is going to be stopped whenever the server is rebooted. So next we need to set up a service for your service so that our hub starts automatically.\nCreate a new directory for the service unit file,\n\nsudo mkdir -p $JHUBENV/etc/systemd\ncd $JHUBENV/etc/systemd\n\nCreate the file and name jupyterhub.service. For example, using nano editor, we do\n\nnano jupyterhub.service\n\nAnd into that file we put the following. Replace /opt/miniconda3/envs/jupyterhub with the actual path to the jupyterhub environment folder.\n\n[Unit]\nDescription=JupyterHub\nAfter=syslog.target network.target\n\n[Service]\nUser=root\nEnvironment=\"PATH=/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/opt/miniconda3/envs/jupyterhub/bin\"\nExecStart=/opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py\n\n[Install]\nWantedBy=multi-user.target\n\nNext we make systemd aware of the new service.\nCreate a symlink file in the folder where all the server services are kept. And tell systemd to reload its configuration files\n\nsudo ln -s $JHUBENV/etc/systemd/jupyterhub.service /etc/systemd/system/jupyterhub.service\nsudo systemctl daemon-reload\n\n\n\nMake sure SELinux doesn’t block our service\nSELinux (security for the server) checks that files that are used have the correct label. All our files have generic file labels. If you do,\n\nls -Z $JHUBENV/etc/systemd/\n\nYou will see that the file label is unconfined_u:object_r:usr_t:s0. We need it to be\n\nsystemd_unit_file_t\n\nWe change the file label with\n\nsudo chcon system_u:object_r:systemd_unit_file_t:s0 $JHUBENV/etc/systemd/jupyterhub.service\n\nSELinux will also object to the file label on all the binaries that we use to start up the JupyterHub (like jupyterhub) so we need to fix those file labels.\nThis will add bin_t label to all the binaries and check that it worked.\n\nsudo find $JHUBENV/bin -type f -exec chcon system_u:object_r:bin_t:s0 {} \\;\nls -Z $JHUBENV/bin\n\nIt got all the binaries but not the simlinks. Nonetheless it seemed to run ok.\n\n\nEnable our new service\n\nsudo systemctl enable jupyterhub.service\n\nThe service will start on reboot, but we can start it straight away using start:\n\nsudo systemctl start jupyterhub.service\n\nCheck that it is running.\n\nsudo systemctl status jupyterhub.service\n\nIf it fails, try\n\naudit2why < /var/log/audit/audit.log\n\nto debug. It is likely to be an issue with SELinux blocking the service from starting.\nNow our hub should be available on http:\\\\XXX.XX.XX.XX:8000. You can double check that it is listen on this port by running\n\nnetstat -tuln\n\nAt this point, you will need to address security if your hub is open to the web, as opposed to being on an internal network and only accessible to that network. Learn about that here." + }, + { + "objectID": "Set-up-centos-tljh.html#set-up-docker-for-user-environment", + "href": "Set-up-centos-tljh.html#set-up-docker-for-user-environment", + "title": "Centos Set-up with TLJH", + "section": "Set up Docker for user environment", + "text": "Set up Docker for user environment\nWhen you log in the jupyter notebooks will be trying to use the Python environment that was created to install JupyterHub, this is not what we want. We will use a docker image to “spawn” the user environment. Read here for other approaches.\nWe are going to use dockerspawner so that we can use a docker image for our user environments. The user will work in these containerized environments and they won’t have access to any other files in the server. In order to share their work with others, the normal workflow would be to work in Git repos and share those repos to a GitHub (or GitLab server). Each user will have a home directory on the server for their files, but they won’t have access to other hub user directories nor will they have access to any other directories on the server.\n\nInstall docker\nI am using Centos in this example\n\nsudo yum install -y yum-utils\nsudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo\n\nThen we need to start docker\n\nsudo systemctl start docker\n\n\n\nInstall dockerspawner\nI am going to be creating the user environment from a docker image, so I also want dockerspawner. Note dockerspawner installed docker-py but it was really old and threw errors so I installed separately to get the latest version. Note make sure you are in the jupyterhub conda env. You can run conda env list and use conda activate jupyterhub if you are not in it.\n\nconda install -c conda-forge dockerspawner\nconda install -c conda-forge docker-py\n\n\n\nJupyter images\nThe image that we use must have the jupyterhub and notebook module installed. The jupyterhub version needs to also match what you have on your hub.\nCheck the version on your server:\n\n$JHUBENV/bin/jupyterhub -V\n\nFor demo purposes, we will use the jupyter images on DockerHub. We want to find an image with the same version of jupyterhub as we have on our server.\n\n\nEdit the config file\nEdit the jupyterhub_config.py file in $JHUB-ENV/etc/jupyterhub/ to add that we want to use DockerSpawner and specify the images that users should have access to. Users will get a drop down menu. Add these lines to jupyterhub_config.py. The hub bind url needs to be 0.0.0.0 because we are using a docker container for the individual user environments.\n\nhttps://discourse.jupyter.org/t/whats-the-main-difference-between-hub-connect-url-vs-hub-bind-url/3596/2\nNote image_whitelist is deprecated as of dockerspawner 12.0. New name is allowed_images.\n\n\nc = get_config() #noqa\nc.JupyterHub.port = 8000\nc.JupyterHub.hub_bind_url = \"http://0.0.0.0:8081\"\nc.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'\nc.DockerSpawner.remove = True\nc.Spawner.http_timeout = 3600\nc.DockerSpawner.image_whitelist = {\n 'datascience-r': 'jupyter/datascience-notebook:r-4.3.1',\n 'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f',\n}\n\nDo a docker pull of the images so that they don’t have to be pulled the first time that a user chooses that image.\n\ndocker pull jupyter/datascience-notebook:r-4.3.1\ndocker pull jupyter/scipy-notebook:7e1a19a8427f\n\nNow you can restart the service and the user can start a notebook with the specified images.\n\n\nCreate your own Docker images\nDocker images that work with JupyterHub with Kubernetes will work with this set-up with the addition of jupyterhub and notebook.\nAdd the following to your Docker image\n\nRUN pip3 install \\\n 'jupyter-rsession-proxy' \\\n 'jupyterhub==3.1.*' \\\n 'notebook==6.*' \\\n 'jupyterlab'\n\nCMD [\"jupyterhub-singleuser\"]\n\nExample using rocker image. Code added to make the home directory home/jovyan.\n\nFROM rocker/binder:4.3\n\nUSER root\nRUN usermod -d /home/jovyan rstudio\nRUN mkdir /home/jovyan\nRUN chown rstudio:rstudio /home/jovyan\nUSER rstudio\n\nRUN pip3 install \\\n 'jupyter-rsession-proxy' \\\n 'jupyterhub==3.1.*' \\\n 'notebook==6.*' \\\n 'jupyterlab'\n\nWORKDIR /home/jovyan\n\nCMD [\"jupyterhub-singleuser\"]\n\nExample using openscapes/rocker\n\nFROM openscapes/rocker:a7596b5\n\nRUN pip3 install \\\n 'jupyter-rsession-proxy' \\\n 'jupyterhub==3.1.*' \\\n 'notebook==6.*' \\\n 'jupyterlab'\n\nUSER root\nRUN mkdir /home/jovyan\nRUN chown rstudio:rstudio /home/jovyan\nUSER rstudio\n\nCMD [\"jupyterhub-singleuser\"]\n\n\n\nSpecial note regarding rocker images\nThe default home directory for rocker images is home/rstudio but the default for JupyterHub is home/jovyan." + }, + { + "objectID": "Set-up-centos-tljh.html#persistent-volume", + "href": "Set-up-centos-tljh.html#persistent-volume", + "title": "Centos Set-up with TLJH", + "section": "Persistent volume", + "text": "Persistent volume\nAdd the following to the config file to create a persistent volume.\n\nnotebook_dir = '/home/jovyan'\nc.DockerSpawner.notebook_dir = notebook_dir\n\n# Mount the real user's Docker volume on the host to the notebook user's\n# notebook directory in the container\nc.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir }" + }, + { + "objectID": "Set-up-centos-tljh.html#user-environment-customization", + "href": "Set-up-centos-tljh.html#user-environment-customization", + "title": "Centos Set-up with TLJH", + "section": "User environment customization", + "text": "User environment customization\n\nMemory limits and guarantees\nYou can set memory limits on the containers that are spawned for users by adding limits. Read the documentation here.\nFor example:\n\nc.DockerSpawner.mem_limit = '8G'\nc.DockerSpawner.mem_guarantee = '1G'\nc.DockerSpawner.cpu_guarantee = 0.5\nc.DockerSpawner.cpu_limit = 1\n\nIf that doesn’t work try\n\nc.Spawner.mem_limit = '2G'\n\nI believe you can specify as a drop-down to give the user choices:\n\nc.DockerSpawner.mem_guarantee = {\n '1G': '1G',\n '2G': '2G',\n '8G': '8G',\n}\n\n\n\nCreating a shared volume\nOne read-only shared volume:\nhttps://github.com/jupyterhub/dockerspawner/issues/172\n\nc.DockerSpawner.volumes = { 'jupyterhub-user-{username}':'/home/jovyan', '/path/to/shared': {\"bind\": '/home/jovyan/shared', \"mode\": \"ro\"} }\n\nA volume that is read-only for some and read-write for others:\nhttps://github.com/jupyterhub/dockerspawner/issues/172\nMore discussions around shared volumes\nhttps://github.com/jupyterhub/dockerspawner/issues/453" + }, + { + "objectID": "Set-up-centos-tljh.html#setting-up-https", + "href": "Set-up-centos-tljh.html#setting-up-https", + "title": "Centos Set-up with TLJH", + "section": "Setting up https", + "text": "Setting up https\nIf you are using a public IP address, rather than being on a private network, you will want to set up https.\n\nCreate a domain name\nFind a domain name provider and set one up. It is not expensive. I used GoDaddy. You only need one. Later you can use it for multiple hubs using subdomains where are created by the next step (DNS entry). For example, let’s say you get the domain bluemountain123.live. You can have as many subdomains as you want and they will be subdomain.bluemountain123.live.\n\n\nCreate a DNS entry\nLet’s pretend you set up bluemountain123.live as the domain. Go to the DNS settings for your domain. Add a type A record. This will do 2 things. First this will create the subdomain that you will use to access your JupyterHub. So let’s say you create, dhub as the type A DNS entry. Put dhub in the name and the public IP address of the server (leaving off :8000) in the value section. Then dhub.bluemountain123.live will be the url.\n\n\n\nTest if the url is working\nhttp:\\\\dhub.bluemountain123.live:8000 would be the url using the example domain above. Test that it is working (shows a JupyterHub login) before moving on. This is what you should see:\n\n\n\nSet-up https on your JupyterHub\nLog back into your Kubernetes cluster: go to portal.azure.com, click on your Kubernetes cluster name, and then click on “Connect”. Then click on “Open Cloud Shell”. Read documentation about https\nOnce you are on the shell, type\nnano dconfig.yaml\nto edit the config file. Paste this in and save. Note the additional jupyterhub: in the yaml file. This is not in a plain JupyterHub with Kubernetes config file (i.e. in a non-daskhub, the jupyterhub: bit is not there and everything is moved to left by 2 spaces).\njupyterhub:\n proxy:\n https:\n enabled: true\n hosts:\n - dhub.bluemountain123.live\n letsencrypt:\n contactEmail: your@email.com\n\n\nUpdate the JupyterHub installation\nAnytime you change dconfig.yaml you need to run this code.\nhelm upgrade --cleanup-on-fail --render-subchart-notes dhub dask/daskhub --namespace dhub --version=2023.1.0 --values dconfig.yaml\n\n\nTest if https is working\nTry https:\\\\dhub.bluemountain123.live and you should see the JupyterHub login without that http warning." + }, + { + "objectID": "Set-up-centos-tljh.html#authentication", + "href": "Set-up-centos-tljh.html#authentication", + "title": "Centos Set-up with TLJH", + "section": "Authentication", + "text": "Authentication\nhttps://oauthenticator.readthedocs.io/en/latest/tutorials/provider-specific-setup/providers/github.html" + }, + { + "objectID": "Set-up-centos-tljh.html#summary", + "href": "Set-up-centos-tljh.html#summary", + "title": "Centos Set-up with TLJH", + "section": "Summary", + "text": "Summary\nOnly the instructions. Make sure you are installing as the root user. I assume you have Python and conda installed.\nCreate the conda environment\n\nsudo -i\n\nconda create -n jupyterhub python --yes\nconda activate jupyterhub\nconda install -c conda-forge jupyterhub --yes\nconda install -c conda-forge jupyterlab notebook --yes\n\nJHUBENV=/opt/miniconda3/envs/jupyterhub\nchmod 755 $JHUBENV\n\nCreate user\n\nuseradd jhub\n\nOpen the 8000 port for access to the application.\n\n#sudo systemctl enable firewalld\n#sudo systemctl start firewalld\n\nsudo firewall-cmd --permanent --add-port 8000/tcp\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-ports\n\nCreate the configuration file. Will be editted at end.\n\nsudo mkdir -p $JHUBENV/etc/jupyterhub/\ncd $JHUBENV/etc/jupyterhub/\nsudo $JHUBENV/bin/jupyterhub --generate-config\n\nInstall docker if needed\n\nsudo yum install -y yum-utils\nsudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo\n\nsudo systemctl start docker\n\nNot sure this is needed.\n\nsudo firewall-cmd --zone=docker --add-port=8081/tcp\nsudo firewall-cmd --reload\nsudo systemctl restart docker\n\nInstall dockerspawner\n\nconda install -c conda-forge dockerspawner --yes\nconda install -c conda-forge docker-py --yes\n\nEdit the configuration file.\n\ncd $JHUBENV/etc/jupyterhub/\nnano jupyterhub_config.py\n\nPaste this in\n\n# Configuration file for jupyterhub.\n\nc = get_config() #noqa\nc.JupyterHub.port = 8000\nc.JupyterHub.hub_bind_url = \"http://0.0.0.0:8081\"\nc.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'\nc.DockerSpawner.remove = True\nc.Spawner.http_timeout = 3600\nc.DockerSpawner.image_whitelist = {\n 'iorocker': 'eeholmes/iorocker-standalone:20231003',\n 'rocker-binder': 'eeholmes/rocker-binder:20231003',\n 'openscapes-rocker': 'eeholmes/minimal-jhub:20231004',\n 'datascience-r': 'jupyter/datascience-notebook:r-4.3.1',\n 'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f',\n}\n\nnotebook_dir = '/home/jovyan'\nc.DockerSpawner.notebook_dir = notebook_dir\n\n# Mount the real user's Docker volume on the host to the notebook user's\n# notebook directory in the container\nc.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir }\n\nDocker pull of the images. Do all.\n\ndocker pull jupyter/datascience-notebook:r-4.3.1\ndocker pull jupyter/scipy-notebook:7e1a19a8427f\n\nMake a new server service\n\nsudo mkdir -p $JHUBENV/etc/systemd\ncd $JHUBENV/etc/systemd\nnano jupyterhub.service\n\nPaste this in\n\n[Unit]\nDescription=JupyterHub\nAfter=syslog.target network.target\n\n[Service]\nUser=root\nEnvironment=\"PATH=/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/opt/miniconda3/envs/jupyterhub/bin\"\nExecStart=/opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py\n\n[Install]\nWantedBy=multi-user.target\n\nMake sure SELinux doesn’t block our service\n\nls -Z $JHUBENV/etc/systemd/\nsudo chcon system_u:object_r:systemd_unit_file_t:s0 $JHUBENV/etc/systemd/jupyterhub.service\nsudo find $JHUBENV/bin -type f -exec chcon system_u:object_r:bin_t:s0 {} \\;\n\nEnable our new service\n\nsudo ln -s $JHUBENV/etc/systemd/jupyterhub.service /etc/systemd/system/jupyterhub.service\nsudo systemctl daemon-reload\nsudo systemctl enable jupyterhub.service\nsudo systemctl start jupyterhub.service\n\nDone! See the long instructions if anything is not working." + }, { "objectID": "Set-up-daskhub.html", "href": "Set-up-daskhub.html", @@ -277,14 +382,14 @@ "href": "Set-up-centos.html", "title": "Centos Set-up", "section": "", - "text": "This is my notes for setting this up on a Centos 7 (Linux distribution) server. Jump to the “Summary” section to see only the instructions without explanations.\nAll the commands are run in a shell (bash)\nReferences:" + "text": "This is my notes for setting this up on a Centos 8 (Linux distribution) server. Jump to the “Summary” section to see only the instructions without explanations.\nAll the commands are run in a shell (bash)\nReferences:" }, { "objectID": "Set-up-centos.html#set-up-vm-on-azure", "href": "Set-up-centos.html#set-up-vm-on-azure", "title": "Centos Set-up", "section": "Set up VM on Azure", - "text": "Set up VM on Azure\n\nCreated a Centos 8.3 server on Azure: https://portal.azure.com/#create/cloud-infrastructure-services.centos-8-3centos-8-3\nI didn’t do anything special for set-up. Choose SSH with key.\nOnce it is created, I went to the dashboard and selected my VM. The dashboard has a “Connect” button to get to the shell and it shows the public IP address.\nI had to create a special security rule to allow me to ssh into the public IP address to connect. Normally I use the cloud shell to connect, but Azure would not let me connect via the cloud shell for a server since it wanted upgraded security and I cannot do that with my work subscription.\nThen I saved the key somewhere on my computer and\n\n\nchmod 400 ~/<key location>\nssh -i ~/<key location> <vm-username>@<public key>" + "text": "Set up VM on Azure\n\nCreated a Centos 8.3 server on Azure: https://portal.azure.com/#create/cloud-infrastructure-services.centos-8-3centos-8-3\nI didn’t do anything special for set-up. Choose SSH with key.\nOnce it is created, I went to the dashboard and selected my VM. The dashboard has a “Connect” button to get to the shell and it shows the public IP address.\nI had to create a special security rule to allow me to ssh into the public IP address to connect. Normally I use the cloud shell to connect, but Azure would not let me connect via the cloud shell for a server since it wanted upgraded security package and I cannot do that with my work subscription.\nThen I saved the key somewhere on my computer and\n\n\nchmod 400 ~/<key location>\nssh -i ~/<key location>/Centos8.cer <vm-username>@<public ip-address>" }, { "objectID": "Set-up-centos.html#on-vm-check-set-up", @@ -340,21 +445,42 @@ "href": "Set-up-centos.html#set-up-docker-for-user-environment", "title": "Centos Set-up", "section": "Set up Docker for user environment", - "text": "Set up Docker for user environment\nWhen you log in the jupyter notebooks will be trying to use the Python environment that was created to install JupyterHub, this is not what we want. We will use a docker image to “spawn” the user environment. Read here for other approaches.\nWe are going to use dockerspawner so that we can use a docker image for our user environments. The user will work in these containerized environments and they won’t have access to any other files in the server. In order to share their work with others, the normal workflow would be to work in Git repos and share those repos to a GitHub (or GitLab server). Each user will have a home directory on the server for their files, but they won’t have access to other hub user directories nor will they have access to any other directories on the server.\n\nInstall docker\nI am using Centos in this example\n\nsudo yum install -y yum-utils\nsudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo\n\nThen we need to start docker\n\nsudo systemctl start docker\n\n\n\nInstall dockerspawner\nI am going to be creating the user environment from a docker image, so I also want dockerspawner. Note dockerspawner installed docker-py but it was really old and threw errors so I installed separately to get the latest version. Note make sure you are in the jupyterhub conda env. You can run conda env list and use conda activate jupyterhub if you are not in it.\n\nconda install -c conda-forge dockerspawner\nconda install -c conda-forge docker-py\n\n\n\nJupyter images\nThe image that we use must have the jupyterhub and notebook module installed. The jupyterhub version needs to also match what you have on your hub.\nCheck the version on your server:\n\n$JHUBENV/bin/jupyterhub -V\n\nFor demo purposes, we will use the jupyter images on DockerHub. We want to find an image with the same version of jupyterhub as we have on our server.\n\n\nEdit the config file\nEdit the jupyterhub_config.py file in $JHUB-ENV/etc/jupyterhub/ to add that we want to use DockerSpawner and specify the images that users should have access to. Users will get a drop down menu. Add these lines to jupyterhub_config.py. The hub bind url needs to be 0.0.0.0 because we are using a docker container for the individual user environments.\n\nhttps://discourse.jupyter.org/t/whats-the-main-difference-between-hub-connect-url-vs-hub-bind-url/3596/2\n\n\nc = get_config() #noqa\nc.JupyterHub.port = 8000\nc.JupyterHub.hub_bind_url = \"http://0.0.0.0:8081\"\nc.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'\nc.DockerSpawner.remove = True\nc.Spawner.http_timeout = 3600\nc.DockerSpawner.image_whitelist = {\n 'datascience-r': 'jupyter/datascience-notebook:r-4.3.1',\n 'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f',\n}\n\nDo a docker pull of the images so that they don’t have to be pulled the first time that a user chooses that image.\n\ndocker pull jupyter/datascience-notebook:r-4.3.1\ndocker pull jupyter/scipy-notebook:7e1a19a8427f\n\nNow you can restart the service and the user can start a notebook with the specified images.\n\n\nCreate your own Docker images\nDocker images that work with JupyterHub with Kubernetes will work with this set-up with the addition of jupyterhub and notebook.\nAdd the following to your Docker image\n\nRUN pip3 install \\\n 'jupyter-rsession-proxy' \\\n 'jupyterhub==3.1.*' \\\n 'notebook==6.*' \\\n 'jupyterlab'\n\nCMD [\"jupyterhub-singleuser\"]\n\nExample using rocker image. Code added to make the home directory home/jovyan.\n\nFROM rocker/binder:4.3\n\nUSER root\nRUN usermod -d /home/jovyan rstudio\nRUN mkdir /home/jovyan\nRUN chown rstudio:rstudio /home/jovyan\nUSER rstudio\n\nRUN pip3 install \\\n 'jupyter-rsession-proxy' \\\n 'jupyterhub==3.1.*' \\\n 'notebook==6.*' \\\n 'jupyterlab'\n\nWORKDIR /home/jovyan\n\nCMD [\"jupyterhub-singleuser\"]\n\nExample using openscapes/rocker\n\nFROM openscapes/rocker:a7596b5\n\nRUN pip3 install \\\n 'jupyter-rsession-proxy' \\\n 'jupyterhub==3.1.*' \\\n 'notebook==6.*' \\\n 'jupyterlab'\n\nUSER root\nRUN mkdir /home/jovyan\nRUN chown rstudio:rstudio /home/jovyan\nUSER rstudio\n\nCMD [\"jupyterhub-singleuser\"]" + "text": "Set up Docker for user environment\nWhen you log in the jupyter notebooks will be trying to use the Python environment that was created to install JupyterHub, this is not what we want. We will use a docker image to “spawn” the user environment. Read here for other approaches.\nWe are going to use dockerspawner so that we can use a docker image for our user environments. The user will work in these containerized environments and they won’t have access to any other files in the server. In order to share their work with others, the normal workflow would be to work in Git repos and share those repos to a GitHub (or GitLab server). Each user will have a home directory on the server for their files, but they won’t have access to other hub user directories nor will they have access to any other directories on the server.\n\nInstall docker\nI am using Centos in this example\n\nsudo yum install -y yum-utils\nsudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo\n\nThen we need to start docker\n\nsudo systemctl start docker\n\n\n\nInstall dockerspawner\nI am going to be creating the user environment from a docker image, so I also want dockerspawner. Note dockerspawner installed docker-py but it was really old and threw errors so I installed separately to get the latest version. Note make sure you are in the jupyterhub conda env. You can run conda env list and use conda activate jupyterhub if you are not in it.\n\nconda install -c conda-forge dockerspawner\nconda install -c conda-forge docker-py\n\n\n\nJupyter images\nThe image that we use must have the jupyterhub and notebook module installed. The jupyterhub version needs to also match what you have on your hub.\nCheck the version on your server:\n\n$JHUBENV/bin/jupyterhub -V\n\nFor demo purposes, we will use the jupyter images on DockerHub. We want to find an image with the same version of jupyterhub as we have on our server.\n\n\nEdit the config file\nEdit the jupyterhub_config.py file in $JHUB-ENV/etc/jupyterhub/ to add that we want to use DockerSpawner and specify the images that users should have access to. Users will get a drop down menu. Add these lines to jupyterhub_config.py. The hub bind url needs to be 0.0.0.0 because we are using a docker container for the individual user environments.\n\nhttps://discourse.jupyter.org/t/whats-the-main-difference-between-hub-connect-url-vs-hub-bind-url/3596/2\nNote image_whitelist is deprecated as of dockerspawner 12.0. New name is allowed_images.\n\n\nc = get_config() #noqa\nc.JupyterHub.port = 8000\nc.JupyterHub.hub_bind_url = \"http://0.0.0.0:8081\"\nc.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'\nc.DockerSpawner.remove = True\nc.Spawner.http_timeout = 3600\nc.DockerSpawner.image_whitelist = {\n 'datascience-r': 'jupyter/datascience-notebook:r-4.3.1',\n 'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f',\n}\n\nDo a docker pull of the images so that they don’t have to be pulled the first time that a user chooses that image.\n\ndocker pull jupyter/datascience-notebook:r-4.3.1\ndocker pull jupyter/scipy-notebook:7e1a19a8427f\n\nNow you can restart the service and the user can start a notebook with the specified images.\n\n\nCreate your own Docker images\nDocker images that work with JupyterHub with Kubernetes will work with this set-up with the addition of jupyterhub and notebook.\nAdd the following to your Docker image\n\nRUN pip3 install \\\n 'jupyter-rsession-proxy' \\\n 'jupyterhub==3.1.*' \\\n 'notebook==6.*' \\\n 'jupyterlab'\n\nCMD [\"jupyterhub-singleuser\"]\n\nExample using rocker image. Code added to make the home directory home/jovyan.\n\nFROM rocker/binder:4.3\n\nUSER root\nRUN usermod -d /home/jovyan rstudio\nRUN mkdir /home/jovyan\nRUN chown rstudio:rstudio /home/jovyan\nUSER rstudio\n\nRUN pip3 install \\\n 'jupyter-rsession-proxy' \\\n 'jupyterhub==3.1.*' \\\n 'notebook==6.*' \\\n 'jupyterlab'\n\nWORKDIR /home/jovyan\n\nCMD [\"jupyterhub-singleuser\"]\n\nExample using openscapes/rocker\n\nFROM openscapes/rocker:a7596b5\n\nRUN pip3 install \\\n 'jupyter-rsession-proxy' \\\n 'jupyterhub==3.1.*' \\\n 'notebook==6.*' \\\n 'jupyterlab'\n\nUSER root\nRUN mkdir /home/jovyan\nRUN chown rstudio:rstudio /home/jovyan\nUSER rstudio\n\nCMD [\"jupyterhub-singleuser\"]\n\n\n\nSpecial note regarding rocker images\nThe default home directory for rocker images is home/rstudio but the default for JupyterHub is home/jovyan." }, { "objectID": "Set-up-centos.html#persistent-volume", "href": "Set-up-centos.html#persistent-volume", "title": "Centos Set-up", "section": "Persistent volume", - "text": "Persistent volume\nAdd the following to the config file to create a persistent volume.\n\nnotebook_dir = '/home/jovyan'\nc.DockerSpawner.notebook_dir = notebook_dir\n\n# Mount the real user's Docker volume on the host to the notebook user's\n# notebook directory in the container\nc.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir }\n\n\nSpecial note regarding rocker images\nThe default home directory for rocker images is home/rstudio but the default for JupyterHub is home/jovyan." + "text": "Persistent volume\nAdd the following to the config file to create a persistent volume.\n\nnotebook_dir = '/home/jovyan'\nc.DockerSpawner.notebook_dir = notebook_dir\n\n# Mount the real user's Docker volume on the host to the notebook user's\n# notebook directory in the container\nc.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir }" + }, + { + "objectID": "Set-up-centos.html#user-environment-customization", + "href": "Set-up-centos.html#user-environment-customization", + "title": "Centos Set-up", + "section": "User environment customization", + "text": "User environment customization\n\nMemory limits and guarantees\nYou can set memory limits on the containers that are spawned for users by adding limits. Read the documentation here.\nFor example:\n\nc.DockerSpawner.mem_limit = '8G'\nc.DockerSpawner.mem_guarantee = '1G'\nc.DockerSpawner.cpu_guarantee = 0.5\nc.DockerSpawner.cpu_limit = 1\n\nIf that doesn’t work try\n\nc.Spawner.mem_limit = '2G'\n\nI believe you can specify as a drop-down to give the user choices:\n\nc.DockerSpawner.mem_guarantee = {\n '1G': '1G',\n '2G': '2G',\n '8G': '8G',\n}\n\n\n\nCreating a shared volume\nOne read-only shared volume:\nhttps://github.com/jupyterhub/dockerspawner/issues/172\n\nc.DockerSpawner.volumes = { 'jupyterhub-user-{username}':'/home/jovyan', '/path/to/shared': {\"bind\": '/home/jovyan/shared', \"mode\": \"ro\"} }\n\nA volume that is read-only for some and read-write for others:\nhttps://github.com/jupyterhub/dockerspawner/issues/172\nMore discussions around shared volumes\nhttps://github.com/jupyterhub/dockerspawner/issues/453" + }, + { + "objectID": "Set-up-centos.html#setting-up-https", + "href": "Set-up-centos.html#setting-up-https", + "title": "Centos Set-up", + "section": "Setting up https", + "text": "Setting up https\nIf you are using a public IP address, rather than being on a private network, you need to set up https so that content (passwords and everything else) is not visible. Read how to do that here.\nThese instructions set up this url: https:\\\\dhub.bluemountain123.live" + }, + { + "objectID": "Set-up-centos.html#github-authentication", + "href": "Set-up-centos.html#github-authentication", + "title": "Centos Set-up", + "section": "GitHub authentication", + "text": "GitHub authentication\nAfter you have https set-up, we can set up authentication via a GitHub teams in a GitHub organization. Read other ways to authenticate (create users) here.\nhttps://oauthenticator.readthedocs.io/en/latest/tutorials/provider-specific-setup/providers/github.html\n\nCreate a new Oauth Application on GitHub\nThis Oauth application is going to be associated with your (personal) GitHub account, but you will use a team on a GitHub organization that you are owner of for the users who are allowed to log into your JupyterHub.\nLog into GitHub and go to GitHub > Settings > Developer Settings > New Oauth Application\nLook carefully at how I filled in the boxes. Change the URL and the name of the application.\n\nNext you will see something like this\n\nYou need to copy the ID and then click the create secrets button and save the secret. You will need those in the next step.\n\n\nCreate a team in your GitHub organization\nYou will be added by default and add anyone else who needs access to the hub. Let’s say your GitHub organization is MyOrg and the team is called JHub. So then the allowed organization is MyOrg:JHub. You can leave off :JHub if you want to allow all members of the organization to log in.\n\n\nEdit the jupyterhub_config.py file\nc.JupyterHub.authenticator_class = \"github\"\nc.OAuthenticator.oauth_callback_url = \"https:\\\\dhub.bluemountain123.live/hub/oauth_callback\"\nc.OAuthenticator.client_id = \"your oauth2 application id\"\nc.OAuthenticator.client_secret = \"your oauth2 application secret\"\nc.GitHubOAuthenticator.allowed_organizations = \"MyOrg:JHub\"\nc.GitHubOAuthenticator.scope = \"read:org\"\nReplace the id, secret and url with your values." }, { "objectID": "Set-up-centos.html#summary", "href": "Set-up-centos.html#summary", "title": "Centos Set-up", "section": "Summary", - "text": "Summary\nOnly the instructions. Make sure you are installing as the root user. I assume you have Python and conda installed.\nCreate the conda environment\n\nsudo -i\n\nconda create -n jupyterhub python --yes\nconda activate jupyterhub\nconda install -c conda-forge jupyterhub --yes\nconda install -c conda-forge jupyterlab notebook --yes\n\nJHUBENV=/opt/miniconda3/envs/jupyterhub\nchmod 755 $JHUBENV\n\nCreate user\n\nuseradd jhub\n\nOpen the 8000 port for access to the application.\n\n#sudo systemctl enable firewalld\n#sudo systemctl start firewalld\n\nsudo firewall-cmd --permanent --add-port 8000/tcp\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-ports\n\nCreate the configuration file. Will be editted at end.\n\nsudo mkdir -p $JHUBENV/etc/jupyterhub/\ncd $JHUBENV/etc/jupyterhub/\nsudo $JHUBENV/bin/jupyterhub --generate-config\n\nInstall docker if needed\n\nsudo yum install -y yum-utils\nsudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo\n\nsudo systemctl start docker\n\nNot sure this is needed.\n\nsudo firewall-cmd --zone=docker --add-port=8081/tcp\nsudo firewall-cmd --reload\nsudo systemctl restart docker\n\nInstall dockerspawner\n\nconda install -c conda-forge dockerspawner --yes\nconda install -c conda-forge docker-py --yes\n\nEdit the configuration file.\n\ncd $JHUBENV/etc/jupyterhub/\nnano jupyterhub_config.py\n\nPaste this in\n\n# Configuration file for jupyterhub.\n\nc = get_config() #noqa\nc.JupyterHub.port = 8000\nc.JupyterHub.hub_bind_url = \"http://0.0.0.0:8081\"\nc.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'\nc.DockerSpawner.remove = True\nc.Spawner.http_timeout = 3600\nc.DockerSpawner.image_whitelist = {\n 'iorocker': 'eeholmes/iorocker-standalone:20231003',\n 'rocker-binder': 'eeholmes/rocker-binder:20231003',\n 'openscapes-rocker': 'eeholmes/minimal-jhub:20231004',\n 'datascience-r': 'jupyter/datascience-notebook:r-4.3.1',\n 'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f',\n}\n\nnotebook_dir = '/home/jovyan'\nc.DockerSpawner.notebook_dir = notebook_dir\n\n# Mount the real user's Docker volume on the host to the notebook user's\n# notebook directory in the container\nc.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir }\n\nDocker pull of the images. Do all.\n\ndocker pull jupyter/datascience-notebook:r-4.3.1\ndocker pull jupyter/scipy-notebook:7e1a19a8427f\n\nMake a new server service\n\nsudo mkdir -p $JHUBENV/etc/systemd\ncd $JHUBENV/etc/systemd\nnano jupyterhub.service\n\nPaste this in\n\n[Unit]\nDescription=JupyterHub\nAfter=syslog.target network.target\n\n[Service]\nUser=root\nEnvironment=\"PATH=/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/opt/miniconda3/envs/jupyterhub/bin\"\nExecStart=/opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py\n\n[Install]\nWantedBy=multi-user.target\n\nMake sure SELinux doesn’t block our service\n\nls -Z $JHUBENV/etc/systemd/\nsudo chcon system_u:object_r:systemd_unit_file_t:s0 $JHUBENV/etc/systemd/jupyterhub.service\nsudo find $JHUBENV/bin -type f -exec chcon system_u:object_r:bin_t:s0 {} \\;\n\nEnable our new service\n\nsudo ln -s $JHUBENV/etc/systemd/jupyterhub.service /etc/systemd/system/jupyterhub.service\nsudo systemctl daemon-reload\nsudo systemctl enable jupyterhub.service\nsudo systemctl start jupyterhub.service\n\nDone! See the long instructions if anything is not working." + "text": "Summary\nOnly the instructions. Make sure you are installing as the root user. I assume you have Python and conda installed.\nCreate the conda environment\n\nsudo -i\n\nconda create -n jupyterhub python --yes\nconda activate jupyterhub\nconda install -c conda-forge jupyterhub --yes\nconda install -c conda-forge jupyterlab notebook --yes\n\nJHUBENV=/opt/miniconda3/envs/jupyterhub\nchmod 755 $JHUBENV\n\nCreate user\n\nuseradd jhub\n\nOpen the 8000 port for access to the application.\n\n#sudo systemctl enable firewalld\n#sudo systemctl start firewalld\n\nsudo firewall-cmd --permanent --add-port 8000/tcp\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-ports\n\nCreate the configuration file. Will be edited at end.\n\nsudo mkdir -p $JHUBENV/etc/jupyterhub/\ncd $JHUBENV/etc/jupyterhub/\nsudo $JHUBENV/bin/jupyterhub --generate-config\n\nInstall docker if needed\n\nsudo yum install -y yum-utils\nsudo yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo\n\nsudo systemctl start docker\n\nNot sure this is needed.\n\nsudo firewall-cmd --zone=docker --add-port=8081/tcp\nsudo firewall-cmd --reload\nsudo systemctl restart docker\n\nInstall dockerspawner\n\nconda install -c conda-forge dockerspawner --yes\nconda install -c conda-forge docker-py --yes\n\nEdit the configuration file.\n\ncd $JHUBENV/etc/jupyterhub/\nnano jupyterhub_config.py\n\nPaste this in\n\n# Configuration file for jupyterhub.\n\nc = get_config() #noqa\nc.JupyterHub.port = 8000\nc.JupyterHub.hub_bind_url = \"http://0.0.0.0:8081\"\nc.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'\nc.DockerSpawner.remove = True\nc.Spawner.http_timeout = 3600\nc.DockerSpawner.image_whitelist = {\n 'iorocker': 'eeholmes/iorocker-standalone:20231003',\n 'rocker-binder': 'eeholmes/rocker-binder:20231003',\n 'openscapes-rocker': 'eeholmes/minimal-jhub:20231004',\n 'datascience-r': 'jupyter/datascience-notebook:r-4.3.1',\n 'scipy-notebook': 'jupyter/scipy-notebook:7e1a19a8427f',\n}\n\nnotebook_dir = '/home/jovyan'\nc.DockerSpawner.notebook_dir = notebook_dir\n\n# Mount the real user's Docker volume on the host to the notebook user's\n# notebook directory in the container\nc.DockerSpawner.volumes = { 'jupyter-{username}': notebook_dir }\n\nDocker pull of the images. Do all.\n\ndocker pull jupyter/datascience-notebook:r-4.3.1\ndocker pull jupyter/scipy-notebook:7e1a19a8427f\n\nMake a new server service\n\nsudo mkdir -p $JHUBENV/etc/systemd\ncd $JHUBENV/etc/systemd\nnano jupyterhub.service\n\nPaste this in\n\n[Unit]\nDescription=JupyterHub\nAfter=syslog.target network.target\n\n[Service]\nUser=root\nEnvironment=\"PATH=/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/opt/miniconda3/envs/jupyterhub/bin\"\nExecStart=/opt/miniconda3/envs/jupyterhub/bin/jupyterhub -f /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/jupyterhub_config.py\n\n[Install]\nWantedBy=multi-user.target\n\nMake sure SELinux doesn’t block our service\n\nls -Z $JHUBENV/etc/systemd/\nsudo chcon system_u:object_r:systemd_unit_file_t:s0 $JHUBENV/etc/systemd/jupyterhub.service\nsudo find $JHUBENV/bin -type f -exec chcon system_u:object_r:bin_t:s0 {} \\;\n\nEnable our new service\n\nsudo ln -s $JHUBENV/etc/systemd/jupyterhub.service /etc/systemd/system/jupyterhub.service\nsudo systemctl daemon-reload\nsudo systemctl enable jupyterhub.service\nsudo systemctl start jupyterhub.service\n\nDone! See the long instructions if anything is not working.\nNow go through the https and GitHub authentication steps if you need that." }, { "objectID": "JHub-User-Guide.html", @@ -425,5 +551,40 @@ "title": "Instructions for editing config", "section": "", "text": "Instructions for editing config\n\nLog into https://portal.azure.com/ and once successful, you will see this\n\n\n\nClick the JupyterHub icon and you will see this\n\n\n\nClick the Connect icon and you will see this. Ignore everything else that you see. I don’t think you need to run the kubectl get deployments --all-namespaces=true unless you need to check Kubernetes set up.\n\n\n\nType nano config.yaml to get the the JupyterHub config. This is the only file you need to change. cntl-O to write. cntl-X to exit.\n\nAfter you update the config.yaml, you need to tell the JupyterHub about the change\nhelm upgrade --cleanup-on-fail jhub jupyterhub/jupyterhub --namespace jhub --version=2.0.0 --values config.yaml\nIf upgrade was successful, you will see this (plus a bunch of text below that you can ignore).\n\n\nWhat a few minutes for your changes to take effect." + }, + { + "objectID": "Set-up-centos-security.html", + "href": "Set-up-centos-security.html", + "title": "Set-up CentOS https", + "section": "", + "text": "Now that our basic JupyterHub is running, we want to secure it. We are going to use Let’s Encrypt. Prerequisites:\nReferences:" + }, + { + "objectID": "Set-up-centos-security.html#create-a-domain-name", + "href": "Set-up-centos-security.html#create-a-domain-name", + "title": "Set-up CentOS https", + "section": "Create a domain name", + "text": "Create a domain name\nFind a domain name provider and set one up. It is not expensive. I used GoDaddy. You only need one. Later you can use it for multiple hubs using subdomains where are created by the next step (DNS entry). For example, let’s say you get the domain bluemountain123.live. You can have as many subdomains as you want and they will be subdomain.bluemountain123.live.\n\nCreate a DNS entry\nLet’s pretend you set up bluemountain123.live as the domain. Go to the DNS settings for your domain. Add a type A record. This will do 2 things. First this will create the subdomain that you will use to access your JupyterHub. So let’s say you create, dhub as the type A DNS entry. Put dhub in the name and the public IP address of the server (leaving off :8000) in the value section. Then dhub.bluemountain123.live will be the url.\n\n\n\nTest if the url is working\nhttp:\\\\dhub.bluemountain123.live:8000 would be the url using the example domain above. Test that it is working (shows a JupyterHub login) before moving on. This is what you should see:" + }, + { + "objectID": "Set-up-centos-security.html#prep-the-server", + "href": "Set-up-centos-security.html#prep-the-server", + "title": "Set-up CentOS https", + "section": "Prep the server", + "text": "Prep the server\n\nOpen port 80\nThis is the default port for http and certbot is going to spin up a temporary webserver on this port and get the SSL certificates. We will close this port when we are done.\n\nGo to the Azure dashboard (Networking section) for your CentOS server and make sure port 80 is open.\nCheck that the firewall is not blocking port 80: sudo firewall-cmd --list-ports. If 80 is not listed, we need to add it and reload:\n\n\nsudo firewall-cmd --permanent --add-port 80/tcp\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-ports\n\n\n\nStop our JupyterHub\n\nsudo systemctl start jupyterhub.service" + }, + { + "objectID": "Set-up-centos-security.html#install-certbot", + "href": "Set-up-centos-security.html#install-certbot", + "title": "Set-up CentOS https", + "section": "Install certbot", + "text": "Install certbot\nPer Let’s Encrypt recommendations, we will use certbot to get our SSL certificates. https://certbot.eff.org/.\nHere are the instructions for certbot on CentOS 8: https://certbot.eff.org/instructions?ws=other&os=centosrhel8 We choose “other” as the software.\n\nUpdate the CentOS repos\nI am using an End-of-Life CentOS distribution (sigh), and the repositories have been archived. This solution worked.\n\ndnf --disablerepo '*' --enablerepo=extras swap centos-linux-repos centos-stream-repos\ndnf distro-sync\n\nNote the last line, suggesting updating a bunch of packages and I said NO to that.\n\n\nInstall snap\nPer instructions here: https://snapcraft.io/docs/installing-snap-on-centos This updated some SELinux packages, which seemed a bit alarming but nothing seemed to break.\n\nsudo yum install snapd\nsudo systemctl enable --now snapd.socket\nsudo ln -s /var/lib/snapd/snap /snap\n\n\n\nInstall certbot\nI had to run this twice. First time it complained.\n\nsudo snap install --classic certbot\nsudo ln -s /snap/bin/certbot /usr/bin/certbot\n\n\n\nCreate the SSL certs.\nHave certbot create the SSL certs by spinning up a temporary webserver listening on port 80. Per instructions on the certbot website.\n\nsudo certbot certonly --standalone\n\nIt’ll ask for your email and the URL of your website. In my toy example, I created the domain dhub.bluemountain123.live.\n\n\nSSL cert renewal\nWith certbot running, the certificates should auto renew, but I haven’t tested this." + }, + { + "objectID": "Set-up-centos-security.html#update-the-jupyterhub-config-file", + "href": "Set-up-centos-security.html#update-the-jupyterhub-config-file", + "title": "Set-up CentOS https", + "section": "Update the JupyterHub config file", + "text": "Update the JupyterHub config file\nEdit with something like\n\ncd /opt/miniconda3/envs/jupyterhub/etc/jupyterhub/\nnano jupyterhub_config.py\n\nThen add this to the config file. The port that is configured for SSL by default is 443. https is not going to work on 8000 which we had configured for http (on Azure).\nc.JupyterHub.port = 443\nc.JupyterHub.ssl_key = '/etc/letsencrypt/live/dhub.bluemountain123.live/privkey.pem'\nc.JupyterHub.ssl_cert = '/etc/letsencrypt/live/dhub.bluemountain123.live/fullchain.pem'\n\nRestart and Test\nWe need to open 443 in the firewall, and we can close 80 and 8000 now.\n\nsudo firewall-cmd --permanent --add-port 443/tcp\nsudo firewall-cmd --permanent --remove-port=80/tcp\nsudo firewall-cmd --permanent --remove-port=8000/tcp\nsudo firewall-cmd --reload\nsudo firewall-cmd --list-ports\n\nNext we restart our JupyterHub service.\n\nsudo systemctl start jupyterhub.service\n\nTry https:\\\\dhub.bluemountain123.live and you should see the JupyterHub login without the http warning." } ] \ No newline at end of file diff --git a/docs/set-up-vm.html b/docs/set-up-vm.html index adba7a2..36f614f 100644 --- a/docs/set-up-vm.html +++ b/docs/set-up-vm.html @@ -30,7 +30,7 @@ - + @@ -127,6 +127,12 @@ Centos Set-up
    +
    • +
  • +
    + + Centos Set-up https +
  • @@ -551,8 +557,8 @@

    Azure