Hi, thank you for your reply. No, I have just confirmed only vm 2 returns 403 when trying to ‘Stop my server’ from the hub control panel. I will share the configurations for vm01 - jhub.example .com and vm02 jhub.example. com:1234. (Sorry but some url have whitespaces as the forum wouldn’t allow me to post more then 2 urls, they are correct in my actual code)
nginx configuration for vm01
server {
listen 80;
return 301 https:/ /$host$request_uri;
}
server {
listen 443 ssl;
ssl_reject_handshake on;
}
server {
listen 443 ssl;
server_name jhub.example. com;
ssl_certificate /etc/ssl/jupyterhub/certs/ssl.jupyterhub.cert;
ssl_certificate_key /etc/ssl/jupyterhub/private/ssl.jupyterhub.key;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/jupyterhub.access.log;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https ://127.0.0.1:8000;
proxy_read_timeout 90;
proxy_redirect https ://127.0.0.1:8000 https ://jhub.example;
# WebSockets support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
nginx configuration for vm02
server {
listen 80;
return 301 https:/ /$host$request_uri;
}
server {
listen 443 ssl;
ssl_reject_handshake on;
}
server {
listen 1234 ssl default_server;
server_name jhub.example:1234;
ssl_certificate /etc/ssl/jupyterhub/certs/ssl.jupyterhub.cert;
ssl_certificate_key /etc/ssl/jupyterhub/private/ssl.jupyterhub.key;
location / {
proxy_pass "https:/ /127.0.0.1:1234";
proxy_set_header Host $host;
}
}
server {
listen 443 ssl default_server;
server_name jhub.example;
ssl_certificate /etc/ssl/jupyterhub/certs/ssl.jupyterhub.cert;
ssl_certificate_key /etc/ssl/jupyterhub/private/ssl.jupyterhub.key;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/jupyterhub.access.log;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https:/ /127.0.0.1:8000;
proxy_read_timeout 90;
proxy_redirect https:/ /127.0.0.1:8000 https:/ /jhub.example:1234;
# WebSockets support
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
Jupyterhub_config.py file, almost the same for both vms, only port changes.
from oauthenticator.azuread import LocalAzureAdOAuthenticator
from jupyter_client.localinterfaces import public_ips
from dockerspawner import DockerSpawner
from tornado import gen
from jupyterhub.auth import LocalAuthenticator
import re
import os
import docker
import json
import shlex
import subprocess
import pwd
c.Application.log_level = 'DEBUG'
c.Spawner.args = ['--NotebookApp.allow_origin=*']
c.Spawner.http_timeout = 300
c.Spawner.start_timeout = 300
c.JupyterHub.ssl_key = '/etc/ssl/jupyterhub/private/ssl.jupyterhub.key'
c.JupyterHub.ssl_cert = '/etc/ssl/jupyterhub/certs/ssl.jupyterhub.cert'
c.JupyterHub.port = 443
host_name = 'jhub.example. com' #[this url is jhub.example. com:1234 in the vm02]
tenant_id = ''
client_id = ''
client_secret = ''
default_admin = ''
image_map_file_name = "image_map.json"
azure_storage_name=""
azure_file_share_name=""
start_ssh_port_mapping=5101
c.Spawner.default_url = '/lab'
c.JupyterHub.spawner_class = CustomDockerSpawner
c.JupyterHub.logo_file = "/home/jupyterhub/logo.png"
c.DockerSpawner.extra_host_config = {'runtime': 'nvidia', 'pid_mode': 'host', 'cap_drop': ['SYS_MODULE', 'SYS_RAWIO', 'SYS_PACCT', 'SYS_ADMIN', 'SYS_NICE', 'SYS_RESOURCE', 'SYS_TIME', 'SYS_TTY_CONFIG', 'AUDIT_CONTROL', 'MAC_ADMIN',
'MAC_OVERRIDE', 'NET_ADMIN', 'SYSLOG', 'DAC_READ_SEARCH', 'LINUX_IMMUTABLE', 'NET_BROADCAST', 'IPC_LOCK', 'IPC_OWNER', 'SYS_BOOT', 'LEASE', 'WAKE_ALARM', 'BLOCK_SUSPEND'], 'privileged': True, 'devices': ['/dev/fuse']}
c.DockerSpawner.extra_create_kwargs = {'user': 'root'}
c.DockerSpawner.environment = {
'GRANT_SUDO': '1', 'NVIDIA_DRIVER_CAPABILITIES': 'compute,utility', 'NVIDIA_VISIBLE_DEVICES': 'all'}
c.DockerSpawner.remove = True
with open(image_map_file_name, "r") as image_map_file:
image_map = json.load(image_map_file)
c.DockerSpawner.image_whitelist = image_map
c.DockerSpawner.notebook_dir = azfiles_dir
c.DockerSpawner.volumes = {'jupyterhub-user-{user}': azfiles_dir,
'jupyterhub-ssdp-{user}': ssdprivate_data_dir, 'jupyterhub-ssd': ssdshared_data_dir}
ip = public_ips()[0]
c.JupyterHub.ip = '0.0.0.0'
c.JupyterHub.port = 8000
c.JupyterHub.hub_ip = ip
c.JupyterHub.authenticator_class = NormalizedUsernameLocalAzureAdOAuthenticator
c.Authenticator.admin_users = {default_admin}
c.LocalAuthenticator.create_system_users = True
c.Authenticator.delete_invalid_users = True
c.LocalAzureAdOAuthenticator.tenant_id = tenant_id
c.LocalAzureAdOAuthenticator.oauth_callback_url = 'https:/ /{}/hub/oauth_callback'.format(
host_name)
c.LocalAzureAdOAuthenticator.client_id = client_id
c.LocalAzureAdOAuthenticator.client_secret = client_secret
There are parts of the code in the config file that have been removed, this is working for me as it’s been up for some time now without issues. Only problem there is now is the 403 when stopping.
Thank you for your help.