server config upload

images/datascience-notebook/Dockerfile

@@ -40,10 +40,13 @@ RUN apt-get update -y && \
 # Jupyter/datahub/nbgrader setup
 COPY /scripts /usr/share/datahub/scripts/
 COPY /scripts/jupyter_notebook_config.py /tmp/jupyter_notebook_config_extra.py
+COPY /scripts/jupyter_server_config.py /tmp/jupyter_server_config_extra.py
 COPY /scripts/nbgrader_config.py /etc/jupyter/nbgrader_config.py
 RUN cat /tmp/jupyter_notebook_config_extra.py >> /etc/jupyter/jupyter_notebook_config.py && \
+cat /tmp/jupyter_server_config_extra.py >> /etc/jupyter/jupyter_server_config.py && \
     chmod -R uga+x /usr/share/datahub/scripts/ && \
     chmod -R uga+x /etc/jupyter/jupyter_notebook_config.py && \
+    chmod -R uga+x /etc/jupyter/jupyter_server_config.py && \
     chmod -R uga+x /etc/jupyter/nbgrader_config.py
 
 # Copy over R tests to /opt/manual_tests

images/datascience-notebook/scripts/jupyter_server_config.py

@@ -0,0 +1,62 @@
+# Copyright (c) Jupyter Development Team.
+# Distributed under the terms of the Modified BSD License.
+# mypy: ignore-errors
+import os
+import stat
+import subprocess
+from pathlib import Path
+
+from jupyter_core.paths import jupyter_data_dir
+
+c = get_config()  # noqa: F821
+c.ServerApp.ip = "0.0.0.0"
+c.ServerApp.open_browser = False
+c.ServerApp.tornado_settings = {'headers': {'Content-Security-Policy': "frame-ancestors *;"}}
+
+# TEMP: Disable RTC until bugs fixed with URL modification
+c.YDocExtension.disable_rtc = True
+
+# to output both image/svg+xml and application/pdf plot formats in the notebook file
+c.InlineBackend.figure_formats = {"png", "jpeg", "svg", "pdf"}
+
+# https://github.com/jupyter/notebook/issues/3130
+c.FileContentsManager.delete_to_trash = False
+
+# Generate a self-signed certificate
+OPENSSL_CONFIG = """\
+[req]
+distinguished_name = req_distinguished_name
+[req_distinguished_name]
+"""
+if "GEN_CERT" in os.environ:
+    dir_name = Path(jupyter_data_dir())
+    dir_name.mkdir(parents=True, exist_ok=True)
+    pem_file = dir_name / "notebook.pem"
+
+    # Generate an openssl.cnf file to set the distinguished name
+    cnf_file = Path(os.getenv("CONDA_DIR", "/usr/lib")) / "ssl/openssl.cnf"
+    if not cnf_file.exists():
+        cnf_file.write_text(OPENSSL_CONFIG)
+
+    # Generate a certificate if one doesn't exist on a disk
+    subprocess.check_call(
+        [
+            "openssl",
+            "req",
+            "-new",
+            "-newkey=rsa:2048",
+            "-days=365",
+            "-nodes",
+            "-x509",
+            "-subj=/C=XX/ST=XX/L=XX/O=generated/CN=generated",
+            f"-keyout={pem_file}",
+            f"-out={pem_file}",
+        ]
+    )
+    # Restrict access to the file
+    pem_file.chmod(stat.S_IRUSR | stat.S_IWUSR)
+    c.ServerApp.certfile = str(pem_file)
+
+# Change default umask for all subprocesses of the Server if set in the environment
+if "NB_UMASK" in os.environ:
+    os.umask(int(os.environ["NB_UMASK"], 8))