platform-ui/nginx.conf.template at master · Medical-Informatics-Platform/platform-ui · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
server {
    listen 80;

    # Serve Angular app
    root /usr/share/nginx/html;
    index index.html;

    # Route other API requests to the backend
    location /${PLATFORM_BACKEND_CONTEXT}/ {
        proxy_pass http://${PLATFORM_BACKEND_SERVER};
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # Angular shell route for the notebook page (must not proxy to JupyterHub).
    location = /${JUPYTER_CONTEXT} {
        set $notebook_enabled "${NOTEBOOK_ENABLED}";
        if ($notebook_enabled != "1") {
            return 404;
        }
        if ($uri != "/notebook") {
            return 302 /notebook;
        }
        try_files /index.html =404;
    }

    # Without this, /notebook 301s to /notebook/ and the prefix location proxies to
    # JupyterHub, which redirects the top window to /notebook/user/.../lab (no shell).
    location = /${JUPYTER_CONTEXT}/ {
        set $notebook_enabled "${NOTEBOOK_ENABLED}";
        if ($notebook_enabled != "1") {
            return 404;
        }
        if ($uri != "/notebook/") {
            return 302 /notebook;
        }
        try_files /index.html =404;
    }

    # Keep single-user Lab URLs inside the iframe. Top-level navigations (refresh,
    # Hub redirects, iframe breakout) should return to the platform shell route.
    location ~ ^/${JUPYTER_CONTEXT}/user/ {
        set $notebook_enabled "${NOTEBOOK_ENABLED}";
        if ($notebook_enabled != "1") {
            return 404;
        }

        # Top-level browser navigations (refresh, Hub redirect, address-bar URL) must
        # use the Angular shell at /notebook. Iframe loads use Sec-Fetch-Dest: iframe.
        if ($http_sec_fetch_dest = "document") {
            return 302 /notebook;
        }

        proxy_pass http://${JUPYTER_SERVER};
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }

    # After Hub OAuth, JupyterHub redirects to /hub/home. Send top-level navigations
    # back to the Angular shell while keeping Hub API paths proxied to JupyterHub.
    location = /${JUPYTER_CONTEXT}/hub/home {
        set $notebook_enabled "${NOTEBOOK_ENABLED}";
        if ($notebook_enabled != "1") {
            return 404;
        }

        if ($http_sec_fetch_dest = "document") {
            return 302 /notebook;
        }

        proxy_pass http://${JUPYTER_SERVER};
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }

    # Route remaining notebook traffic to JupyterHub (hub API, websockets, etc.).
    location /${JUPYTER_CONTEXT}/ {
        set $notebook_enabled "${NOTEBOOK_ENABLED}";
        if ($notebook_enabled != "1") {
            return 404;
        }
        proxy_pass http://${JUPYTER_SERVER};
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }

    # Fallback to index.html for Angular routing
    location / {
        try_files $uri /index.html;
    }
}