Improve local auth/spawn behavior and make launcher sizing labels configurable

Author: nenb

config/jupyterhub/00-gateway-auth.py

@@ -62,7 +62,7 @@ async def authenticate(self, handler, data=None):
         }
 
 
-if get_config("custom.external-url", ""):
+if bool(get_config("custom.gateway-auth-enabled", False)):
     c.JupyterHub.authenticator_class = EnvoyOIDCAuthenticator
     # All users who pass Keycloak auth at the gateway are allowed
     c.Authenticator.allow_all = True

config/jupyterhub/01-spawner.py

@@ -9,7 +9,10 @@
 # Using fixed /home/jovyan mount path because {username} expands differently in
 # KubeSpawner (escaped slug) vs base Spawner traits like notebook_dir (raw username),
 # causing a path mismatch when usernames contain special characters (e.g. emails).
-# Each user still gets an isolated PVC via claim-{username}.
+# Named-server PVC behavior differs across spawner wrappers. For local reliability,
+# force one home PVC per user (shared across that user's named servers): claim-{username}.
+# This avoids pending spawns like: persistentvolumeclaim "claim-<user>" not found.
+c.KubeSpawner.pvc_name_template = "claim-{username}"
 c.KubeSpawner.storage_pvc_ensure = True
 c.KubeSpawner.storage_capacity = "10Gi"
 c.KubeSpawner.storage_access_modes = ["ReadWriteOnce"]

config/jupyterhub/02-jhub-apps.py

@@ -10,9 +10,13 @@
 # bind_url must include the real external hostname so JupyterHub constructs
 # correct OAuth redirect URLs for internal services like jhub-apps.
 # See: nebari's 02-spawner.py for the same pattern.
-domain = get_config("custom.external-url", "")
+domain = str(get_config("custom.external-url", "") or "").strip()
 if domain:
-    c.JupyterHub.bind_url = f"https://{domain}"
+    if domain.startswith("http://") or domain.startswith("https://"):
+        c.JupyterHub.bind_url = domain
+    else:
+        scheme = str(get_config("custom.external-url-scheme", "https") or "https").strip()
+        c.JupyterHub.bind_url = f"{scheme}://{domain}"
 else:
     c.JupyterHub.bind_url = "http://0.0.0.0:8000"
 c.JupyterHub.default_url = "/hub/home"
@@ -32,3 +36,34 @@
 
 # Install jhub-apps (sets up service, roles, etc.)
 c = install_jhub_apps(c, spawner_to_subclass=KubeSpawner)
+
+# Ensure all authenticated Hub users can access launcher services.
+# This prevents intermittent "You do not have permission to access JupyterHub service japps"
+# errors in local setups with mixed/stale cookies.
+existing_roles = list(getattr(c.JupyterHub, "load_roles", []) or [])
+extra_scopes = {
+    "self",
+    "access:services!service=japps",
+    "access:services!service=pi-launcher",
+}
+
+# De-duplicate any pre-existing "user" role definitions and re-add exactly one.
+merged_user_scopes = set()
+filtered_roles = []
+for role in existing_roles:
+    if isinstance(role, dict) and role.get("name") == "user":
+        scopes = role.get("scopes")
+        if isinstance(scopes, list):
+            merged_user_scopes.update(scopes)
+        continue
+    filtered_roles.append(role)
+
+merged_user_scopes.update(extra_scopes)
+filtered_roles.append(
+    {
+        "name": "user",
+        "scopes": sorted(merged_user_scopes),
+    }
+)
+
+c.JupyterHub.load_roles = filtered_roles

config/jupyterhub/05-pi-launcher.py

@@ -57,6 +57,11 @@
             "medium": "pi-medium",
             "large": "pi-large",
         }
+        PROFILE_UI_SPECS = {
+            "small": os.environ.get("PI_PROFILE_SMALL_SPEC", "2 cpu / 8G RAM"),
+            "medium": os.environ.get("PI_PROFILE_MEDIUM_SPEC", "4 cpu / 16G RAM"),
+            "large": os.environ.get("PI_PROFILE_LARGE_SPEC", "8 cpu / 32G RAM"),
+        }
 
         def hub_request(method: str, path: str, **kwargs):
             headers = kwargs.pop("headers", {})
@@ -832,17 +837,17 @@ def get(self):
                   <form method="post" action="{SERVICE_PREFIX}/launch">
                     <input type="hidden" name="_xsrf" value="{xsrf_token}" />
                     <input type="hidden" name="size" value="small" />
-                    <button class="btn" type="submit">Small<small>2 cpu / 8 GB ram</small></button>
+                    <button class="btn" type="submit">Small<small>{html.escape(str(PROFILE_UI_SPECS.get('small', '')))}</small></button>
                   </form>
                   <form method="post" action="{SERVICE_PREFIX}/launch">
                     <input type="hidden" name="_xsrf" value="{xsrf_token}" />
                     <input type="hidden" name="size" value="medium" />
-                    <button class="btn" type="submit">Medium<small>4 cpu / 16 GB ram</small></button>
+                    <button class="btn" type="submit">Medium<small>{html.escape(str(PROFILE_UI_SPECS.get('medium', '')))}</small></button>
                   </form>
                   <form method="post" action="{SERVICE_PREFIX}/launch">
                     <input type="hidden" name="_xsrf" value="{xsrf_token}" />
                     <input type="hidden" name="size" value="large" />
-                    <button class="btn" type="submit">Large<small>8 cpu / 32 GB ram</small></button>
+                    <button class="btn" type="submit">Large<small>{html.escape(str(PROFILE_UI_SPECS.get('large', '')))}</small></button>
                   </form>
                 </div>
                 <div class="row">
@@ -1590,10 +1595,39 @@ def make_app():
 pi_sharing_namespace = str(z2jh.get_config("custom.pi-sharing-namespace", "") or "").strip()
 pi_share_session_max_bytes = str(z2jh.get_config("custom.pi-share-session-max-bytes", 1048576))
 pi_coding_agent_dir = str(z2jh.get_config("custom.pi-coding-agent-dir", "/tmp/pi-agent") or "/tmp/pi-agent").strip()
+
+pi_profiles_cfg = z2jh.get_config("custom.pi-profiles", {}) or {}
+
+def _format_cpu_value(value):
+    if value is None:
+        return ""
+    try:
+        f = float(value)
+        if f.is_integer():
+            return str(int(f))
+    except Exception:
+        pass
+    return str(value)
+
+def _profile_spec_text(size_key, default_text):
+    if isinstance(pi_profiles_cfg, dict):
+        spec = pi_profiles_cfg.get(size_key)
+        if isinstance(spec, dict):
+            cpu = _format_cpu_value(spec.get("cpu_limit"))
+            mem = str(spec.get("mem_limit") or "").strip()
+            if cpu and mem:
+                return f"{cpu} cpu / {mem} RAM"
+    return default_text
+
+pi_profile_small_spec = _profile_spec_text("small", "2 cpu / 8G RAM")
+pi_profile_medium_spec = _profile_spec_text("medium", "4 cpu / 16G RAM")
+pi_profile_large_spec = _profile_spec_text("large", "8 cpu / 32G RAM")
+
 public_host = z2jh.get_config("custom.external-url") or ""
 public_host = str(public_host).strip().rstrip("/")
 if public_host and not public_host.startswith(("http://", "https://")):
-    public_host = f"https://{public_host}"
+    public_scheme = str(z2jh.get_config("custom.external-url-scheme", "https") or "https").strip()
+    public_host = f"{public_scheme}://{public_host}"
 pi_launcher_oauth_redirect_uri = f"{public_host}/services/{pi_launcher_service_name}/oauth_callback"
 
 launcher_env = {
@@ -1605,6 +1639,9 @@ def make_app():
     "PI_LIVE_SHARE_ENABLED": pi_live_share_enabled,
     "PI_SHARE_SESSION_MAX_BYTES": pi_share_session_max_bytes,
     "PI_CODING_AGENT_DIR": pi_coding_agent_dir,
+    "PI_PROFILE_SMALL_SPEC": pi_profile_small_spec,
+    "PI_PROFILE_MEDIUM_SPEC": pi_profile_medium_spec,
+    "PI_PROFILE_LARGE_SPEC": pi_profile_large_spec,
 }
 if pi_sharing_namespace:
     launcher_env["PI_SHARING_NAMESPACE"] = pi_sharing_namespace