Skip to content

Conversation

@dometto
Copy link
Contributor

@dometto dometto commented Dec 2, 2025

Where #592 introduced the ability to proxy to servers running on a unix domain socket, this PR allows the proxy itself to listen on a unix socket.

  • Added CLI options --socket, --api-socket, and --metrics-socket to provide socket path for the proxy, api, and metrics servers.
  • Refactored the setupProxy test helper method to allow passing in a unix socket instead of a TCP port for test servers to listen on.
  • Added tests. Tests check only whether basic connectivity for the proxy works, for normal HTTP and websockets. They copy and adapt the "basic HTTP request" and "basic WebSocket request" tests.

Using the changes in this PR, we can securely run JupyterHub on a shared server with multiple users, using a proxy auth strategy.

@dometto dometto force-pushed the listen_unix_socket branch 2 times, most recently from f041fc7 to 18e056b Compare December 2, 2025 20:55
@dometto dometto force-pushed the listen_unix_socket branch from 1c93488 to b2e4405 Compare December 2, 2025 20:57
@dometto
Copy link
Contributor Author

dometto commented Dec 2, 2025

Not seeing these test failures locally -- advice very welcome!

});

it("unix socket HTTP request", function (done) {
http
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using http.request because I couldn't get the fetch API to work with a unix socket.

Copy link
Member

@minrk minrk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! Some suggestions about how to handle the mutual exclusivity using commander's conflicts to implement the mutual exclusivity, rather than unconditional warnings, but otherwise looks great!


if (args.socket) {
listen.proxyTarget = [args.socket];
logger.warn(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably best to warn only if conflicting args are specified. It's a bit confusing to get a warning when everything is behaving as intended.

I think commander can help with this by adding .conflicts() to express these conflicts: https://github.com/tj/commander.js?tab=readme-ov-file#more-configuration


if (args.apiSocket) {
listen.apiSocket = [args.apiSocket];
logger.warn(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here


if (args.metricsSocket) {
listen.metricsSocket = [args.metricsSocket];
logger.warn(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

2 participants