Problems setting up Jupyter-Server with Nginx-Proxy

Hi there,

I try to host a jupyter-server under jupyter.myhost.com , and configured an nginx with the following config:

(This is the "best practice" secure NGINX Config from the Manual)

services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";

commonHttpConfig = ''
  map $scheme $hsts_header {
      https   "max-age=31536000; includeSubdomains; preload";
  }
  add_header Strict-Transport-Security $hsts_header;

  #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
  add_header 'Referrer-Policy' 'origin-when-cross-origin';
  add_header X-Frame-Options DENY;
  add_header X-Content-Type-Options nosniff;
  add_header X-XSS-Protection "1; mode=block";

  proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
virtualHosts = let
  base = locations: {
inherit locations;
    forceSSL = true;
    enableACME = true;
};
  proxy = port: base {
"/".proxyPass = "http://127.0.0.1:" + toString(port) + "/"; }; in {

"jupyter.myhost.com" = proxy 8888 // { default = false; }; }; };

Where my jupyter-config is the following:

 services.jupyter.enable = true;
services.jupyter.kernels = { 
  python3 = 
let env = (pkgs.python3.withPackages (pythonPackages: with pythonPackages; [ ipykernel pandas scikitlearn ])); 
in { displayName = "Python 3 for machine learning"; 
argv = [ "$ {env.interpreter}" 
"-m" "ipykernel_launcher" 
"-f" "{connection_file}" ]; language = "python"; }; }; 
services.jupyter.ip = "0.0.0.0"; 
services.jupyter.password="'sha1:2e06dfd4a5bc:56ba61b9d1e5503ba230a7aa995e9327186cecb4'"; services.jupyter.notebookConfig = '' 
c.NotebookApp.open_browser = False 
c.NotebookApp.allow_remote_access=True 
c.NotebookApp.disable_check_xsrf=True 
c.NotebookApp.token="" '';

And my firewall-setting is the following:

networking.firewall.enable = true;
networking.firewall.allowPing = true; networking.firewall.allowedTCPPorts = [ 80 443];

​

I have a few problems, some regard Nginx some regard Jupyter:

1. Without thec.NotebookApp.disable_check_xsrf=Trueevery call after the login page will fail when I try to do something, saying that the "_xrsf argument" was not set in the POST requests. However, I do not have this problem for the login (which is also a Post-Request) and I Feel this is an Nginx-Setting rather than Jupyter.Also, disabling some security features sounds wrong.When i look into the jupyter-notebook-logs, it says i have a _xrsf2 argument in my cookie, but it seems not recognized.
2. The Kernel cannot be connected - do I have to install Python separately?
3. While my Firewall only allows Ports 80 and 443, the port 8888 is also open. When i go to www.myhost.com:8888 i get a response, which is not what i want.I want only jupyter.myhost.com:443 to work.
   Edit: This has been resolved with services.jupyter.ip = "127.0.0.1";