Portal integration by pvvhoang · Pull Request #2 · Garvan-Data-Science-Platform/single-cell-explorer

pvvhoang · 2026-05-18T03:26:14Z

//—------------------------------------------
// 1) Explorer uses local stack from portal
//—------------------------------------------
Update docker-compose.yml
//—------------------------------------------
// 2) Change from http to https
//—------------------------------------------
env
env.explorer
docker-compose.yml
hosted/Dockerfile

Add file hosted/nginx.ssl.conf
listen 5000 ssl;

    ssl_certificate     /etc/ssl/certs/nginx-selfsigned.crt;
    ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

//—------------------------------------------
// 3) Explorer uses explorer.corporanet.local instead of localhost
//—------------------------------------------
Run this command:
sudo bash -c 'cat >> /etc/hosts << EOF
127.0.0.1 explorer.corporanet.local
EOF'

env.explorer
//—------------------------------------------
// 4) To use explorer in portal, we need to change from "frame-ancestors": ["'none'"], to "frame-ancestors": [os.getenv("FRONTEND_URL")],
env.explorer
server/ecs/app.py
//—------------------------------------------

So, with these updates, explorer can run at localhost using https://explorer.corporanet.local:5500/e/test.cxg/

Note: For these files .env.example, .env.explorer.example, and nginx.ssl.conf.example, please change their names by removing .example at the end, then review and update the correct information before running at local

…localhost

Copilot

Pull request overview

This PR integrates the Explorer local stack with the portal-oriented local development flow by switching local URLs to HTTPS and explorer.corporanet.local, adding portal network attachment, and relaxing CSP frame embedding for a frontend origin.

Changes:

Switch example local Explorer env values from localhost/HTTP to explorer.corporanet.local/HTTPS.
Add Docker build support for local self-signed SSL nginx configuration.
Update compose networking to attach Explorer to the portal corporanet network.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`server/ecs/app.py`	Changes CSP `frame-ancestors` to use `FRONTEND_URL`.
`hosted/Dockerfile`	Adds OpenSSL and conditional self-signed certificate/nginx SSL config setup.
`docker-compose.yml`	Adds SSL build arg, removes Explorer dependency on localstack, and attaches Explorer to portal network.
`.gitignore`	Ignores local nginx SSL config.
`.env.explorer.example`	Updates Explorer local domains/protocol and adds `FRONTEND_URL`.
`.env.example`	Enables local SSL certificate generation by default.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pvvhoang · 2026-05-21T00:20:02Z

+COPY hosted/nginx.ssl.conf* /etc/nginx/nginx.ssl.conf
+ARG LOCALHOST_SSL_CERT=false
+# Generate self-signed SSL certificate only when LOCALHOST_SSL_CERT=true
+RUN if [ "$LOCALHOST_SSL_CERT" = "true" ]; then \
+      mv /etc/nginx/nginx.ssl.conf /etc/nginx/nginx.conf; \


Fixed, COPY hosted/nginx.ssl.conf* /etc/nginx/, then if using local ssl cert, overwrite /etc/nginx/nginx.conf by /etc/nginx/nginx.ssl.conf

pvvhoang · 2026-05-21T00:22:05Z

            "object-src": ["'none'"],
            "base-uri": ["'none'"],
-            "frame-ancestors": ["'none'"],
+            "frame-ancestors": [os.getenv("FRONTEND_URL")],


Fixed, only setting frame-ancestors when FRONTEND_URL existed

pvvhoang · 2026-05-21T00:29:44Z

+        -keyout /etc/ssl/private/nginx-selfsigned.key \
+        -out /etc/ssl/certs/nginx-selfsigned.crt \
+        -days 3650 \
+        -subj "/CN=explorer.corporanet.local"; \


pvvhoang · 2026-05-21T00:33:32Z

+      single-cell-data-portal_corporanet:
+        aliases:
+          - explorer.corporanet.local


localstack has been removed from the section of depends_on in explorer service

pvvhoang · 2026-05-21T00:34:25Z

 networks:
  corporanet:
+  single-cell-data-portal_corporanet:
+    external: true


Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 7 comments.

pvvhoang · 2026-05-20T05:10:37Z

            "object-src": ["'none'"],
            "base-uri": ["'none'"],
-            "frame-ancestors": ["'none'"],
+            "frame-ancestors": [os.getenv("FRONTEND_URL")],
        }


Fixed, if no FRONTEND_URL, will use "'none'"

pvvhoang · 2026-05-20T05:17:25Z

+                  process.env.DEPLOYMENT_TYPE !== "vcp-hosted" && 
+                  process.env.USE_FOR_PORTAL === "false" && (


pvvhoang · 2026-05-20T05:46:19Z

 COPY hosted/nginx.conf /etc/nginx/nginx.conf
+COPY hosted/nginx.ssl.conf* /etc/nginx/nginx.ssl.conf
+ARG LOCALHOST_SSL_CERT=false
+# Generate self-signed SSL certificate only when LOCALHOST_SSL_CERT=true
+RUN if [ "$LOCALHOST_SSL_CERT" = "true" ]; then \
+      mv /etc/nginx/nginx.ssl.conf /etc/nginx/nginx.conf; \
+      openssl req -x509 -newkey rsa:4096 -nodes \


Fixed, copy into a directory instead of a target file

pvvhoang · 2026-05-20T06:45:58Z

        - BUILDKIT_INLINE_CACHE=1
        - IMAGE_TAG
        - BASE_IMAGE=${BASE_IMAGE}
+        - LOCALHOST_SSL_CERT=${LOCALHOST_SSL_CERT}


Fixed, add in args in docker-compose

pvvhoang · 2026-05-20T23:12:32Z

        - BASE_IMAGE=${BASE_IMAGE}
+        - LOCALHOST_SSL_CERT=${LOCALHOST_SSL_CERT}
    restart: always
-    depends_on:
-      - localstack
    env_file:
      - ./.env.explorer
    ports:


explorer does not use this localstack anymore, it will use localstack from portal

pvvhoang · 2026-05-20T23:56:26Z

+      single-cell-data-portal_corporanet:
+        aliases:
+          - explorer.corporanet.local
 networks:
  corporanet:
+  single-cell-data-portal_corporanet:
+    external: true


Fixed as suggestion

pvvhoang · 2026-05-21T00:10:35Z

            "base-uri": ["'none'"],
-            "frame-ancestors": ["'none'"],
+            "frame-ancestors": [os.getenv("FRONTEND_URL")],
        }


It works with the setting for frame-ancestors, because frame-ancestors has a higher priority compared frame-options

pvvhoang added 8 commits May 13, 2026 16:37

use local stack from portal

17adaf9

connect to portal network & use https

619e571

Merge remote-tracking branch 'origin/dev' into portal_integration

c4d7dae

use local stack from portal & https

776add5

delete one empty line

0c1bace

roll back, use http

5600036

roll back, use http

e6a91f7

Change from http to https & use explorer.corporanet.local instead of …

06b36df

…localhost

pvvhoang requested a review from Copilot May 18, 2026 06:31

Copilot started reviewing on behalf of pvvhoang May 18, 2026 06:31 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

pvvhoang added 3 commits May 19, 2026 10:14

example for nginx.ssl.conf

b291643

turn off top menu

2ae1dce

add empty line at the end

bf59b3d

pvvhoang requested a review from Copilot May 20, 2026 04:30

Copilot started reviewing on behalf of pvvhoang May 20, 2026 04:30 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

pvvhoang added 5 commits May 20, 2026 15:09

set default value if no env var FRONTEND_URL

64fe241

check USE_FOR_PORTAL == true, not show nav bar

39e953e

Fix issue if there many many files as hosted/nginx.ssl.conf*

81cb2a6

fix issue of loading env var USE_FOR_PORTAL

7dc19fa

use env variables & add alt name for ssl cert

5c86216

pvvhoang marked this pull request as ready for review May 21, 2026 06:52

		process.env.DEPLOYMENT_TYPE !== "vcp-hosted" &&
		process.env.USE_FOR_PORTAL === "false" && (

Uh oh!

Conversation

pvvhoang commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pvvhoang commented May 18, 2026 •

edited

Loading