Enable pulling private GitHub repos for Neurohackademy

config/clusters/2i2c/enc-neurohackademy.secret.values.yaml

@@ -2,24 +2,24 @@ jupyterhub:
     hub:
         config:
             CILogonOAuthenticator:
-                client_id: ENC[AES256_GCM,data:6XHOmSCMGhfqmlUiPrZ3XOOCxvcxcY9kGvL4tOq3r938OcFYL2c4djMY1HaiiWqxuSy7,iv:baQy9nkbEjAFjrfAh2jck90ovu40yo8kyxDeIJ90oio=,tag:fcjU9fNH2qL9cRjCuBJNSA==,type:str]
-                client_secret: ENC[AES256_GCM,data:cMmsQtb46YaqSu1agyrXXASIKLkpVTjwfVEtp+LbO6un6e0o+G3TqUxSIBxl2Frkv4vgi+b7kIPGW0vMsi5A3uYJ5afSDhujKukJhtT6KAjkvkLDFHo=,iv:rYat5xx4XTp4WRLM4w0w5YL6WksxpCIT1qOpSAk9o/c=,tag:/pkEPkgggSQvNbQPY2b8qA==,type:str]
-staticWebsite:
-    githubAuth:
-        githubApp:
-            id: ENC[AES256_GCM,data:ycsNCrTO,iv:ikASM8Mhh8BrZ0dEnDl+jBhzduCR1mj1+24XyADEkrM=,tag:EjgrgfQfVfK8u9o0BReMtQ==,type:int]
-            privateKey: ENC[AES256_GCM,data:q8UMKibJMvsIzRdJtoLCiGcF730N/f0DYdi+L0YRw8vKlvDJuxXoqLV4xYiAlSh2ULp91s3A7rw4WpBoaqeJIvGyjBWDSPCGFiVpjqsXGgTli1LMsCUgY29Kpoz3bOKbjE35Rmqiru1sYBM1FVSRrWcMymNLCNlvsk8SB92jVwQuJmj1T1VvmkQ8Ii/PQByeIIApUqSy8xh/vWiJGtfUTDQd/Qlxc6cF5KKkz03CWDRlcO7nkYG8Ni6znbYjRbxnpyu0DlAI0+YCS2pRiysAlE908+s6htmdUvBZf8SimaM6PNaRQXI1Zq0sNneEAIjh6gufvdu00Z4uLqIOkkM992BgubUWaMYqKt9thWPnLSAhjQIINUplo4ELQEtGevgjXRHk6kf+lDFimY/2TAYaKsUdfF1bgXNDAAIWADCbygLT1TK0DTWlypqFgX50PL9KytWZP+rsvxRZNT5aBlJ+gKfYURISPPO1hgqwKzs1aX8LEJnxoasumJDe6/UNkCcDa5nuu/Hj6BTVaV/CoVa4yFaoRonyF5f9c2M18sqIf5VC32L4uS6Sq0ctPUd4HutyFlruGHI0mfGlwDNXBPN5ubzATeFQniHWNTq7UgTBBHNLPGP7yGPwzLg4rTAnUz0jPwK2IwIQAjPQFDXJatb2u3E9uBOIFIVtZg7nFV+MQzuHvzXccF5xjPQgu4quwrMcBQYXKC1ef8kzuZfeooOArY3dBaw08UwEhp4u4nk0LTUfxayg6sk31kIlEq/T0TcB18C+9TeP4KliEQMOKcjfzpK/KuErSruZMrJ8lSKW6Il87t0X3J5UrKV4KZUz3HnZo+Sss0uWnJjkZUCTU5Sca6WtxRV9ZwF6z1wocIzxAUFduTIV/8rc5MScyNkZpPySg1Xp4DEmnqWP3RMxruWS6YHZDPj1l6Uq39GgrL66HBwxLQ8eSXozvYqcoBWyfhwMwRSeOhBAn0geaagSmaiZlbXMuooSYWcnBe9aZjpePXbAXGUVlheA21TqItJXgGAMV1AVFSEjmcZAFySJPNWLrvV+0u4KgmLtNsXXCDkwPy/CDf5McJjjxmSQ1h9KQKXz67FmMllotPxXTluF/iTwCE/nvzSfNqQX7AKQ8wUCUK1RNEcV9lMAZbi2lwyVV2SUgOfMxBVw+2uTEUirJgqMbMA7suOfd7+o4HAsvTn7s5uWYEcuDP4zdbhXiP9Xe4xtnnB1G85FjT2ukBDyvN97PjiGMo/d7A9JDyxbqlXmFlIV28ox4yoo+uqWfbz/igyvqj4v7iFb6ugaZx/dWPRUVt7+FotN7Y6CUUGRXUD0QK9boYgHUVX2s/pwnXGSZzNJUG6YI9p+P1yMlQTdLl/gqweTTmr/PZfTdIHQAyPpoGTHWnBFUIimGXfN8rGnhw85Tmc3w/Gnb8rbLrQefrBiBk9RMpEFOSrxGrjoC5xLjoIAVmnwr0KxiRM9LL2/4xxTEky72jUjPYnzMDyl2O9R/pGb433Uv4ks7uv0vWyFWDbSyH2esSxVnI6L7FkB7VSVv+h3adukGORJ8Gppe3WpLWLYK/Plh+iTU/5bjQ+Sbup07PVRkVJDvuoQMUj6LmHeo/LmotJP1Hl0fqHtIyjjIVlMGj4Cr+PojhBTUaRlvF/6KqgF2dZXoqaem6R+bC5lA0uRabs7bTI6iqPMaOR5aoEcS4ARL1D93OUMtKUZMPNiWRHUiE84tRNfLOu2mRj/cQ/TIQhI/NAQLPUq1X53gYoGBPEyw/7retbLpe2k0l/0vQwLOxqXITv+IJ98lYQtzBWNPFdrbwTjq82hVaU0ryq4Dp2io3g0uj4OyEEc1JZxsw8SV7Gg7a3vW4eE2+hUBTSj1yxT+3ZcRT7tc6zVAnH3bgrayVaU3EhSBA1BM60w4SitcFlE8c+XA8zuT4vK6Sy6cU97Mz1O5X6ShgGd/YD8gTinkwD6uensaq01MbnDNAZA96Fml+Ewu715MNEclMyZ5xpz20KecCLU8NpNlFtEem5MdKf87BiVIUejxLOihQoJRgKMEassuConm70T97NSVTsBHgMQactIAYXXMw8bPGqrK6TORtlFS9jty6HDMepqkQblDyWFUiYYr6IBtaulcMLr8ZTdCKOxYfW9xmw8RmNNPfDXXfqLXoGBL9v26w9oppmBuuEWG1MSEe8OsllWC0jyWtLK7sEGreLGTAUf6UocqnRO9RQ1PmrGkzanPxC3jXSrhV+zH7WQpqE=,iv:UqcUBm2uy8wyGTyKcgNNe5sj4X8isa4DHT1CGuyFRqU=,tag:QkW2e5nlEkTM2Rz7gprKEg==,type:str]
+                client_id: ENC[AES256_GCM,data:/V5zuwdVRd5ylEW1eB/kxskMkShJHCx7AefXpropYmD4fi8wvLux+VO+kpP6WnsQw+w5,iv:5j08+QLAFMf4Vt8r3i9lgGrX0syPv2Wr8yRbaEaakAM=,tag:1RH78JX6PkORH/aY8xu2/A==,type:str]
+                client_secret: ENC[AES256_GCM,data:QhunpQzs0wdrzHRAV66sF/yj+uvLBsNgS+xrZ+t31tXthqJyl/NK3w20h9xbMTVWZjwHpEJPDRvdXD52nHi/beNlEGSKVno3pLYgBmg0+mGlhQoVmlY=,iv:2xrJb182QTRSCldR9KxSvZADgfWA79WvdMDmKw75GsU=,tag:S7wKAdcLTqPmtIiTH+xY/g==,type:str]
+    singleuser:
+        extraFiles:
+            github-app-private-key.pem:
+                mountPath: ENC[AES256_GCM,data:Ov0lkLLSgJtZvjA2lnMrWmYbNemh13Pu0qSdkQOnahNkV0zsSvc=,iv:hvSLVxXAxXB44qP3kh6dX8hyUnlO5iDvjv5OOyay1u0=,tag:/QBW7Yq+jeSvqOAX4+OuPQ==,type:str]
+                stringData: ENC[AES256_GCM,data:c5/5NDR+I5tuIq69NSXQqJ0OyIA4sNM+ystkIQDYjwKUcqQ95GyVRryALpLkmR+WXRFDDzBQEEtFsIw2GtcbOd6+gdKIamMpdulqFonc3Ii9Wm86hqRUfDv4iNgZqnvWLBQ4VfOHLoIYF3eQ9AYmr3Ie25iCdNM9E3Iz8lrs8Uo+VSogcyheHtohsg8kdcaAs2u1crbLQqdtpeHZqvYgwxpI7L/E/pp1tEGPWq/H0I3X/gB4oBOSwYzWHvWFxn2Pd+lokklbZyCHsxxLiiieNhe4dsXaQh28sdwLD+dcVG/RCjLqf2n79c738rtmsbJRlySMxgcQut/RWy0REPDYo7QYHrjkxaiyMsVzw/araNsp5M2KddVdWIPz3jlLGh/3/WtxXW8zauYz7/0FAsGGYsyEjnJJyObdncd0MIFuKRt+hCwJP75+A3cghutw96jfRhIe5S8x+pZc5I48VKrRb0IpwKu3TN9pHCBWOoP9a5zj3uCKwYjJ8j1NjS0t9iqQ8J4CGmXkN/pyFxmuaJPiXYiMJwbuMu8aQ1xLIr+yUs/wmAvALhRuhb4eVVFND2PxVHDIyxzRhCsc2M6RwHYqny5YsqPaGzI4rBRhTYxp35OQRNXFonlU7ZJwiDH/NN1ogdPluTaiTnXmQV24xpOG6yN51D1A8S0TZxYc0+GxWM++39kQOYoC+VTBEZ5DQ9LtGMP0TinD6gdvAzun1Il7ZJEFFN+KzA7dalH2idfAdiYPlEwYaTaUpI0xqqO4sEKO0AVRqmdfrOMj+ItvK88LJRftryEnNzTmjFd8fVJztTGuuZeh4sO3scbgkJwVNNw4nu61qiY3OWFjoFy78PankpmhPz0sd8Jv00K9+L2WcrhL97b7Lrt4rW+Zdecc3nshzlnw2SrNRxMCrxRqqu61uEtB2KrsgkdOF/oLAa2jNlRvIFwxuZD3BItHzh683Orjfs07zVI5aHJ9Wgc5uBwMhzsQik8oGiYq8IHd1tBG2epWY3yhavyY6mzpUpCYPQyyqkW+w8cT0Wida1lCuuz0XBXX2zHdDP9YSCMXr5BMwB/fXQkhrhPqPgmpaU3IW5kXi3mYAHXZj99BnU6r7zd9X/crWaWh30SGGxaOOcfOBdNUQmdR2kZWgocrry5/CQS0Sqe3t3QZz0kf/vLFbKY4Fg76OOk0ngpXKDEo0bd17yoLu3/a3fSysRUXL+nb3FPC2Dd5DVqRd4+NulyiuClxei3x9pJPxaJu99HgGvpb0vrOSz1u0TyCmWLPRAP7T3gNAuQIbqnLr27ZlqoBv9ieIkpBXXLwdSD4SU34trT5PywxkRY9tpH0OCGUi4RsqPKWI7+Ky4AmlnjPwrgd2pcLah6XCZEiOjltlMXEQMooISV3ppBl36RDNh93jBTHLuZO9rqx1Nj4KwIQIPXkpLepxn+WbY0VVSra5EvcGvJArPVAGXTPd0J+ZRoKoRj7KU/Bmm6+aq1KrF42G+jxqDnUw+HTSxbbVDZol9kzcl14X7RbTvZTi1WWFcf1dKILeG/9erqBXGKzoYWR24fgAfvj+S1d0QO14VEoR00zhccYcxETdIoEB4rSmZsvwWFZsX5IhpqlBBZz5BqKbpFudIF4BXczm+POz0pbx08AqJozVYkXReFbZomOIbHR7kuUH2MZPUKOVpaBm19I3tLqu4aILkUwGRkmIBbzHoVxl7yTPHI2XuSqfCx8ES3lVqmE/9xBulUsm7ND9rC0PIRpB04cyIxiFaLQTpftAEV6TmXwWOQ08V05qZ7fxMheiUX4litsjOTuC2YeKGuzyfDU5lDkY4dCO+dyTMRRRQ4mIXtAYH+Jh9XZb1Px0mVsINxmAuocXEm1bk136kf/msH+EUi0AP00OZ/vE0C51YRinPnxtuJyorfQMYs+l8P7vVu+pd9pEkOjgk+YeO5Eq5wtGS2qZEJb7hn3wbTJi0f3VxpycNa/stEPwNBvEEwp0z/MeLnzREd+E9+StBNHT2rn/P7MyVb2rYetjOpx/Gw/sBhIO3ikav36MisTUgPtyCHZLubaz9yTvxgs0StvsR1c4oHm7WqKuWVL+EY39RJg3f4DadtjpEZA+eiLHhoNAJHEhH9+Tb8gDb5QL3kZ3sWG9Jq7/YuIDuUQBPpEg1MlvtzrAdlN/kZ+y8+55jJnnjz/AGdunBKxd1oOWt3ST8HsY3QplRF96B1l50V9aNRdku480ychV0XlUuUINqxcIQ==,iv:sc4DVogQTcMdwXZZIZZMsBB9uvAWhd+Q+DvwzIk6p4M=,tag:lkCRCcsYHO7yln81w43EJA==,type:str]
 sops:
     kms: []
     gcp_kms:
         - resource_id: projects/two-eye-two-see/locations/global/keyRings/sops-keys/cryptoKeys/similar-hubs
-          created_at: "2023-07-05T15:17:39Z"
-          enc: CiUA4OM7eEmJaSPDCoUu7vlQ5IDjRhlMuVmo2uFBXuBxo1EntXxzEkkAyiwFHBZy64jJAmZWIRWh60+61EYVBPoqEzJP/2Yz8O+tlyKSk4r5n3J25XgXFxhAMJEodpfXd3qohNQgYcScTFukCzza3P3y
+          created_at: "2023-07-21T17:00:19Z"
+          enc: CiUA4OM7ePhQoduO2OVXLQZHWj5P2rxIIdvc+PDheYWgpiNqKbGXEkkAyiwFHHdw83axVZbD2yP0xoQX9PhnIJx0n9uyp6gmGLvBv1v6SMaXe9h/W998wg7WdAL60ht+x0+zJBMRHhbW/6ZrOan29G6D
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2023-07-05T15:17:40Z"
-    mac: ENC[AES256_GCM,data:t6tJO3Al3e0RBxMgOBMJVfnlbZPJbjNqPisUqCcrrUdYA3P7LpzX1bCJQAct59DHKZ5hPJvbPIFflRi2ZHKZ1JzLaZAg8n3r0dLBmsRPnGd0AXs0O3v1zki6NaXnq+XWsx+mge9zBZzgzpzk+io202xrgCUFV+emWcRUBbxugNI=,iv:oydLLO+cyRmfPelDsOFhms1MeJ9eKsEN0+r0WNHGQJc=,tag:8QvRxIYy/7x7QKykRdQ6kA==,type:str]
+    lastmodified: "2023-07-21T17:00:19Z"
+    mac: ENC[AES256_GCM,data:BPdzh5EbcRD+yObsVXm0JwPqgJrEEIY3ZJCLy0KBGtY2WRMNdX9d6+vQ3YIlXDgBBMHi9x9eSMsH0cof0nsoOwrEnjV1jK/4I8eHQqIu+2aV3y8VrXTP0A2vZylN6bZKbfmjl7IzrtyikED4DXnakVKf2hR42XowPd+cnb56zBA=,iv:bqFW+rPT1ZxJ/x4wEfbte4nKp7yiRWSI6CXuiHkGYug=,tag:tJWPIeWVbN0SCpjwAPaNIA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.7.3

config/clusters/2i2c/neurohackademy.values.yaml

@@ -1,24 +1,3 @@
-### Presently the below config does not work. We suspect that network policies
-### are blocking the authentication/OIDC discovery step. We have given
-### ourselves a one week timebox to figure this out, otherwise this config should
-### be removed and an alternative found.
-### https://github.com/2i2c-org/infrastructure/issues/2681#issuecomment-1629374195
-# dex:
-#   enabled: true
-#   hubHostName: neurohackademy.2i2c.cloud
-
-# staticWebsite:
-#   enabled: true
-#   source:
-#     git:
-#       repo: https://github.com/NeuroHackademy-2023/zoom/
-#       branch: main
-#   ingress:
-#     host: neurohackademy.2i2c.cloud
-#     path: /zoom
-#   githubAuth:
-#     enabled: true
-
 jupyterhub:
   ingress:
     hosts:
@@ -47,10 +26,17 @@ jupyterhub:
           name: The National Institutes of Health grant 2R25MH112480-06
           url: https://reporter.nih.gov/search/ydTvTwXxk0yd6eGdRznbLQ/project-details/10409452
   singleuser:
+    extraFiles:
+      gitconfig:
+        mountPath: /srv/conda/envs/notebook/etc/gitconfig
+        stringData: |
+          [credential "https://github.com"]
+          helper = !git-credential-github-app --app-key-file /etc/github/github-app-private-key.pem --app-id 356717
+          useHttpPath = true
     # User image: https://quay.io/repository/arokem/nh2023?tab=tags
     image:
       name: quay.io/arokem/nh2023
-      tag: "9aecdbb2881f"
+      tag: "894883dfb3bd"
     nodeSelector:
       2i2c.org/community: neurohackademy
     extraTolerations:
@@ -108,17 +94,3 @@ jupyterhub:
                   - value: "/git-pull?repo=https%3A%2F%2Fgithub.com%2FNeuroHackademy-2023%2Fcurriculum&urlpath=lab&branch=main"
                     title: Pull curriculum repo and redirect to /lab
                     description: Use ngbitpuller to pull https://github.com/NeuroHackademy-2023/curriculum and redirect to /lab afterwards
-    ### Presently the below config does not work. We suspect that network policies
-    ### are blocking the authentication/OIDC discovery step. We have given
-    ### ourselves a one week timebox to figure this out, otherwise this config should
-    ### be removed and an alternative found.
-    ### https://github.com/2i2c-org/infrastructure/issues/2681#issuecomment-1629374195
-    # services:
-    #   dex:
-    #     url: http://dex:5556
-    #     oauth_redirect_uri: https://neurohackademy.2i2c.cloud/services/dex/callback
-    #     oauth_no_confirm: true
-    #     display: false
-    #   oauth2-proxy:
-    #     url: http://dex:9000
-    #     display: false