Sam Cofer samcofer

Relocating Posit Workbench configuration out of /etc/rstudio with XDG_CONFIG_DIRS / RSTUDIO_CONFIG_DIR (single-server)

Relocating Posit Workbench configuration out of `/etc/rstudio`

Posit Workbench reads its server configuration from /etc/rstudio by default. On many deployments you want that configuration to live somewhere else — a shared or replicated mount, a read-only config volume baked by configuration management, or simply a path your organization controls outside /etc. Workbench supports this through the XDG Base Directory mechanism, and once it's set up you can move every config file out of /etc/rstudio and run an identical Workbenc

Posit Workbench + S3 Access Grants via Web-Identity Federation on Amazon EKS

Posit Workbench can hand each user their own AWS IAM role at session start, without any static keys, by federating the OIDC login the user already did into AWS via web-identity federation. This guide takes that one step further and uses that per-user role to reach S3 through AWS S3 Access Grants, so the credentials that actually touch a bucket are short-lived, scoped to a single prefix, and never live on disk or in code.

Karpenter for Posit Workbench on Amazon EKS

Karpenter is a node autoscaler for Kubernetes that provisions right-sized EC2 instances on demand, in response to pending pods, and removes them when they are no longer needed. On an EKS cluster running Posit Workbench, this is a good fit for the bursty nature of interactive sessions: a data scientist launches a session, Karpenter brings up a node to hold it, and the node goes away after the session ends. You pay for session capacity while it is in use instead of running a fleet of half-idle nodes all day.

	#!/usr/bin/env bash
	#
	# wb-access-logrotate.sh
	#
	# Installs a logrotate rule for the Posit Workbench HTTP access log
	# (server-access-log=1 in /etc/rstudio/rserver.conf), keeping 14 days of
	# daily rotations. Then forces two rotations (5s apart) to prove it works.
	#
	# Scope: logrotate only. Assumes Workbench is installed and
	# server-access-log is already enabled. Tested on Ubuntu 24.04.

	license:
	key: XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX # TODO: Replace with your Posit Connect license key
	sharedStorage:
	create: true
	mount: true
	storageClassName: fsx-sc
	requests:
	storage: 1Gi # This is required to allow for a volume to be provisioned from FSx OpenZFS

	ingress:

	#Requires -Version 7.0
	$ErrorActionPreference = 'Stop'

	# --- Helper functions ---

	function Prompt-Value {
	param(
	[string]$Name,
	[string]$Label,
	[string]$Default = '',

	#!/usr/bin/env bash
	set -euo pipefail

	need() { command -v "$1" >/dev/null \|\| { echo "Missing required command: $1"; exit 1; }; }
	need az
	need jq

	normalize_yesno() {
	case "${1,,}" in
	y\|yes) echo "Yes" ;;

	# Start from the RStudio Workbench base image
	FROM rstudio/rstudio-workbench:jammy

	# Set repository options globally for all R sessions
	RUN echo 'options(repos = c( CRAN = "https://packagemanager.posit.co/cran/__linux__/jammy/latest", CRAN_20240401 = "https://packagemanager.posit.co/cran/__linux__/jammy/2024-04-01", BioCsoft = "https://bioconductor.org/packages/3.13/bioc", BioCann = "https://bioconductor.org/packages/3.13/data/annotation", BioCexp = "https://bioconductor.org/packages/3.13/data/experiment", BioCworkflows = "https://bioconductor.org/packages/3.13/workflows" ))' > /opt/R/4.4.1/lib/R/etc/Rprofile.site

	# Install pak for efficient dependency resolution
	RUN /opt/R/4.4.1/bin/Rscript -e 'install.packages("pak", repos = "https://packagemanager.posit.co/cran/__linux__/jammy/latest")'

	# Install required R packages using pak

	# Use SSH key if on Connect, otherwise use managed credentials
	if (Sys.getenv("RSTUDIO_PRODUCT") == "CONNECT"){
	# grab ssh key from environment variable and cache as tempfile
	cached_key <- tempfile()
	readr::write_file(openssl::base64_decode(Sys.getenv("SNOWFLAKE_SSH_KEY")), file = cached_key)

	# The ambient credential feature in odbc::snowflake() causes unexpected overwrites, so we'll use the base Snowflake driver.
	con <- dbConnect(
	odbc::odbc(),
	driver = "Snowflake",

	#!/bin/bash

	# LDAP Connection details
	LDAP_SERVER="ldap://cofer.me"
	BIND_DN="CN=ldap-bind,CN=Users,DC=cofer,DC=me"
	PASSWORD="password"
	BASE_DN="DC=cofer,DC=me"

	# Output CSV file
	OUTPUT_FILE="ad-users.csv"