Setup for self-hosted eLabFTW or DataHUB

Advanced Users

This guide is targeted to users who have a custom configuration for eLabFTW or DataHUB. It is based on the following GitHub issues:

• Using eLab2ARC with self-hosted DataHub instance
• elab2arc doesn’t work with eLabFTW instances in private networks

In case of self-hosted services behind a private network (VPN), the CORS header should be edited to allow the redirection from elab2ARC to these services.

The point of CORS header

CORS (Cross-Origin Resource Sharing) is a client-based security mechanism which prevents information from being redirected from the current HTTP service to another service. This security layer is important since it prevents credential information from being shared between web services (for more details, see Mozilla page about CORS).

Self-hosted eLabFTW instance

In the docker compose file for eLabFTW (by default in /etc/elabftw.yml), you can change the CORS header by editing the following environment variables:

services:
  # eLabFTW service
  elab:
    # ...
    # eLabFTW config
    # ...
    # Environmental variable:
    environment:
        #######################
        # NGINX CONFIGURATION #
        #######################
        # Update CORS header to allow connection to eLab2ARC
        # source: https://github.com/nfdi4plants/elab2arc/issues/43
        - ALLOW_ORIGIN=https://nfdi4plants.github.io
        - ALLOW_METHODS=GET, OPTIONS
        - ALLOW_HEADERS=Authorization, Accept, Content-Type, Origin

Self-hosted DataHUB instance

Similarly, the following CORS header needs to be edited:

• Allow Methods = GET,POST,OPTIONS
• Allow Headers = Content-Type,Authorization,X-Requested-With
• Allow Originlist = https://nfdi4plants.github.io
• Allow Credentials = true

However, DataHUB is a GitLab-based docker image and there is no easy way to edit the CORS header in GitLab (see Documenting how to setup CORS).

So here are some possible solutions:

• If using Traefik, you can set up a middleware to edit the CORS header (detailed below).
• Host a local git CORS proxy using git-cors-proxy (not tested).

With Traefik as reverse proxy, it is possible to add a middleware to edit the CORS header before it reaches DataHUB services:

services:
  datahub:
    # ...
    # DataHUB config
    # ...
    # Traefik labels:
    labels:
      # CORS header middleware
      # (https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/headers/#cors-headers)
      # Modified based on https://github.com/nfdi4plants/elab2arc/issues/54#issuecomment-4214458360
      - "traefik.http.middlewares.corsheader.headers.accesscontrolallowmethods=GET,POST,OPTIONS"
      - "traefik.http.middlewares.corsheader.headers.accesscontrolallowheaders=Content-Type,Authorization,X-Requested-With"
      - "traefik.http.middlewares.corsheader.headers.accesscontrolalloworiginlist=https://nfdi4plants.github.io"
      - "traefik.http.middlewares.corsheader.headers.accesscontrolallowcredentials=true"
      - "traefik.http.middlewares.corsheader.headers.addvaryheader=true"
      # Add the middleware to the routes
      # (https://community.traefik.io/t/traefik-not-setting-access-control-allow-origin-header/14961/3)
      - "traefik.http.routers.datahub.middlewares=corsheader"

A similar setup is probably possible with Nginx.