Airgapped Connect

Posit Connect can be run in environments with limited or no access to the Internet. This page provides guidance for configuring Connect in such environments.

Overview

A typical deployment of Posit Connect accepts requests from publishers and makes requests to package repositories and other services:

%%{init: {"look": "handDrawn" } }%%
flowchart LR
Publisher -- deploy <br> content -->   connect(Posit Connect)
connect -- get <br> packages --> repo(CRAN <br> PyPI)
connect -- load <br> apps --> gallery(Gallery)
connect -- update <br> feed --> rss(What's New)

Restricted

When Connect is run in an environment with restricted connectivity, as illustrated below:

%%{init: {"look": "handDrawn" } }%%
flowchart LR
Publisher -- deploy <br> content -->   connect(Posit Connect)
connect -- get <br> packages --> repo(CRAN <br> PyPI)

subgraph vpc[Private Network]
    direction LR
    Publisher
    connect
    repo
end

gallery(Gallery)
rss(What's New)

• Publishers must continue to have network access to the Connect server.
• Connect must be able to reach a package repository to fetch packages as it reconstructs application environments.
  • Posit Package Manager and other commercial or open source altenatives enable you to run your own repository within your environment.
  • Alternatively, it is possible to disable Connect’s environment management features. This can make application deployment more difficult.
• Some default Connect behaviors can be disabled to suppress warnings that might appear in logs or other clients.

Configuration

To suppress warnings that may appear in the Connect UI or logs, it is recommended that the following configuration settings be disabled:

• Server.WhatsNewEnabled Allows Connect to fetch in-product updates about new releases and funtionality.
• Server.GalleryEnabled Allows applications to be deployed from the Connect Gallery.
• Server.ProductCheck Periodically makes a request to a Posit server.
• Set RPackageRepository to the address of a CRAN-like repository accessible from your private network, or disable R environment management
• Create a configuration file for pip at /etc/pip.conf and set the global.index-url to a PyPI-like repository accessible from your private network, or disable Python package management.

Example configuration

/etc/rstudio/rstudio-connect.gcfg

[Server]
GalleryEnabled = false
WhatsNewEnabled = false
ProductCheck = false

[RPackageRepository "CRAN"]
URL = "http://posit-package-manager.example.com/cran"

/etc/pip.conf

[global]
index-url = https://posit-package-manager.example.com/pypi