How to enable SSL/HTTPS on bokeh 0.12.5?

Question

I have created a simple Bokeh app that runs successfully via bokeh serve. I was then asked whether it could be re-deployed using HTTPS instead. The client already has an SSL certificate, and the app is only accessed within their intranet. Most search results are for deployments behind a proxy server like Apache or Nginx. Are those required for us to setup SSL? Can it be done on Bokeh natively?

Answer 1

Bokeh Server does not have any SSL capability built in. If you want that, you will need to deploy behind a proxy such as Nginx that can terminate the SSL connections. There is a description of the setup required in te User's Guide section Reverse Proxying with Nginx and SSL. The gist is that you need to start the Bokeh server itself with the --use-xheaders option, and then have an Nginx config similar to:

location / {
        proxy_pass http://127.0.0.1:5100;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host:$server_port;
        proxy_buffering off;
    }

It's probably the case that other proxies will work as well, as long as they can also proxy websockets.