Collab Services: 11 Scientific Computing Tools Join openDesk Edu

openDesk Edu has landed its largest feature update yet. Collab Services — Phase A of a three-phase initiative — adds 11 open-source scientific computing tools to the platform, transforming it from a productivity-and-LMS system into a full digital research environment for universities and research institutions.

The new tools cover interactive notebooks, collaborative LaTeX, browser-based IDEs, local AI assistants, distributed computing, and more. All are deployed via Helmfile on Kubernetes, integrated with Keycloak single sign-on, and share Let's Encrypt TLS through HAProxy ingress.

What's Being Added

Category	Tool	Function	Status	Subdomain
Computing	JupyterHub	Multi-user notebooks (Python, R, Julia, SageMath, Octave)	✅ Stable	jupyter.*
	code-server	VS Code in the browser	✅ Stable	code.*
	RStudio Server	R IDE with Shiny app support	🟡 Beta	r.*
	Dask Gateway	Distributed parallel computing clusters	🔵 Planned	compute.*
Editing	Overleaf CE	Collaborative real-time LaTeX	✅ Stable	latex.*
	Slidev	Markdown-to-presentations	🟡 Beta	slides.*
AI	Open WebUI	ChatGPT-like interface for local LLMs	🟡 Beta	ai.*
	Ollama	Local LLM backend (llama3.2, nomic-embed-text)	🟡 Beta	—
Visualization	Excalidraw	Collaborative whiteboard	✅ Stable	—
Infrastructure	ttyd	Browser-based Linux terminal	✅ Stable	term.*
	KasmVNC	Full Linux desktop in the browser	🟡 Beta	desktop.*

Each service gets its own subdomain under the institution's wildcard DNS — jupyter.uni-marburg.de, r.uni-marburg.de, latex.uni-marburg.de, and so on — routed through HAProxy ingress with automatic Let's Encrypt TLS certificates.

Why This Matters

openDesk Edu already provided learning management (ILIAS, Moodle), video conferencing (BigBlueButton, Jitsi), file sync (Nextcloud, OpenCloud), and productivity tools (Collabora, XWiki, OpenProject). What was missing was the interactive computing infrastructure that platforms like CoCalc offer to universities.

Collab Services closes that gap. Students and researchers can now:

• Run Jupyter notebooks with Python, R, Julia, SageMath, and GNU Octave kernels
• Write collaborative LaTeX documents in real time with Overleaf CE
• Develop R scripts and Shiny applications in a dedicated IDE
• Code in VS Code from any device with no local installation
• Chat with private LLMs through Open WebUI, powered by Ollama
• Access a full Linux terminal or desktop environment from a browser
• Create presentations from Markdown with Slidev
• Submit distributed computing jobs to a Dask Gateway cluster

All without leaving the openDesk Edu ecosystem and without provisioning any additional infrastructure.

Architecture

The deployment follows openDesk Edu's established conventions. All tools live in helmfile/apps/ as a new app group alongside the existing education and productivity services.

Repository Structure

opendesk-edu/
├── helmfile/apps/
│   ├── jupyterhub/          # Upstream chart (hub.jupyter.org)
│   ├── overleaf/            # Upstream chart (ghcr.io/sharelatex)
│   ├── open-webui/          # Upstream chart (helm.openwebui.com)
│   ├── ollama/              # Upstream chart (ollama.github.io)
│   ├── code-server/         # Upstream chart (helm.coder.com)
│   ├── kasmvnc/             # Upstream chart (registry.kasmweb.com)
│   ├── dask/                # Upstream chart (helm.dask.org)
│   ├── rstudio/             # Custom local chart
│   ├── ttyd/                # Custom local chart
│   ├── slidev/              # Custom local chart
│   └── collab-dashboard/    # Custom local chart + React SPA
├── helmfile/charts/
│   ├── rstudio/             # Deployment + Service + Ingress + PVC
│   ├── ttyd/                # Deployment + Service + Ingress
│   ├── slidev/              # Init container + nginx + PVC
│   ├── collab-dashboard/    # nginx serving React SPA
│   └── opencloud-sidecar/   # rclone-based file sync sidecar
└── collab-dashboard/        # React app source (Vite + TypeScript + Tailwind)
    ├── src/
    │   ├── data/tools.ts    # Feature catalog data model
    │   ├── components/
    │   │   ├── CardGrid.tsx
    │   │   └── ToolCard.tsx
    │   └── pages/Home.tsx
    ├── package.json
    ├── vite.config.ts
    └── Dockerfile

Seven tools use upstream Helm charts directly. Four tools required custom charts because no production-quality Helm charts existed:

Custom Chart	Image	Port	Storage	Auth
rstudio	rocker/rstudio:4.4.2	8787	10Gi PVC	oauth2-proxy
ttyd	tsl0922/ttyd:1.7.7	7681	—	oauth2-proxy
slidev	ghcr.io/slidevjs/slidev:0.49.0 → nginx:alpine	80	1Gi PVC	oauth2-proxy
collab-dashboard	weissto/collab-dashboard (custom build)	80	—	oauth2-proxy

Deployment Order

The helmfile groups releases by stage to respect dependency chains:

Stage	Releases
010-infra	ollama (LLM backend — must be running before Open WebUI)
050-components	jupyterhub, overleaf, open-webui, rstudio, code-server, ttyd, kasmvnc, dask, slidev
060-frontend	collab-dashboard (depends on services being available)

Single Sign-On Architecture

All services authenticate through Keycloak using one of two patterns:

Pattern 1: oauth2-proxy sidecar — A reverse proxy sidecar injected into the same pod as RStudio, ttyd, Slidev, code-server, and the Collab Dashboard. The sidecar intercepts all incoming HTTP traffic on port 4180, redirects unauthenticated users to Keycloak's OIDC endpoint, and proxies authenticated requests to the application container on its local port.

Pattern 2: Native OIDC — JupyterHub uses OAuthenticator with the GenericOAuthenticator class, and Open WebUI has built-in OIDC support. Both point directly at Keycloak's standard OIDC endpoints (/realms/opendesk/protocol/openid-connect/...).

In the production environment at Philipps-Universität Marburg, Keycloak is configured with an Identity Provider Redirector that auto-forwards to Shibboleth SAML. The result is a seamless authentication chain:

User → Service (e.g. RStudio)
  → oauth2-proxy redirects to Keycloak
    → Keycloak auto-redirects to Shibboleth SAML
      → University login (weblogin.uni-marburg.de)
        → SAML assertion → Keycloak OIDC token
          → Authenticated access to RStudio

Users authenticate once with their university credentials and gain access to all 11 tools without re-authentication.

OpenCloud Storage Integration

RStudio also received an OpenCloud WebDAV sidecar. The sidecar uses rclone to mount the user's OpenCloud files into the RStudio workspace, giving R users direct access to their file sync storage from within the IDE:

opencloud:
  enabled: true
  url: "https://opencloud.example.com"
  username: "demo"
  password: "demo"
  syncInterval: "60s"

The same opencloud-sidecar pattern is planned for code-server and ttyd.

The Collab Dashboard

A custom React SPA — built with Vite, TypeScript, and Tailwind CSS — sits at collab.* and serves as a feature catalog. It maps each CoCalc feature to its open-source Kubernetes-native alternative:

export const tools: CollabTool[] = [
  {
    id: 'jupyterhub',
    name: 'JupyterHub',
    description: 'Multi-user notebooks with kernels for Python, R, Julia, SageMath, and Octave.',
    coCalcFeature: '↔ Jupyter Notebooks',
    category: 'computing',
    status: 'stable',
  },
  {
    id: 'overleaf',
    name: 'Overleaf CE',
    coCalcFeature: '↔ Collaborative LaTeX',
    category: 'editing',
    status: 'stable',
  },
  // ... 9 more tools
];

The dashboard is served by an nginx container and protected behind the same oauth2-proxy sidecar, ensuring only authenticated users can browse the service catalog.

How to Deploy

Collab Services is part of the main branch on Codeberg. Deploy alongside the rest of openDesk Edu with Helmfile selectors:

# Deploy a single tool
helmfile -e prod apply --selector name=rstudio

# Deploy the LLM backend first, then the AI interface
helmfile -e prod apply --selector name=ollama
helmfile -e prod apply --selector name=open-webui

# Deploy everything at once
helmfile -e prod apply

For standalone deployments outside the Helmfile orchestration, each custom chart supports direct Helm installs:

helm upgrade --install rstudio ./helmfile/charts/rstudio \
  --namespace opendesk-edu \
  --set ingress.hosts[0].host=r.${DOMAIN} \
  --set oauth2.enabled=true \
  --set oauth2.clientSecret=${CLIENT_SECRET} \
  --set oauth2.cookieSecret=$(openssl rand -hex 16) \
  --set oauth2.oidcIssuerUrl=https://id.${DOMAIN}/realms/opendesk

For JupyterHub with native OIDC:

helm upgrade --install jupyterhub jupyterhub/jupyterhub \
  --namespace opendesk-edu \
  --set ingress.enabled=true \
  --set ingress.hosts[0]=jupyter.${DOMAIN} \
  --set hub.config.GenericOAuthenticator.client_id=opendesk-jupyterhub \
  --set hub.config.GenericOAuthenticator.client_secret=${JH_CLIENT_SECRET} \
  --set hub.config.GenericOAuthenticator.oauth_callback_url=https://jupyter.${DOMAIN}/hub/oauth_callback \
  --set hub.config.GenericOAuthenticator.authorize_url=https://id.${DOMAIN}/realms/opendesk/protocol/openid-connect/auth

Keycloak OIDC clients must be created for each service before enabling authentication. See the OAuth2-proxy configuration guide for details.

Verification

A smoke test script (scripts/smoke-test.sh) verifies all services respond correctly. Actual results from the HRZ cluster at Universität Marburg on 28 May 2026:

=== Collab Services Smoke Test ===
Domain: opendesk.hrz.uni-marburg.de | Ingress: 192.168.3.201

  ✅ RStudio (r) → HTTP 302
  ✅ ttyd (term) → HTTP 302
  ✅ Dashboard (collab) → HTTP 302
  ✅ Slidev (slides) → HTTP 200
  ✅ Open WebUI (ai) → HTTP 200
  ✅ JupyterHub (jupyter) → HTTP 302
  ✅ code-server (code) → HTTP 302

  Plus existing services:
  ✅ ILIAS (lms) → HTTP 200
  ✅ Moodle (moodle) → HTTP 200

✅ Smoke test complete — all 9 services operational

All five custom charts additionally pass dedicated Helm test connectivity checks using nc -z (TCP port probing):

$ helm test rstudio -n opendesk-edu          → ✅ Succeeded
$ helm test ttyd -n opendesk-edu             → ✅ Succeeded
$ helm test slidev -n opendesk-edu           → ✅ Succeeded
$ helm test collab-dashboard -n opendesk-edu → ✅ Succeeded
$ helm test code-server -n opendesk-edu      → ✅ Succeeded

What's Next: Phase B and Phase C

Collab Services is planned in three phases. Phase A (Foundation) is complete. Two more phases are on the roadmap.

Phase B — Core Tools Refinement

• Full JupyterHub profiles for SageMath, Octave, and Julia kernels via singleuser image profiles
• Overleaf CE with persistent storage and real-time collaboration tuning
• Deeper Open WebUI + Ollama integration with model management via the Ollama API
• Production values tuning based on pilot user feedback

Phase C — Remaining Tools and Polish

• KasmVNC and Dask with full production-ready configuration
• Portal tiles in the Nubus navigation for all 11 services
• Feature detail pages in the React dashboard (per-tool routes with documentation)
• OpenCloud sidecar rollout to code-server and ttyd
• Resource quota recommendations for each tool

Getting Involved

Collab Services is open-source (Apache 2.0) and part of the opendesk-edu/opendesk-edu repository on Codeberg. The repository is bidirectionally mirrored to GitHub.

Useful links:

• Deployment guide — step-by-step instructions for each tool
• Design spec — full architecture and CoCalc feature map
• OAuth2-proxy config — Keycloak client setup for each service
• Implementation plan — detailed task breakdown for Phase A

Deploy today:

git clone https://codeberg.org/opendesk-edu/opendesk-edu.git
cd opendesk-edu
helmfile -e prod apply --selector name=jupyterhub

Questions, bug reports, and contributions are welcome via Codeberg Issues or the Matrix channel.

---

openDesk Edu is an open-source digital workplace platform for higher education. It extends openDesk Community Edition with learning management, video conferencing, file sync, and now scientific computing tools — all on Kubernetes with unified single sign-on. Licensed under Apache 2.0.

This project is developed at the Hochschulrechenzentrum (HRZ) of Philipps-Universität Marburg as part of the university's digital sovereignty strategy.