Exploring Extensions from the Posit Connect Gallery (Toph Allen) | posit::conf(2025)

Hi everyone, my name's Toph, I use he and they pronouns, and I'm a software engineer on Connect. And today I'm going to be talking about the Connect Gallery. I'm going to be showing you some of the extensions that you can find there.

So I'm pretty sure that most people in the room know what Connect is, but just so we're all on the same page, Connect is a data science publishing or deployment platform that we develop here at Posit. You can deploy your data science work, so applications, dashboards, reports, APIs, that kind of thing, and share it with stakeholders, maybe in your organization.

And the gallery is a new home on Connect for example content and for extensions.

And something I'm going to be using as sort of a framing device for this is that maintaining long-lived apps is kind of tricky. And by this I mean like the things that we publish to Connect that like stick around and we don't just share once but become part of our organization's infrastructure. So some of the extensions in the gallery are designed to like help with some of the friction of this. And I'm going to go through those.

Usage metrics and knowing what's important

So one of the challenges with maintaining long-lived apps is kind of knowing what's important. So like getting a message like this, getting a Slack message from someone saying that they are checking a dashboard that we published is very validating. It means the work that I am doing is having impact, but it's just an anecdote and we really want data, right? There's some data on usage already in Connect, it turns out. It's here in the content settings pane. But this isn't really helpful for comparing across bits of content.

So in the gallery here, you would go down and install a usage metrics dashboard. I will say by the way, this is Builder's live demo. There will be a live demo later, don't worry. But I also have some screen recordings. And so in the usage metrics dashboard, you can see all of your published content, so apps, APIs, et cetera, and data on their usage.

And there are some controls in the sidebar. So I can filter for different content types or time periods or narrow the scope to just the things that I've published. And then I can dive in to a detail view for a specific piece of important content to see who's viewing it and when they're looking at it. So this hopefully helps us get a better sense of where to spend our time and energy when we're thinking about maintaining things that we have on Connect.

Content health monitoring

So there are other types of Slack messages that we might get that motivate maintenance tasks. We don't always want to get a message saying that something's down, but downtime does happen. And in this case, I would go and have to fix that dashboard. But no one really wants a notification like this. I would much rather be the first person to know if something that I'm responsible for goes down. And so we have a content health monitor, which you can point at a specific important piece of content on Connect, and it'll check to see if it's reachable. Or you can have it run on a schedule and send you an email if that thing becomes unreachable. I'll walk through setting this up a little bit later.

I would much rather be the first person to know if something that I'm responsible for goes down.

Runtime version scanner

So another thing that we need to deal with is making sure that stuff's up to date. Now, I don't know about you, but I know that I updated to a newer version of Python at some point, and I've definitely updated some of the things on Connect since I updated Python. So those things might be running Python 3.10, but there's sort of this dark matter of other things on Connect that might be running Python 3.9, and if it's removed from the server, I don't want them to go down. And so the question is, like, do I have to look at each one to figure out which version of Python is running on the server?

Turns out, so there's an extension in the gallery called the Runtime Version Scanner. And the Runtime Version Scanner, you can look at the runtimes that different bits of, that you can see all of the stuff that you've published to Connect. You can pick a version of R, Python, and or Quarto from a dropdown menu, and then see just the things that are running that version or lower. And you can also see the view count over a time period that you can select. And so that can help you prioritize the most important things and maybe highlight some things that you can just delete and not have to worry about.

Package vulnerability scanner

So one other type of maintenance task here is accounting for vulnerabilities. And I often just don't have much ambient awareness at all of if there are any vulnerabilities in the packages that I'm using. Like if I'm working on something new and I'm setting it up, like, I'll install the latest version of, you know, FastAPI or something, but I'm not necessarily going to update that whenever I'm updating this, you know, this dashboard that I'm working on, because that could cause a bug or, you know, introduces more busy work.

And so I guess there are two problems here. The first problem is just which of the things that I've got on Connect is running the version that has the vulnerability? And then just in general, how can I monitor to see if there is anything running a vulnerability? So you may be detecting a pattern here. There's a package vulnerability scanner that we have up in the gallery. And the package vulnerability scanner lets you see which of your, the things that you've published to Connect has a package which has a reported vulnerability. We actually pull in vulnerability data on packages from Posit Package Manager. And you can also dive into an individual piece of content to see details on the vulnerability itself, as well as the version of the package that it was fixed in. So now, looking at this, I'll know which bits of content I need to go update and what version of the package to update to. And even without getting a notification from someone, I can come check this to see if there are any vulnerabilities on Connect in my content.

And so just to take a quick look back, the four extensions that I've described, which are to do with package, with, I guess, maintenance of long-running apps. We've got a usage metrics dashboard, which helps us understand what's most important. We've got a content health monitor, which lets us pick an important piece of content and get alerts if it goes down. And then we have two, the runtime version scanner and the package vulnerability scanner, which help with those maintenance tasks. So I'm going to show you some of this live on a Connect, on a Connect server.

Live demo

So here I've got one of our development Connect servers, and the gallery is a new tab up at the top here, alongside everything else you are familiar with. So I'll go over to the gallery, and we've got a bunch of example stuff. So these are, when you log on to Connect, you have this window that sometimes pops up unless you tell it to stop popping up that has example content. So that all lives here now, and you can deploy it with a single click of a button. But I'm going to go over to extensions, and I'm going to install the runtime version scanner. So I'm just going to click the add button here, and it'll deploy, hopefully quickly. And I can click this button to open it. Actually, the first thing that it's going to do is it's going to give me a pop-up, and it'll ask me to add this visitor API key integration by clicking this button. Now what this does is it allows this app to use the credentials of whoever's viewing it. So if I shared the URL for this app with someone else who didn't have, say, my permissions, because I'm an admin on this server, this, and I don't necessarily want them to see all the content on the server, this will let it assume the role whoever is looking at it. I'll just click it, and it'll add it and restart.

And so it's going to load my content, and now I've got a list of everything that I've deployed to the server, along with the version of R, Python, and Quarto it runs. And I can check a box here to filter for Python. By default, the R and Python filters use the tidyverse end-of-life or the official Python end-of-life versions, but we can click the drop-down to select from any version that's detected on the server. So if I want to pick the lowest version of Python 3.10 on the server, I can see anything running below that. And say I'm only interested in updating applications and APIs, stuff that's used interactively, I can filter for that too. And if I care about view counts in the last quarter, I can select that too. I can download a CSV of my filtered data.

So if I want to monitor this bit of this, say that was a really important dashboard, it's critical for it to not go down, I'll set up the content health monitor. And so this one is going to take, it has some post-deployment steps because we need to tell it what to monitor. And then we need to also tell it what schedule to run on. And so after it is deployed and renders for the first time, I'll just let that happen. And so it has instructions on how to set it up, but I already know how to do that, so I'm not going to make you read them. I need to create an environment variable called monitored content, and it asks me for the GUID of the content I want to monitor, or just the URL. So I'll go over to the runtime version scanner, I'll copy the URL here, and paste in the URL and save it. And then I'm going to hit the render button up here. And so when I do that, it's going to go check this piece of content, and it will see if it can reach it. And so what it's doing is it's checking for an HTTP 200 status, basically. But you can actually, I'll describe more how you can configure this to check anything about this content. So if you want to have a more detailed check, as opposed to just the web page is reachable. And so yeah, this passed, so that's great. We can run it. Or we, this, you know, we can, that other piece of content ran successfully. And so I'm going to create a schedule for it. Render on a schedule. And I'm going to enable send email after update. It's only going to email me if it fails. So now that I've done this, this is going to render every day at 12 o'clock PM, and if it fails, if the content that is pointed at fails the check, it's going to send an email.

Gallery overview and open source

So those are two extensions, and that's sort of an overview of the gallery. I just have a few more slides. So just a few other quick points about the stuff that's in the gallery. So it's not just app maintenance tools. So we also have some experimental LLM content. We have a sort of chat with your content tool, and we have a publisher command center. So it's sort of an alternative view of your published apps and running processes. And the stuff that's available in the gallery, the updates and new things that we add to the gallery, will appear there and be available to install without you needing to update your Connect server. And so I guess the other point here is that these are all just like apps and reports that we've written. So anything that you can do with the stuff that you've published, you can do with these. So that includes like access controls, you know, you can add collaborators so other people who are on your Connect server can view them, and you can also download the code behind them. And actually all of this is open source. So all this is in a repo on GitHub. And I'll put the URL in bigger text in a second.

And so you can take any of the code and customize it for your own needs. You can also see how we're using our own SDKs and Connect APIs to build all this stuff. Maybe it'll inspire you to make your own tools. So for example, the content health monitor, the way that you would customize it to do your own check is it's got some instructions in the readme and then a place in the code which is sort of an anchor point for you to run any custom checks, health checks on your own content.

And here's that URL bigger. So the Connect extensions repo in the PositDev organization.

And we'd love to hear from you. We're interested in learning about the kinds of things that you would be interested to see as extensions in the gallery. We're interested in hearing about your challenges with workflows maintaining long-lived apps. And yeah, I'm going to be over in the Connect booth this afternoon, so you can come find me or any of my colleagues. Yeah, we're very interested to hear. Yeah, so that's my demo session. Thanks again.

Q&A

Thank you so much. So we'll take questions from everyone virtually in the Slido, which is in the Positron Lounge channel. But I wanted to check here in the room if anyone had questions too.

That's a really exciting extension. I'm just wondering what the best way to contact you is. For the help monitor, for example, I think that is super useful and extending out to a group of users or a group of apps would be something that would be a natural extension. Is that like a GitHub issue suggestion or is that contacting our Tama point?

Oh yeah, you can definitely, I would say the GitHub repo is a great way to get in touch. Awesome, thank you.

As I'm running over, one question that came in on Slido was, what version of Connect do you need for this to show up?

Oh, that's a good question. I think it is 2024.05, but I could be wrong there. Oh, Taylor's confirming. 2025.05. 2025.05, I believe. I think it's 2025.05, yeah.

So for your end of life monitoring, is there situations where you would recommend people remove Python packages? Because when I think about Connect, I put the code there and it's going to live forever because it's so isolated. And I'm just wondering, with this monitoring perspective, is the guidance that we should remove old versions of Python?

I don't think we have specific guidance about that. There are different organizations run their Connect servers differently, and sometimes we'll have servers that remove an old version of Python. But I don't think that's something that... I wouldn't say that the presence of the extension implies guidance that you should be doing that. I wouldn't say that.

I guess I'm slightly concerned that my organization will think that now. Because that would actually cost a lot of work for older times, for older apps. Yeah. Because people need to go through... Exactly. So yeah, you don't necessarily need to remove old versions of Python from Connect.

And it was, can customers contribute to the gallery? Like if a customer wanted to have their own internal gallery, is that a possibility?

So we don't have support for having your own separate gallery of things that you can see and install from in OneClick. In OneClick, I would say we have sort of part of the, I guess, point of connectors deploy... I guess there are two questions there. One is having your own feed. We don't have support for that right now. If that's something that would be helpful, we'd love to hear that. And then we don't have any third-party extensions in the gallery as of yet. I believe we're working on having one of those. I don't think this is something we've yet figured out whether we want to have as a general marketplace for people to submit things. But if people are interested in submitting extensions to the gallery, we'd love to hear from you. If there's interest in that, we'd love to hear about that.