Neverfinished Dockerfile for jupyterhub with selected plugins/extensions. Using this nginx config and jupyter_conf.py I can guarantee that it is going to work on a Ubuntu server, on a subdomain.

Dockerfile

############
### We must build our own image, conda is a no go
# https://gist.github.com/affixalex/97bc870e478b4f77a161e5fb2d63ec6d
# https://hub.docker.com/r/jupyterhub/jupyterhub/dockerfile
#######
FROM jupyterhub/jupyterhub:latest

USER root

RUN pip3 install oauthenticator ipywidgets nbdime ipyleaflet ipympl jupyterlab-git jupyterlab_sql jupyterlab_code_formatter \
         black autopep8 bokeh numpy scipy matplotlib ipython jupyter pandas sympy nose scikit-learn scrapy seaborn \
         statsmodels ipysheet jupyterlab-dash jupyter_contrib_nbextensions matlab_kernel
         
# install ocalm (kernel) and R kernel
RUN apt install -y nodejs ocaml-nox libzmq3-dev

RUN opam install iocaml

RUN jupyter labextension install @jupyterlab/hub-extension
RUN jupyter labextension install @jupyterlab/geojson-extension
RUN jupyter labextension install @jupyter-widgets/jupyterlab-manager
RUN jupyter nbextension enable --py widgetsnbextension
RUN jupyter labextension install jupyter-leaflet
RUN jupyter labextension install jupyter-matplotlib
RUN jupyter labextension install @jupyterlab/git
RUN jupyter serverextension enable --py jupyterlab_git
RUN jupyter labextension install @jupyterlab/toc
RUN jupyter labextension install jupyterlab_voyager
RUN jupyter labextension install @jupyterlab/mathjax3-extension
RUN jupyter labextension install @jupyterlab/plotly-extension
RUN jupyter labextension install jupyterlab-dash

RUN jupyter serverextension enable jupyterlab_sql --py --sys-prefix
RUN jupyter labextension install jupyterlab_bokeh
RUN jupyter labextension install @ryantam626/jupyterlab_code_formatter
RUN jupyter serverextension enable --py jupyterlab_code_formatter


RUN jupyter lab build

jupyterhub_config.py

## The URL on which the Hub will listen. This is a private URL for internal
#  communication. Typically set in combination with hub_connect_url. If a unix
#  socket, hub_connect_url **must** also be set.
#  
#  For example:
#  
#      "http://127.0.0.1:8081"
#      "unix+http://%2Fsrv%2Fjupyterhub%2Fjupyterhub.sock"
#  
#  .. versionadded:: 0.9
c.JupyterHub.hub_bind_url = 'http://127.0.0.1:8741'

## The internal port for the Hub process.
#  
#  This is the internal port of the hub itself. It should never be accessed
#  directly. See JupyterHub.port for the public port to use when accessing
#  jupyterhub. It is rare that this port should be set except in cases of port
#  conflict.
#  
#  See also `hub_ip` for the ip and `hub_bind_url` for setting the full bind URL.
#c.JupyterHub.hub_port = 8741


## The ip address for the Hub process to *bind* to.
#  
#  By default, the hub listens on localhost only. This address must be accessible
#  from the proxy and user servers. You may need to set this to a public ip or ''
#  for all interfaces if the proxy or user servers are in containers or on a
#  different host.
#  
#  See `hub_connect_ip` for cases where the bind and connect address should
#  differ, or `hub_bind_url` for setting the full bind URL.
#c.JupyterHub.hub_ip = ''


##################################################################################

## The public facing ip of the whole JupyterHub application (specifically
#  referred to as the proxy).
#  
#  This is the address on which the proxy will listen. The default is to listen
#  on all interfaces. This is the only address through which JupyterHub should be
#  accessed by users.
#  
#  .. deprecated: 0.9
#      Use JupyterHub.bind_url
#c.JupyterHub.ip = ''

## The public facing port of the proxy.
#  
#  This is the port on which the proxy will listen. This is the only port through
#  which JupyterHub should be accessed by users.
#  
#  .. deprecated: 0.9
#      Use JupyterHub.bind_url
#c.JupyterHub.port=8741
c.JupyterHub.bind_url = 'http://127.0.0.1:8456'

## The ip or hostname for proxies and spawners to use for connecting to the Hub.
#  
#  Use when the bind address (`hub_ip`) is 0.0.0.0 or otherwise different from
#  the connect address.
#  
#  Default: when `hub_ip` is 0.0.0.0, use `socket.gethostname()`, otherwise use
#  `hub_ip`.
#  
#  Note: Some spawners or proxy implementations might not support hostnames.
#  Check your spawner or proxy documentation to see if they have extra
#  requirements.
#  
#  .. versionadded:: 0.8
#c.JupyterHub.hub_connect_ip = '0.0.0.0'

## DEPRECATED
#  
#  Use hub_connect_url
#  
#  .. versionadded:: 0.8
#  
#  .. deprecated:: 0.9
#      Use hub_connect_url
#c.JupyterHub.hub_connect_port = 0

## The URL for connecting to the Hub. Spawners, services, and the proxy will use
#  this URL to talk to the Hub.
#  
#  Only needs to be specified if the default hub URL is not connectable (e.g.
#  using a unix+http:// bind url).
#  
#  .. seealso::
#      JupyterHub.hub_connect_ip
#      JupyterHub.hub_bind_url
#  
#  .. versionadded:: 0.9
#c.JupyterHub.hub_connect_url = 'http://127.0.0.1:8741'



## Shuts down all user servers on logout
c.JupyterHub.shutdown_on_logout = True

c.Application.log_level = 'DEBUG'

c.JupyterHub.admin_access = True
c.NotebookApp.allow_root=True

#c.JupyterHub.authenticator_class = 'jupyterhub.auth.PAMAuthenticator'

#c.JupyterHub.allow_named_servers = True

#c.JupyterHub.concurrent_spawn_limit = 0

#c.JupyterHub.cleanup_proxy = True
#c.JupyterHub.cleanup_servers = True

#c.JupyterHub.proxy_class = 'jupyterhub.proxy.ConfigurableHTTPProxy'
c.JupyterHub.authenticator_class = 'dummy'
#c.JupyterHub.spawner_class = 'simple'
c.JupyterHub.spawner_class = 'systemdspawner.SystemdSpawner'

c.Spawner.start_timeout = 300
c.ConfigurableHTTPProxy.debug = True
# https://github.com/jupyterhub/systemdspawner/
c.SystemdSpawner.dynamic_users = True

c.Spawner.notebook_dir = '~'

## The IP address (or hostname) the single-user server should listen on.
#  
#  The JupyterHub proxy implementation should be able to send packets to this
#  interface.
c.Spawner.ip = '127.0.0.1'
#c.Spawner.port = 9632
c.Spawner.debug = True
c.Spawner.default_url = '/lab'
c.LocalProcessSpawner.debug = True
c.Spawner.start_timeout = 300
c.Spawner.cmd = ['jupyter-labhub']

c.Authenticator.whitelist = {'jm', 'alm'}
c.Authenticator.admin_users = {'jm', 'alm'}

nginx_conf

server {
    listen 80;
    listen 443 ssl http2;

    server_name xxxxxx www.xxxxxxxxxxxxx;

    location / {
        proxy_pass http://127.0.0.1:8456;
        client_max_body_size 0;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-User $http_authorization;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;

        proxy_http_version 1.1;
        #proxy_redirect off;
        #proxy_buffering off;
        #proxy_read_timeout 86400;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        #proxy_max_temp_file_size 0;

        client_body_buffer_size    128k;
        proxy_connect_timeout      90;
        proxy_send_timeout         90;
        proxy_read_timeout         90;
        proxy_buffer_size          4k;
        proxy_buffers              4 32k;
        proxy_busy_buffers_size    64k;
        proxy_temp_file_write_size 64k;
    }

    location ~* /(api/kernels/[^/]+/channels|terminals/websocket)/? {
        proxy_pass http://127.0.0.1:8456;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_http_version 1.1;
        proxy_set_header Upgrade "websocket";
        proxy_set_header Connection "Upgrade";
        proxy_read_timeout 86400;
    }

    if ($http_x_forwarded_proto = "http") {
      return 301 https://$server_name$request_uri;
    }

    ssl_certificate /etc/letsencrypt/live/xxxxxxx/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/xxxxxxxxxx/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}