Merge branch '16265-security-updates' into dependabot/bundler/apps/workbench/loofah...

[arvados.git] / doc / install / install-workbench-app.html.textile.liquid

diff --git a/doc/install/install-workbench-app.html.textile.liquid b/doc/install/install-workbench-app.html.textile.liquid
index cf33cca3586837276a50caa20765874473be618f..3d391724dc1e619590c97cb0bb47c25971e6e05d 100644 (file)
--- a/doc/install/install-workbench-app.html.textile.liquid
+++ b/doc/install/install-workbench-app.html.textile.liquid
@@ -12,10 +12,10 @@ SPDX-License-Identifier: CC-BY-SA-3.0
 # "Install dependencies":#dependencies
 # "Update config.yml":#update-config
 # "Update Nginx configuration":#update-nginx
+# "Trusted client flag":#trusted_client
 # "Install arvados-workbench":#install-packages
 # "Restart the API server and controller":#restart-api
 # "Confirm working installation":#confirm-working
-# "Trusted client setting":#trusted_client
 
 h2(#dependencies). Install dependencies
 
@@ -25,12 +25,12 @@ h2(#dependencies). Install dependencies
 
 h2(#configure). Update config.yml
 
-Edit @/etc/arvados/config.yml@ to set the keys below.  The full set of configuration options are in the "Workbench section of config.yml":{{site.baseurl}}/admin/config.html
+Edit @config.yml@ to set the keys below.  The full set of configuration options are in the "Workbench section of config.yml":{{site.baseurl}}/admin/config.html
 
 <notextile>
 <pre><code>    Services:
-      Workbench:
-        ExternalURL: <span class="userinput">"https://workbench.ClustedID.example.com"</span>
+      Workbench1:
+        ExternalURL: <span class="userinput">"https://workbench.ClusterID.example.com"</span>
     Workbench:
       SecretKeyBase: <span class="userinput">aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa</span>
     Users:
@@ -52,11 +52,17 @@ You probably want to enable @Users.AutoAdminFirstUser@ .  The first user to log
 
 h2(#update-nginx). Update nginx configuration
 
-Use a text editor to create a new file @/etc/nginx/conf.d/arvados-workbench.conf@ with the following configuration.  Options that need attention are marked with "TODO".
+Use a text editor to create a new file @/etc/nginx/conf.d/arvados-workbench.conf@ with the following configuration.  Options that need attention are marked in <span class="userinput">red</span>.
 
 <notextile>
 <pre><code>server {
-  listen       <span class="userinput">[your public IP address]</span>:443 ssl;
+    listen       80;
+    server_name  workbench.<span class="userinput">ClusterID.example.com</span>;
+    return 301   https://workbench.<span class="userinput">ClusterID.example.com</span>$request_uri;
+}
+
+server {
+  listen       *:443 ssl;
   server_name  workbench.<span class="userinput">ClusterID.example.com</span>;
 
   ssl on;
@@ -77,49 +83,25 @@ Use a text editor to create a new file @/etc/nginx/conf.d/arvados-workbench.conf
 </code></pre>
 </notextile>
 
-h2(#install-packages). Install arvados-workbench
-
-h3. Centos 7
+h2(#trusted_client). Trusted client flag
 
-<notextile>
-<pre><code># <span class="userinput">yum install arvados-workbench</span>
-</code></pre>
-</notextile>
+In the <strong>API server</strong> project root, start the Rails console.  {% include 'install_rails_command' %}
 
-h3. Debian and Ubuntu
+Create an ApiClient record for your Workbench installation with the @is_trusted@ flag set.
 
-<notextile>
-<pre><code># <span class="userinput">apt-get --no-install-recommends install arvados-workbench</span>
+<notextile><pre><code>irb(main):001:0&gt; <span class="userinput">include CurrentApiClient</span>
+=&gt; true
+irb(main):002:0&gt; <span class="userinput">act_as_system_user do ApiClient.create!(url_prefix: "https://workbench.ClusterID.example.com/", is_trusted: true) end</span>
+=&gt; #&lt;ApiClient id: 2, uuid: "...", owner_uuid: "...", modified_by_client_uuid: nil, modified_by_user_uuid: "...", modified_at: "2019-12-16 14:19:10", name: nil, url_prefix: "https://workbench.ClusterID.example.com/", created_at: "2019-12-16 14:19:10", updated_at: "2019-12-16 14:19:10", is_trusted: true&gt;
 </code></pre>
 </notextile>
 
-h2(#restart-api). Restart the API server and controller
+{% assign arvados_component = 'arvados-workbench' %}
 
-After adding Workbench to the Services section, make sure the cluster config file is up to date on the API server host, and restart the API server and controller processes to ensure the changes are applied.
+{% include 'install_packages' %}
 
-<notextile>
-<pre><code># <span class="userinput">systemctl restart nginx arvados-controller</span>
-</code></pre>
-</notextile>
+{% include 'restart_api' %}
 
 h2(#confirm-working). Confirm working installation
 
 Visit @https://workbench.ClusterID.example.com@ in a browser.  You should be able to log in using the login method you configured in the previous step.  If @Users.AutoAdminFirstUser@ is true, you will be an admin user.
-
-h2(#trusted_client). Trusted client flag
-
-Log in to Workbench once to ensure that the Arvados API server has a record of the Workbench client. (It's OK if Workbench says your account hasn't been activated yet. We'll deal with that next.)
-
-In the <strong>API server</strong> project root, start the Rails console.  {% include 'install_rails_command' %}
-
-At the console, enter the following commands to locate the ApiClient record for your Workbench installation (typically, while you're setting this up, the @last@ one in the database is the one you want), then set the @is_trusted@ flag for the appropriate client record:
-
-<notextile><pre><code>irb(main):001:0&gt; <span class="userinput">wb = ApiClient.all.last; [wb.url_prefix, wb.created_at]</span>
-=&gt; ["https://workbench.example.com/", Sat, 19 Apr 2014 03:35:12 UTC +00:00]
-irb(main):002:0&gt; <span class="userinput">include CurrentApiClient</span>
-=&gt; true
-irb(main):003:0&gt; <span class="userinput">act_as_system_user do wb.update_attributes!(is_trusted: true) end</span>
-=&gt; true
-</code></pre>
-</notextile>
-