X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/38a0f5e77f2190487d03d6538337d3b7055fd1e8..6d5d0c69464455b8be6dac693ebfd383fc1bcee3:/lib/config/config.default.yml diff --git a/lib/config/config.default.yml b/lib/config/config.default.yml index f62c483f46..5862309d14 100644 --- a/lib/config/config.default.yml +++ b/lib/config/config.default.yml @@ -22,51 +22,76 @@ Clusters: Services: - # In each of the service sections below, the keys under - # InternalURLs are the endpoints where the service should be - # listening, and reachable from other hosts in the cluster. - SAMPLE: - InternalURLs: - "http://host1.example:12345": {} - "http://host2.example:12345": - # Rendezvous is normally empty/omitted. When changing the - # URL of a Keepstore service, Rendezvous should be set to - # the old URL (with trailing slash omitted) to preserve - # rendezvous ordering. - Rendezvous: "" - SAMPLE: - Rendezvous: "" - ExternalURL: "-" + # Each of the service sections below specifies ListenAddress, + # InternalURLs, and ExternalURL. + # + # InternalURLs specify how other Arvados service processes will + # connect to the service. Typically these use internal hostnames + # and high port numbers. Example: + # + # InternalURLs: + # "http://host1.internal.example:12345": {} + # "http://host2.internal.example:12345": {} + # + # ListenAddress specifies the address and port the service + # process's HTTP server should listen on. Example: + # + # ListenAddress: "0.0.0.0:12345" + # + # If ListenAddress is blank, the service will try listening on + # the host:port part of each InternalURLs entry until one + # works. This approach only works if the host names resolve (via + # /etc/hosts, DNS, etc) to the IP addresses of the host's + # network interfaces. + # + # ExternalURL specifies how applications/clients will connect to + # the service, regardless of whether they are inside or outside + # the cluster. Example: + # + # ExternalURL: "https://keep.zzzzz.example.com/" + # + # To avoid routing internal traffic through external networks, + # use split-horizon DNS for ExternalURL host names: inside the + # cluster's private network "host.zzzzz.example.com" resolves to + # the host's private IP address, while outside the cluster + # "host.zzzzz.example.com" resolves to the host's public IP + # address (or its external gateway or load balancer). RailsAPI: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "-" Controller: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "" Websocket: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "" Keepbalance: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "-" GitHTTP: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "" GitSSH: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "" DispatchCloud: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "-" - SSO: - InternalURLs: {} - ExternalURL: "" Keepproxy: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "" WebDAV: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} # Base URL for Workbench inline preview. If blank, use # WebDAVDownload instead, and disable inline preview. # If both are empty, downloading collections from workbench @@ -105,7 +130,8 @@ Clusters: ExternalURL: "" WebDAVDownload: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} # Base URL for download links. If blank, serve links to WebDAV # with disposition=attachment query param. Unlike preview links, # browsers do not render attachments, so there is no risk of XSS. @@ -119,13 +145,22 @@ Clusters: ExternalURL: "" Keepstore: - InternalURLs: {} + ListenAddress: "" + InternalURLs: + SAMPLE: + # Rendezvous is normally empty/omitted. When changing the + # URL of a Keepstore service, Rendezvous should be set to + # the old URL (with trailing slash omitted) to preserve + # rendezvous ordering. + Rendezvous: "" ExternalURL: "-" Composer: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "" WebShell: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} # ShellInABox service endpoint URL for a given VM. If empty, do not # offer web shell logins. # @@ -136,13 +171,16 @@ Clusters: # https://*.webshell.uuid_prefix.arvadosapi.com ExternalURL: "" Workbench1: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "" Workbench2: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "" Health: - InternalURLs: {} + ListenAddress: "" + InternalURLs: {SAMPLE: {}} ExternalURL: "-" PostgreSQL: @@ -158,6 +196,13 @@ Clusters: dbname: "" SAMPLE: "" API: + # Limits for how long a client token created by regular users can be valid, + # and also is used as a default expiration policy when no expiration date is + # specified. + # Default value zero means token expirations don't get clamped and no + # default expiration is set. + MaxTokenLifetime: 0s + # Maximum size (in bytes) allowed for a single API request. This # limit is published in the discovery document for use by clients. # Note: You must separately configure the upstream web server or @@ -197,7 +242,7 @@ Clusters: # * 1.1) fits comfortably in memory. On a host dedicated to running # Keepstore, divide total memory by 88MiB to suggest a suitable value. # For example, if grep MemTotal /proc/meminfo reports MemTotal: 7125440 - # kB, compute 7125440 / (88 * 1024)=79 and configure MaxBuffers: 79 + # kB, compute 7125440 / (88 * 1024)=79 and set MaxKeepBlobBuffers: 79 MaxKeepBlobBuffers: 128 # API methods to disable. Disabled methods are not listed in the @@ -426,7 +471,7 @@ Clusters: # # BalancePeriod determines the interval between start times of # successive scan/balance operations. If a scan/balance operation - # takes longer than RunPeriod, the next one will follow it + # takes longer than BalancePeriod, the next one will follow it # immediately. # # If SIGUSR1 is received during an idle period between operations, @@ -523,24 +568,61 @@ Clusters: TrustAllContent: false # Cache parameters for WebDAV content serving: - # * TTL: Maximum time to cache manifests and permission checks. - # * UUIDTTL: Maximum time to cache collection state. - # * MaxBlockEntries: Maximum number of block cache entries. - # * MaxCollectionEntries: Maximum number of collection cache entries. - # * MaxCollectionBytes: Approximate memory limit for collection cache. - # * MaxPermissionEntries: Maximum number of permission cache entries. - # * MaxUUIDEntries: Maximum number of UUID cache entries. WebDAVCache: + # Time to cache manifests, permission checks, and sessions. TTL: 300s + + # Time to cache collection state. UUIDTTL: 5s - MaxBlockEntries: 4 + + # Block cache entries. Each block consumes up to 64 MiB RAM. + MaxBlockEntries: 20 + + # Collection cache entries. MaxCollectionEntries: 1000 - MaxCollectionBytes: 100000000 + + # Approximate memory limit (in bytes) for collection cache. + MaxCollectionBytes: 100000000 + + # Permission cache entries. MaxPermissionEntries: 1000 - MaxUUIDEntries: 1000 + + # UUID cache entries. + MaxUUIDEntries: 1000 + + # Persistent sessions. + MaxSessions: 100 + + # Selectively set permissions for regular users and admins to + # download or upload data files using the upload/download + # features for Workbench, WebDAV and S3 API support. + WebDAVPermission: + User: + Download: true + Upload: true + Admin: + Download: true + Upload: true + + # Selectively set permissions for regular users and admins to be + # able to download or upload blocks using arv-put and + # arv-get from outside the cluster. + KeepproxyPermission: + User: + Download: true + Upload: true + Admin: + Download: true + Upload: true + + # Post upload / download events to the API server logs table, so + # that they can be included in the arv-user-activity report. + # You can disable this if you find that it is creating excess + # load on the API server and you don't need it. + WebDAVLogEvents: true Login: - # One of the following mechanisms (SSO, Google, PAM, LDAP, or + # One of the following mechanisms (Google, PAM, LDAP, or # LoginCluster) should be enabled; see # https://doc.arvados.org/install/setup-login.html @@ -555,9 +637,6 @@ Clusters: # ID > Web application) and add your controller's /login URL # (e.g., "https://zzzzz.example.com/login") as an authorized # redirect URL. - # - # Incompatible with ForceLegacyAPI14. ProviderAppID must be - # blank. ClientID: "" ClientSecret: "" @@ -567,6 +646,17 @@ Clusters: # work. If false, only the primary email address will be used. AlternateEmailAddresses: true + # Send additional parameters with authentication requests. See + # https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters + # for a list of supported parameters. + AuthenticationRequestParameters: + # Show the "choose which Google account" page, even if the + # client is currently logged in to exactly one Google + # account. + prompt: select_account + + SAMPLE: "" + OpenIDConnect: # Authenticate with an OpenID Connect provider. Enable: false @@ -601,6 +691,31 @@ Clusters: # address. UsernameClaim: "" + # Send additional parameters with authentication requests, + # like {display: page, prompt: consent}. See + # https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest + # and refer to your provider's documentation for supported + # parameters. + AuthenticationRequestParameters: + SAMPLE: "" + + # Accept an OIDC access token as an API token if the OIDC + # provider's UserInfo endpoint accepts it. + # + # AcceptAccessTokenScope should also be used when enabling + # this feature. + AcceptAccessToken: false + + # Before accepting an OIDC access token as an API token, first + # check that it is a JWT whose "scope" value includes this + # value. Example: "https://zzzzz.example.com/" (your Arvados + # API endpoint). + # + # If this value is empty and AcceptAccessToken is true, all + # access tokens will be accepted regardless of scope, + # including non-JWT tokens. This is not recommended. + AcceptAccessTokenScope: "" + PAM: # (Experimental) Use PAM to authenticate users. Enable: false @@ -688,16 +803,6 @@ Clusters: # originally supplied by the user will be used. UsernameAttribute: uid - SSO: - # Authenticate with a separate SSO server. (Deprecated) - Enable: false - - # ProviderAppID and ProviderAppSecret are generated during SSO - # setup; see - # https://doc.arvados.org/v2.0/install/install-sso.html#update-config - ProviderAppID: "" - ProviderAppSecret: "" - Test: # Authenticate users listed here in the config file. This # feature is intended to be used in test environments, and @@ -722,8 +827,15 @@ Clusters: # Default value zero means tokens don't have expiration. TokenLifetime: 0s + # If true (default) tokens issued through login are allowed to create + # new tokens. + # If false, tokens issued through login are not allowed to + # viewing/creating other tokens. New tokens can only be created + # by going through login again. + IssueTrustedTokens: true + # When the token is returned to a client, the token itself may - # be restricted from manipulating other tokens based on whether + # be restricted from viewing/creating other tokens based on whether # the client is "trusted" or not. The local Workbench1 and # Workbench2 are trusted by default, but if this is a # LoginCluster, you probably want to include the other Workbench @@ -812,7 +924,11 @@ Clusters: # stale locks from a previous dispatch process. StaleLockTimeout: 1m - # The crunch-run command to manage the container on a node + # The crunch-run command used to start a container on a worker node. + # + # When dispatching to cloud VMs, this is used only if + # DeployRunnerBinary in the CloudVMs section is set to the empty + # string. CrunchRunCommand: "crunch-run" # Extra arguments to add to crunch-run invocation @@ -826,6 +942,9 @@ Clusters: # Minimum time between two attempts to run the same container MinRetryPeriod: 0s + # Container runtime: "docker" (default) or "singularity" (experimental) + RuntimeEngine: docker + Logging: # When you run the db:delete_old_container_logs task, it will find # containers that have been finished for at least this many seconds, @@ -1033,7 +1152,7 @@ Clusters: # # Use the empty string to disable this step: nothing will be # copied, and cloud instances are assumed to have a suitable - # version of crunch-run installed. + # version of crunch-run installed; see CrunchRunCommand above. DeployRunnerBinary: "/proc/self/exe" # Tags to add on all resources (VMs, NICs, disks) created by @@ -1153,13 +1272,13 @@ Clusters: StorageClasses: default: true SAMPLE: true - Driver: s3 + Driver: S3 DriverParameters: # for s3 driver -- see # https://doc.arvados.org/install/configure-s3-object-storage.html IAMRole: aaaaa - AccessKey: aaaaa - SecretKey: aaaaa + AccessKeyID: aaaaa + SecretAccessKey: aaaaa Endpoint: "" Region: us-east-1a Bucket: aaaaa @@ -1393,15 +1512,11 @@ Clusters:

Please log in.

-

The "Log in" button below will show you a sign-in - page. After you log in, you will be redirected back to - Arvados Workbench.

-

If you have never used Arvados Workbench before, logging in for the first time will automatically create a new account.

- Arvados Workbench uses your name and email address only for + Arvados Workbench uses your information only for identification, and does not retrieve any other personal information. @@ -1442,13 +1557,6 @@ Clusters: # this blank. SSHHelpHostSuffix: "" - # Bypass new (Arvados 1.5) API implementations, and hand off - # requests directly to Rails instead. This can provide a temporary - # workaround for clients that are incompatible with the new API - # implementation. Note that it also disables some new federation - # features and will be removed in a future release. - ForceLegacyAPI14: false - # (Experimental) Restart services automatically when config file # changes are detected. Only supported by `arvados-server boot` in # dev/test mode.