X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/bd855b0c92549d5cdcabc7a312166e4a6b556697..c340eecc7a03dd066792e5f046f087b8b3dfced6:/lib/config/generated_config.go diff --git a/lib/config/generated_config.go b/lib/config/generated_config.go index de233a8668..36a21d4c35 100644 --- a/lib/config/generated_config.go +++ b/lib/config/generated_config.go @@ -30,49 +30,42 @@ Clusters: # In each of the service sections below, the keys under # InternalURLs are the endpoints where the service should be - # listening, and reachable from other hosts in the cluster. - SAMPLE: - InternalURLs: - "http://host1.example:12345": {} - "http://host2.example:12345": - # Rendezvous is normally empty/omitted. When changing the - # URL of a Keepstore service, Rendezvous should be set to - # the old URL (with trailing slash omitted) to preserve - # rendezvous ordering. - Rendezvous: "" - SAMPLE: - Rendezvous: "" - ExternalURL: "-" + # listening, and reachable from other hosts in the + # cluster. Example: + # + # InternalURLs: + # "http://host1.example:12345": {} + # "http://host2.example:12345": {} RailsAPI: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "-" Controller: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "" Websocket: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "" Keepbalance: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "-" GitHTTP: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "" GitSSH: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "" DispatchCloud: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} + ExternalURL: "-" + DispatchLSF: + InternalURLs: {SAMPLE: {}} ExternalURL: "-" - SSO: - InternalURLs: {} - ExternalURL: "" Keepproxy: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "" WebDAV: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} # Base URL for Workbench inline preview. If blank, use # WebDAVDownload instead, and disable inline preview. # If both are empty, downloading collections from workbench @@ -111,7 +104,7 @@ Clusters: ExternalURL: "" WebDAVDownload: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} # Base URL for download links. If blank, serve links to WebDAV # with disposition=attachment query param. Unlike preview links, # browsers do not render attachments, so there is no risk of XSS. @@ -125,13 +118,19 @@ Clusters: ExternalURL: "" Keepstore: - InternalURLs: {} + InternalURLs: + SAMPLE: + # Rendezvous is normally empty/omitted. When changing the + # URL of a Keepstore service, Rendezvous should be set to + # the old URL (with trailing slash omitted) to preserve + # rendezvous ordering. + Rendezvous: "" ExternalURL: "-" Composer: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "" WebShell: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} # ShellInABox service endpoint URL for a given VM. If empty, do not # offer web shell logins. # @@ -142,13 +141,13 @@ Clusters: # https://*.webshell.uuid_prefix.arvadosapi.com ExternalURL: "" Workbench1: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "" Workbench2: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "" Health: - InternalURLs: {} + InternalURLs: {SAMPLE: {}} ExternalURL: "-" PostgreSQL: @@ -280,6 +279,7 @@ Clusters: AdminNotifierEmailFrom: arvados@example.com EmailSubjectPrefix: "[ARVADOS] " UserNotifierEmailFrom: arvados@example.com + UserNotifierEmailBcc: {} NewUserNotificationRecipients: {} NewInactiveUserNotificationRecipients: {} @@ -466,6 +466,13 @@ Clusters: # long-running balancing operation. BalanceTimeout: 6h + # Maximum number of replication_confirmed / + # storage_classes_confirmed updates to write to the database + # after a rebalancing run. When many updates are needed, this + # spreads them over a few runs rather than applying them all at + # once. + BalanceUpdateLimit: 100000 + # Default lifetime for ephemeral collections: 2 weeks. This must not # be less than BlobSigningTTL. DefaultTrashLifetime: 336h @@ -527,10 +534,10 @@ Clusters: # WebDAV would have to expose XSS vulnerabilities in order to # handle the redirect (see discussion on Services.WebDAV). # - # This setting has no effect in the recommended configuration, - # where the WebDAV is configured to have a separate domain for - # every collection; in this case XSS protection is provided by - # browsers' same-origin policy. + # This setting has no effect in the recommended configuration, where the + # WebDAV service is configured to have a separate domain for every + # collection and XSS protection is provided by browsers' same-origin + # policy. # # The default setting (false) is appropriate for a multi-user site. TrustAllContent: false @@ -544,7 +551,7 @@ Clusters: UUIDTTL: 5s # Block cache entries. Each block consumes up to 64 MiB RAM. - MaxBlockEntries: 4 + MaxBlockEntries: 20 # Collection cache entries. MaxCollectionEntries: 1000 @@ -561,8 +568,36 @@ Clusters: # Persistent sessions. MaxSessions: 100 + # Selectively set permissions for regular users and admins to + # download or upload data files using the upload/download + # features for Workbench, WebDAV and S3 API support. + WebDAVPermission: + User: + Download: true + Upload: true + Admin: + Download: true + Upload: true + + # Selectively set permissions for regular users and admins to be + # able to download or upload blocks using arv-put and + # arv-get from outside the cluster. + KeepproxyPermission: + User: + Download: true + Upload: true + Admin: + Download: true + Upload: true + + # Post upload / download events to the API server logs table, so + # that they can be included in the arv-user-activity report. + # You can disable this if you find that it is creating excess + # load on the API server and you don't need it. + WebDAVLogEvents: true + Login: - # One of the following mechanisms (SSO, Google, PAM, LDAP, or + # One of the following mechanisms (Google, PAM, LDAP, or # LoginCluster) should be enabled; see # https://doc.arvados.org/install/setup-login.html @@ -639,6 +674,23 @@ Clusters: AuthenticationRequestParameters: SAMPLE: "" + # Accept an OIDC access token as an API token if the OIDC + # provider's UserInfo endpoint accepts it. + # + # AcceptAccessTokenScope should also be used when enabling + # this feature. + AcceptAccessToken: false + + # Before accepting an OIDC access token as an API token, first + # check that it is a JWT whose "scope" value includes this + # value. Example: "https://zzzzz.example.com/" (your Arvados + # API endpoint). + # + # If this value is empty and AcceptAccessToken is true, all + # access tokens will be accepted regardless of scope, + # including non-JWT tokens. This is not recommended. + AcceptAccessTokenScope: "" + PAM: # (Experimental) Use PAM to authenticate users. Enable: false @@ -726,16 +778,6 @@ Clusters: # originally supplied by the user will be used. UsernameAttribute: uid - SSO: - # Authenticate with a separate SSO server. (Deprecated) - Enable: false - - # ProviderAppID and ProviderAppSecret are generated during SSO - # setup; see - # https://doc.arvados.org/v2.0/install/install-sso.html#update-config - ProviderAppID: "" - ProviderAppSecret: "" - Test: # Authenticate users listed here in the config file. This # feature is intended to be used in test environments, and @@ -760,8 +802,15 @@ Clusters: # Default value zero means tokens don't have expiration. TokenLifetime: 0s + # If true (default) tokens issued through login are allowed to create + # new tokens. + # If false, tokens issued through login are not allowed to + # viewing/creating other tokens. New tokens can only be created + # by going through login again. + IssueTrustedTokens: true + # When the token is returned to a client, the token itself may - # be restricted from manipulating other tokens based on whether + # be restricted from viewing/creating other tokens based on whether # the client is "trusted" or not. The local Workbench1 and # Workbench2 are trusted by default, but if this is a # LoginCluster, you probably want to include the other Workbench @@ -868,6 +917,9 @@ Clusters: # Minimum time between two attempts to run the same container MinRetryPeriod: 0s + # Container runtime: "docker" (default) or "singularity" (experimental) + RuntimeEngine: docker + Logging: # When you run the db:delete_old_container_logs task, it will find # containers that have been finished for at least this many seconds, @@ -977,6 +1029,19 @@ Clusters: # (See http://ruby-doc.org/core-2.2.2/Kernel.html#method-i-format for more.) AssignNodeHostname: "compute%d" + LSF: + # Additional arguments to bsub when submitting Arvados + # containers as LSF jobs. + BsubArgumentsList: [] + + # Use sudo to switch to this user account when submitting LSF + # jobs. + # + # This account must exist on the hosts where LSF jobs run + # ("execution hosts"), as well as on the host where the + # Arvados LSF dispatcher runs ("submission host"). + BsubSudoUser: "crunch" + JobsAPI: # Enable the legacy 'jobs' API (crunch v1). This value must be a string. # @@ -1170,6 +1235,29 @@ Clusters: Price: 0.1 Preemptible: false + StorageClasses: + + # If you use multiple storage classes, specify them here, using + # the storage class name as the key (in place of "SAMPLE" in + # this sample entry). + # + # Further info/examples: + # https://doc.arvados.org/admin/storage-classes.html + SAMPLE: + + # Priority determines the order volumes should be searched + # when reading data, in cases where a keepstore server has + # access to multiple volumes with different storage classes. + Priority: 0 + + # Default determines which storage class(es) should be used + # when a user/client writes data or saves a new collection + # without specifying storage classes. + # + # If any StorageClasses are configured, at least one of them + # must have Default: true. + Default: true + Volumes: SAMPLE: # AccessViaHosts specifies which keepstore processes can read @@ -1193,7 +1281,9 @@ Clusters: ReadOnly: false Replication: 1 StorageClasses: - default: true + # If you have configured storage classes (see StorageClasses + # section above), add an entry here for each storage class + # satisfied by this volume. SAMPLE: true Driver: S3 DriverParameters: @@ -1435,15 +1525,11 @@ Clusters:

Please log in.

-

The "Log in" button below will show you a sign-in - page. After you log in, you will be redirected back to - Arvados Workbench.

-

If you have never used Arvados Workbench before, logging in for the first time will automatically create a new account.

- Arvados Workbench uses your name and email address only for + Arvados Workbench uses your information only for identification, and does not retrieve any other personal information.