X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/dfff0d837f55f7880242c676dfe35369a057072c..7aecff0797f9d282587544b356b105c05f13da21:/doc/install/install-api-server.html.textile.liquid
diff --git a/doc/install/install-api-server.html.textile.liquid b/doc/install/install-api-server.html.textile.liquid
index dc4023461e..4c9f168e82 100644
--- a/doc/install/install-api-server.html.textile.liquid
+++ b/doc/install/install-api-server.html.textile.liquid
@@ -48,25 +48,20 @@ h3. Tokens
SystemRootToken: "$system_root_token"
ManagementToken: "$management_token"
- API:
- RailsSessionSecretToken: "$rails_secret_token"
Collections:
- BlobSigningKey: "blob_signing_key"
+ BlobSigningKey: "$blob_signing_key"
-@SystemRootToken@ is used by Arvados system services to authenticate as the system (root) user when communicating with the API server.
+These secret tokens are used to authenticate messages between Arvados components.
+* @SystemRootToken@ is used by Arvados system services to authenticate as the system (root) user when communicating with the API server.
+* @ManagementToken@ is used to authenticate access to system metrics.
+* @Collections.BlobSigningKey@ is used to control access to Keep blocks.
-@ManagementToken@ is used to authenticate access to system metrics.
-
-@API.RailsSessionSecretToken@ is required by the API server.
-
-@Collections.BlobSigningKey@ is used to control access to Keep blocks.
-
-You can generate a random token for each of these items at the command line like this:
+Each token should be a string of at least 50 alphanumeric characters. You can generate a suitable token with the following command:
-~$ tr -dc 0-9a-zA-Z </dev/urandom | head -c50; echo
+~$ tr -dc 0-9a-zA-Z </dev/urandom | head -c50 ; echo
@@ -89,7 +84,7 @@ h3. Services
Services:
Controller:
- ExternalURL: "https://xxxxx.example.com"
+ ExternalURL: "https://ClusterID.example.com"
InternalURLs:
"http://localhost:8003": {}
RailsAPI:
@@ -99,13 +94,13 @@ h3. Services
-Replace @xxxxx.example.com@ with the hostname that you previously selected for the API server.
+Replace @ClusterID.example.com@ with the hostname that you previously selected for the API server.
The @Services@ section of the configuration helps Arvados components contact one another (service discovery). Each service has one or more @InternalURLs@ and an @ExternalURL@. The @InternalURLs@ describe where the service runs, and how the Nginx reverse proxy will connect to it. The @ExternalURL@ is how external clients contact the service.
h2(#update-nginx). Update nginx configuration
-Use a text editor to create a new file @/etc/nginx/conf.d/arvados-api-and-controller.conf@ with the following configuration. Options that need attention are marked with "TODO".
+Use a text editor to create a new file @/etc/nginx/conf.d/arvados-api-and-controller.conf@ with the following configuration. Options that need attention are marked in red.
proxy_http_version 1.1;
@@ -120,11 +115,11 @@ Use a text editor to create a new file @/etc/nginx/conf.d/arvados-api-and-contro
# "available keep services" request with either a list of internal keep
# servers (0) or with the keepproxy (1).
#
-# TODO: Following the example here, update the 10.20.30.0/24 netmask
-# to match your private subnet.
-# TODO: Update 1.2.3.4 and add lines as necessary with the public IP
-# address of all servers that can also access the private network to
-# ensure they are not considered 'external'.
+# Following the example here, update the 10.20.30.0/24 netmask
+# to match your private subnet.
+# Update 1.2.3.4 and add lines as necessary with the public IP
+# address of all servers that can also access the private network to
+# ensure they are not considered 'external'.
geo $external_client {
default 1;
@@ -142,28 +137,33 @@ server {
# This configures the public https port that clients will actually connect to,
# the request is reverse proxied to the upstream 'controller'
- listen *:443 ssl;
- server_name xxxxx.example.com;
+ listen 443 ssl;
+ server_name ClusterID.example.com;
- ssl on;
- ssl_certificate /TODO/YOUR/PATH/TO/cert.pem;
- ssl_certificate_key /TODO/YOUR/PATH/TO/cert.key;
+ ssl_certificate /YOUR/PATH/TO/cert.pem;
+ ssl_certificate_key /YOUR/PATH/TO/cert.key;
# Refer to the comment about this setting in the passenger (arvados
# api server) section of your Nginx configuration.
client_max_body_size 128m;
location / {
- proxy_pass http://controller;
- proxy_redirect off;
- proxy_connect_timeout 90s;
- proxy_read_timeout 300s;
-
- proxy_set_header X-Forwarded-Proto https;
- proxy_set_header Host $http_host;
+ proxy_pass http://controller;
+ proxy_redirect off;
+ proxy_connect_timeout 90s;
+ proxy_read_timeout 300s;
+ proxy_max_temp_file_size 0;
+ proxy_request_buffering off;
+ proxy_buffering off;
+ proxy_http_version 1.1;
+
+ proxy_set_header Host $http_host;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "upgrade";
proxy_set_header X-External-Client $external_client;
- proxy_set_header X-Real-IP $remote_addr;
- proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto https;
+ proxy_set_header X-Real-IP $remote_addr;
}
}
@@ -179,8 +179,8 @@ server {
passenger_enabled on;
- # TODO: If you are using RVM, uncomment the line below.
- # If you're using system ruby, leave it commented out.
+ # If you are using RVM, uncomment the line below.
+ # If you're using system ruby, leave it commented out.
#passenger_ruby /usr/local/rvm/wrappers/default/ruby;
# This value effectively limits the size of API objects users can
@@ -205,21 +205,18 @@ h2(#confirm-working). Confirm working installation
Confirm working controller:
-
-$ curl https://ClusterID.example.com/arvados/v1/config
-
+$ curl https://ClusterID.example.com/arvados/v1/config
+
Confirm working Rails API server:
-
-$ curl https://ClusterID.example.com/discovery/v1/apis/arvados/v1/rest
-
+$ curl https://ClusterID.example.com/discovery/v1/apis/arvados/v1/rest
+
Confirm that you can use the system root token to act as the system root user:
-
-$ curl -H "Authorization: Bearer $system_root_token" https://xxxxx.example.com/arvados/v1/users/current
-
+$ curl -H "Authorization: Bearer $system_root_token" https://ClusterID.example.com/arvados/v1/users/current
+
h3. Troubleshooting