X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/f95ac4c11b99daea342be0fba98e66c92d70e54c..77c8223f5ddd64cff2b08d0857749644c474946f:/lib/config/config.default.yml diff --git a/lib/config/config.default.yml b/lib/config/config.default.yml index 907acdc878..f62c483f46 100644 --- a/lib/config/config.default.yml +++ b/lib/config/config.default.yml @@ -12,6 +12,8 @@ Clusters: xxxxx: + # Token used internally by Arvados components to authenticate to + # one another. Use a string of at least 50 random alphanumerics. SystemRootToken: "" # Token to be included in all healthcheck requests. Disabled by default. @@ -139,9 +141,6 @@ Clusters: Workbench2: InternalURLs: {} ExternalURL: "" - Nodemanager: - InternalURLs: {} - ExternalURL: "-" Health: InternalURLs: {} ExternalURL: "-" @@ -215,11 +214,6 @@ Clusters: # serving a single incoming multi-cluster (federated) request. MaxRequestAmplification: 4 - # RailsSessionSecretToken is a string of alphanumeric characters - # used by Rails to sign session tokens. IMPORTANT: This is a - # site secret. It should be at least 50 characters. - RailsSessionSecretToken: "" - # Maximum wall clock time to spend handling an incoming request. RequestTimeout: 5m @@ -261,9 +255,6 @@ Clusters: # The e-mail address of the user you would like to become marked as an admin # user on their first login. - # In the default configuration, authentication happens through the Arvados SSO - # server, which uses OAuth2 against Google's servers, so in that case this - # should be an address associated with a Google account. AutoAdminUserWithEmail: "" # If AutoAdminFirstUser is set to true, the first user to log in when no @@ -279,9 +270,10 @@ Clusters: NewUserNotificationRecipients: {} NewInactiveUserNotificationRecipients: {} - # Set AnonymousUserToken to enable anonymous user access. You can get - # the token by running "bundle exec ./script/get_anonymous_user_token.rb" - # in the directory where your API server is running. + # Set AnonymousUserToken to enable anonymous user access. Populate this + # field with a long random string. Then run "bundle exec + # ./script/get_anonymous_user_token.rb" in the directory where your API + # server is running to record the token in the database. AnonymousUserToken: "" # If a new user has an alternate email address (local@domain) @@ -290,6 +282,20 @@ Clusters: # address is used. PreferDomainForUsername: "" + UserSetupMailText: | + <% if not @user.full_name.empty? -%> + <%= @user.full_name %>, + <% else -%> + Hi there, + <% end -%> + + Your Arvados account has been set up. You can log in at + + <%= Rails.configuration.Services.Workbench1.ExternalURL %> + + Thanks, + Your Arvados administrator. + AuditLogs: # Time to keep audit logs, in seconds. (An audit log is a row added # to the "logs" table in the PostgreSQL database each time an @@ -486,6 +492,9 @@ Clusters: # Use of this feature is not recommended, if it can be avoided. ForwardSlashNameSubstitution: "" + # Include "folder objects" in S3 ListObjects responses. + S3FolderObjects: true + # Managed collection properties. At creation time, if the client didn't # provide the listed keys, they will be automatically populated following # one of the following behaviors: @@ -689,6 +698,16 @@ Clusters: ProviderAppID: "" ProviderAppSecret: "" + Test: + # Authenticate users listed here in the config file. This + # feature is intended to be used in test environments, and + # should not be used in production. + Enable: false + Users: + SAMPLE: + Email: alice@example.com + Password: xyzzy + # The cluster ID to delegate the user database. When set, # logins on this cluster will be redirected to the login cluster # (login cluster must appear in RemoteClusters with Proxy: true) @@ -698,6 +717,22 @@ Clusters: # remain valid before it needs to be revalidated. RemoteTokenRefresh: 5m + # How long a client token created from a login flow will be valid without + # asking the user to re-login. Example values: 60m, 8h. + # Default value zero means tokens don't have expiration. + TokenLifetime: 0s + + # When the token is returned to a client, the token itself may + # be restricted from manipulating other tokens based on whether + # the client is "trusted" or not. The local Workbench1 and + # Workbench2 are trusted by default, but if this is a + # LoginCluster, you probably want to include the other Workbench + # instances in the federation in this list. + TrustedClients: + SAMPLE: + "https://workbench.federate1.example": {} + "https://workbench.federate2.example": {} + Git: # Path to git or gitolite-shell executable. Each authenticated # request will execute this program with the single argument "http-backend" @@ -833,6 +868,26 @@ Clusters: # period. LogUpdateSize: 32MiB + ShellAccess: + # An admin user can use "arvados-client shell" to start an + # interactive shell (with any user ID) in any running + # container. + Admin: false + + # Any user can use "arvados-client shell" to start an + # interactive shell (with any user ID) in any running + # container that they started, provided it isn't also + # associated with a different user's container request. + # + # Interactive sessions make it easy to alter the container's + # runtime environment in ways that aren't recorded or + # reproducible. Consider the implications for automatic + # container reuse before enabling and using this feature. In + # particular, note that starting an interactive session does + # not disqualify a container from being reused by a different + # user/workflow in the future. + User: false + SLURM: PrioritySpread: 0 SbatchArgumentsList: [] @@ -923,6 +978,11 @@ Clusters: # Time before repeating SIGTERM when killing a container. TimeoutSignal: 5s + # Time to give up on a process (most likely arv-mount) that + # still holds a container lockfile after its main supervisor + # process has exited, and declare the instance broken. + TimeoutStaleRunLock: 5s + # Time to give up on SIGTERM and write off the worker. TimeoutTERM: 2m @@ -930,6 +990,12 @@ Clusters: # unlimited). MaxCloudOpsPerSecond: 0 + # Maximum concurrent node creation operations (0 = unlimited). This is + # recommended by Azure in certain scenarios (see + # https://docs.microsoft.com/en-us/azure/virtual-machines/linux/capture-image) + # and can be used with other cloud providers too, if desired. + MaxConcurrentInstanceCreateOps: 0 + # Interval between cloud provider syncs/updates ("list all # instances"). SyncInterval: 1m @@ -952,6 +1018,12 @@ Clusters: TimeoutShutdown: 10s # Worker VM image ID. + # (aws) AMI identifier + # (azure) managed disks: the name of the managed disk image + # (azure) shared image gallery: the name of the image definition. Also + # see the SharedImageGalleryName and SharedImageGalleryImageVersion fields. + # (azure) unmanaged disks (deprecated): the complete URI of the VHD, e.g. + # https://xxxxx.blob.core.windows.net/system/Microsoft.Compute/Images/images/xxxxx.vhd ImageID: "" # An executable file (located on the dispatcher host) to be @@ -988,7 +1060,7 @@ Clusters: # Cloud-specific driver parameters. DriverParameters: - # (ec2) Credentials. + # (ec2) Credentials. Omit or leave blank if using IAM role. AccessKeyID: "" SecretAccessKey: "" @@ -1008,13 +1080,38 @@ Clusters: # (azure) Instance configuration. CloudEnvironment: AzurePublicCloud - ResourceGroup: "" Location: centralus + + # (azure) The resource group where the VM and virtual NIC will be + # created. + ResourceGroup: "" + + # (azure) The resource group of the Network to use for the virtual + # NIC (if different from ResourceGroup) + NetworkResourceGroup: "" Network: "" Subnet: "" + + # (azure) managed disks: The resource group where the managed disk + # image can be found (if different from ResourceGroup). + ImageResourceGroup: "" + + # (azure) shared image gallery: the name of the gallery + SharedImageGalleryName: "" + # (azure) shared image gallery: the version of the image definition + SharedImageGalleryImageVersion: "" + + # (azure) unmanaged disks (deprecated): Where to store the VM VHD blobs StorageAccount: "" BlobContainer: "" + + # (azure) How long to wait before deleting VHD and NIC + # objects that are no longer being used. DeleteDanglingResourcesAfter: 20s + + # Account (that already exists in the VM image) that will be + # set up with an ssh authorized key to allow the compute + # dispatcher to connect. AdminUsername: arvados InstanceTypes: @@ -1072,6 +1169,8 @@ Clusters: ConnectTimeout: 1m ReadTimeout: 10m RaceWindow: 24h + # Use aws-s3-go (v2) instead of goamz + UseAWSS3v2Driver: false # For S3 driver, potentially unsafe tuning parameter, # intentionally excluded from main documentation. @@ -1266,7 +1365,7 @@ Clusters: # a link to the multi-site search page on a "home" Workbench site. # # Example: - # https://workbench.qr1hi.arvadosapi.com/collections/multisite + # https://workbench.zzzzz.arvadosapi.com/collections/multisite MultiSiteSearch: "" # Should workbench allow management of local git repositories? Set to false if @@ -1284,6 +1383,10 @@ Clusters: VocabularyURL: "" FileViewersConfigURL: "" + # Idle time after which the user's session will be auto closed. + # This feature is disabled when set to zero. + IdleTimeout: 0s + # Workbench welcome screen, this is HTML text that will be # incorporated directly onto the page. WelcomePageHTML: |