////
    Do not modify this file directly, it is automatically generated by combining
    the Python script `docs/utils/gen-conf-ref.py` and the template
    `docs/utils/conf-ref.adoc.j2`. Please refer to the Python script comments
    to discover how it is used.
////




== `service`

[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|interface
|str
|Address of network interfaces to bind native service for incoming
connections. Special value `0.0.0.0` means all network interfaces.





*Default:* `localhost`

|-

|port
|int
|TCP port to listen for incoming connections.




*Default:* `5011`

|-

|cors
|bool
|When true, Cross-Origin Resource Sharing (CORS) headers are enabled.




*Default:* `False`

|-

|debug
|bool
|Enable debug mode




*Default:* `False`

|-

|log_flags
|list[str]
|List of log flags to enable. Special value `ALL` enables all log flags.



*Choices:*


* `slurmweb`
* `rfl`
* `werkzeug`
* `urllib3`
* `racksdb`
* `ALL`


*Default:*


* `ALL`


|-

|debug_flags
|list[str]
|List of debug flags to enable. Special value `ALL` enables all debug
flags.




*Choices:*


* `slurmweb`
* `rfl`
* `werkzeug`
* `urllib3`
* `racksdb`
* `ALL`


*Default:*


* `slurmweb`


|-


|===



== `ui`

[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|host
|uri
|Public URL to access the gateway component. This is used to setup the
frontend application with base URL to gateway endpoints. The path part is
used to replace the base path placeholder in pre-built UI assets at
runtime. When path is defined in the URI, it is also used to wrap all
gateway endpoints under it.



*Example:* `https://dashboard.corp.com/`


_No default value_

|-

|enabled
|bool
|Serve frontend application with gateway




*Default:* `True`

|-

|path
|path
|Path to Slurm-web frontend application




*Default:* `/usr/share/slurm-web/frontend`

|-

|templates
|path
|Path HTML templates folder.





*Default:* `/usr/share/slurm-web/templates`

|-

|message_template
|path
|Path to service message HTML template relative to the templates folder.





*Default:* `message.html.j2`

|-

|message_login
|path
|Path to service message presented to users below the login form. Slurm-web
loads the file if it exists. However, it does not fail if file is not
found, it is skipped silently. The content must be formatted in markdown.





*Default:* `/etc/slurm-web/messages/login.md`

|-

|hide_denied
|bool
|Control if users can see the list of denied clusters, ie. clusters on
which they do not have any permission. When false, these clusters are
visible and marked as denied for these users. When true, these clusters
are hidden to these users.





*Default:* `False`

|-

|racksdb_rows_labels
|bool
|Enable racks rows labels in RacksDB infrastructure graphical
representations.





*Default:* `False`

|-

|racksdb_racks_labels
|bool
|Enable racks labels in RacksDB infrastructure graphical representations.





*Default:* `False`

|-


|===



== `agents`

[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|url
|list[uri]
|List of Slurm-web agents URL


*Example:*


* `https://cluster1/agent`

* `https://cluster2/agent`



_No default value_

|✅

|cacert
|path
|Path to CA certificate used to validate signature of agent server
certificate when using HTTPS. By default, system CA certificates are
used.



*Example:* `/path/to/certificate.pem`


_No default value_

|-

|version
|str
|Minimal support version of Slurm-web agent API

CAUTION: You SHOULD NOT change this parameter unless you really know what
you are doing. This parameter is more intented for Slurm-web developers
rather than end users. Slurm-web is officially tested and validated with
the default value only.





*Default:* `6.0.0`

|-

|racksdb_version
|str
|Minimal supported version of RacksDB API

CAUTION: You SHOULD NOT change this parameter unless you really know what
you are doing. This parameter is more intented for Slurm-web developers
rather than end users. Slurm-web is officially tested and validated with
the default value only.





*Default:* `0.5.0`

|-


|===



== `authentication`

[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|enabled
|bool
|Determine if authentication is enabled




*Default:* `False`

|-

|method
|str
|Authentification method



*Choices:*


* `ldap`


*Default:* `ldap`

|-


|===



== `ldap`

[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|uri
|uri
|URI to connect to LDAP server


*Example:* `ldap://localhost`


_No default value_

|-

|cacert
|path
|Path to CA certificate used to validate signature of LDAP server
certificate when using ldaps or STARTTLS protocols. When not defined, the
default system CA certificates is used.



*Example:* `/path/to/certificate.pem`


_No default value_

|-

|starttls
|bool
|Use STARTTLS protocol to negociate TLS connection with LDAP server




*Default:* `False`

|-

|user_base
|str
|Base DN for users entries


*Example:* `ou=people,dc=example,dc=org`


_No default value_

|-

|group_base
|str
|Base DN for group entries


*Example:* `ou=group,dc=example,dc=org`


_No default value_

|-

|user_class
|str
|Class of user entries




*Default:* `posixAccount`

|-

|user_name_attribute
|str
|User entry attribute for user name




*Default:* `uid`

|-

|user_fullname_attribute
|str
|User entry attribute for full name




*Default:* `cn`

|-

|user_primary_group_attribute
|str
|User entry attribute for primary group ID




*Default:* `gidNumber`

|-

|group_name_attribute
|str
|Group entry attribute for name




*Default:* `cn`

|-

|group_object_classes
|list[str]
|List of LDAP object classes for groups




*Default:*


* `posixGroup`

* `groupOfNames`


|-

|lookup_user_dn
|bool
|Lookup user DN in the scope of user base subtree. If disable, LDAP
directory is not requested to search for the user in the subtree before
authentication, and the user DN are considered to be in the form of
`<user_name_attribute>=$login,<user_base>` (ex:
`uid=$login,ou=people,dc=example,dc=org`). This notably implies all
users entries to be at the first level under the user base in the tree.





*Default:* `True`

|-

|bind_dn
|str
|DN used to bind to the LDAP server. When this parameter is not defined,
access to LDAP directory is performed anonymously.



*Example:* `cn=system,ou=people,dc=example,dc=org`


_No default value_

|-

|bind_password
|password
|Password of bind DN. This parameter is required when `bind_dn` is
defined.



*Example:* `SECR3T`


_No default value_

|-

|bind_password_file
|path
|As an alternative to `bind_password` parameter, path to a separate file to
read bind DN password from. When this parameter is defined, the
`bind_password` parameter is ignored.



*Example:* `/etc/slurm-web/ldap_password`


_No default value_

|-

|lookup_as_user
|bool
|After successful user authentication, when this parameter is set to _yes_,
Slurm-web retrieves user information and groups from LDAP directory with
authenticated user permissions. When this parameter is set to _no_
Slurm-web searches this information with service `bind_dn` and
`bind_password` when defined or performs the operation anonymously. When
this parameter is omitted in configuration (default), Slurm-web uses
service `bind_dn` and `bind_password` when defined or authenticated user
permissions as a fallback.




_No default value_

|-

|restricted_groups
|list[str]
|List of users groups allowed to connect. When this parameter is not
defined, all users in LDAP directory are authorized to sign in.



*Example:*


* `admins`

* `biology`



_No default value_

|-


|===



== `jwt`

[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|key
|path
|Path to private key for JWT signature




*Default:* `/var/lib/slurm-web/jwt.key`

|-

|duration
|int
|JWT validity duration in days




*Default:* `1`

|-

|algorithm
|str
|Cryptographic algorithm used to sign JWT



*Choices:*


* `HS256`
* `HS384`
* `HS512`
* `ES256`
* `ES256K`
* `ES384`
* `ES512`
* `RS256`
* `RS384`
* `RS512`
* `PS256`
* `PS384`
* `PS512`
* `EdDSA`


*Default:* `HS256`

|-

|audience
|str
|Audience defined in generated JWT and expected in JWT provided by clients





*Default:* `slurm-web`

|-


|===
