////
    Do not modify this file directly, it is automatically generated by combining
    the Python script `docs/utils/gen-conf-ref.py` and the template
    `docs/utils/conf-ref.adoc.j2`. Please refer to the Python script comments
    to discover how it is used.
////




== `service`

[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|interface
|str
|Address of network interfaces to bind native service for incoming
connections. Special value `0.0.0.0` means all network interfaces.





*Default:* `localhost`

|-

|port
|int
|TCP port to listen for incoming connections.




*Default:* `5011`

|-

|cors
|bool
|When true, Cross-Origin Resource Sharing (CORS) headers are enabled.




*Default:* `False`

|-

|debug
|bool
|Enable debug mode




*Default:* `False`

|-

|log_flags
|list[str]
|List of log flags to enable. Special value `ALL` enables all log flags.



*Choices:*


* `slurmweb`
* `rfl`
* `werkzeug`
* `urllib3`
* `racksdb`
* `ALL`


*Default:*


* `ALL`


|-

|debug_flags
|list[str]
|List of debug flags to enable. Special value `ALL` enables all debug
flags.




*Choices:*


* `slurmweb`
* `rfl`
* `werkzeug`
* `urllib3`
* `racksdb`
* `ALL`


*Default:*


* `slurmweb`


|-

|session_key
|path
|Path to file with the secret key used to protect server-side sessions
during authentication.



*Example:* `/var/lib/slurm-web/session.key`



*Default:* `/var/lib/slurm-web/session.key`

|-


|===



== `ui`

This section configures the user interface served by the gateway: public URL,
static assets, login messages, RacksDB display options, and optional custom
branding (colors, logos, favicon).

For branding file layout, color usage, logo variants, and examples, see
xref:conf:branding.adoc[Custom Branding].


[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|host
|uri
|Public URL to access the gateway component. This is used to setup the
frontend application with base URL to gateway endpoints. The path part is
used to replace the base path placeholder in pre-built UI assets at
runtime. When path is defined in the URI, it is also used to wrap all
gateway endpoints under it.



*Example:* `https://dashboard.corp.com/`


_No default value_

|-

|enabled
|bool
|Serve frontend application with gateway




*Default:* `True`

|-

|path
|path
|Path to Slurm-web frontend application




*Default:* `/usr/share/slurm-web/frontend`

|-

|templates
|path
|Path HTML templates folder.





*Default:* `/usr/share/slurm-web/templates`

|-

|message_template
|path
|Path to service message HTML template relative to the templates folder.





*Default:* `message.html.j2`

|-

|message_login
|path
|Path to service message presented to users below the login form. Slurm-web
loads the file if it exists. However, it does not fail if file is not
found, it is skipped silently. The content must be formatted in markdown.





*Default:* `/etc/slurm-web/messages/login.md`

|-

|hide_denied
|bool
|Control if users can see the list of denied clusters, ie. clusters on
which they do not have any permission. When false, these clusters are
visible and marked as denied for these users. When true, these clusters
are hidden to these users.





*Default:* `False`

|-

|racksdb_rows_labels
|bool
|Enable racks rows labels in RacksDB infrastructure graphical
representations.





*Default:* `False`

|-

|racksdb_racks_labels
|bool
|Enable racks labels in RacksDB infrastructure graphical representations.





*Default:* `False`

|-

|color_light
|str
|Custom light brand color for the frontend interface, as a hexadecimal
color (e.g. `#ccdbe6`). Used for light page backgrounds, subtle
highlights, and tags. When not defined, the default Slurm-web color is
used.



*Example:* `#ccdbe6`


_No default value_

|-

|color_main
|str
|Custom main brand color for the frontend interface, as a hexadecimal color
(e.g. `#759ab8`). Used for the sidebar background, primary buttons, links,
focus rings, and selected controls (dashboard tabs, filters, resource
diagram highlights). When not defined, the default Slurm-web color is used.



*Example:* `#759ab8`


_No default value_

|-

|color_darker
|str
|Custom darker brand color for the frontend interface, as a hexadecimal
color (e.g. `#6185a3`). Used for button hover states and focus outlines.
When not defined, the default Slurm-web color is used.



*Example:* `#6185a3`


_No default value_

|-

|color_dark
|str
|Custom dark brand color for the frontend interface, as a hexadecimal color
(e.g. `#486a86`). Used for active sidebar entries, secondary text, and
dark-mode button backgrounds. When not defined, the default Slurm-web color
is used.



*Example:* `#486a86`


_No default value_

|-

|color_verydark
|str
|Custom very dark brand color for the frontend interface, as a hexadecimal
color (e.g. `#3b5163`). Used for active navigation in dark mode and
primary actions on dark backgrounds. When not defined, the default
Slurm-web color is used.



*Example:* `#3b5163`


_No default value_

|-

|color_font_disabled
|str
|Custom disabled font color for the frontend interface, as a hexadecimal
color (e.g. `#dbe9f4`). Used for inactive sidebar menu labels and icons on
the main brand background. When not defined, the default Slurm-web color is
used.



*Example:* `#dbe9f4`


_No default value_

|-

|logo_login
|path
|Path to a custom logo image displayed on the login page in light mode.
Use a PNG file; a square or portrait layout around 140×160 pixels matches
the default Slurm-web logo. When not defined, the default Slurm-web logo is
used.



*Example:* `/etc/slurm-web/branding/logo.png`


_No default value_

|-

|logo_login_dark
|path
|Path to a custom logo image displayed on the login page in dark mode. Use a
PNG file with the same recommended size as logo_login (around 140×160
pixels). When not defined, the default Slurm-web logo is used.



*Example:* `/etc/slurm-web/branding/logo_dark.png`


_No default value_

|-

|logo_horizontal
|path
|Path to a custom horizontal logo image displayed in the sidebar in light
mode. Use a PNG file; a wide layout around 280×64 pixels matches the
default Slurm-web logo. When not defined, the default Slurm-web logo is
used.



*Example:* `/etc/slurm-web/branding/logo_horizontal.png`


_No default value_

|-

|logo_horizontal_dark
|path
|Path to a custom horizontal logo image displayed in the sidebar in dark
mode. Use a PNG file with the same recommended size as logo_horizontal
(around 280×64 pixels). When not defined, the default Slurm-web logo is
used.



*Example:* `/etc/slurm-web/branding/logo_horizontal_dark.png`


_No default value_

|-

|logo_alt
|str
|Alternative text for custom logo images in the frontend interface. When
not defined, `Slurm-web` is used.



*Example:* `My HPC Portal`


_No default value_

|-

|favicon
|path
|Path to a custom favicon file. Only the ICO extension is supported. Use a
multi-resolution ICO (for example 16×16, 32×32, and 48×48 pixels) so icons
remain sharp in browser tabs and bookmarks. The file is copied to the
frontend application at runtime. When not defined, the default Slurm-web
favicon is used.



*Example:* `/etc/slurm-web/branding/favicon.ico`


_No default value_

|-


|===



== `agents`

[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|url
|list[uri]
|List of Slurm-web agents URL


*Example:*


* `https://cluster1/agent`

* `https://cluster2/agent`



_No default value_

|✅

|cacert
|path
|Path to CA certificate used to validate signature of agent server
certificate when using HTTPS. By default, system CA certificates are
used.



*Example:* `/path/to/certificate.pem`


_No default value_

|-

|version
|str
|Minimal support version of Slurm-web agent API

CAUTION: You SHOULD NOT change this parameter unless you really know what
you are doing. This parameter is more intented for Slurm-web developers
rather than end users. Slurm-web is officially tested and validated with
the default value only.





*Default:* `7.0.0`

|-

|racksdb_version
|str
|Minimal supported version of RacksDB API

CAUTION: You SHOULD NOT change this parameter unless you really know what
you are doing. This parameter is more intented for Slurm-web developers
rather than end users. Slurm-web is officially tested and validated with
the default value only.





*Default:* `0.7.0`

|-


|===



== `authentication`

[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|enabled
|bool
|Determine if authentication is enabled




*Default:* `False`

|-

|method
|str
|Authentification method



*Choices:*


* `ldap`
* `oidc`


*Default:* `ldap`

|-


|===



== `oidc`

Parameters in this section apply when `authentication` > `method` is set to
`oidc`. Slurm-web uses the OAuth 2.0 authorization code flow to authenticate
users against an OpenID Connect provider such as Keycloak or Authentik. Enable
PKCE with the optional `pkce` parameter (`S256` or `plain`).

Register the redirect URI `{ui.host}/api/oidc/callback` (including any path
prefix defined in `ui.host`) in the identity provider. Map user groups into
the ID token or userinfo endpoint under the configured `groups_claim` for RBAC
in the policy file.

For setup instructions, see xref:conf:auth/oidc.adoc[].


[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|issuer
|uri
|OIDC issuer URL used for discovery


*Example:* `https://idp.example.com/realms/org`


_No default value_

|-

|client_id
|str
|OIDC client identifier



_No default value_

|-

|client_secret
|password
|OIDC client secret for confidential clients. Optional for public clients
(omit `client_secret` and `client_secret_file`; `pkce` must then be set).



*Example:* `SECR3T`


_No default value_

|-

|client_secret_file
|path
|As an alternative to `client_secret` parameter, path to a separate file to
read OIDC client secret from. When this parameter is defined, the
`client_secret` parameter is ignored. Optional for public clients.



*Example:* `/etc/slurm-web/oidc_client_secret`


_No default value_

|-

|redirect_uri
|uri
|OIDC redirect URI registered at the identity provider. When not defined,
it is automatically derived from `ui.host` with path `/api/oidc/callback`.




_No default value_

|-

|scope
|str
|OIDC authorization scopes




*Default:* `openid profile email`

|-

|subject_claim
|str
|Claim used as user login in Slurm-web




*Default:* `sub`

|-

|fullname_claim
|str
|Claim used as user full name in Slurm-web




*Default:* `name`

|-

|groups_claim
|str
|Claim used for user groups in Slurm-web RBAC. When empty, groups are not
retrieved from userinfo endpoint.





*Default:* `groups`

|-

|restricted_groups
|list[str]
|List of user groups allowed to connect. When this parameter is not
defined, all authenticated OIDC users are authorized to sign in.



*Example:*


* `admins`

* `biology`



_No default value_

|-

|pkce
|str
|PKCE code challenge method for the authorization code flow. When not
defined, PKCE is disabled (typical for confidential clients). Use S256
(recommended). `plain` is supported for legacy identity providers only.
Required for public clients (no client secret).




*Choices:*


* `S256`
* `plain`

_No default value_

|-

|verify_ssl
|bool
|Verify TLS certificate when connecting to OIDC provider




*Default:* `True`

|-

|cacert
|path
|Path to CA certificate used to validate signature of OIDC provider
certificate. When not defined, the default system CA certificates is used.



*Example:* `/path/to/certificate.pem`


_No default value_

|-


|===



== `ldap`

Parameters in this section apply when `authentication` > `method` is set to
`ldap` (the default). The gateway validates username and password against the
LDAP directory and retrieves group memberships at login.

For setup instructions, see xref:conf:auth/ldap.adoc[].


[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|uri
|uri
|URI to connect to LDAP server


*Example:* `ldap://localhost`


_No default value_

|-

|cacert
|path
|Path to CA certificate used to validate signature of LDAP server
certificate when using ldaps or STARTTLS protocols. When not defined, the
default system CA certificates is used.



*Example:* `/path/to/certificate.pem`


_No default value_

|-

|starttls
|bool
|Use STARTTLS protocol to negociate TLS connection with LDAP server




*Default:* `False`

|-

|user_base
|str
|Base DN for users entries


*Example:* `ou=people,dc=example,dc=org`


_No default value_

|-

|group_base
|str
|Base DN for group entries


*Example:* `ou=group,dc=example,dc=org`


_No default value_

|-

|user_class
|str
|Class of user entries




*Default:* `posixAccount`

|-

|user_name_attribute
|str
|User entry attribute for user name




*Default:* `uid`

|-

|user_fullname_attribute
|str
|User entry attribute for full name




*Default:* `cn`

|-

|user_primary_group_attribute
|str
|User entry attribute for primary group ID




*Default:* `gidNumber`

|-

|group_name_attribute
|str
|Group entry attribute for name




*Default:* `cn`

|-

|group_object_classes
|list[str]
|List of LDAP object classes for groups




*Default:*


* `posixGroup`

* `groupOfNames`


|-

|lookup_user_dn
|bool
|Lookup user DN in the scope of user base subtree. If disable, LDAP
directory is not requested to search for the user in the subtree before
authentication, and the user DN are considered to be in the form of
`<user_name_attribute>=$login,<user_base>` (ex:
`uid=$login,ou=people,dc=example,dc=org`). This notably implies all
users entries to be at the first level under the user base in the tree.





*Default:* `True`

|-

|bind_dn
|str
|DN used to bind to the LDAP server. When this parameter is not defined,
access to LDAP directory is performed anonymously.



*Example:* `cn=system,ou=people,dc=example,dc=org`


_No default value_

|-

|bind_password
|password
|Password of bind DN. This parameter is required when `bind_dn` is
defined.



*Example:* `SECR3T`


_No default value_

|-

|bind_password_file
|path
|As an alternative to `bind_password` parameter, path to a separate file to
read bind DN password from. When this parameter is defined, the
`bind_password` parameter is ignored.



*Example:* `/etc/slurm-web/ldap_password`


_No default value_

|-

|lookup_as_user
|bool
|After successful user authentication, when this parameter is set to _yes_,
Slurm-web retrieves user information and groups from LDAP directory with
authenticated user permissions. When this parameter is set to _no_
Slurm-web searches this information with service `bind_dn` and
`bind_password` when defined or performs the operation anonymously. When
this parameter is omitted in configuration (default), Slurm-web uses
service `bind_dn` and `bind_password` when defined or authenticated user
permissions as a fallback.




_No default value_

|-

|restricted_groups
|list[str]
|List of users groups allowed to connect. When this parameter is not
defined, all users in LDAP directory are authorized to sign in.



*Example:*


* `admins`

* `biology`



_No default value_

|-


|===



== `jwt`

[cols="2l,1,5a,^1"]
|===
|Parameter|Type|Description|Required


|key
|path
|Path to private key for JWT signature




*Default:* `/var/lib/slurm-web/jwt.key`

|-

|duration
|int
|JWT validity duration in days




*Default:* `1`

|-

|algorithm
|str
|Cryptographic algorithm used to sign JWT



*Choices:*


* `HS256`
* `HS384`
* `HS512`
* `ES256`
* `ES256K`
* `ES384`
* `ES512`
* `RS256`
* `RS384`
* `RS512`
* `PS256`
* `PS384`
* `PS512`
* `EdDSA`


*Default:* `HS256`

|-

|audience
|str
|Audience defined in generated JWT and expected in JWT provided by clients





*Default:* `slurm-web`

|-


|===
