Skip to content

Update configuration options to latest state #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
moebiusband73 merged 1 commit into from
Jun 16, 2026
Merged

Update configuration options to latest state #152

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions content/en/docs/explanation/authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ The Login function:
* Return public cross login key
* Otherwise return standard public key
* Check if claims are valid
* Depending on the option `validateUser` the roles are
* Depending on the option `validate-user` the roles are
extracted from JWT token or taken from user object fetched from database
* Ask browser to delete the JWT cookie
* In case user does not exist in the database and the option `SyncUserOnLogin`
Expand All @@ -193,7 +193,7 @@ Implemented in JWTAuthenticator:
prefix
* Parse token and check if it is valid. The Parse routine will also check if the
token is expired.
* If the option `validateUser` is set it will ensure the
* If the option `validate-user` is set it will ensure the
user object exists in the database and takes the roles from the database user
* Otherwise the roles are extracted from the roles claim
* Returns a valid user object with AuthType set to AuthToken
Expand Down
10 changes: 6 additions & 4 deletions content/en/docs/explanation/jwtoken.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,10 +60,12 @@ CROSS_LOGIN_JWT_PUBLIC_KEY="+51iXX8BdLFocrppRxIw52xCOf8xFSH/eNilN5IHVGc="
rejected and roles set via JWT will be ignored.

```json
"jwts": {
"cookieName": "access_cc",
"forceJWTValidationViaDatabase": true,
"trustedExternalIssuer": "auth.example.com"
"auth": {
"jwts": {
"cookie-name": "access_cc",
"validate-user": true,
"trusted-issuer": "auth.example.com"
}
}
```

Expand Down
82 changes: 27 additions & 55 deletions content/en/docs/getting-started/demo-standalone/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,66 +31,38 @@ directory, initialize the sqlite database, `config.json` and `.env` files:
./cc-backend -init
```

Open `config.json` in an editor of your choice to edit the existing clusters
name and add a second cluster. Name the clusters `fritz` and `alex`. The file
should look as below afterwards:
The `./cc-backend -init` command creates a `config.json` with sensible defaults.
The cluster configurations (`fritz` and `alex`) are embedded in the job archive
you will download below — no manual cluster configuration is needed in
`config.json`. The generated file should look similar to:

```json {linenos=table,hl_lines=[9,31]}
```json
{
"main": {
"addr": "127.0.0.1:8080",
"archive": {
"kind": "file",
"path": "./var/job-archive"
"short-running-jobs-duration": 300,
"resampling": {
"minimum-points": 600,
"trigger": 300,
"resolutions": [240, 60]
},
"api-allowed-ips": ["*"],
"emission-constant": 317
},
"cron": {
"commit-job-worker": "1m",
"duration-worker": "5m",
"footprint-worker": "10m"
},
"archive": {
"kind": "file",
"path": "./var/job-archive"
},
"auth": {
"jwts": {
"session-max-age": "24h",
},
"clusters": [
{
"name": "fritz",
"metricDataRepository": {
"kind": "cc-metric-store",
"url": "http://localhost:8082",
"token": ""
},
"filterRanges": {
"numNodes": {
"from": 1,
"to": 64
},
"duration": {
"from": 0,
"to": 86400
},
"startTime": {
"from": "2023-01-01T00:00:00Z",
"to": null
}
}
},
{
"name": "alex",
"metricDataRepository": {
"kind": "cc-metric-store",
"url": "http://localhost:8082",
"token": ""
},
"filterRanges": {
"numNodes": {
"from": 1,
"to": 64
},
"duration": {
"from": 0,
"to": 86400
},
"startTime": {
"from": "2023-01-01T00:00:00Z",
"to": null
}
}
}
]
"max-age": "2000h"
}
}
}
```

Expand Down
2 changes: 1 addition & 1 deletion content/en/docs/how-to-guides/resampling.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ To enable resampling, you must add the following toplevel configuration key:

#### Configuration Parameters

The `enable-resampling` object is optional. If configured, it enables dynamic downsampling of metric data using the following properties:
The `resampling` object is optional. If configured, it enables dynamic downsampling of metric data using the following properties:

* **`minimum-points`** (Integer)
Specifies the minimum number of data points required to trigger resampling. This ensures short jobs are not unnecessarily downsampled.
Expand Down
33 changes: 22 additions & 11 deletions content/en/docs/how-to-guides/retention-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,8 @@ from the active database.
"retention": {
"policy": "move",
"age": 365,
"location": "/mnt/archive/old-jobs",
"target-kind": "file",
"target-path": "/mnt/archive/old-jobs",
"include-db": true
}
}
Expand All @@ -116,13 +117,22 @@ This configuration will:

### `archive.retention` section

| Parameter | Type | Required | Default | Description |
| ------------- | ------- | ------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `policy` | string | Yes | - | Retention policy: `none`, `delete`, `copy`, or `move` |
| `age` | integer | No | 7 | Age threshold in days. Jobs older than this are affected |
| `include-db` | boolean | No | true | Also remove jobs from the database (not just archive) |
| `omit-tagged` | string | No | `none` | Skip tagged jobs: `none` = apply to all jobs, `all` = skip any tagged job, `user` = skip jobs with user-created tags (auto-tagger tags are not user tags) |
| `location` | string | For `move`/`copy` | - | Target directory for moved/copied jobs |
| Parameter | Type | Required | Default | Description |
| ---------------------- | ------- | --------------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `policy` | string | Yes | - | Retention policy: `none`, `delete`, `copy`, or `move` |
| `age` | integer | No | 7 | Age threshold in days. Jobs older than this are affected |
| `include-db` | boolean | No | true | Also remove jobs from the database (not just archive) |
| `omit-tagged` | string | No | `none` | Skip tagged jobs: `none` = apply to all jobs, `all` = skip any tagged job, `user` = skip jobs with user-created tags (auto-tagger tags are not user tags) |
| `format` | string | No | `json` | Output format for `copy`/`move` policies: `json` (default) or `parquet` |
| `target-kind` | string | For `move`/`copy` | `file` | Target storage kind: `file` or `s3` |
| `target-path` | string | For `target-kind: file` | - | Filesystem path for moved/copied jobs |
| `target-endpoint` | string | For `target-kind: s3` | - | S3 endpoint URL for target storage |
| `target-bucket` | string | For `target-kind: s3` | - | S3 bucket name for target storage |
| `target-access-key` | string | For `target-kind: s3` | - | S3 access key for target storage |
| `target-secret-key` | string | For `target-kind: s3` | - | S3 secret key for target storage |
| `target-region` | string | For `target-kind: s3` | - | S3 region for target storage |
| `target-use-path-style`| boolean | No | - | Use path-style S3 URLs for target (required for MinIO) |
| `max-file-size-mb` | integer | No | 512 | Maximum Parquet file size in MB before splitting. Only for `format: parquet` |

## Complete configuration examples

Expand Down Expand Up @@ -156,7 +166,8 @@ Keep 6 months active, move older data to long-term storage:
"retention": {
"policy": "move",
"age": 180,
"location": "/mnt/slow-storage/archive",
"target-kind": "file",
"target-path": "/mnt/slow-storage/archive",
"include-db": true
}
}
Expand Down Expand Up @@ -312,8 +323,8 @@ Jobs moved to the retention location can be restored:

1. Target directory exists and is writable
2. Sufficient disk space at target location
3. File permissions allow `cc-backend` to write to `location`
4. Path in `location` is absolute, not relative
3. File permissions allow `cc-backend` to write to `target-path`
4. Path in `target-path` is absolute, not relative

### Performance impact

Expand Down
3 changes: 3 additions & 0 deletions content/en/docs/reference/cc-backend/environment.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ run ./tools/gen-keypair/`. The release binaries also include the
[JWT documentation]({{< ref "jwtoken" >}} "JSON Web Token").
- `SESSION_KEY`: Some random bytes used as secret for cookie-based sessions
- `LDAP_ADMIN_PASSWORD`: The LDAP admin user password (optional)
- `CROSS_LOGIN_JWT_PUBLIC_KEY`: Base64 encoded Ed25519 public key for accepting
JWTs generated by an external authentication service (optional). Keys in PEM
format can be converted using `tools/convert-pem-pubkey`.
- `CROSS_LOGIN_JWT_HS512_KEY`: Used for token based logins via another
authentication service (optional)
- `OID_CLIENT_ID`: OpenID connect client id (optional)
Expand Down
8 changes: 5 additions & 3 deletions content/en/docs/reference/cc-backend/rest-api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,14 @@ Because tokens are signed using public/private key pairs, the signature also
certifies that only the party holding the private key is the one that signed it.
JWT tokens in ClusterCockpit are not encrypted, means all information is clear
text. Expiration of the generated tokens can be configured in config.json using
the `max-age` option in the jwts object. Example:
the `max-age` option in the `auth.jwts` object. Example:

```json
"jwts": {
"auth": {
"jwts": {
"max-age": "168h"
},
}
}
```

The party that generates and signs JWT tokens has to be in possession of the
Expand Down
Loading
Loading