OpenOnDemand - Revision history

Antony: /* I'm getting Host "whatever" not specified in allowlist or cluster configs using the shell app */

2023-11-07T22:23:19Z

I'm getting Host "whatever" not specified in allowlist or cluster configs using the shell app

Antony: /* I'm getting Host "whatever" not specified in allowlist or cluster configs using the shell app */

2023-11-07T22:21:00Z

I'm getting Host "whatever" not specified in allowlist or cluster configs using the shell app

Antony: add grafana hosting behind ood

2023-11-07T18:42:23Z

add grafana hosting behind ood

Antony at 18:20, 7 November 2023

2023-11-07T18:20:00Z

Antony: /* Switch OOD to use FreeIPA and ondemand-dex */

2023-11-07T18:06:00Z

Switch OOD to use FreeIPA and ondemand-dex

Antony: editded the ssl cert part

2023-11-07T14:33:32Z

editded the ssl cert part

Antony: adding freeipa cusomisations

2023-11-07T13:59:21Z

adding freeipa cusomisations

Antony: add some categories

2019-06-11T16:24:10Z

add some categories

Antony: post testing tweaks

2019-06-11T16:06:45Z

post testing tweaks

Antony: tweaks before final testing

2019-06-11T11:42:43Z

tweaks before final testing

@@ Line 28: / Line 28: @@
 OOD_SSHHOST_ALLOWLIST="test-[0-9][0-9][0-9]:small-[0-9][0-9][0-9]:login-1"
 </pre>
 == Switch OOD to use FreeIPA and ondemand-dex auth using ldaps ==

@@ Line 22: / Line 22: @@
 == I'm getting Host "whatever" not specified in allowlist or cluster configs using the shell app ==
 this is fixed by editing <code>/etc/ood/config/apps/shell/env</code> and adding or appending the <code>OOD_SSHHOST_ALLOWLIST</code> variable which is fully documented here https://osc.github.io/ood-documentation/latest/customizations.html?highlight=ood_sshhost_allowlist#set-ssh-allowlist
-I have three classes of nodes test-00[1-4] small-00[1-4] and login-1 so this regex works for me
+I have three classes of nodes test-00[1-8] small-00[1-4] and login-1 so this glob list more than works for me
 <pre>
 [root@login-1 config]# cat /etc/ood/config/apps/shell/env
 OOD_SHELL_ORIGIN_CHECK="https://nuig-cluster.define-technology.com"
-OOD_SSHHOST_ALLOWLIST="test-\d+,small-\d+,login-\d+"
+OOD_SSHHOST_ALLOWLIST="test-[0-9][0-9][0-9]:small-[0-9][0-9][0-9]:login-1"
 </pre>

@@ Line 19: / Line 19: @@
 .0.3.240      nuig-cluster.define-technology.com
 </pre>
@@ Line 238: / Line 246: @@
 </pre>
-notice that it's only listenting on 443 (https) and 81 (not so sure it is but hey) this is good.
+notice that it's only listening on 443 (https) and 81 (not so sure it is but hey) this is good.
 now we can install certbot <code>dnf install -y certbot</code> and run it against our domain which you have to point at the public ip <code>certbot certonly -d <public FQDN> </code>. In the following example I and doing a dry run as I have run this before but you should remove this.
@@ Line 311: / Line 319: @@
 i.e. I commented out the old SSL cert liines from the stackhpc appliance (we will need to override this in the playbooks later) and put in the new links
 everything below this line is ancient but STILL useful
 [[File:dashboard.png]]

← Older revision		Revision as of 18:20, 7 November 2023
Line 5:		Line 5:

	the deplyonment is now pretty much handled by the stackhpc/osc playbooks BUT I'm adding some extra notes do document how to do stuff by hand to tweak an existing setup.		the deplyonment is now pretty much handled by the stackhpc/osc playbooks BUT I'm adding some extra notes do document how to do stuff by hand to tweak an existing setup.
		+	== I'm getting 500 errors ==
		+	This is frequently caused by routing issues. One that got me is that in CIX the login node cannot curl to it's external ip
		+	<pre>
		+	[root@login-1 config]# curl 217.74.56.217
		+	^C
		+	</pre>
		+
		+	we solve this by adding this to /etc/hosts TODO lookup how to configure a response policy zone in freeipa
		+	</pre>
		+	[rocky@login-1 ~]$ cat /etc/hosts
		+	127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
		+	::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
		+
		+	10.0.3.240 nuig-cluster.define-technology.com
		+	</pre>

	== Switch OOD to use FreeIPA and ondemand-dex auth using ldaps ==		== Switch OOD to use FreeIPA and ondemand-dex auth using ldaps ==

@@ Line 6: / Line 6: @@
 the deplyonment is now pretty much handled by the stackhpc/osc playbooks BUT I'm adding some extra notes do document how to do stuff by hand to tweak an existing setup.
-== Switch OOD to use FreeIPA and ondemand-dex ==
+== Switch OOD to use FreeIPA and ondemand-dex auth using ldaps ==
 on the portal node (here login-1)
 first step install the ondemand-dex package
@@ Line 12: / Line 12: @@
 dnf install -y ondemand-dex
 </pre>
 now we edit the /etc/ood/config/ood-portal.yml file
-remove or commne all httpd-auth lines like these:
+the current version of ondemand docs say to using this as a guide so here it is
 <pre>
 </pre>
 == Stop httpd from listening on port 80 and use certbot to create a trusted SSL cert that won't ever expire ==

← Older revision		Revision as of 13:59, 7 November 2023
Line 3:		Line 3:

	Open OnDemand is a portal to run web applications to help add ease of use functionality to any Compute Cluster.		Open OnDemand is a portal to run web applications to help add ease of use functionality to any Compute Cluster.
		+
		+	the deplyonment is now pretty much handled by the stackhpc/osc playbooks BUT I'm adding some extra notes do document how to do stuff by hand to tweak an existing setup.
		+
		+	== Switch OOD to use FreeIPA and ondemand-dex ==
		+	on the portal node (here login-1)
		+	first step install the ondemand-dex package
		+	<pre>
		+	dnf install -y ondemand-dex
		+	</pre>
		+	now we edit the /etc/ood/config/ood-portal file
		+
		+	remove or commne all httpd-auth lines like these:
		+	<pre>
		+
		+	</pre>
		+
		+	== Stop httpd from listening on port 80 and use certbot to create a trusted SSL cert that won't ever expire ==
		+
		+	first up make sure you ARE allowing port 80 through the firewall and security groups
		+
		+	next comment out all lines in <code>/etc/httpd/conf.d/welcome.conf</code> i should look like this. '''Do not delete it or it will come back from the dead when you update apache'''
		+	<pre>
		+	root@login-1 certs]# cat /etc/httpd/conf.d/welcome.conf
		+	#
		+	# This configuration file enables the default "Welcome" page if there
		+	# is no default index page present for the root URL. To disable the
		+	# Welcome page, comment out all the lines below.
		+	#
		+	# NOTE: if this file is removed, it will be restored on upgrades.
		+	#
		+	#<LocationMatch "^/+$">
		+	# Options -Indexes
		+	# ErrorDocument 403 /.noindex.html
		+	#</LocationMatch>
		+	#
		+	#<Directory /usr/share/httpd/noindex>
		+	# AllowOverride None
		+	# Require all granted
		+	#</Directory>
		+	#
		+	#Alias /.noindex.html /usr/share/httpd/noindex/index.html
		+	#Alias /poweredby.png /usr/share/httpd/icons/apache_pb3.png
		+	</pre>
		+
		+	comment out <code>Listen 80</code> in <code>/etc/httpd/conf/httpd.conf</code> on mine its around line 45.
		+
		+	restart httpd
		+
		+	check it's not listening with systemctl and <code>ss -t \| grep -e ":http" -e ":80"</code>
		+	<pre>
		+	[root@login-1 certs]# grep "Listen 80" /etc/httpd/conf/httpd.conf -n
		+	45:#Listen 80
		+	[root@login-1 tls]# systemctl restart httpd
		+	[root@login-1 tls]# systemctl status httpd
		+	● httpd.service - The Apache HTTP Server
		+	Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
		+	Drop-In: /etc/systemd/system/httpd.service.d
		+	└─ood-portal.conf, ood.conf
		+	Active: active (running) since Tue 2023-11-07 12:41:18 GMT; 8s ago
		+	Docs: man:httpd.service(8)
		+	Process: 98483 ExecStartPre=/opt/ood/ood-portal-generator/sbin/update_ood_portal --rpm (code=exited, status=0/SUCCESS)
		+	Main PID: 98499 (httpd)
		+	Status: "Started, listening on: port 443, port 81"
		+	Tasks: 213 (limit: 100627)
		+	Memory: 44.2M
		+	CGroup: /system.slice/httpd.service
		+	├─98499 /usr/sbin/httpd -DFOREGROUND
		+	├─98500 /usr/sbin/httpd -DFOREGROUND
		+	├─98501 /usr/sbin/httpd -DFOREGROUND
		+	├─98502 /usr/sbin/httpd -DFOREGROUND
		+	└─98503 /usr/sbin/httpd -DFOREGROUND
		+
		+	Nov 07 12:41:18 login-1.cluster.internal systemd[1]: Starting The Apache HTTP Server...
		+	Nov 07 12:41:18 login-1.cluster.internal update_ood_portal[98483]: No change in Apache config.
		+	Nov 07 12:41:18 login-1.cluster.internal update_ood_portal[98483]: No change in the Dex config.
		+	Nov 07 12:41:18 login-1.cluster.internal httpd[98499]: [Tue Nov 07 12:41:18.946520 2023] [so:warn] [pid 98499:tid 140163328375104] AH01574: module status_module is already loaded, skipping
		+	Nov 07 12:41:18 login-1.cluster.internal systemd[1]: Started The Apache HTTP Server.
		+	Nov 07 12:41:18 login-1.cluster.internal httpd[98499]: Server configured, listening on: port 443, port 81
		+	[root@login-1 certs]# ss -t \| grep -e :http -e :80
		+	LAST-ACK 0 1 10.0.3.240:59462 74.125.193.99:https
		+	ESTAB 0 0 10.0.3.240:53178 92.122.160.95:https
		+	ESTAB 0 0 10.0.3.240:43826 104.82.170.85:https
		+	ESTAB 0 0 [::ffff:10.0.3.240]:https [::ffff:82.1.125.18]:56555
		+	</pre>
		+
		+	notice that it's only listenting on 443 (https) and 81 (not so sure it is but hey) this is good.
		+
		+	now we can install certbot <code>dnf install -y certbot</code> and run it against our domain which you have to point at the public ip <code>certbot certonly -d <public FQDN> </code>. In the following example I and doing a dry run as I have run this before but you should remove this.
		+	<pre>
		+	[root@login-1 certs]# certbot certonly -d nuig-cluster.define-technology.com --dry-run
		+	Saving debug log to /var/log/letsencrypt/letsencrypt.log
		+
		+	How would you like to authenticate with the ACME CA?
		+	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
		+	1: Spin up a temporary webserver (standalone)
		+	2: Place files in webroot directory (webroot)
		+	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
		+	Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1
		+	Simulating renewal of an existing certificate for nuig-cluster.define-technology.com
		+	The dry run was successful.
		+	</pre>
		+
		+	now you should have the certs in <code>/etc/letsencrypt/<fqdn>/</code> directory I tried putting this path directly into the apache config files but if fails
		+
		+	mine didn't add the renew job to cron or a timer so I did the following to auto renew the certs
		+
		+	<pre>
		+	cat >/etc/cron.daily/certbot-renew <<EOF
		+	#!/bin/bash
		+	/usr/bin/certbot renew &>/dev/null
		+	EOF
		+	chmod a+x /etc/cron.daily/certbot-renew
		+	</pre>
		+
		+	everything below this line is ancient but STILL useful

	[[File:dashboard.png]]		[[File:dashboard.png]]

← Older revision		Revision as of 16:24, 11 June 2019
Line 272:		Line 272:

	</pre>		</pre>
		+	[[Category:SLURM]]
		+	[[Category:Portal]]
		+	[[Category:VNC]]

@@ Line 32: / Line 32: @@
 Note that the last three lines configure the reverse proxy settings. the most important is the host_regex line. If a host does not match this then no proxy will connect to the node this is to stop your portal server being used to redirect traffic to node you do not control. In TrinityX we use the internal TLD domain suffix .cluster <code>'[\w.-]+\.cluster'</code> limits access to these servers. If you wanted to be more specific then you could use something like <code>node\d+\.cluster</code> or <code>(rvis|interactive)\d+\.cluster</code> to limit access to more specific hosts in the cluster.
 <pre>
 cp /etc/ood/config/ood_portal.yml /etc/ood/config/ood_portal.yml.orig
@@ Line 40: / Line 43: @@
    - 'AuthBasicProvider ldap'
    - 'AuthLDAPURL "ldaps://trinityx.cluster:636/ou=People,dc=local?uid"'
-  - 'AuthLDAPGroupAttribute memberUid'
+#  - 'AuthLDAPGroupAttribute memberUid'
-  - 'AuthLDAPGroupAttributeIsDN off'
+#  - 'AuthLDAPGroupAttributeIsDN off'
    - 'RequestHeader unset Authorization'
    - 'Require valid-user'
@@ Line 76: / Line 79: @@
 <pre>
 mkdir -p /etc/ood/config/clusters.d/
-echo > /etc/ood/config/clusters.d/my_cluster.yml << EOF
+cat > /etc/ood/config/clusters.d/my_cluster.yml << EOF
 ---
 v2:
@@ Line 159: / Line 162: @@
 yum groupinstall xfce
 yum install numpy
 exit
 luna osimage pack compute

@@ Line 130: / Line 130: @@
    bc_account:
      help: "this should be left blank most of the time"
-   desktop:
+   desktop: "xfce"
    bc_vnc_idle:
      value: 180
-     label: Idle timeout
+     label: "Idle timeout"
      help: This is the time you have to connect to a session before it is automatically terminated
    node_type: null