Skip to content

installation.md

Latest commit

 

History

History
99 lines (81 loc) · 4.39 KB

installation.md

File metadata and controls

99 lines (81 loc) · 4.39 KB
Raw

Installation overview

  1. Configure SSL redirection for OOD
  2. Install the application on OOD
  3. Install and configure the ThinLinc server on the compute node
  4. Configure ThinLinc to start sessions under SLURM's control
  5. Configure authentication for ThinLinc sessions (optional)

Chapter 1-2 are for the Open OnDemand login node and chapter 3-5 are for the compute nodes.

1. Configure SSL redirection for OOD

You need to set the SSL redirection sub-uri and the additional SSL settings for the OOD reverse proxy in /etc/ood/config/ood_portal.yml:

secure_rnode_uri: '/secure-rnode'

# Enable these extra settings if you rely on self-signed certificates
ssl_proxy:
  - 'SSLProxyCheckPeerCN Off'
  - 'SSLProxyCheckPeerName Off'

custom_vhost_directives:
  # Pre-existing settings
  - 'RewriteCond %{REQUEST_URI} ^/secure-rnode/([^/]+)/\d+/connect/\1/agent$'
  - 'RewriteRule ^/secure-rnode/[^/]+/(\d+)/connect/([^/]+)/agent$ /secure-rnode/$2/$1/agent [R=307,L]'

NOTE: Read about why the custom_vhost_directives is set in the README.

Should you want to enable Native client support, this custom virtual host directive will be needed to set the correct MIME-type for the ThinLinc profile. The native client will only work if users are able to establish a direct SSH connection to the compute node/ThinLinc server.

custom_vhost_directives:
  # Pre-existing settings
  - '<LocationMatch ".*\.tlclient$">'
  - '  Header set Content-Type "application/thinlinc.client"'
  - '  Header set Content-Disposition "attachment"'
  - '</LocationMatch>'

When you have added these configurations to your ood_portal.yml config, generate the new Apache config as such:

sudo /opt/ood/ood-portal-generator/sbin/update_ood_portal

To apply the new configurations made with update_ood_portal, you need to restart the web server running the OOD instance.

2. Install the application on OOD

  1. Clone this repository into your applications folder for OOD.

  2. Configure the form.yml

    • You need to at least configure the clusters available to start the job on. These clusters names are the ones specified in /etc/ood/config/clusters.d/<clustername>.yml.

  3. Configure the submit.yml.erb

    • This may or may not need configurations for resources such as GPU (sharing or no sharing) or other devices/configuration changes made in form.yml.

  4. Configure the view.html.erb

    • To enable the native client functionality, set the enabled_client variable to either native for native client-only support, or both to enable the native client and the web client.
    • If you configured the secure_rnode_uri to something other than /secure-rnode, change the webaccess_url variable to your value.

3. Install and configure the ThinLinc server on the compute node

Download and install the latest ThinLinc server on the compute node.

4. Configure ThinLinc to start sessions under SLURM's control

Navigate to /opt/thinlinc/etc/xsession and overrwrite the file with the contents in the provided xsession file. Also available as a direct download.

NOTE: The choice of desktop environment affects how well the session stays within its SLURM allocation. Since GNOME 3.34, gnome-session launches the whole session through the per-user systemd instance (user@<uid>.service, under user.slice), so the desktop's processes end up outside the cgroup that SLURM created for the job. The desktop still starts and runs, but SLURM can no longer reliably enforce the job's resource limits on it or clean it up when the job ends.

MATE and XFCE do not forcefully delegate session startup to systemd, so their processes stay within the SLURM allocation. We recommend MATE or XFCE, which are also lighter-weight and make better use of the allocated resources.

5. Configure authentication for ThinLinc sessions (optional)

When a user connects to their ThinLinc session, they need to authenticate. There are two supported options: no automatic login, which presents the ThinLinc Web Access login prompt without any setup required, or using the OpenID Connect support shipped in ThinLinc 4.21.0.

See the authentication document for a description of both options and how to set them up.