diff --git a/services/admin-guide/_static/ssh_gateways_list-01.png b/services/admin-guide/_static/ssh_gateways_list-01.png deleted file mode 100644 index db430fb4..00000000 Binary files a/services/admin-guide/_static/ssh_gateways_list-01.png and /dev/null differ diff --git a/services/admin-guide/_static/ssh_gateways_list-02.png b/services/admin-guide/_static/ssh_gateways_list-02.png deleted file mode 100644 index 76f6679c..00000000 Binary files a/services/admin-guide/_static/ssh_gateways_list-02.png and /dev/null differ diff --git a/services/admin-guide/_static/ssh_gateways_overview.drawio.svg b/services/admin-guide/_static/ssh_gateways_overview.drawio.svg deleted file mode 100644 index 1f5667bc..00000000 --- a/services/admin-guide/_static/ssh_gateways_overview.drawio.svg +++ /dev/null @@ -1,245 +0,0 @@ - - - - - - - -
-
-
- Firewall -
-
-
- - - Firewall - - - - - - - -
-
-
- Firewall -
-
-
- - - Firewall - - - - - - -
-
-
- Office Network -
-
-
- - - Office Net... - - - - - - - -
-
-
- Protected -
- Network -
-
-
- - - Protected... - - - - - - - - - -
-
-
- ssh / 22 -
-
-
- - - ssh / 22 - - - - - - - - -
-
-
- ICMP/PING -
-
-
- - - ICMP/PING - - - - - - -
-
-
- Gateway Network -
- 129.129.197.0/24 -
-
-
- - - Gateway Ne... - - - - - - - - -
-
-
- ssh gateway -
-
-
- - - ssh gateway - - - - - - - - -
-
-
- VNC / 5900 -
-
-
- - - VNC / 5900 - - - - - - - - -
-
-
- RDP / 3389 -
-
-
- - - RDP / 3389 - - - - - - - - -
-
-
- NX / 4000 -
-
-
- - - NX / 4000 - - - - - - - - -
-
-
- ssh / 22 -
-
-
- - - ssh / 22 - - - - - - - - -
-
-
- central services -
-
-
- - - central se... - - - - - - - - - Text is not SVG - cannot display - - - - diff --git a/services/admin-guide/_static/unix_groups_image-01.png b/services/admin-guide/_static/unix_groups_image-01.png deleted file mode 100644 index 8ac998ba..00000000 Binary files a/services/admin-guide/_static/unix_groups_image-01.png and /dev/null differ diff --git a/services/admin-guide/index.md b/services/admin-guide/index.md deleted file mode 100644 index ef54dc01..00000000 --- a/services/admin-guide/index.md +++ /dev/null @@ -1,5 +0,0 @@ -# Admin Guide - - -```{tableofcontents} -``` diff --git a/services/admin-guide/nx_nomachine.md b/services/admin-guide/nx_nomachine.md deleted file mode 100644 index 5dbd1b1b..00000000 --- a/services/admin-guide/nx_nomachine.md +++ /dev/null @@ -1,17 +0,0 @@ -# NX Nomachine - -All information about the nomachine service and how to troubleshoot, currently can be found here: https://git.psi.ch/nomachine/documentation - - -## Hiera - -To install and configure nomachine vie hiera following variables are needed: - -``` -base::enable_nomachine: true -nomachine::version: '8.4.2-1' -nomachine::profile: 'enterprise-desktop' -nomachine::license::: -``` - -Which versions are available for `nomachine:profile` can be found in here: https://git.psi.ch/linux-infra/puppet/-/blob/preprod/code/modules/profile/manifests/nomachine.pp#L3 diff --git a/services/admin-guide/ssh_gateways.md b/services/admin-guide/ssh_gateways.md deleted file mode 100644 index ba829c07..00000000 --- a/services/admin-guide/ssh_gateways.md +++ /dev/null @@ -1,182 +0,0 @@ -# SSH Gateways - -The purpose of the ssh gateways is to give access to protected networks and resources (for a finite period of time). The gateway always gives access to the networks first name is indicating, i.e. sf-gw is giving access to all sf networks, sls-gw is giving access to sls networks. - -Users are only supposed to use ssh to connect to the gateways as well as them to further connect to other machines. Never the less, for ease of use, there are some protocols/ports that can directly be accessed from the ssh gateway. These ports include: 5900 VNC, 3389 RDP, 4000 NX, ICMP/PING. -Therefore direct portforwarding on those ports will work. - -``` -ssh -L 3389:machine-you-want-to-connect:3389 protected-network-gw -``` - -It is not intended that users keep state on the gateways (e.g. screen/tmux sessions) - -Depending on the gateway the user authenticates via password or password/MFA combination. - -All ssh gateways are located in an isolated network __129.129.197.x__. Communication to and from the ssh gateways always go through the PSI firewall and needs to be explicitly enabled. - -Following communication is currently possible: -![](_static/ssh_gateways_overview.drawio.svg) - - -The access to a gateway is always controlled via an AD group. The name of the AD group always follows the same pattern: __unx-gw_<gateway-name>__. __gateway-name__ is always the part of ssh gateways name before the __-gw__ (example: sls-gw.psi.ch > unx-gw_sls). - - -(temporary solution) Depending on the gateway the members of the group are either managed in [DUO](https://duo.psi.ch) by the beamline scientist or via https://git.psi.ch/controls_it/unix_group_management. - -However, the general baseline is that always the responsible of the protected network must approve that a user is added to the group. - -(temporary solution) The effective update of the AD groups is currently done on gfa-admin.psi.ch via some webhooks / timers. -- /etc/systemd/system/update_ad_gw_groups.service -- /etc/systemd/system/ldaputils_webhook.service - - -The administration and management of the gateways is done via hiera: -https://git.psi.ch/linux-infra/hiera/data-lx (all the machines are in the sshgw group) - -## Gateway List -The list of supported gateways can be found here: -https://git.psi.ch/linux-infra/ansible/playbooks/lx_ansible/-/blob/main/inventory.yaml#L3 - - -## Group Membership / Access Groups - -The memberships and the approver of the different gateway access groups (naming pattern: unx-gw_XX) can be found on this Service Now page: - -https://psi.service-now.com/now/nav/ui/classic/params/target/sys_user_group_list.do%3Fsysparm_query%3DnameSTARTSWITHunx-gw_%255Eactive%253Dtrue%26sysparm_first_row%3D1%26sysparm_view%3Dlinux_groups%26sysparm_choice_query_raw%3D%26sysparm_list_header_search%3Dtrue - -Once you have the list, click on a group to see the details for this group: -![](_static/ssh_gateways_list-01.png) - -To see/check the member of this group scroll down and select the __Group Members__ tab: -![](_static/ssh_gateways_list-02.png) - - - - -### Grant User Access to Gateway -To grant a user access to a gateway use the same Workflow as described in the [SSH Gateway - User Guide](https://linux.psi.ch/services-user-guide/ssh_gateways.html) - -### Remove / Revoke User Access -Remove a user from a group, please open a normal Incident in service now. (Need to be improved!) - - -## Troubleshooting - -### Checklist - -- Is gateway up and running? -- Is user part of the AD group giving access to the gateway (ideally check on the gateway itself) - ``` - getent group unx-gw_ - ``` - or - - ``` - id whaeveruser_l | sed 's/,/\n/g' | grep unx-gw_ - 35526(unx-gw_twlha) - 35514(unx-gw_hipa) - 35524(unx-gw_sls) - 35525(unx-gw_sf) - -bash-4.2$ - ``` - - - In case the user is not part of the group, the user needs to contact the respective responsible (i.e. beamline scientist in case of a beamline) to add him to the group. The management of the group membership is currently done in DUO. - -### General -Howto identify and kill high load sessions on the ssh gateway, useful commands for usage diagnostic: - -`top` or `htop` wil list heavy CPU consumers (see manpages for details) -`w` will list all user connections (see manpage for details) -`w ` will list connections for a specific user - -### Show users most traffic -```bash -[ ~]# nethogs -``` - -### Show heavy CPU consumers -```bash -[ ~]$ top -b -d 5 | head -n 20 -top - 11:47:44 up 67 days, 6:09, 51 users, load average: 9.63, 10.87, 10.50 -Tasks: 406 total, 10 running, 396 sleeping, 0 stopped, 0 zombie -%Cpu(s): 74.3 us, 20.0 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 5.7 si, 0.0 st -KiB Mem : 8008520 total, 5377448 free, 908264 used, 1722808 buff/cache -KiB Swap: 0 total, 0 free, 0 used. 6806948 avail Mem - - PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND -9674 xxxxxx+ 20 0 197068 6032 4196 S 10.3 0.1 225:29.90 ssh -10012 xxxxxx 20 0 202292 11976 1264 R 10.3 0.1 1257:25 sshd -10043 xxxxxx 20 0 202124 11052 4196 R 10.3 0.1 1350:13 ssh -27819 xxxxxx 20 0 205632 10324 1228 R 10.3 0.1 3462:20 sshd -9629 xxxxxx 20 0 192728 3700 1220 S 6.9 0.0 211:37.81 sshd -10160 xxxxxx 20 0 201304 5908 1228 S 6.9 0.1 501:14.56 sshd -10193 xxxxxx 20 0 199268 8140 4192 R 6.9 0.1 535:54.23 ssh -17510 xxxxxx 20 0 198616 3028 1252 R 6.9 0.0 15:08.35 sshd -18082 xxxxxx 20 0 204092 15148 1252 S 6.9 0.2 3:42.87 sshd -18786 xxxxxx 20 0 196448 5332 4188 S 6.9 0.1 1:36.56 ssh -19719 xxxxxx 20 0 199692 4404 1228 S 6.9 0.1 71:23.15 sshd -23834 xxxxxx 20 0 199096 3612 1204 R 6.9 0.0 156:01.83 sshd -23872 xxxxxx 20 0 198564 7540 4192 R 6.9 0.1 167:02.21 ssh -``` - - -### Show all connections from a specific user: -```bash -[ ~]$ w wally_e -11:10:40 up 67 days, 5:32, 51 users, load average: 10.26, 7.79, 7.64 -USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT -wally_e pts/0 pc11006.psi.ch 12Sep23 20days 12:03 0.36s sshd: wally_e [priv] -wally_e pts/10 satese-cons-06.p 11Sep23 17days 0.02s 0.02s -bash -wally_e pts/15 satese-cons-06.p Thu17 28:40 2:24m 2:24m ssh -XY sf-lca -wally_e pts/68 pc11006.psi.ch 03Oct23 4days 4:19m 4:19m ssh -XY sf-lc7a -wally_e pts/79 satesf-cons-07.p 26Sep23 13days 3:54m 3:54m ssh -CXY sf-lc7a -wally_e pts/85 pc11006.psi.ch 21Sep23 1:58m 11:01m 11:01m ssh -CXY sf-lc7a -``` - -### Show listing of last logged in users: -```bash -[ ~]$ last -bob_b pts/28 macstudvonhelge. Tue Oct 10 11:25 - 11:28 (00:03) -bob_b pts/42 macstudvonhelge. Tue Oct 10 11:17 - 11:17 (00:00) -bob_b pts/28 macstudvonhelge. Tue Oct 10 11:16 - 11:17 (00:00) -builder_b pts/41 pc9681.psi.ch Tue Oct 10 11:08 still logged in -[…] -``` - -### List all outbound connections for a specific user: -```bash -[ ~]$ pgrep -au wally_e | grep -w ssh -8101 ssh -CXY sf-lc7a -9101 ssh -XY sf-lca -14058 ssh -CXY sf-lc7a -26888 ssh -CXY sf-lc7a -32317 ssh -XY sf-lc7a -``` - -### List all inbound connections for a specific user: -```bash -[ ~]$ pgrep -au wally_e | grep -w sshd -9066 sshd: wally_e@pts/15 -14018 sshd: wally_e@pts/85 -26857 sshd: wally_e@pts/79 -30364 sshd: wally_e@pts/0 -32177 sshd: wally_e@pts/10 -32286 sshd: wally_e@pts/68 -``` - - -Terminate Sessions - -### The following command will terminate all sessions from user ‘wally_e’: - -```bash -[ ~]$ sudo pkill -u wally_e -``` - -### The following command will terminate a specific sessions: -```bash -[ ~]$ sudo kill 30364 -``` - - diff --git a/services/admin-guide/unix_groups.md b/services/admin-guide/unix_groups.md deleted file mode 100644 index 75bce2cb..00000000 --- a/services/admin-guide/unix_groups.md +++ /dev/null @@ -1,19 +0,0 @@ -# Unix Groups / Group Management - -Users can be added to a unix group by this workflow: -[SSH Gateway - User Guide](https://linux.psi.ch/services-user-guide/unix_groups.html) - -The administrators registered for a group will get an approval request email. Uppon approval the user will be automatically added to the group. - -You can also add users on their behalf. If you are one of the admins of the groups the request will be automatically approved (no need to approve it additionally) - - -The member as well as the administrators of the group can be found here: -https://psi.service-now.com/now/nav/ui/classic/params/target/sys_user_group_list.do%3Fsysparm_userpref_module%3D92f011c81b440690d6a82f4aab4bcb5f%26sysparm_view%3Dlinux_groups%26sysparm_query%3DnameSTARTSWITHunx%255Eactive%253Dtrue%255EEQ%26sysparm_force_row_count%3D500 - -![](_static/unix_groups_image-01.png) - -If there are no administrators marked, the helpdesk will get the approval request. - -To remove users from a group create a general Service Now ticket. -(there will be an easier workflow in the upcoming weeks) \ No newline at end of file diff --git a/services/admin-guide/webhosting.md b/services/admin-guide/webhosting.md deleted file mode 100644 index aea91a36..00000000 --- a/services/admin-guide/webhosting.md +++ /dev/null @@ -1,43 +0,0 @@ -# WebHosting - -WebHosting is a service for running simple web apps without the need to operate and maintain a virtual machine. Based on Docker compose, it allows users to configure their applications and access them through an NGINX reverse proxy, which directs requests to the appropriate service. Certificates will be deployed by us. The content for hosted websites will be available on an NFS share, which you can access. - -## Available Services - -- **Elog** is pre-configured as a container and can be ordered and configured by you. - - -## How to Use the Service - -> **Note:** If you need assistance at any step, reach out to [linux-eng](mailto:linux-eng@psi.ch). - -1. **Prepare Your Service** - - Ensure your service is running in one or more Docker container. - -2. **Create a Branch or Fork** - - Navigate to the repository: [WebHosting](https://git.psi.ch/linux-infra/WebHosting) - -3. **Edit the Docker Configuration** - - Update the `docker-compose.yaml` file in the repository to include you service container(s). - - Add a configuration file for your service to the `conf.d` directory, specifying `proxy_pass` with the container's name as defined in `docker-compose.yaml` to route requests properly through the nginx reverse proxy to your container(s). - -4. **Create a Merge Request** - - Submit a merge request in the [WebHosting](https://git.psi.ch/linux-infra/WebHosting) repository. - -5. **Contact Linux Engineering for Merge Approval** - - Email [linux-eng](mailto:linux-eng@psi.ch) to request the merge of your branch after review. - - The team will handle certificate creation post-review. - -6. **Deployment** - - The service is automatically deployed upon merging to the main branch. - - -## Additional Information - -- **Backup Schedule** - - Elog Logbooks are backed up hourly, retained for one week. - - Other web content is backed up four times daily. - -- **Running Multiple Containers** - - For services needing multiple containers, we can create additional networks upon request. - diff --git a/services/admin-guide/wmgt.md b/services/admin-guide/wmgt.md deleted file mode 100644 index d9fb53fd..00000000 --- a/services/admin-guide/wmgt.md +++ /dev/null @@ -1,37 +0,0 @@ -# wmgt.psi.ch - -The wmgt service consists of 3 servers, wmgt01 / wmgt02 / wmgt03. -wmgt01/wmgt02 are hardware servers, wmgt03 is virtual. - -The locations of the hardware servers are: -wmgt01 - location datacenter west -wmgt02 - location datacenter __east__ - -These systems are not Puppet managed! - -Access CIMC Interfaces: -rmwmgt01.mgt.psi.ch (DC West) und -rmwmgt02.mgt.psi.ch (DC Ost) - -Username: lxadmin -The credentials can be found in the pass store. - -The easiest way to access them is via Socks Proxy via wmgt-> eadmin01/wadmin01. There is a chicken-egg problem, if none of the wmgt systems are running then there is also no access to the CIMC interfaces. In that case one must go into the serverroom to access it. - -## User Management -User management is done via the AD group - svc-wmgt_users currently there is not automated approval workflow. Up to now Tobias Marx approved who is allowed to access wmgtXX except for users from ZPT. Those users are currently added without approval. - -We will change this workflow to a ServiceNow workflow. Tobias has to approve all users (without any exceptions) It would also be good if there would be a periodic review of the access list. - -## Monitoring -Currently the monitoring of the systems is here: -https://kibana.psi.ch/s/dcdb/app/dashboards#/view/e351a5e0-df75-11ed-97b0-67ad05d92422?_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-15m,to:now)) - -## Administration - -The repos with the necessary setup for the wmgt systems are currently located here: https://git.psi.ch/linux-infra/wmgt-tmp - -## Responsibilities -Hardware responsibility is within the AIT Central Infrastructure group. This includes Hardware monitoring, replacement of broken hardware as well as information/planning for the hardware lifecycle. - -Operation of the service is within the responsiblity of Linux Core. diff --git a/services/index.md b/services/index.md deleted file mode 100644 index 9068fe67..00000000 --- a/services/index.md +++ /dev/null @@ -1,4 +0,0 @@ -# Services - -```{tableofcontents} -``` \ No newline at end of file diff --git a/services/user-guide/_static/ssh_gateways_01.png b/services/user-guide/_static/ssh_gateways_01.png deleted file mode 100644 index 1025c4cc..00000000 Binary files a/services/user-guide/_static/ssh_gateways_01.png and /dev/null differ diff --git a/services/user-guide/_static/ssh_gateways_02.png b/services/user-guide/_static/ssh_gateways_02.png deleted file mode 100644 index ca2cc873..00000000 Binary files a/services/user-guide/_static/ssh_gateways_02.png and /dev/null differ diff --git a/services/user-guide/_static/ssh_gateways_03.png b/services/user-guide/_static/ssh_gateways_03.png deleted file mode 100644 index a6758004..00000000 Binary files a/services/user-guide/_static/ssh_gateways_03.png and /dev/null differ diff --git a/services/user-guide/_static/ssh_gateways_04.png b/services/user-guide/_static/ssh_gateways_04.png deleted file mode 100644 index a3a95c24..00000000 Binary files a/services/user-guide/_static/ssh_gateways_04.png and /dev/null differ diff --git a/services/user-guide/_static/unix_groups_request_01.png b/services/user-guide/_static/unix_groups_request_01.png deleted file mode 100644 index 33746bfb..00000000 Binary files a/services/user-guide/_static/unix_groups_request_01.png and /dev/null differ diff --git a/services/user-guide/_static/unix_groups_request_02.png b/services/user-guide/_static/unix_groups_request_02.png deleted file mode 100644 index 80e704a2..00000000 Binary files a/services/user-guide/_static/unix_groups_request_02.png and /dev/null differ diff --git a/services/user-guide/_static/unix_groups_request_03.png b/services/user-guide/_static/unix_groups_request_03.png deleted file mode 100644 index f7234d9e..00000000 Binary files a/services/user-guide/_static/unix_groups_request_03.png and /dev/null differ diff --git a/services/user-guide/_static/unix_groups_request_04.png b/services/user-guide/_static/unix_groups_request_04.png deleted file mode 100644 index 6ce6800a..00000000 Binary files a/services/user-guide/_static/unix_groups_request_04.png and /dev/null differ diff --git a/services/user-guide/gitea/gitea-faq.md b/services/user-guide/gitea/gitea-faq.md deleted file mode 100644 index 34bd9689..00000000 --- a/services/user-guide/gitea/gitea-faq.md +++ /dev/null @@ -1,68 +0,0 @@ -# Important information about the Gitea migration -Most frequently asked questions about the Gitea migration and guides to get started. -If you are missing something here please contact [Gitea Project](mailto:gitea@psi.ch) - -## What Serives are available? -### GIT -Gitea is a barebone GIT service. It is a GitHub fork and therefore very similar to GitHub. -https://gitea.psi.ch - -### Pages -You can publish your own gitpage within seconds! -There is two ways described here how you can create your own gitpage: -1. Create a Repository called gitea-pages in your Organization with a second branch called gitea-pages. -All content inside the gitea-pages branch will be automatically published under: {YourOrg}.pages.psi.ch -If you want to have this content available in the internet, please open a SNOW ticket with your request and some justyfication about why that should be exposed to the internet. - -2. Create a gitea-pages branch inside any repository, the content of that branch will be served at: {YourOrg}.pages.psi.ch/{YourRepo} -Same rules for publishing apply to this method too. - -### Snippets -Since Gitea has no way to publish snippets we introduce snippets.psi.ch -When you press "Continue with PSI Gitea account" the Auth token used with Gitea will be reused to login to snippets. (Also works if you have MFA enabled) -Snippets can be read by anonymous users / services but only created by a logged in user. - -### Runners -We provide runners in every security zone, that you can wherever you are inside PSI-Network use the CI/CD from Gitea. -If none of the runners available to your project suits you, you can contact [Gitea Project](mailto:gitea@psi.ch) and we can find a solution that fits you best. -The runner RPM is available on repos.psi.ch and also as package to download in the Linux Organization on Gitea. https://gitea.psi.ch/linux/act-runner/packages - - -## FAQ - -### My Project was migrated and I can't push anymore -This Project was archived and is now available on https://gitea.psi.ch -Please use following commands to update your local git: - -- `git remote -v` -- If the output starts with "origin https..." use option 1 otherwise 2 -1. `git remote set-url https://gitea.psi.ch/{Org}/{Repo}.git` -2. `git remote set-url git@gitea.psi.ch:/{Org}/{Repo}.git` -If you have not recieved a special notification about the archival the organization is the Gitlab group name. - -More information about archived projects can be found here: -- https://docs.gitlab.com/user/project/working_with_projects/#archive-a-project - -### I want to migrate a project from Gitlab / Github to Gitea -Login to https://gitea.psi.ch with your PSI LDAP account. (Username: muster_m Password: SUPERSECRET123) -Since Gitea is a GitHub fork, you will find Organizations instead of groups. Every user is allowed to create Organizations. -When should I create a new Organization? -> If you are (or feel) responsible for a certain team in PSI it makes sense to create an Organization named likewise. Try to use the official names used at PSI. In the top left corner you can click on browse and then Organizations to see if someone already created the desired organization. - -Optional: -- Click the "+" in the top right of your screen and create an organization -- Authorization inside Organizations can be done via Teams - Create Team and give the persmissions you need -- If you want to use AD Groups to authorize people in your Teams please contact [Gitea Project](mailto:gitea@psi.ch) - -Migration: -- Click the "+" in the top right of your screen and click "New Migration" -- Choose the Source you want to migrate from -- Enter the HTTPS clone URL -- On the source you need to create an access token for that project -- Paste the token in "Access Token" -- Choose the migration options (Attention! If you choose mirror, you won't be able to migrate releases!) -- Choose an Owner (Organization or if its a personal Project your Username) and give it a name. (Can be the existing one) - -### I had a collaboration with non PSI Users on gitlab.psi.ch -All "ext-" users have been imported as restricted users and must be explicitly added to a project. -If you are missing a user and you are sure it has a PSI account, message [Gitea Project](mailto:gitea@psi.ch) - diff --git a/services/user-guide/gitea/gitea-pages.md b/services/user-guide/gitea/gitea-pages.md deleted file mode 100644 index 27b8c2f1..00000000 --- a/services/user-guide/gitea/gitea-pages.md +++ /dev/null @@ -1,2 +0,0 @@ -# Gitea Pages -Available under {YourOrg}.pages.psi.ch diff --git a/services/user-guide/gitea/gitea-runner.md b/services/user-guide/gitea/gitea-runner.md deleted file mode 100644 index 900d6d62..00000000 --- a/services/user-guide/gitea/gitea-runner.md +++ /dev/null @@ -1,2 +0,0 @@ -# Gitea Runner -Available in every security zone diff --git a/services/user-guide/gitea/gitea-snippets.md b/services/user-guide/gitea/gitea-snippets.md deleted file mode 100644 index fdbfb087..00000000 --- a/services/user-guide/gitea/gitea-snippets.md +++ /dev/null @@ -1,2 +0,0 @@ -# Gitea Snippets -Snippet Server for Gitea has SSO with gitea.psi.ch diff --git a/services/user-guide/gitea/gitea.md b/services/user-guide/gitea/gitea.md deleted file mode 100644 index 712f3697..00000000 --- a/services/user-guide/gitea/gitea.md +++ /dev/null @@ -1,5 +0,0 @@ -# Gitea (Git with a cup of tea) -This is the official GIT Service at PSI. -It offers a wide range of features and improvements to the Gitlab service and will be its successor. -Here you can find various information about the services offered with Gitea and a FAQ about the migration. - diff --git a/services/user-guide/gitlab/container.psi.ch.md b/services/user-guide/gitlab/container.psi.ch.md deleted file mode 100644 index ef71b9d4..00000000 --- a/services/user-guide/gitlab/container.psi.ch.md +++ /dev/null @@ -1,20 +0,0 @@ -# Container Registry - -The container registry is available under container.psi.ch. - -To push a container to the registry you need to tag it accordingly. Also you need to login to the registry before pushing. - -```bash -# login to the container registry -docker login container.psi.ch - -# tag you container -docker tag {MYCONTAINER} container.psi.ch/{NAMESPACE}/{YOURCONTAINER}:{TAG} - -# push container -docker push container.psi.ch/{NAMESPACE}/{YOURCONTAINER}:{TAG} -``` - -```{note} -The container registry is __only__ available inside the PSI-Network. -``` diff --git a/services/user-guide/gitlab/dependency_proxy.md b/services/user-guide/gitlab/dependency_proxy.md deleted file mode 100644 index b88f962d..00000000 --- a/services/user-guide/gitlab/dependency_proxy.md +++ /dev/null @@ -1,26 +0,0 @@ -# Dependency Proxy - -The dependency proxy in Gitlab is only able to pull images from docker hub. There is an epic on Gitlab.com to support other registries. -https://gitlab.com/groups/gitlab-org/-/epics/6061 - -## How to use the dependency proxy? - -Manually: - -Enable the dependency proxy in the desired group and use following command: -``docker pull git.psi.ch/GROUPNAME/dependency_proxy/containers/IMAGENAME:TAG`` - -``docker pull git.psi.ch/docker/dependency_proxy/containers/alpine:latest`` pulls the image to your computer “trough” the dependency proxy. If the image digest is the same on dockerhub and in the dependency proxy, it will pull from the proxy. - - -Automated: - -``image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/alpine:latest`` -Add this to your .gitlab-ci.yml to use the proxy in your pipelines. You can find the exact line of code when you enable the dependency proxy in your group. - -https://docs.gitlab.com/ee/user/packages/dependency_proxy/#use-the-dependency-proxy-for-docker-images -All the documentation can be found here. - -## Note - -The dependency proxy and the docker registry are not the same blob storage and therefore the images are also named differently. It is suggested to use the dependency proxy only in automated setups / pipelines. \ No newline at end of file diff --git a/services/user-guide/gitlab/git.psi.ch.md b/services/user-guide/gitlab/git.psi.ch.md deleted file mode 100644 index f83ba4a9..00000000 --- a/services/user-guide/gitlab/git.psi.ch.md +++ /dev/null @@ -1,30 +0,0 @@ -# General Information and Guideline - -__Under Construction!__ - -To make a cut between internal development and external colaboration, there is two installations of Gitlab at PSI. -For convenience reasons, we speak of Gitlab. If the information is specific to one instance it will be called by its URL. - -## Comparison -| Feature | gitlab.psi.ch | git.psi.ch | -| :------ | ------- | ---------------: | -| Container Registry | No | Yes | -| RPM Registry | Yes | Yes | -| Gitpages | No | Yes | -| ACL for Gitpages | No | Yes | -| LFS | Yes | Yes | -| Public accessible | Yes | No | - -## User Management -Every PSI User is allowed to login to Gitlab, to work with non PSI Users, these must first be registered in AD. This can be done in [SNOW](https://intranet.psi.ch/en/computing/request-accounts-for-external-collaborators) (Beware Page is a little out of date) -The user must have logged in first to Gitlab that it can be added to any group or project. -Make sure to upload an SSH public key to your Gitlab profile to be able to push and pull code with SSH. - -Sign-up and local Users are disabled. - -## Runners -There are 2 shared Gitlab runners to use, if you want to use deticated runners, these must be registered first and the option to use shared runners disabled in the project options. -Runners are in the responsability of the owner, if there are any changes, we will inform the users accordingly. - -## Availability -There is no SLA on Gitlab, but we do our best to have it available like other linux services during office hours. diff --git a/services/user-guide/gitlab/gitlab.md b/services/user-guide/gitlab/gitlab.md deleted file mode 100644 index 86fdfd5d..00000000 --- a/services/user-guide/gitlab/gitlab.md +++ /dev/null @@ -1,17 +0,0 @@ -# Gitlab - -__Still under construction !!!__ - -gitlab.psi.ch is the Internet facing Git service of PSI. All PSI users can use the service by simply login in. Also external collaborators can use the service as soon as they have a PSI ext account. - -To grant an external collaborator access to a repository following steps are needed: - -1. Order an ext-account for your collaborator -2. Once the account is created, your collaborator need to login to gitlab.psi.ch. Important use `ext-` as username to log in, not the external email address! -3. Grant access to the needed repositories via Manage > Members - - -More documentation that can be found here: -- (Gitlab) git.psi.ch -- (Container Registry) container.psi.ch -- (Git Pages) gitpages.psi.ch diff --git a/services/user-guide/gitlab/gitlab_cli.md b/services/user-guide/gitlab/gitlab_cli.md deleted file mode 100644 index 6539b2a9..00000000 --- a/services/user-guide/gitlab/gitlab_cli.md +++ /dev/null @@ -1,34 +0,0 @@ -# Gitlab CLI - -To interact with your gitlab instances via CLI you can use the Gitlab CLI tool: https://gitlab.com/gitlab-org/cli - - -## Installation - -On a standard PSI RHELX system you can install the CLI client via: -``` -yum install glac -``` - -Otherwise please head over to https://gitlab.com/gitlab-org/cli/-/releases and download/install the client for your platform. - -## Usage - -Configuration for your instance: -``` -glab config set -g host git.psi.ch -``` - -Global configuration file can be found: -`~/.config/glab-cli/config.yml` - -Authentication -- Create access token with at least **API** and **write_repository** permissions: https://git.psi.ch/-/profile/personal_access_tokens?scopes=api,write_repository - -``` -glab auth login --hostname git.psi.ch --token -``` - -After authentication you can work with the `glab` command as documented on: -https://gitlab.com/gitlab-org/cli#core-commands - diff --git a/services/user-guide/gitlab/gitpages.psi.ch.md b/services/user-guide/gitlab/gitpages.psi.ch.md deleted file mode 100644 index 71ae7cec..00000000 --- a/services/user-guide/gitlab/gitpages.psi.ch.md +++ /dev/null @@ -1,8 +0,0 @@ -# Pages -__Under Construction!__ - -Gitpages can be used to display static HTTP content. Per default, gitpages are readable by everyone. You can change this behaviour in your project settings in the general tab under "visibility, project features, permissions" to only allow authenticated users to read your page. - -To make gitpages accessible with a different (more speaking name) one can order a DNS entry in ServiceNow like linux.psi.ch :) - -Gitpages are only available inside the PSI Network and only on git.psi.ch (internal gitlab) diff --git a/services/user-guide/gmgt.md b/services/user-guide/gmgt.md deleted file mode 100644 index e067354f..00000000 --- a/services/user-guide/gmgt.md +++ /dev/null @@ -1,11 +0,0 @@ -# gmgt.psi.ch - -gmgt.psi.ch is the jumphost to reach GMGTW (WinSRV) via RDP or iLO (https:443) in the GFA managment network. - -The access group is manually managed via puppet/hiera: https://git.psi.ch/linux-infra/hiera/data-lx/-/blob/master/default/lx-gmgt-01.psi.ch.yaml?ref_type=heads - -Access to the machine is via wmgtXX.psi.ch - -```bash -ssh -J wmgt.psi.ch gmgt.psi.ch -``` diff --git a/services/user-guide/index.md b/services/user-guide/index.md deleted file mode 100644 index 43006c17..00000000 --- a/services/user-guide/index.md +++ /dev/null @@ -1,6 +0,0 @@ -# User Guide - -These are the current services supported by the Core Linux group: - -```{tableofcontents} -``` diff --git a/services/user-guide/nx_nomachine.md b/services/user-guide/nx_nomachine.md deleted file mode 100644 index f9e1ffe0..00000000 --- a/services/user-guide/nx_nomachine.md +++ /dev/null @@ -1,6 +0,0 @@ -# NX Nomachine - -More info on the nomachine service can be found here: -[User Documentation - Intranet](https://www.psi.ch/en/photon-science-data-services/remote-interactive-access) - - diff --git a/services/user-guide/python.md b/services/user-guide/python.md deleted file mode 100644 index 903958dc..00000000 --- a/services/user-guide/python.md +++ /dev/null @@ -1,53 +0,0 @@ -# Python - -## Package Caching Proxy - -Instead of accessing pypi.org directly PSI provides a caching proxy for pypi packages. There are several advantages in using this instead of directly accessing pypi.org: - -1. Speed - the caching proxy might/will improve the dependency resolution and download speed for installing packages -2. Once downloaded/installed packages will still be available even if they are not accessible on the internet again. -3. Accessibility - pypi.psi.ch is accessible from all PSI networks (including the onces without internet access) - -### Usage -The url to use the CachingProxy is: https://pypi.psi.ch/simple: - -You can manually specify the url while using the `pip` command as follows: -pip install --index-url=https://pypi.psi.ch/simple pandas - - -To fix the default url for your user to the proxy you can create the following config file within your users home directory: - -```bash -% cat ~/.config/pip/pip.conf -[global] -timeout = 60 -index-url = https://pypi.psi.ch/simple -``` - -To change the default for the whole system edit: `/etc/pip.conf` -(also see: https://pip.pypa.io/en/stable/topics/configuration/#location) - -To check whether your pip client is using this address you can simply issue a: -``` -pip install -h -``` - -Check whats written in the descripiton of the option --index-url: - -``` -% pip install -h | grep -A5 index-url - -i, --index-url Base URL of the Python Package Index (default - https://pypi.psi.ch/simple). This should point - to a repository compliant with PEP 503 (the - simple repository API) or a local directory laid - out in the same format. -... -``` - -or do a `pip config list` -``` -% pip config list -global.index-url='https://pypi.psi.ch/simple' -global.timeout='60' - -``` \ No newline at end of file diff --git a/services/user-guide/ssh_gateways.md b/services/user-guide/ssh_gateways.md deleted file mode 100644 index db0d9940..00000000 --- a/services/user-guide/ssh_gateways.md +++ /dev/null @@ -1,82 +0,0 @@ -# SSH Gateways - -The purpose of the ssh gateways is to give temporary access to protected networks and resources. Users are only supposed to use __ssh__ to connect to and from the gateways. - -The access to the gateway is controlled by special ActiveDirectory groups. The membership of the groups are managed by the responsible of the protected network the gateway gives access to. In case of a beamline this is the beamline scientist. - -Connecting to a gateway: - -```bash -ssh -gw -``` - -To avoid having to type your password to connect to the gateway you can upload your ssh public key to it. This can be done by: - -```bash -ssh-copy-id -gw -``` - -Afterwards you should be able to login to the gateway without a password. - - -Establishing an SSH connection through the gateway to a machine inside the protected network: - -```bash -ssh -J -gw -``` - -## Request Gateway Access - -Access to a Gateway can be requested via Service Now with the following workflow: - -Open Service Now and https://psi.service-now.com/psisp and browse to the __Request Gateway Access__ Workflow as follows: - -![](_static/ssh_gateways_01.png) -![](_static/ssh_gateways_02.png) - -Alternatively you can search for "Gateway" in the search field. - -![](_static/ssh_gateways_04.png) - -Afterwards specify the user and the Gateway you request access for: -![](_static/ssh_gateways_03.png) - -Once the request is submitted the responsible person for the Gateway Access List will be informed and requested for approval. Once the Approval is given the user will be automatically added to the necessary AD group. - -## Using SSH Gateways with Windows - -1. Open Command Prompt -Run CMD: Press Windows Key + R, type cmd, and press Enter. - -Alternatively, search for "Command Prompt" (“Eingabeaufforderung” in German) in the search bar and select it. - - -2. Connecting to a Gateway -```powershell -ssh @-gw -``` - -3. Establish an SSH connection through the gateway to a machine inside the protected network -```powershell -ssh -J @-gw @ -``` - -### Optional: Save the Connection in a Batch File - -Saving the Connection in a Batch Script let’s you re-use the command. This way you won’t have to retype it every time you use the same connection again. - -Open Notepad: -- Press Windows Key + R, type `notepad`, and press `Enter`. -- Type the SSH command, for example: -``` -ssh -J @-gw @ -``` -- Save the File as a Batch File: Click on File > Save As. -- Set the file name, e.g., connect-to-gateway.bat. -- Choose "Save as type": Select All Files. -- Ensure the file extension is .bat (e.g., connect-to-gateway.bat). -- Save the file in a convenient location, such as your Desktop. - - -Run the Batch File: -- Double-click the .bat file to execute the SSH command. \ No newline at end of file diff --git a/services/user-guide/unix_groups.md b/services/user-guide/unix_groups.md deleted file mode 100644 index 122ab6cf..00000000 --- a/services/user-guide/unix_groups.md +++ /dev/null @@ -1,15 +0,0 @@ -# Unix Groups / Group Management - -To request membership in a unix group follow this workflow: - -Open Service Now and https://psi.service-now.com/psisp and browse to the __Request Linux Group Membership__ Workflow as follows: - -![](_static/unix_groups_request_01.png) -![](_static/unix_groups_request_02.png) -![](_static/unix_groups_request_03.png) - -Alternatively you can search for "Unix Group" in the search field. - -![](_static/unix_groups_request_04.png) - -Once you submitted the request, the responsible person for the group automatically gets an approval request. Upon approval you will be automatically added to the group. \ No newline at end of file diff --git a/services/user-guide/wmgt.md b/services/user-guide/wmgt.md deleted file mode 100644 index 5e7e5d05..00000000 --- a/services/user-guide/wmgt.md +++ /dev/null @@ -1,37 +0,0 @@ -# wmgt.psi.ch - -The wmgt service provides SSH access to machines in various isolated networks. Access is protected by MFA. - -To use the service use the DNS alias __wmgt.psi.ch__. - -```bash -ssh @wmgt.psi.ch -``` - -To directly tunnel to a machine in a protected network to which wmgt gives access to you can use: - -```bash -ssh -J wmgt.psi.ch -``` - -If you need to connect through wmgt often, you can add following configuration to your `~/.ssh/config` file. This will give you a persistent connection to wmgt.psi.ch that can be (re)used for multiple connections. (this way you only have to authenticate once with MFA) - -``` -Host wmgt-jumpost - HostName wmgt.psi.ch - ControlMaster auto - ControlPath ~/.ssh/mux-%r@%h:%p - ControlPersist 8h -``` - -Afterwards you can use - -```bash -ssh -J wmgt-jumpost -``` - -to establish the connection. - -```{note} -Be aware, if you are switching networks this persistent connection might get screwed up. In that case you have to find the connection via `ps -ef` and kill it with the `kill` command. -```