documentation/docs/user-guide/consoles.md

(RHEL9) Beamline Consoles

In here we use the terms "beamline", "endstation", "experimental station" synonomously.

Beamline consoles are the crucial systems to operate a beamline at one of PSIs' facilities. These systems are mission critical and need to be fully reproducible within a short period of time in case of e.g. hardware failure.

Access Control

Consoles follow a strict access control design. Nobody has access to beamline resources/systems except she/he is member of one of the following groups:

• unx-sls_<beamline>
• unx-sls_beamline>_bs
• <BEAMLINE>

The group unx-sls_beamline>_bs is reserved for beamline scientists/managers and give them e.g. rights to write into the /sls/<beamline>/* folders.

The group <BEAMLINE> holds all e-accounts created/managed by DUO and that are associated with the beamline.

The group unx-sls_<beamline> holds all people that should have access to the beamline resources. Membership is managed by the beamline scientists/responsibles and membership can be requested via the process described here: https://linux.psi.ch/services/unix_groups. The process is fully automated and runs without human intervention (except one of the beamline scientists need to approve - but this is exactly what is needed and why it is implemented) - So this workflow will also work during the night in case of a pikett case, etc. . Therefore this group should only hold people that need access to beamline systems at the current time and/or on a regular basis. It is the duty and responsibility of the beamline scientist to remove people as soon as access is not needed any more and to keep the list as short as possible.

Login via eaccounts

As mentioned above the eaccounts of the scheduled pgroups can log on to the beamline consoles. There are two options to logon to the consoles (and also to unlock a locked screen when the eaccount is logged in):

1. Use the eaccounts password

2. (recommended) Use the personal account+password of any member of the associated pgroup. For this enter you username and password as follows (replace and with the respective values of your personal account):

   <username>:<password>
   

More details to eccounts can be found in the eaccounts documentation.

Directories

The consoles will have following directory structures available

/<facility>/<beamline>
/<facility>/<beamline>/bin              # this folder is automatically in the PATH
/<facility>/<beamline>/config           # configuration data for applications
/<facility>/<beamline>/applications     # beamline applications and scripts
/<facility>/<beamline>/data             # beamline data
/<facility>/<beamline>/data/<pgroup>
/<facility>/<beamline>/data/<pgroup>/raw        # read write at the beamline, read only on ra 
/<facility>/<beamline>/data/<pgroup>/work       # read/write on ra
/<facility>/<beamline>/code             # checked out code to be available at all the consoles
                                        # we propose to create a folder for each person in here where individual people can checkout their code.
/<facility>/<beamline>/misc             # whatever else doesn't fit into the above folders

Following folders are configured to be automatically deployed from a Git repository

/<facility>/<beamline>/bin
/<facility>/<beamline>/config/qt
/<facility>/<beamline>/config/launcher

The respective Git repositories can be found in the following location:

• https://gitea.psi.ch/autodeploy_bin (repository for /.../bin)
• https://gitea.psi.ch/autodeploy_config (repositories for /.../config/* )

The autodeployment is done via a gitea actions and its status can be checked by checking the latest workflow runs in the respective repository. This can be done by clicking on the "Actions" tab in the repository. The state of the latest run is indicated by a green checkmark (success) or a red cross (failure).

Backup / Snapshot

There is a hidden .snapshot directory in /<facility>/<group> with hourly, daily and weekly snapshots. In case of need snapshots can be recovered from there.

cd /<facility>/<group>/.snapshot

Access Control

Access permissions of all folders and files in the /<facility>/<beamline> filesystem are enforced through server side NFS4 ACLs. The permissions are enforced like this:

• read/write/execute - unx-<facility>_<beamline>_bs --> /<facility>/<beamline>/*/
• read/execute - unx-<facility>_<beamline> --> /<facility>/<beamline>/*/

If e.g. a person regularly need to deploy some software into /<facility>/<beamline>/applications that is not part of the _bs group you can allow this by doing the following steps:

1. Create the application folder on his behalf mkdir /<facility>/<beamline>/applications/<whatever>
2. Request to (linux-eng@psi.ch) to change the owownership of that directory

RDP Access

Following commands can be used the same way on Linux as well as on up-to-date Windows systems. On Windows you need to open PowerShell to issue the commands (no need of Putty and/or other ssh clients)

!!! note Windows Because Windows already has the port 3389 open you need to use a different port than 3389 for the tunnel in the following examples. You could use 33389 or any other port: ssh -L 33389:<your-console>.psi.ch:3389 <your-gateway> Important, you need to explicitly specify the port in the RDP client - i.e. you connect to localhost:33389

Office Network

Consoles with RDP enabled can be accessed from the PSI intranet as follows:

1. Open an SSH Tunnel via the beamline SSH gateway (replace <your-console> with the console you want to connect to and your-ssh-gateway with your ssh gateway)

   ssh -L 3389:<your-console>.psi.ch:3389 <your-ssh-gateway>
   
   # replace <your-console> and <your-ssh-gateway> according to your beamline
   # example: ssh -L 3389:x00da-vcons-test-01:3389 x00da-gw
   

2. Open an RDP client and connect to localhost

Internet

From outside PSI connections can be established in two ways, VPN or via SSH/hopx.

VPN (preferred)

1. Establish a VPN connection via the PSI Cisco Anyconnect client

2. Use the same command as connecting from the Office Network to establish a tunnel (replace <your-console> with the console you want to connect to and your-ssh-gateway with your ssh gateway)

   ssh -L 3389:<your-console>.psi.ch:3389 <your-ssh-gateway>
   
   # replace <your-console> and <your-ssh-gateway> according to your beamline
   # example: ssh -L 3389:x00da-vcons-test-01:3389 x00da-gw
   

3. Open an RDP client and connect to localhost

SSH/hopx.psi.ch

Connections via hopx.psi.ch can be established as follows:

1. Open an interactive session to hopx.psi.ch and leave this session open!

   ssh hopx.psi.ch
   

2. Open an SSH Tunnel via hopx and your beamline SSH gateway (replace <your-console> with the console you want to connect to and your-ssh-gateway with your ssh gateway)

   ssh -J hopx.psi.ch -L 3389:<your-console>.psi.ch:3389 <your-ssh-gateway>
   

3. Open an RDP client and connect to localhost

Frequently Asked Questions

Where is the (Epics) launcher?

The launcher can be found in the start menu of the consoles. It is called "EPICS Launcher" and has the following icon:

From the terminal you can start exactly the same launcher by running the following command:

epics_launcher_wrapper

If you want to use a different launcher configuration than the default you would call epics_launcher <configuration_file>

Where do I find the users experiment data?

The experiment data is stored in /<facility>/<beamline>/data/<pgroup>/raw and can be accessed from the consoles via the file explorer or terminal. There is a shortcut to the data folder on the desktop of the consoles.

How to open an application?

My included TIFF files in CAQTM is doesn't work / looking ugly...

TIFF is not a supported CAQTM file format (see official communication Controls). Issues might be temporarily resolved by installing particular qt packages (which need to be named and requested by you/beamline). However we recommend to not use TIFFs in CAQTDM so that you have full support from Controls.

How to configure an application to start at login?

To configure an application to start at login of a user, you can use the "Startup Applications" feature of the Gnome desktop environment. You can find more details on how to use this feature in the official Red Hat documentation:

https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/customizing_the_gnome_desktop_environment/setting-up-startup-applications-in-gnome_customizing-the-gnome-desktop-environment