mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-01-26 06:50:36 -05:00
425 lines
13 KiB
Markdown
425 lines
13 KiB
Markdown
---
|
|
title: "Getting Started"
|
|
date: 2018-05-02T00:00:00+00:00
|
|
weight: 10
|
|
geekdocRepo: https://github.com/owncloud/ocis-konnectd
|
|
geekdocEditPath: edit/master/docs
|
|
geekdocFilePath: getting-started.md
|
|
---
|
|
|
|
{{< toc >}}
|
|
|
|
## Installation
|
|
|
|
So far we are offering two different variants for the installation. You can choose between [Docker](https://www.docker.com/) or pre-built binaries which are stored on our download mirrors and GitHub releases. Maybe we will also provide system packages for the major distributions later if we see the need for it.
|
|
|
|
### Docker
|
|
|
|
TBD
|
|
|
|
### Binaries
|
|
|
|
TBD
|
|
|
|
## Configuration
|
|
|
|
We provide overall three different variants of configuration. The variant based on environment variables and commandline flags are split up into global values and command-specific values.
|
|
|
|
### Envrionment variables
|
|
|
|
If you prefer to configure the service with environment variables you can see the available variables below.
|
|
|
|
#### Global
|
|
|
|
KONNECTD_CONFIG_FILE
|
|
: Path to config file, empty default value
|
|
|
|
KONNECTD_LOG_LEVEL
|
|
: Set logging level, defaults to `info`
|
|
|
|
KONNECTD_LOG_COLOR
|
|
: Enable colored logging, defaults to `true`
|
|
|
|
KONNECTD_LOG_PRETTY
|
|
: Enable pretty logging, defaults to `true`
|
|
|
|
#### Server
|
|
|
|
KONNECTD_TRACING_ENABLED
|
|
: Enable sending traces, defaults to `false`
|
|
|
|
KONNECTD_TRACING_TYPE
|
|
: Tracing backend type, defaults to `jaeger`
|
|
|
|
KONNECTD_TRACING_ENDPOINT
|
|
: Endpoint for the agent, empty default value
|
|
|
|
KONNECTD_TRACING_COLLECTOR
|
|
: Endpoint for the collector, empty default value
|
|
|
|
KONNECTD_TRACING_SERVICE
|
|
: Service name for tracing, defaults to `konnectd`
|
|
|
|
KONNECTD_DEBUG_ADDR
|
|
: Address to bind debug server, defaults to `0.0.0.0:9134`
|
|
|
|
KONNECTD_DEBUG_TOKEN
|
|
: Token to grant metrics access, empty default value
|
|
|
|
KONNECTD_DEBUG_PPROF
|
|
: Enable pprof debugging, defaults to `false`
|
|
|
|
KONNECTD_DEBUG_ZPAGES
|
|
: Enable zpages debugging, defaults to `false`
|
|
|
|
KONNECTD_HTTP_ADDR
|
|
: Address to bind http server, defaults to `0.0.0.0:9130`
|
|
|
|
KONNECTD_HTTP_ROOT
|
|
: Root path of http server, defaults to `/`
|
|
|
|
KONNECTD_HTTP_NAMESPACE
|
|
: Set the base namespace for service discovery, defaults to `com.owncloud.web`
|
|
|
|
KONNECTD_IDENTITY_MANAGER
|
|
: Identity manager (one of ldap,kc,cookie,dummy), defaults to `ldap`
|
|
|
|
KONNECTD_TRANSPORT_TLS_CERT
|
|
: Certificate file for transport encryption, uses a temporary dev-cert if empty
|
|
|
|
KONNECTD_TRANSPORT_TLS_KEY
|
|
: Secret file for transport encryption, uses a temporary dev-cert if empty
|
|
|
|
KONNECTD_ISS
|
|
: OIDC issuer URL, defaults to `https://localhost:9130`
|
|
|
|
KONNECTD_SIGNING_PRIVATE_KEY
|
|
: Full path to PEM encoded private key file (must match the --signing-method algorithm)
|
|
|
|
KONNECTD_SIGNING_KID
|
|
: Value of kid field to use in created tokens (uniquely identifying the signing-private-key), empty default value
|
|
|
|
KONNECTD_VALIDATION_KEYS_PATH
|
|
: Full path to a folder containg PEM encoded private or public key files used for token validaton (file name without extension is used as kid), empty default value
|
|
|
|
KONNECTD_ENCRYPTION_SECRET
|
|
: Full path to a file containing a %d bytes secret key, empty default value
|
|
|
|
KONNECTD_SIGNING_METHOD
|
|
: JWT default signing method, defaults to `PS256`
|
|
|
|
KONNECTD_URI_BASE_PATH
|
|
: Custom base path for URI endpoints, empty default value
|
|
|
|
KONNECTD_SIGN_IN_URI
|
|
: Custom redirection URI to sign-in form, empty default value
|
|
|
|
KONNECTD_SIGN_OUT_URI
|
|
: Custom redirection URI to signed-out goodbye page, empty default value
|
|
|
|
KONNECTD_ENDPOINT_URI
|
|
: Custom authorization endpoint URI, empty default value
|
|
|
|
KONNECTD_ENDSESSION_ENDPOINT_URI
|
|
: Custom endsession endpoint URI, empty default value
|
|
|
|
KONNECTD_ASSET_PATH
|
|
: Path to custom assets, empty default value
|
|
|
|
KONNECTD_IDENTIFIER_CLIENT_PATH
|
|
: Path to the identifier web client base folder, defaults to `/var/tmp/konnectd`
|
|
|
|
KONNECTD_IDENTIFIER_REGISTRATION_CONF
|
|
: Path to a identifier-registration.yaml configuration file, defaults to `./config/identifier-registration.yaml`
|
|
|
|
KONNECTD_IDENTIFIER_SCOPES_CONF
|
|
: Path to a scopes.yaml configuration file, empty default value
|
|
|
|
KONNECTD_INSECURE
|
|
: Disable TLS certificate and hostname validation
|
|
|
|
KONNECTD_TLS
|
|
: Use TLS (disable only if konnectd is behind a TLS-terminating reverse-proxy), defaults to `true`
|
|
|
|
KONNECTD_TRUSTED_PROXY
|
|
: List of trusted proxy IP or IP network(s) (usage: KONNECTD_TRUSTED_PROXY=x.x.x.x y.y.y.y)
|
|
|
|
KONNECTD_ALLOW_SCOPE
|
|
: Allow OAuth 2 scope(s) (usage: KONNECTD_ALLOW_SCOPE=A B C)
|
|
|
|
KONNECTD_ALLOW_CLIENT_GUESTS
|
|
: Allow sign in of client controlled guest users
|
|
|
|
KONNECTD_ALLOW_DYNAMIC_CLIENT_REGISTRATION
|
|
: Allow dynamic OAuth2 client registration
|
|
|
|
KONNECTD_DISABLE_IDENTIFIER_WEBAPP
|
|
: Disable built-in identifier-webapp to use a frontend hosted elsewhere. Per default we use the built-in webapp. If set to false --identifier-client-path must be provided, defaults to `true`
|
|
|
|
|
|
#### Health
|
|
|
|
KONNECTD_DEBUG_ADDR
|
|
: Address to debug endpoint, defaults to `0.0.0.0:9134`
|
|
|
|
### Commandline flags
|
|
|
|
If you prefer to configure the service with commandline flags you can see the available variables below.
|
|
|
|
#### Global
|
|
|
|
--config-file
|
|
: Path to config file, empty default value
|
|
|
|
--log-level
|
|
: Set logging level, defaults to `info`
|
|
|
|
--log-color
|
|
: Enable colored logging, defaults to `true`
|
|
|
|
--log-pretty
|
|
: Enable pretty logging, defaults to `true`
|
|
|
|
#### Server
|
|
|
|
--tracing-enabled
|
|
: Enable sending traces, defaults to `false`
|
|
|
|
--tracing-type
|
|
: Tracing backend type, defaults to `jaeger`
|
|
|
|
--tracing-endpoint
|
|
: Endpoint for the agent, empty default value
|
|
|
|
--tracing-collector
|
|
: Endpoint for the collector, empty default value
|
|
|
|
--tracing-service
|
|
: Service name for tracing, defaults to `konnectd`
|
|
|
|
--debug-addr
|
|
: Address to bind debug server, defaults to `0.0.0.0:9134`
|
|
|
|
--debug-token
|
|
: Token to grant metrics access, empty default value
|
|
|
|
--debug-pprof
|
|
: Enable pprof debugging, defaults to `false`
|
|
|
|
--debug-zpages
|
|
: Enable zpages debugging, defaults to `false`
|
|
|
|
--http-addr
|
|
: Address to bind http server, defaults to `0.0.0.0:9130`
|
|
|
|
--http-root
|
|
: Root path of http server, defaults to `/`
|
|
|
|
--http-namespace
|
|
: Set the base namespace for service discovery, defaults to `com.owncloud.web`
|
|
|
|
--identity-manager
|
|
: Identity manager (one of ldap,kc,cookie,dummy), defaults to `ldap`
|
|
|
|
--transport-tls-cert
|
|
: Certificate file for transport encryption, uses a temporary dev-cert if empty
|
|
|
|
--transport-tls-key
|
|
: Key file for transport encryption, uses a temporary dev-cert if empty
|
|
|
|
--iss
|
|
: OIDC issuer URL, defaults to `https://localhost:9130`
|
|
|
|
--signing-private-key
|
|
: Full path to PEM encoded private key file (must match the --signing-method algorithm)
|
|
|
|
--signing-kid
|
|
: Value of kid field to use in created tokens (uniquely identifying the signing-private-key), empty default value
|
|
|
|
--validation-keys-path
|
|
: Full path to a folder containg PEM encoded private or public key files used for token validaton (file name without extension is used as kid), empty default value
|
|
|
|
--encryption-secret
|
|
: Full path to a file containing a 32 bytes secret key, empty default value
|
|
|
|
--signing-method
|
|
: JWT default signing method, defaults to `PS256`
|
|
|
|
--uri-base-path
|
|
: Custom base path for URI endpoints, empty default value
|
|
|
|
--sign-in-uri
|
|
: Custom redirection URI to sign-in form, empty default value
|
|
|
|
--signed-out-uri
|
|
: Custom redirection URI to signed-out goodbye page, empty default value
|
|
|
|
--authorization-endpoint-uri
|
|
: Custom authorization endpoint URI, empty default value
|
|
|
|
--endsession-endpoint-uri
|
|
: Custom endsession endpoint URI, empty default value
|
|
|
|
--asset-path
|
|
: Path to custom assets, empty default value
|
|
|
|
--identifier-client-path
|
|
: Path to the identifier web client base folder, defaults to `/var/tmp/konnectd`
|
|
|
|
--identifier-registration-conf
|
|
: Path to a identifier-registration.yaml configuration file, defaults to `./config/identifier-registration.yaml`
|
|
|
|
--identifier-scopes-conf
|
|
: Path to a scopes.yaml configuration file, empty default value
|
|
|
|
--insecure
|
|
: Disable TLS certificate and hostname validation
|
|
|
|
--tls
|
|
: Use TLS (disable only if konnectd is behind a TLS-terminating reverse-proxy), defaults to `true`
|
|
|
|
--trusted-proxy
|
|
: List of trusted proxy IP or IP network (usage: --trusted-proxy x.x.x.x --trusted-proxy y.y.y.y)
|
|
|
|
--allow-scope
|
|
: Allow OAuth 2 scope (usage: --allow-scope a --allow-scope b ...)
|
|
|
|
--allow-client-guests
|
|
: Allow sign in of client controlled guest users
|
|
|
|
--allow-dynamic-client-registration
|
|
: Allow dynamic OAuth2 client registration
|
|
|
|
--disable-identifier-webapp
|
|
: Disable built-in identifier-webapp to use a frontend hosted elsewhere. Per default we use the built-in webapp. If set to false --identifier-client-path must be provided, defaults to `true`
|
|
|
|
|
|
#### Health
|
|
|
|
--debug-addr
|
|
: Address to debug endpoint, defaults to `0.0.0.0:9134`
|
|
|
|
### Configuration file
|
|
|
|
So far we support the file formats `JSON` and `YAML`, if you want to get a full example configuration just take a look at [our repository](https://github.com/owncloud/ocis-konnectd/tree/master/config), there you can always see the latest configuration format. These example configurations include all available options and the default values. The configuration file will be automatically loaded if it's placed at `/etc/ocis/konnectd.yml`, `${HOME}/.ocis/konnectd.yml` or `$(pwd)/config/konnectd.yml`.
|
|
|
|
## Usage
|
|
|
|
The program provides a few sub-commands on execution. The available configuration methods have already been mentioned above. Generally you can always see a formated help output if you execute the binary via `ocis-konnectd --help`.
|
|
|
|
### Server
|
|
|
|
The server command is used to start the http and debug server on two addresses within a single process. The http server is serving the general webservice while the debug server is used for health check, readiness check and to server the metrics mentioned below. For further help please execute:
|
|
|
|
{{< highlight txt >}}
|
|
ocis-konnectd server --help
|
|
{{< / highlight >}}
|
|
|
|
### Health
|
|
|
|
The health command is used to execute a health check, if the exit code equals zero the service should be up and running, if the exist code is greater than zero the service is not in a healthy state. Generally this command is used within our Docker containers, it could also be used within Kubernetes.
|
|
|
|
{{< highlight txt >}}
|
|
ocis-konnectd health --help
|
|
{{< / highlight >}}
|
|
|
|
## Metrics
|
|
|
|
This service provides some [Prometheus](https://prometheus.io/) metrics through the debug endpoint, you can optionally secure the metrics endpoint by some random token, which got to be configured through one of the flag `--debug-token` or the environment variable `KONNECTD_DEBUG_TOKEN` mentioned above. By default the metrics endpoint is bound to `http://0.0.0.0:9134/metrics`.
|
|
|
|
go_gc_duration_seconds
|
|
: A summary of the GC invocation durations
|
|
|
|
go_gc_duration_seconds_sum
|
|
: A summary of the GC invocation durations
|
|
|
|
go_gc_duration_seconds_count
|
|
: A summary of the GC invocation durations
|
|
|
|
go_goroutines
|
|
: Number of goroutines that currently exist
|
|
|
|
go_info
|
|
: Information about the Go environment
|
|
|
|
go_memstats_alloc_bytes
|
|
: Number of bytes allocated and still in use
|
|
|
|
go_memstats_alloc_bytes_total
|
|
: Total number of bytes allocated, even if freed
|
|
|
|
go_memstats_buck_hash_sys_bytes
|
|
: Number of bytes used by the profiling bucket hash table
|
|
|
|
go_memstats_frees_total
|
|
: Total number of frees
|
|
|
|
go_memstats_gc_cpu_fraction
|
|
: The fraction of this program's available CPU time used by the GC since the program started
|
|
|
|
go_memstats_gc_sys_bytes
|
|
: Number of bytes used for garbage collection system metadata
|
|
|
|
go_memstats_heap_alloc_bytes
|
|
: Number of heap bytes allocated and still in use
|
|
|
|
go_memstats_heap_idle_bytes
|
|
: Number of heap bytes waiting to be used
|
|
|
|
go_memstats_heap_inuse_bytes
|
|
: Number of heap bytes that are in use
|
|
|
|
go_memstats_heap_objects
|
|
: Number of allocated objects
|
|
|
|
go_memstats_heap_released_bytes
|
|
: Number of heap bytes released to OS
|
|
|
|
go_memstats_heap_sys_bytes
|
|
: Number of heap bytes obtained from system
|
|
|
|
go_memstats_last_gc_time_seconds
|
|
: Number of seconds since 1970 of last garbage collection
|
|
|
|
go_memstats_lookups_total
|
|
: Total number of pointer lookups
|
|
|
|
go_memstats_mallocs_total
|
|
: Total number of mallocs
|
|
|
|
go_memstats_mcache_inuse_bytes
|
|
: Number of bytes in use by mcache structures
|
|
|
|
go_memstats_mcache_sys_bytes
|
|
: Number of bytes used for mcache structures obtained from system
|
|
|
|
go_memstats_mspan_inuse_bytes
|
|
: Number of bytes in use by mspan structures
|
|
|
|
go_memstats_mspan_sys_bytes
|
|
: Number of bytes used for mspan structures obtained from system
|
|
|
|
go_memstats_next_gc_bytes
|
|
: Number of heap bytes when next garbage collection will take place
|
|
|
|
go_memstats_other_sys_bytes
|
|
: Number of bytes used for other system allocations
|
|
|
|
go_memstats_stack_inuse_bytes
|
|
: Number of bytes in use by the stack allocator
|
|
|
|
go_memstats_stack_sys_bytes
|
|
: Number of bytes obtained from system for stack allocator
|
|
|
|
go_memstats_sys_bytes
|
|
: Number of bytes obtained from system
|
|
|
|
go_threads
|
|
: Number of OS threads created
|
|
|
|
promhttp_metric_handler_requests_in_flight
|
|
: Current number of scrapes being served
|
|
|
|
promhttp_metric_handler_requests_total
|
|
: Total number of scrapes by HTTP status code
|