Skip to content

Commit

Permalink
Edit oct 10
Browse files Browse the repository at this point in the history
  • Loading branch information
sjkoke committed Oct 10, 2024
1 parent e967ab1 commit 4fc0fa2
Show file tree
Hide file tree
Showing 7 changed files with 46 additions and 47 deletions.
4 changes: 2 additions & 2 deletions config_examples/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Configuration example files for eLabFTW

This folder holds example configuration files for popular web servers, when used as reverse proxy in front of eLabFTW container.
This folder holds example configuration files for popular web servers, when used as a reverse proxy in front of the eLabFTW container.

## Apache

Expand All @@ -12,7 +12,7 @@ The [Nginx folder](./nginx) contains documentation for running Nginx as a revers

## HAProxy

The [HAProxy folder](./haproxy) contains configuration for running HAProxy in front of one (or several) elabimg container in http mode.
The [HAProxy folder](./haproxy) contains configuration for running HAProxy in front of one (or several) elabimg containers in http mode.

## Traefik

Expand Down
15 changes: 7 additions & 8 deletions config_examples/apache/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,28 +9,27 @@ sudo a2enmod proxy
sudo a2enmod headers
~~~

It is recommended to run the Docker container in HTTP mode and let Apache do
TLS termination. But letting the Docker container deal with TLS is also a
possibility. Both configurations are presented below.
We recommend that you run the Docker container in HTTP mode and let Apache handle
TLS termination. However, letting the Docker container deal with TLS is also an option. Both configurations are presented below.

## Prerequisite: running the container on a custom port

Because our Apache is already running on port 443, we will want the Docker container to run on another port.
Because our Apache server is already running on port 443, we will want the Docker container to run on another port.

In the `ports` part of this configuration file, expose the container on port 3148 for instance:
In the `ports` section of this configuration file, expose the container on port 3148 as follows:

~~~yaml
ports:
- '127.0.0.1:3148:443'
~~~

**Note**: we're using the 127.0.0.1 localhost ip to avoid Docker exposing the port by bypassing the firewall configuration (see [this issue](https://github.com/moby/moby/issues/22054)).
**Note**: We're using the 127.0.0.1 localhost ip to prevent Docker from exposing the port by bypassing the firewall configuration (see [this issue](https://github.com/moby/moby/issues/22054)).

## Reverse proxy for a container in http mode (recommended)

### Running the container in HTTP mode

By default the eLabFTW (elabftw/elabimg) container runs in HTTPS mode, so you'll need to edit your `elabftw.yml` file (or `docker-compose.yml`) and add:
By default, the eLabFTW (elabftw/elabimg) container runs in HTTPS mode, so you'll need to edit your `elabftw.yml` file (or `docker-compose.yml`) and add:

~~~yaml
DISABLE_HTTPS=true
Expand All @@ -49,7 +48,7 @@ ProxyPassReverse "/" "http://localhost:3148/"

## Reverse proxy for a container in https mode

You will need `mod_ssl` activated.
You will need to make sure `mod_ssl` is activated.

Add these lines to your Apache configuration file (probably in `/etc/apache2/apache.conf` or in your VirtualHosts files).

Expand Down
2 changes: 1 addition & 1 deletion config_examples/haproxy/README.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# HAProxy configuration for eLabFTW

This is an example config for having HAProxy in front of one or several eLabFTW's container (image: elabftw/elabimg).
This is an example config for a case in which HAProxy is in front of one or several eLabFTW containers (image: elabftw/elabimg).

## Example docker-compose config

Expand Down
2 changes: 1 addition & 1 deletion config_examples/haproxy/haproxy.cfg
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ global
# log to stdout
log stdout format raw local0 info

# Default ciphers to use on SSL-enabled listening sockets.
# Default ciphers to use on SSL-enabled listening sockets
# from https://mozilla.github.io/server-side-tls/ssl-config-generator/
ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
Expand Down
8 changes: 4 additions & 4 deletions config_examples/nginx/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,20 +4,20 @@ If you already have an Nginx webserver running, you can use it to forward reques

## Prerequisite: running the container on a custom port

Because our Nginx is already running on port 443, we will want the Docker container to run on another port.
Because our Nginx server is already running on port 443, we will want the Docker container to run on another port.

In the `ports` part of this configuration file, expose the container on port 3148 for instance:
In the `ports` section of this configuration file, expose the container on port 3148 as follows:

~~~yaml
ports:
- '127.0.0.1:3148:443'
~~~

**Note**: we're using the 127.0.0.1 localhost ip to avoid Docker exposing the port by bypassing the firewall configuration (see [this issue](https://github.com/moby/moby/issues/22054)).
**Note**: We're using the 127.0.0.1 localhost ip to prevent Docker from exposing the port by bypassing the firewall configuration (see [this issue](https://github.com/moby/moby/issues/22054)).

## Nginx configuration

The following example forwards the URL https://elab.example.org to the local port 3148 where the Docker container is listening. In this example, Nginx is listening to port 8888, and HAProxy is doing TLS termination. Adapt to your needs. If you don't have HAProxy doing TLS termination, use https in the proxy_pass instruction and make sure DISABLE_HTTPS is false in the elabftw.yml config.
In the following example, the URL https://elab.example.org is forwarded to local port 3148, where the Docker container is listening. In this example, Nginx is listening to port 8888, and HAProxy is handling TLS termination. Adapt this example to your needs. If HAProxy is not handling TLS termination in your case, use https in the proxy_pass instruction and make sure DISABLE_HTTPS is false in the elabftw.yml config.

~~~nginxconf
server {
Expand Down
2 changes: 1 addition & 1 deletion doc/404.rst
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ Page not found!
Oops!
=====

No page with that name could be found. Maybe you followed an old link?
No page with that name could be found. Maybe you clicked on an old link?

Look at the menu on the left to find what you are looking for!

Expand Down
60 changes: 30 additions & 30 deletions doc/admin-guide.rst
Original file line number Diff line number Diff line change
Expand Up @@ -3,79 +3,79 @@
***********
Admin guide
***********
This guide is intended for Admins of Teams. An Admin is a User in a Team with Admin rights, and access to the Admin Panel (from the top right menu or the bottom left link). A Team can have several Admins and must have at least one.
This guide is intended for Admins of Teams. An Admin is a User in a Team with Admin rights, and access to the Admin Panel (accessed via the top right menu or the bottom left link). A Team can have several Admins and must have at least one.

How to become Admin?
How to become an Admin?
====================
A user is automatically an Admin if they are the first user in a Team. An Admin can promote another user to Admin from the Admin Panel > Users tab. A Sysadmin can promote a User to Admin the same way (from the Sysadmin Panel).
A User is automatically an Admin if they are the first User in a Team. An Admin can promote another User to the Admin level from the Admin Panel > Users tab. A Sysadmin can promote a User to the Admin level in the same way (from the Sysadmin Panel).

General overview
================
An Admin:

* Has access to the Admin Panel with settings impacting only their team
* Can validate/archive users of their team
* Can edit available Categories and Status for Experiments and Resources of their team
* Can edit the default experiments template
* Can manage groups of users amongst the team (see below)
* Has access to the Admin Panel, where they can change the settings for their entire Team
* Can validate/archive Users of their Team
* Can edit available Categories and Status options for Experiments and Resources used by their Team
* Can edit the default Experiment template
* Can manage groups of Users within the Team (see below)
* Can change the rightmost link in the main menu (default is Documentation)
* Can archive users. Archiving users means disable login for that account, and lock all experiments.
* Can archive a User, thus disabling login for that account, and locking all Experiments created by that account.

Validating accounts
===================
Unless this setting has been modified by the Sysadmin, or provisioning is done automatically, new accounts will need validation from a team Admin before they can connect. It is your role as an Admin to validate new users accounts. To do that, head to the Admin panel and you will see the users waiting for validation.
Unless this setting has been modified by the Sysadmin, or provisioning is done automatically, new accounts will need to be validated by a Team Admin before new Users can connect. The Admin is responsible for validating new User accounts. To validate new Users, head to the Admin panel where you will see a list of Users waiting for validation.

.. image:: img/admin-validate-user.png
.. image:: img/admin-validate-User.png
:align: center
:alt: admin user validation
:alt: Admin User validation

If you do not wish to validate an account because they do not belong, you can either ask the Sysadmin to change the team of this account, or delete the account yourself.
If you do not wish to validate an account because that User does not belong to your Team, you can either ask the Sysadmin to change the Team associated with that account, or delete the account yourself.

TEAM tab
Team tab
========
The first tab of the Admin Panel contains various settings for the Team. This is where you can configure what users can or cannot do in the team, and define a default template for experiments or change the last link in the main menu.
The first tab in the Admin Panel contains various settings for the Team. This is where you can configure what Users can or cannot do in the Team, and define a default template for Experiments or change the last link in the main menu.

GROUPS tab
==========
The Admin can create User Groups from the Admin Panel. Once a User Group is created, the Admin can add Users to this group by typing their name in the input field and selecting the suggested User. Users that are part of a User Group can then choose to set the permissions of an item/experiment to this group. Only members of this group will be able to see/edit this entry.
The Admin can create User Groups from the Admin Panel. Once a User Group is created, the Admin can add Users to this Group by typing their names in the input field and selecting the suggested Users. Users in a Group can set the permissions of a Resource/Experiment for that Group such that only members of the Group can see/edit an entry.

Note that it is possible to assign members from other Teams in a group.
Note that it is possible to add Users from other Teams to a User Group.

USERS tab
=========
The Users tab allows you to modify user accounts in your team. From this page, you can reset a password directly or "Archive" an user. An "archived" user won't be able to login anymore and all of their experiments will be locked. If the user needs to be in another team, the correct procedure is to archive the user in the first team, and create a new account (same email) in the new team. This way the first team keeps the data, and the user can have a fresh account in the new team with the same email.
The Users tab allows you to modify User accounts in your Team. From this page, you can reset a password directly or "archive" a User. An "archived" User will no longer be able to login and all of their Experiments will be locked. If a User needs to leave one Team and join a different Team, that User should first be archived in the original Team. Then, a new account (same email) can be created for that User in the new Team. This way, the first Team keeps the data previously inputted by the User, and the User has a fresh account in the new Team using the same email address.

You can also disable multifactor authentication for a particular user, if needed.
You can also disable multifactor authentication for a particular User, if needed.

At the bottom, you can add directly a new user in your team. The new user will need to activate the "Reset password" functionality to access their account.
From this page, you can also directly add a new User to your Team. The new User will need to activate the "Reset password" functionality to access their account.

CATEGORIES tab
==============

This menu allows you to define categories for Experiments, which are very similar to Status: they have a name and a color.
This menu allows you to define Categories for Experiments. Categories are very similar to status options: they have a name and a color.

And define categories for Resources, which are similar to experiments templates because on top of the name and color you can define default text/tags/links/fields.
You can also define Categories for Resources. These are similar to Experiment templates because in addition to the name and color, you can define default text/Tags/links/fields.

You can have as many as you want. For instance:

* Antibody
* Cell line
* Microscope (make sure to make it bookable so it can be used in the Scheduler of the Team tab)
* Protocol (or you might prefer to use templates for that)
* Microscope (you can make it bookable so it can be accessed in the Scheduler, found in the Team tab)
* Protocol (or you could use a template for this)
* Computer
* Software
* Project
* Plasmid
* ...

Select a category and click "Go" to load it. Or click "Create" to add a new category.
Select a Category and click "Go" to load it, or click "Create" to add a new Category.

.. image:: img/admin-panel-itemstypes.png
:align: right
:alt: resources categories tab


When you create a new category, use the default template of that type of item to add fields. For instance, for a Plasmid category you might want to have:
When you create a new Category, use the default template of that type of item to add fields. For instance, for a Plasmid category you might want to have:

**Concentration:**

Expand All @@ -85,16 +85,16 @@ When you create a new category, use the default template of that type of item to

**Resistance mammalian:**

You can also have a look at using :ref:`extra fields <metadata>` defined through the metadata json editor so all items created in that category will have these supplementary inputs.
You can also use :ref:`extra fields <metadata>` defined in the metadata json editor so that all items created in that Category will have these supplementary inputs.

STATUS tab
==========
Status are entirely editable and you can customize them to your liking. There is one set of Status for Experiments and another one for Resources.
The Status options are editable and customizable. There is one set of Status options for Experiments and another one for Resources.

EXPORT tab
==========
This tab allows you to Export experiments, items or scheduler bookings in various formats.
This tab allows you to export Experiments, items, or scheduled bookings in various formats.

TAG MANAGER tab
===============
This interface allows an Admin to edit the existing tags if needed. For instance, if you have "RPE1" and "RPE-1" and you want all the tags to be in the form "RPE-1", find the "RPE1" tag, click on it to edit it to "RPE-1", and click the Deduplicate button.
This interface allows an Admin to edit existing Tags. For instance, if you have Tags called "RPE1" and "RPE-1" and you want all of the Tags to be in the form "RPE-1", find the "RPE1" Tag, click on it to edit it to "RPE-1", and click the Deduplicate button.

0 comments on commit 4fc0fa2

Please sign in to comment.