View on GitHub

hinkskalle

OCI + Singularity Container Registry

Configuration Values

Configuration is read from a file specified by the environment variable HINKSKALLE_SETTINGS or conf/config.json by default.

Frontend Config

Make sure that this environment variable is to your taste at startup:

Other runtime values can be set in config.json or overriden by environment variables, see below.

Flask

Refer to https://flask.palletsprojects.com/en/2.1.x/config/ for general Flask configuration values.

You might want to set these:

Hinkskalle

RQ Worker/Redis

See https://python-rq.org/docs/workers/ for general config settings.

Maintenance Tasks

Configure a key CRON in config.json (times are in UTC!):

{
  "CRON": {
    "expire_images": "46 21 * * *",
    "check_quotas": "48 21 * * *",
    "ldap_sync_results": "1,11,21,31,41,51 * * * *"
  }
}

Available tasks:

Secrets

try to keep these out of config.json!

Auth/LDAP

{
  ...
  "AUTH": {
    "LDAP": {
      "ENABLED": true,
      "HOST": "ldap.testha.se",
      "PORT": 389,
      "BIND_DN": "cn=login,ou=Adm,dc=testha,dc=se",
      "BASE_DN": "ou=Accounts,dc=testha,dc=se",
      "BIND_PASSWORD": "put me in secrets.env!"
    }
  }
}

Fine Tuning

You should be fine if you’ve got a fairly standard LDAP setup. But since everybody’s mileage varies:

Custom Search Filters

How we look for users in your LDAP directory:

          "FILTERS": {
              "user": "(&(uid={})(objectClass=person))",
              "all_users": "(objectClass=person)"
          },

The user filter is used during login: we replace the {} with whatever comes from the username field of the login form (properly escaped, duh) and we try to authenticate to the LDAP server using the entry we found + the provided password (rebind auth).

Be very careful what you put there, it determines who has access as who! You might want to have additional restrictions (e.g. memberOf=Somegroup) or different objectClass, …

all_users tells us which users we synchronise with the Hinkskalle database. All entries returned are added during sync.

Attribute Mapping

A map of hinkskalle user attributes to LDAP attributes, defaults to:

          "ATTRIBUTES": {
              "username": "uid",
              "email": "mail",
              "firstname": "givenName",
              "lastname": "sn"
          }

Most interesting maybe: The username mapping - it must be unique in Hinkskalle and it is also used as the name of the entity (namespace) of the user.

Environment Overrides

Certain variables from the config file(s) can be set via the environment. If hinkskalle finds them there, it will overwrite values from config.json:

This is superuseful for injecting configs and secrets when running Hinkskalle in a container (e.g. docker)

If using docker deployments you should also set the environment variables

for the database initialization. It should match DB_PASSWORD. in addition make sure that

are set and match your sqlalchemy database uri.

Refer to the official docker image docs