Quickstart with system packages

System packages

This guide installs Slurm-web from system packages on the cluster and gateway hosts.

Requirements

  • Cluster with Slurm >= 24.05 [1] and accounting enabled

  • Host with a supported GNU/Linux distribution among:

    • CentOS

    • AlmaLinux

    • Rocky Linux

    • Fedora

    • RHEL

    • Debian

    • Ubuntu

    • SUSE Linux Enterprise Server (SLES)

    • openSUSE

Slurm JWT authentication

Generate random Slurm JWT signing key with restrictive permissions:

# dd if=/dev/random of=/var/spool/slurm/jwt_hs256.key bs=32 count=1
# chown slurm:slurm /var/spool/slurm/jwt_hs256.key
# chmod 0600 /var/spool/slurm/jwt_hs256.key

Edit main Slurm and SlurmDBD configuration to enable JWT alternative authentication:

AuthAltTypes=auth/jwt
AuthAltParameters=jwt_key=/var/spool/slurm/jwt_hs256.key

Restart slurmctld and slurmdbd services to update configuration:

# systemctl restart slurmctld slurmdbd
More links

Install slurmrestd

Slurm-web extracts Slurm information from the REST API provided its slurmrestd daemon. This daemon must be installed on the host. The installation method depends on the origin of Slurm packages deployed on the cluster:

  • SchedMD RPM packages

  • EPEL

  • SchedMD Deb packages

  • Debian

On clusters deployed with SchedMD official RPM packages, install slurmrestd daemon with this command:

# dnf install slurm-slurmrestd
Please refer to SchedMD official Slurm installation guide for more help.

On clusters deployed with RPM packages from EPEL community, install slurmrestd daemon with this command:

# dnf install slurm-slurmrestd

On clusters deployed with SchedMD official Deb packages, install slurmrestd daemon with this command:

# apt install slurm-smd-slurmrestd
Please refer to SchedMD official Slurm installation guide for more help.

On clusters deployed with RPM packages from Debian community, install slurmrestd with this command:

# apt install slurmrestd

Setup slurmrestd

Create /etc/systemd/system/slurmrestd.service.d/slurm-web.conf drop-in configuration override for slurmrestd service:

[Service]
# Unset vendor unit ExecStart and Environment to avoid cumulative definition
ExecStart=
Environment=
Environment="SLURM_JWT=daemon"
ExecStart=/usr/sbin/slurmrestd $SLURMRESTD_OPTIONS -a rest_auth/jwt unix:/run/slurmrestd/slurmrestd.socket
RuntimeDirectory=slurmrestd
RuntimeDirectoryMode=0755
User=slurmrestd
Group=slurmrestd
DynamicUser=yes
With this configuration, slurmrestd listens for incoming connections on Unix socket with jwt authentication method. It is also possible to configure slurmrestd to listen on TCP/IP socket. Please refer to slurmrestd configuration page for more details.

Make systemd reload units changes on disk:

# systemctl daemon-reload

Enable and start slurmrestd service:

# systemctl enable --now slurmrestd.service

To check slurmrestd daemon is properly running with JWT authentication, run this command:

# export $(scontrol token)
# curl -H X-SLURM-USER-TOKEN:$SLURM_JWT --unix-socket /run/slurmrestd/slurmrestd.socket http://slurm/slurm/v0.0.41/diag
{
   "meta": {
     "plugin": {
      "type": "openapi\/slurmctld",
      "name": "Slurm OpenAPI slurmctld",
      "data_parser": "data_parser\/v0.0.41",
      "accounting_storage": "accounting_storage\/slurmdbd"
    },
   }
  …
}

In case of failure, please refer to troubleshooting guide for help.

More links

Install Slurm-web

Jump to the package installation procedure for your host distribution:

  • DNF — RHEL, CentOS, Rocky Linux, AlmaLinux, Fedora

  • APT — Debian, Ubuntu

  • Zypper — SLES, openSUSE

DNF

This procedure works on RHEL, CentOS, Rocky Linux and AlmaLinux OS.

On RHEL, CentOS and Rocky Linux some dependencies are missing in standard distribution repositories. You must enable EPEL repositories to get all requirements on these distributions:

# dnf install -y epel-release

Download and save RPM repository kerying:

# curl https://pkgs.rackslab.io/keyring.asc --output /etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab

Create DNF repository file /etc/yum.repos.d/rackslab.repo with this content:

  • RHEL 8

  • RHEL 9

  • RHEL 10

  • Fedora 43

  • Fedora 44

These packages are also compatible with CentOS 8, Rocky Linux 8 and AlmaLinux OS 8. 
[rackslab]
name=Rackslab
baseurl=https://pkgs.rackslab.io/rpm/el8/main/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab

[rackslab-slurmweb-7]
name=Rackslab slurmweb-7
baseurl=https://pkgs.rackslab.io/rpm/el8/slurmweb-7/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab
These packages are also compatible with CentOS 9, Rocky Linux 9 and AlmaLinux OS 9. 
[rackslab]
name=Rackslab
baseurl=https://pkgs.rackslab.io/rpm/el9/main/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab

[rackslab-slurmweb-7]
name=Rackslab slurmweb-7
baseurl=https://pkgs.rackslab.io/rpm/el9/slurmweb-7/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab
These packages are also compatible with CentOS 10, Rocky Linux 10 and AlmaLinux OS 10. 
[rackslab]
name=Rackslab
baseurl=https://pkgs.rackslab.io/rpm/el10/main/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab

[rackslab-slurmweb-7]
name=Rackslab slurmweb-7
baseurl=https://pkgs.rackslab.io/rpm/el10/slurmweb-7/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab
[rackslab]
name=Rackslab
baseurl=https://pkgs.rackslab.io/rpm/fc43/main/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab

[rackslab-slurmweb-7]
name=Rackslab slurmweb-7
baseurl=https://pkgs.rackslab.io/rpm/fc43/slurmweb-7/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab
[rackslab]
name=Rackslab
baseurl=https://pkgs.rackslab.io/rpm/fc44/main/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab

[rackslab-slurmweb-7]
name=Rackslab slurmweb-7
baseurl=https://pkgs.rackslab.io/rpm/fc44/slurmweb-7/$basearch/
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-Rackslab

Install Slurm-web agent and gateway packages:

# dnf install slurm-web-agent slurm-web-gateway

All dependencies are automatically installed.

APT

This procedure works Debian and Ubuntu.

Download and install packages repository signing key:

# curl -sS https://pkgs.rackslab.io/keyring.asc | gpg --dearmor | tee /usr/share/keyrings/rackslab.gpg > /dev/null

Create APT sources file /etc/apt/sources.list.d/rackslab.sources with this content:

  • Debian 13 « trixie »

  • Debian 14 « forky »

  • Debian unstable « sid »

  • Ubuntu 26.04 LTS

Types: deb
URIs: https://pkgs.rackslab.io/deb
Suites: trixie
Components: main slurmweb-7
Architectures: amd64
Signed-By: /usr/share/keyrings/rackslab.gpg
Types: deb
URIs: https://pkgs.rackslab.io/deb
Suites: forky
Components: main slurmweb-7
Architectures: amd64
Signed-By: /usr/share/keyrings/rackslab.gpg
Types: deb
URIs: https://pkgs.rackslab.io/deb
Suites: sid
Components: main slurmweb-7
Architectures: amd64
Signed-By: /usr/share/keyrings/rackslab.gpg
Types: deb
URIs: https://pkgs.rackslab.io/deb
Suites: ubuntu26.04
Components: main slurmweb-7
Architectures: amd64
Signed-By: /usr/share/keyrings/rackslab.gpg

Update packages repositories metadata:

# apt update

Install Slurm-web agent and gateway packages:

# apt install slurm-web-agent slurm-web-gateway

All dependencies are automatically installed.

Zypper

This procedure works on SUSE Linux Entreprise Server (SLES) and openSUSE LEAP.

Import RPM siging key:

# rpm --import https://pkgs.rackslab.io/keyring.asc

Run these commands to add package repositories:

  • SLES 15

  • SLES 16

These packages are also compatible with openSUSE Leap 15. 
# zypper addrepo --check --gpgcheck-allow-unsigned-repo --refresh \
  https://pkgs.rackslab.io/rpm/suse15/main/x86_64 rackslab-main
# zypper addrepo --check --gpgcheck-allow-unsigned-repo --refresh \
  https://pkgs.rackslab.io/rpm/suse15/slurmweb-7/x86_64 rackslab-slurmweb-7
These packages are also compatible with openSUSE Leap 16. 
# zypper addrepo --check --gpgcheck-allow-unsigned-repo --refresh \
  https://pkgs.rackslab.io/rpm/suse16/main/x86_64 rackslab-main
# zypper addrepo --check --gpgcheck-allow-unsigned-repo --refresh \
  https://pkgs.rackslab.io/rpm/suse16/slurmweb-7/x86_64 rackslab-slurmweb-7

Install Slurm-web agent and gateway packages:

# zypper install slurm-web-agent slurm-web-gateway

All dependencies are automatically installed.

More links

Initial setup

Create agent configuration file /etc/slurm-web/agent.ini to set the cluster name, for example:

[service]
cluster=nova

Create gateway configuration file /etc/slurm-web/gateway.ini with URL to the agent:

[agents]
url=http://localhost:5012
By default, Slurm-web agent listens on port TCP/5012 of loopback network interface. This can be changed with port parameter in service section of agent configuration.
More links

Slurm-web secret keys

Before starting gateway services, generate two secret files on the gateway host as root with the slurm-web CLI: a gateway session secret to secure server-side login state during authentication flows, and a JSON Web Token (JWT) signing key for authentication between Slurm-web components.

Generate the gateway session secret key (default /var/lib/slurm-web/session.key) with:

# slurm-web gen-session-key --set-ownership
INFO ⸬ Running slurm-web gen-session-key
INFO ⸬ Generated session key file /var/lib/slurm-web/session.key
INFO ⸬ Setting ownership of session key for slurm-web user

Generate the JWT signing key (default /var/lib/slurm-web/jwt.key) with:

# slurm-web gen-jwt-key --set-ownership
INFO ⸬ Running slurm-web gen-jwt-key
INFO ⸬ Generating JWT private key file /var/lib/slurm-web/jwt.key
INFO ⸬ Setting read permission on key for slurm-web user
More links

Slurm JWT siging key

For Slurm-web authentication to slurmrestd, copy the Slurm JWT signing key into the agent secrets directory as slurmrestd.key:

# cp /var/spool/slurm/jwt_hs256.key /var/lib/slurm-web/slurmrestd.key

Restrict access to this sensitive file with read permission to the slurm-web system user only:

# chown slurm-web:slurm-web /var/lib/slurm-web/slurmrestd.key
# chmod 400 /var/lib/slurm-web/slurmrestd.key
With this configuration, Slurm-web agent automatically generates its tokens with short lifespan for authentication to slurmrestd. As an alternative, Slurm-web supports static tokens. Please refer to slurmrestd configuration page for more details.

To test Slurm-web agent and slurmrestd service configuration parameters, you can run slurm-web connect-check command. It tries to send HTTP request to slurmrestd with Slurm-web agent configuration parameters and reports the status. For example:

# slurm-web connect-check
✅ connection successful! (cluster: hpc, slurm: 25.11.0, api: 0.0.44)

First Access

Slurm-web is now ready to start!

Enable and start the agent and gateway native services:

# systemctl enable --now slurm-web-agent.service
# systemctl enable --now slurm-web-gateway.service

Connect your browser to the gateway on http://localhost:5011. You should see the dashboard of the configured cluster:

slurm web policy admin

By default, Slurm-web gateway native service listens for incoming network connections on port TCP/5011. This can be changed with port parameter in service section of gateway configuration.

Also, the gateway native service is bound to the loopback network interface by default. This restricts access to localhost for security reasons. It is recommended to setup production HTTP server for external access to Slurm-web. However, this can be changed with the following lines in the gateway configuration file /etc/slurm-web/gateway.ini:

[service]
interface=HOSTNAME_OR_IP

[ui]
host=http://HOSTNAME_OR_IP:5011

Actual values depend on your DNS hostname or the public IP address of the host.

Slurm-web is now available on: http://HOSTNAME_OR_IP:5011

Please refer to gateway configuration reference documentation for more details.
In case of failure, please refer to troubleshooting guide for help.
More details

Going Further

Slurm-web is now running. The following optional sections help you improve performance, secure access, customize authorization and enable advanced features.

In-memory Cache

Slurm-web has a transparent caching feature which can use Redis (or any compatible alternative) in-memory database to cache Slurm responses.

It is highly recommended to setup cache on Slurm-web agent to significantly reduce the amount of repetitive requests sent to Slurm and reduce its load.

Install Redis:

  • APT

  • DNF

For Debian and Ubuntu, run this command:

# apt install redis-server

For RHEL, CentOS, Rocky Linux and AlmaLinux OS, run this command:

# dnf install redis

Start and enable the service:

# systemctl enable --now redis.service

Edit agent configuration file /etc/slurm-web/agent.ini to enable cache:

[cache]
enabled=yes
It is also possible to setup a remote Redis server, configure a password to access a server secured in protected mode or adjust cache timeouts. More details in cache section of agent configuration file.

Restart the agent component to apply the new configuration:

# systemctl restart slurm-web-agent.service
More details

User Authentication

To restrict access to the dashboard, enable authentication on the gateway and choose either LDAP or OpenID Connect (OIDC). Only one method is active per deployment.

See authentication documentation for an overview and setup guides:

Authorization Policy

At this stage, the agent is running with default authorization policy. You can create a file /etc/slurm-web/policy.ini to define your custom RBAC fine-grain policy with specific roles.

Follow Authorization policy reference documentation to learn the policy file format, review examples and choose the actions granted to each role.

More details

Production HTTP server

At this stage, Slurm-web is served by native Python HTTP services. This setup is convenient for evaluation, but it is not recommended for production: network communications are not secured with TLS and the service is not integrated behind a production HTTP server.

For a production deployment, follow the Production HTTP server setup guide. It explains how to serve Slurm-web with supported HTTP servers such as Nginx, Apache or Caddy, how to expose the gateway and agent WSGI applications, and how to update Slurm-web configuration for the public URL.

More details

RacksDB database

Slurm-web can use RacksDB to generate advanced interactive graphical representations of datacenters racks with the compute nodes. For this feature, RacksDB database must be defined with your HPC cluster infrastructure. This is actually quick and easy based on the examples provided.

Some requirements must be fulfilled in this database:

  • The infrastructure must have the same name as the cluster previously declared in agent configuration file.

  • The compute tag must be assigned to all compute nodes declared in Slurm configuration.

You can choose another tag name but you must declare it in racksdb section of agent configuration, for example:

[racksdb]
tags=blade

Restart the agent component to load the RacksDB database:

# systemctl restart slurm-web-agent.service

By default, RacksDB integration is in auto mode: the agent tries to load the database and schema and disables the feature with a warning in logs if unable to load.

If you don’t need this advanced interactive graphical representations feature and want to suppress the warning in logs, RacksDB integration can be disabled with the following lines in /etc/slurm-web/agent.ini:

[racksdb]
enabled=no
More links

Metrics

Slurm-web offers the possibility to export Slurm metrics in OpenMetrics format and integrate with Prometheus. This feature can be used to store metrics in timeseries databases and draw diagrams of historical data.

This feature is disabled by default.

It can be enabled with the following lines in /etc/slurm-web/agent.ini:

[metrics]
enabled=yes

Restart the agent component to apply the new configuration:

# systemctl restart slurm-web-agent.service
More details

Multi-clusters

Slurm-web is designed to support distributed setup with a central server and multiple clusters. Compared to the steps above, the following changes must be considered:

  1. Install and setup slurmrestd on all clusters.

  2. Install Slurm-web agent on all clusters, colocated on the same hosts as slurmrestd.

  3. Install Slurm-web gateway on the central server.

  4. Setup production HTTP servers with HTTPS (SSL/TLS) for all agents and the gateway.

  5. Set URL of all agents in agents section of gateway configuration.

  6. Generate JWT signing key on central server and deploy this key on all agents servers (same key must be shared by all agents and the gateway).

  7. Deploy the RacksDB database at the default path on all agent servers (auto-loaded on restart).

  8. Deploy custom policy on all agents servers.

  9. Setup in-memory cache on all agents servers.

Et voilà!

1. Slurm-web 7.0.0 actually requires Slurm REST API v0.0.41 available in Slurm 24.05 and above. Please refer to Slurm REST API versions section for more details.