From cee4f1ac4c18086dd84469cfbd9ac94e01207732 Mon Sep 17 00:00:00 2001 From: slopqueue Date: Sat, 8 Aug 2026 23:30:45 +0000 Subject: [PATCH 1/4] Add EUROfusion access onboarding docs Document how ITPcp members obtain and verify EUROfusion DevOps/Gateway access (request route via group lead, SSH key reuse, access verification) and link it from the README Getting Started section. Closes #18 --- README.md | 4 +++ docs/eurofusion-access.md | 60 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) create mode 100644 docs/eurofusion-access.md diff --git a/README.md b/README.md index 4669b05..40af65f 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,10 @@ If you haven't done so earlier, set up your SSH keys in `~/.ssh` via `ssh-keygen with a **blank passphrase** and add the content of `id_rsa.pub` to Gitlab and GitHub for authentication. +For EUROfusion/IMAS work, your account is requested by the group lead +(not self-service); see [docs/eurofusion-access.md](docs/eurofusion-access.md) +for the request route, SSH setup, and access verification. + ### Perparing your machine On Linux: At ITPcp computers all packages should be installed to get going. diff --git a/docs/eurofusion-access.md b/docs/eurofusion-access.md new file mode 100644 index 0000000..e7347a3 --- /dev/null +++ b/docs/eurofusion-access.md @@ -0,0 +1,60 @@ +# EUROfusion access + +EUROfusion provides its own "DevOps" compute and collaboration +infrastructure (Gateway access, a DevOps GitLab, and the IMAS data +model / Access Layer) that ITPcp members need for IMAS-facing work and +for anything that must be built or run on EUROfusion-provided systems. + +Unlike the TU Graz GitLab or GitHub, account access is **not +self-service**: an account request goes through a project/unit +administrator and typically takes weeks. Start early. + +## Who requests access + +Account and group membership is requested by a project administrator. +At ITPcp, ask the group lead (Christopher Albert) to sponsor the +request and to have you added to the ITPcp group/project on the +EUROfusion DevOps GitLab. + +Current ITPcp members with access are tracked in the issue +"Add users to EUROfusion devops" (itpplasma/code#18): +Chris, Winny, Sergei, Max. + +## What you need + +- **Gateway (SSH) account**: grants command-line access to + EUROfusion-provided systems. You receive the exact host from the + account-grant mail; use that, do not guess a hostname. +- **DevOps GitLab membership**: group/project membership on the + EUROfusion DevOps GitLab, via the web SSO login. *Having an account + is not the same as having access to the relevant project*; confirm + the group membership, not just the account. + +## SSH key setup + +Reuse the SSH key you already set up for GitHub/GitLab (see +[README.md](../README.md#getting-started), `~/.ssh` with a blank +passphrase). There is no need to generate a new key; add `id_rsa.pub` +to your EUROfusion profile where the account grant instructs. + +## Verifying access + +On your ITPcp machine, after your account is granted: + +```bash +# 1. Interactive login to the EUROfusion Gateway front-end +# (exact host: take from the account-grant mail, do not guess) +ssh @ + +# 2. Git access to the EUROfusion DevOps GitLab +# (exact host: take from the account-grant mail, do not guess) +ssh -T git@ +# Expected: "Welcome to GitLab, @!" + +# 3. Web SSO +# log in to the DevOps GitLab web UI and confirm membership of the +# ITPcp group/project (step 3 is the one that matters operationally) +``` + +Only when all three succeed — and step 3 shows the required group +membership — does ITPcp consider the account usable. From 79b5f943250ac0e267be841049264cceccc750dc Mon Sep 17 00:00:00 2001 From: slopqueue Date: Sun, 9 Aug 2026 00:00:30 +0000 Subject: [PATCH 2/4] docs: fill in verified EUROfusion Gateway and DevOps GitLab hosts Replace the unresolved and placeholders with the exact verified endpoints (EFGW Gateway at login.eufus.eu and the CINECA-hosted EUROfusion DevOps GitLab SSH endpoint gitlab-ssh.hpc.cineca.it) and document the authoritative UserDB account grant route, so new members can follow and verify the onboarding steps. --- docs/eurofusion-access.md | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/docs/eurofusion-access.md b/docs/eurofusion-access.md index e7347a3..9f36046 100644 --- a/docs/eurofusion-access.md +++ b/docs/eurofusion-access.md @@ -22,9 +22,14 @@ Chris, Winny, Sergei, Max. ## What you need -- **Gateway (SSH) account**: grants command-line access to - EUROfusion-provided systems. You receive the exact host from the - account-grant mail; use that, do not guess a hostname. +- **Gateway (SSH) account**: grants command-line access to the + EUROfusion Gateway (EFGW), reachable at `login.eufus.eu`. Access is + not self-service: register in the CINECA **UserDB portal** + (`userdb.cineca.it`), send the signed GUA to the EUROfusion + Coordination Officer, then submit the HPC-access request on UserDB. + Granting is confirmed by CINECA emails with your username and the + 2FA set-up link (see + ). - **DevOps GitLab membership**: group/project membership on the EUROfusion DevOps GitLab, via the web SSO login. *Having an account is not the same as having access to the relevant project*; confirm @@ -42,13 +47,11 @@ to your EUROfusion profile where the account grant instructs. On your ITPcp machine, after your account is granted: ```bash -# 1. Interactive login to the EUROfusion Gateway front-end -# (exact host: take from the account-grant mail, do not guess) -ssh @ +# 1. Interactive login to the EUROfusion Gateway front-end (EFGW) +ssh @login.eufus.eu -# 2. Git access to the EUROfusion DevOps GitLab -# (exact host: take from the account-grant mail, do not guess) -ssh -T git@ +# 2. Git access to the EUROfusion DevOps GitLab (hosted by CINECA) +ssh -T git@gitlab-ssh.hpc.cineca.it # Expected: "Welcome to GitLab, @!" # 3. Web SSO From 0eae912230feb34c30573076d9bd4f47dd36a769 Mon Sep 17 00:00:00 2001 From: slopqueue Date: Sun, 9 Aug 2026 00:46:09 +0000 Subject: [PATCH 3/4] docs: add DevOps GitLab web URL and EUROfusion group for SSO verification New members could not follow the membership-verification step because the doc only named the SSH host gitlab-ssh.hpc.cineca.it with no web destination. Add the exact CINECA-hosted web UI (https://gitlab.hpc.cineca.it/) and the EUROfusion group URL (https://gitlab.hpc.cineca.it/groups/eurofusion) under which the ITPcp group/project membership is confirmed, in both the What-you-need bullet and the verification step 3. --- docs/eurofusion-access.md | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/docs/eurofusion-access.md b/docs/eurofusion-access.md index 9f36046..faa4961 100644 --- a/docs/eurofusion-access.md +++ b/docs/eurofusion-access.md @@ -31,9 +31,12 @@ Chris, Winny, Sergei, Max. 2FA set-up link (see ). - **DevOps GitLab membership**: group/project membership on the - EUROfusion DevOps GitLab, via the web SSO login. *Having an account - is not the same as having access to the relevant project*; confirm - the group membership, not just the account. + EUROfusion DevOps GitLab, via the web SSO login at + (the same CINECA-hosted GitLab as + the `gitlab-ssh.hpc.cineca.it` endpoint, reached through the ITPcp + group [eurofusion](https://gitlab.hpc.cineca.it/groups/eurofusion)). + *Having an account is not the same as having access to the relevant + project*; confirm the group membership, not just the account. ## SSH key setup @@ -55,8 +58,10 @@ ssh -T git@gitlab-ssh.hpc.cineca.it # Expected: "Welcome to GitLab, @!" # 3. Web SSO -# log in to the DevOps GitLab web UI and confirm membership of the -# ITPcp group/project (step 3 is the one that matters operationally) +# log in at https://gitlab.hpc.cineca.it/ and, under the +# eurofusion group (https://gitlab.hpc.cineca.it/groups/eurofusion), +# confirm membership of the ITPcp group/project +# (step 3 is the one that matters operationally) ``` Only when all three succeed — and step 3 shows the required group From b9ac761567d2f91a1f4ed3175ca2f13d7be5ef95 Mon Sep 17 00:00:00 2001 From: slopqueue Date: Sun, 9 Aug 2026 01:25:07 +0000 Subject: [PATCH 4/4] docs: fix UserDB URL and document EFGW step-CA SSH certificate setup --- docs/eurofusion-access.md | 40 ++++++++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 7 deletions(-) diff --git a/docs/eurofusion-access.md b/docs/eurofusion-access.md index faa4961..3cc4483 100644 --- a/docs/eurofusion-access.md +++ b/docs/eurofusion-access.md @@ -25,11 +25,13 @@ Chris, Winny, Sergei, Max. - **Gateway (SSH) account**: grants command-line access to the EUROfusion Gateway (EFGW), reachable at `login.eufus.eu`. Access is not self-service: register in the CINECA **UserDB portal** - (`userdb.cineca.it`), send the signed GUA to the EUROfusion + (https://userdb.hpc.cineca.it), send the signed GUA to the EUROfusion Coordination Officer, then submit the HPC-access request on UserDB. Granting is confirmed by CINECA emails with your username and the - 2FA set-up link (see + set-up link for 2FA plus the time-limited SSH certificate issued via + the `efgw` smallstep (step-CA) provisioner (see ). + - **DevOps GitLab membership**: group/project membership on the EUROfusion DevOps GitLab, via the web SSO login at (the same CINECA-hosted GitLab as @@ -40,17 +42,41 @@ Chris, Winny, Sergei, Max. ## SSH key setup -Reuse the SSH key you already set up for GitHub/GitLab (see -[README.md](../README.md#getting-started), `~/.ssh` with a blank -passphrase). There is no need to generate a new key; add `id_rsa.pub` -to your EUROfusion profile where the account grant instructs. +Two different kinds of SSH credentials are involved, and they must not +be confused: + +- **GitLab SSH key**: for Git access to the EUROfusion DevOps GitLab, + reuse the SSH key you already set up for GitHub/GitLab (see + [README.md](../README.md#getting-started), `~/.ssh` with a blank + passphrase). There is no need to generate a new key; add `id_rsa.pub` + to your DevOps GitLab profile + (). +- **Gateway (EFGW) authentication**: contrary to the GitLab SSH key, + the Gateway does **not** accept a bare `id_rsa` key. Logging in + requires a **time-limited SSH certificate** obtained from the + `efgw` smallstep (step-CA) provisioner, which additionally enforces + 2FA. Install the + [smallstep CLI](https://smallstep.com/docs/step-cli/installation/) + and log in once per certificate lifetime (by default repeatedly + re-running the login when prompted) with: + + ```bash + step ssh login --provisioner efgw + ``` + + This prompts for the 2FA code and writes a short-lived SSH + certificate into `~/.ssh` that the Gateway accepts; the Gateway is + reached through the `login.eufus.eu` host (see + ). ## Verifying access On your ITPcp machine, after your account is granted: ```bash -# 1. Interactive login to the EUROfusion Gateway front-end (EFGW) +# 1. Obtain the time-limited Gateway SSH certificate (2FA required) +step ssh login --provisioner efgw +# Then interactive login to the EUROfusion Gateway front-end (EFGW) ssh @login.eufus.eu # 2. Git access to the EUROfusion DevOps GitLab (hosted by CINECA)