fix(conf): run slurm-web-agent auth local as slurm

Run Slurm-web agent as slurm special user when authentication is local.

Author: rezib

CHANGELOG.md

@@ -12,7 +12,9 @@ and this project adheres to
 - conf: Add pkgs.rackslab.io packages repositories by default.
 
 ### Fixed
-- conf: Slurm-web v5 JWT for slurmrestd authentification ownership.
+- conf:
+  - Slurm-web v5 JWT for slurmrestd authentification ownership.
+  - Run Slurm-web agent as slurm special user when authentication is local.
 
 ## [1.2.0] - 2025-09-18
 

conf/roles/slurmweb/defaults/main.yml

@@ -11,6 +11,7 @@ slurmweb_slurmrestd_jwt_key: /var/lib/slurm-web/slurmrestd_jwt_hs256.key
 slurmweb_slurmrestd_jwt_token: null
 slurmweb_local_slurmrestd_jwt_key_file: jwt_hs256.key  # dummy
 slurmweb_agent_subdir: agent
+slurmweb_agent_service_override_path: /etc/systemd/system/slurm-web-agent-uwsgi.service.d/firehpc.conf
 slurmweb_agent_settings_defaults: {}
 slurmweb_gateway_settings_defaults: {}
 slurmweb_agent_settings: {}

conf/roles/slurmweb/tasks/main.yml

@@ -50,7 +50,7 @@
 #
 - name: Create JWT signing key
   ansible.builtin.command:
-    cmd: /usr/libexec/slurm-web/slurm-web-gen-jwt-key
+    cmd: "/usr/libexec/slurm-web/slurm-web-gen-jwt-key{% if slurmweb_slurmrestd_auth == 'local' %} --with-slurm{% endif %}"
     creates: "{{ slurmweb_jwt_key }}"
 
 - name: Install systemd services for components
@@ -65,6 +65,30 @@
   - agent
   - gateway
 
+- name: Setup slurm-web agent to run as slurm system user
+  block:
+  - name: Create slurm-web agent service override directory
+    ansible.builtin.file:
+      path: "{{ slurmweb_agent_service_override_path | dirname }}"
+      state: directory
+      owner: root
+      group: root
+      mode: 0755
+
+  - name: Deploy slurm-web agent service override file
+    ansible.builtin.copy:
+      content: |
+        [Service]
+        User=slurm
+        Group=slurm
+      dest: "{{ slurmweb_agent_service_override_path }}"
+      owner: slurm
+      group: slurm
+      mode: 0644
+    notify: Restart slurm-web-agent uWSGI
+  when:
+  - slurmweb_slurmrestd_auth == 'local'
+
 - name: Ensure Slurm-web uWGSI are started
   ansible.builtin.systemd_service:
     name: "slurm-web-{{ item }}-uwsgi"