Server Configuration

Some aspects of app execution are controlled by the Fileglancer server’s config.yaml, not by individual app manifests. These settings are managed by the system administrator and apply to every job on the server.

Note

As a tool author you generally don’t set these — but knowing they exist explains why a tool like nextflow or pixi might be available on the cluster without you installing it, and where container images are cached.

Extra Paths (extra_paths)

The extra_paths setting adds directories to $PATH for all job scripts. This makes tools like nextflow, pixi, or apptainer available without requiring users to configure their own environments.

config.yaml

apps:
  extra_paths:
    - /opt/nextflow/bin
    - /opt/pixi/bin
    - /usr/local/apptainer/bin

These paths are:

1. Appended to $PATH in every generated job script — the user’s own $PATH entries take precedence.
2. Visible to the runtime requirement check — so requirements: [nextflow] can find /opt/nextflow/bin/nextflow even if it isn’t on the user’s default $PATH.

Worker Environment (worker_env_passthrough)

Fileglancer runs git operations and job submission in a per-user worker process. The worker’s environment is built from an allowlist, so server-side secrets (API keys, tokens, database URLs) in the Fileglancer server’s environment are never readable by users via the worker process. The built-in allowlist covers what jobs and schedulers legitimately need: PATH/HOME/locale/tmp variables, proxy and SSH settings, scheduler variables (LSF_*, SLURM_*, SGE_*, PBS_*), environment modules, conda/pixi, container runtimes, and PYTHONPATH.

If your site needs additional variables in the job environment — a license server, a site-specific scheduler setting — list them in worker_env_passthrough as exact names or as prefixes ending in _:

config.yaml

apps:
  worker_env_passthrough:
    - MYSITE_LICENSE_SERVER   # exact variable name
    - MYSITE_                 # prefix: passes every MYSITE_* variable

Add only non-secret variables — anything passed through is visible to every user on the server. Fileglancer’s own FGC_* settings variables are never passed through, even if listed here.

Unknown-Job Cutoff (unknown_timeout_hours)

A job whose status the scheduler can no longer report (for example, it aged out of the scheduler’s queue history) shows as UNKNOWN. Unknown jobs are treated as still active — they keep being polled and can be cancelled — but a job that stays in UNKNOWN longer than unknown_timeout_hours (default: 24) is marked FAILED and dropped from polling, since continued polling would never resolve it. Set it to 0 to disable the cutoff.

config.yaml

apps:
  unknown_timeout_hours: 24

Users can clear a stuck job sooner by cancelling it from the Jobs page.

Service Proxy (service_proxy_domain)

A service job binds a port on a compute node and publishes http://host:port. Reaching that address means plain HTTP, and it only works from a network that can route to the compute nodes directly. Setting service_proxy_domain makes Fileglancer republish every running service at a per-job HTTPS subdomain of that zone instead:

config.yaml

session_secret_key: "<a long random string>"
apps:
  service_proxy_domain: "services.example.org"

Users then open https://job-42-k7m2qhxr.services.example.org/..., and the path and query of the service’s own URL — including any access token — are carried across unchanged. The subdomain label is signed with session_secret_key, which is required whenever the proxy domain is set, so the per-job addresses cannot be guessed or enumerated.

Leave service_proxy_domain empty to disable it; each service’s direct URL is then published unchanged. Turning it on also needs a wildcard DNS record, a wildcard TLS certificate for the zone, and a matching reverse-proxy server block. Those steps are described in docs/ServiceProxy.md in the Fileglancer repository.

Individual apps can decline to be republished with service_proxy: false on the runnable — see Opting out of the proxy.

Container Cache Directory

By default, Apptainer container images (SIF files) are cached at ~/.fileglancer/apptainer_cache/. There is no server-level setting for this; users override it individually in the Preferences page under “Container cache directory”. A value starting with ~/ is expanded to the user’s home directory.

See Containers (Apptainer) for how the cache is used during a job.