Web UI Settings Example

This example demonstrates how to configure web UI settings on Qumulo clusters using the qumulo_web_ui_settings resource. These settings control session security and display compliance banners.

Features

The qumulo_web_ui_settings resource configures:

• Session inactivity timeout for automatic logout (security compliance)
• Login banner for legal notices and compliance warnings (Markdown supported)

Architecture

┌─────────────────────────────────────────────────────────────────────────────┐
│                        WEB UI SETTINGS SCOPE                                 │
└─────────────────────────────────────────────────────────────────────────────┘

    ADMINISTRATOR                                    QUMULO CLUSTER
┌───────────────────┐                         ┌───────────────────────────────┐
│                   │                         │                               │
│   Web Browser     │      HTTPS :443         │   Web UI (React)              │
│                   │─────────────────────────│                               │
│  ┌─────────────┐  │                         │  ┌─────────────────────────┐  │
│  │ Login Page  │  │                         │  │   LOGIN BANNER          │  │
│  │             │  │◄────────────────────────│  │   (Markdown rendered)   │  │
│  │  [Banner]   │  │                         │  │                         │  │
│  │  Username   │  │                         │  │   "Authorized Access    │  │
│  │  Password   │  │                         │  │    Only..."             │  │
│  │  [Login]    │  │                         │  └─────────────────────────┘  │
│  └─────────────┘  │                         │                               │
│                   │                         │  ┌─────────────────────────┐  │
│  ┌─────────────┐  │                         │  │   SESSION TIMEOUT       │  │
│  │  Dashboard  │  │ After 30 min inactive   │  │                         │  │
│  │             │──│◄────────────────────────│  │   inactivity_timeout:   │  │
│  │  [Session   │  │   Auto-logout           │  │   1800 seconds          │  │
│  │   Expired]  │  │                         │  │   (30 minutes)          │  │
│  └─────────────┘  │                         │  └─────────────────────────┘  │
│                   │                         │                               │
└───────────────────┘                         └───────────────────────────────┘

Prerequisites

1. Qumulo cluster with REST API access (port 8000)
2. Admin credentials for the cluster

Usage

1. Create a terraform.tfvars file:

cluster_endpoint = "https://cluster.example.com:8000"
cluster_username = "admin"
cluster_password = "cluster-admin-password"

# Session timeout (30 minutes, 0 to disable)
inactivity_timeout_minutes = 30

# Login banner (Markdown supported)
login_banner = <<-EOT
  ## Authorized Access Only

  This system is the property of Example Corporation and is for authorized
  use only. By using this system, all users acknowledge notice of, and agree
  to comply with, the Acceptable Use Policy.

  **Warning:** Unauthorized access to this system is prohibited.
EOT

1. Initialize and apply:

terraform init -upgrade
terraform plan
terraform apply

Variables

Name	Description	Type	Default
cluster_endpoint	Qumulo cluster REST API endpoint	string	-
cluster_username	Qumulo cluster admin username	string	"admin"
cluster_password	Qumulo cluster admin password	string	-
inactivity_timeout_minutes	Session inactivity timeout (0 to disable)	number	30
login_banner	Login banner text (Markdown supported, empty to disable)	string	""

Outputs

Name	Description
timeout_configured	Whether inactivity timeout is configured
banner_configured	Whether login banner is configured

Configuration Examples

Basic Timeout Only

resource "qumulo_web_ui_settings" "main" {
  connection_profile = "cluster1"

  # 15-minute timeout
  inactivity_timeout_seconds = 900

  # No banner
  login_banner = null
}

PCI-DSS Compliance

PCI-DSS requires 15-minute timeouts for inactive sessions:

resource "qumulo_web_ui_settings" "pci" {
  connection_profile = "cluster1"

  # 15-minute timeout (PCI-DSS requirement 8.1.8)
  inactivity_timeout_seconds = 900

  login_banner = <<-EOT
    ## PCI-DSS Compliant System

    This system processes payment card data and is subject to PCI-DSS
    requirements. Unauthorized access is prohibited and may result in
    civil and criminal penalties.

    All activity is logged and monitored.
  EOT
}

HIPAA Compliance

resource "qumulo_web_ui_settings" "hipaa" {
  connection_profile = "cluster1"

  # 30-minute timeout
  inactivity_timeout_seconds = 1800

  login_banner = <<-EOT
    ## Protected Health Information (PHI) System

    This system contains Protected Health Information subject to HIPAA
    regulations. Access is restricted to authorized personnel only.

    By accessing this system, you agree to:
    - Access only information necessary for your job function
    - Maintain the confidentiality of all PHI
    - Report any suspected security incidents immediately

    Unauthorized access or disclosure may result in disciplinary action
    and civil/criminal penalties under HIPAA.
  EOT
}

Government/FedRAMP

resource "qumulo_web_ui_settings" "fedramp" {
  connection_profile = "cluster1"

  # 15-minute timeout (FedRAMP requirement)
  inactivity_timeout_seconds = 900

  login_banner = <<-EOT
    ## U.S. Government System

    **WARNING:** This is a U.S. Government computer system. Unauthorized
    access is a violation of U.S. law and could result in criminal
    prosecution.

    By continuing, you consent to:
    - Monitoring of your activities
    - Recording of your session
    - Disclosure of any evidence of criminal activity

    If you do not agree to these conditions, disconnect immediately.
  EOT
}

Multi-Cluster Deployment

Apply consistent settings across multiple clusters:

variable "clusters" {
  type = map(object({
    endpoint = string
    username = string
    password = string
  }))
}

provider "qumulo" {
  connection_profiles = [
    for name, config in var.clusters : {
      name     = name
      endpoint = config.endpoint
      username = config.username
      password = config.password
    }
  ]
}

resource "qumulo_web_ui_settings" "fleet" {
  for_each = var.clusters

  connection_profile = each.key

  inactivity_timeout_seconds = 1800

  login_banner = <<-EOT
    ## ${upper(each.key)} Cluster

    Authorized access only. All activity is monitored.
  EOT
}

Full Configuration

# Web UI Settings Example
#
# This example demonstrates configuring web UI settings on Qumulo clusters.
# It shows how to:
# - Configure session inactivity timeout for security compliance
# - Display login banners for legal/compliance notices
# - Apply consistent settings across multiple clusters

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

variable "cluster_endpoint" {
  description = "Qumulo cluster REST API endpoint"
  type        = string
}

variable "cluster_username" {
  description = "Qumulo cluster admin username"
  type        = string
  default     = "admin"
}

variable "cluster_password" {
  description = "Qumulo cluster admin password"
  type        = string
  sensitive   = true
}

variable "inactivity_timeout_minutes" {
  description = "Session inactivity timeout in minutes (set to 0 to disable)"
  type        = number
  default     = 30
}

variable "login_banner" {
  description = "Login banner text (Markdown supported)"
  type        = string
  default     = ""
}

# Define connection profile for the cluster
provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = var.cluster_endpoint
      username             = var.cluster_username
      password             = var.cluster_password
      insecure_skip_verify = true # Required for clusters with self-signed certificates
    }
  ]
}

# Web UI settings - session timeout and login banner
resource "qumulo_web_ui_settings" "main" {
  connection_profile = "cluster1"

  # Session inactivity timeout (convert minutes to seconds)
  # Set to null to disable auto-logout
  inactivity_timeout_seconds = var.inactivity_timeout_minutes > 0 ? var.inactivity_timeout_minutes * 60 : null

  # Login banner (Markdown supported)
  # Set to null to show no banner
  login_banner = var.login_banner != "" ? var.login_banner : null
}

# Example with security compliance settings
resource "qumulo_web_ui_settings" "compliance_example" {
  count = 0 # Set to 1 to enable this example

  connection_profile = "cluster1"

  # 30-minute timeout for PCI-DSS compliance
  inactivity_timeout_seconds = 1800

  # Compliance banner
  login_banner = <<-EOT
    ## Authorized Access Only

    This system is the property of Example Corporation and is for authorized
    use only. By using this system, all users acknowledge notice of, and agree
    to comply with, the Acceptable Use Policy.

    **Warning:** Unauthorized access to this system is prohibited. All activity
    may be monitored and recorded. Evidence of unauthorized use may be provided
    to law enforcement.
  EOT
}

output "timeout_configured" {
  description = "Whether inactivity timeout is configured"
  value       = var.inactivity_timeout_minutes > 0
}

output "banner_configured" {
  description = "Whether login banner is configured"
  value       = var.login_banner != ""
}