Your W&B Local Server comes up ready-to-use on boot. However, several advanced configuration options are available, at the /system-admin page on your server once it's up and running. You can email [email protected] to request a trial license to enable more users and teams.

Configuration as code

All configuration settings can be set via the UI however if you would like to manage these configuration options via code you can set the following environment variables:

Authentication

By default, a W&B Local Server run with manual user management enabling up to 4 users. Licensed versions of wandb/local also unlock SSO using Auth0.

Your server supports any authentication provider supported by Auth0. You should set up your own Auth0 domain and application that will be under your teams' control.

After creating an Auth0 app, you'll need to configure your Auth0 callbacks to the host of your W&B Server. By default, the server supports http from the public or private IP address provided by the host. You can also configure a DNS hostname and SSL certificate if you choose.

• Set the Callback URL to http(s)://YOUR-W&B-SERVER-HOST

• Set the Allowed Web Origin to http(s)://YOUR-W&B-SERVER-HOST

• Set the Logout URL to http(s)://YOUR-W&B-SERVER-HOST/logout

Save the Client ID and domain from your Auth0 app.

Then, navigate to the W&B settings page at http(s)://YOUR-W&B-SERVER-HOST/admin-settings. Enable the "Customize Authentication with Auth0" option, and fill in the Client ID and domain from your Auth0 app.

Finally, press "Update settings and restart W&B".

File Storage

By default, a W&B Enterprise Server saves files to a local data disk with a capacity that you set when you provision your instance. To support limitless file storage, you may configure your server to use an external cloud file storage bucket with an S3-compatible API.

Amazon Web Services

To use an AWS S3 bucket as the file storage backend for W&B, you'll need to create a bucket, along with an SQS queue configured to receive object creation notifications from that bucket. Your instance will need permissions to read from this queue.

Create an SQS Queue

First, create an SQS Standard Queue. Add a permission for all principals for the SendMessage and ReceiveMessage actions as well as GetQueueUrl . (If you like you can further lock this down using an advanced policy document.)

Create an S3 Bucket and Bucket Notifications

Then, create an S3 bucket. Under the bucket properties page in the console, in the "Events" section of "Advanced Settings", click "Add notification", and configure all object creation events to be sent to the SQS Queue you configured earlier.

Enable CORS access: your CORS configuration should look like the following:

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
    <AllowedOrigin>http://YOUR-W&B-SERVER-IP</AllowedOrigin>
    <AllowedMethod>GET</AllowedMethod>
    <AllowedMethod>PUT</AllowedMethod>
    <AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>

Configure W&B Server

Finally, navigate to the W&B settings page at http(s)://YOUR-W&B-SERVER-HOST/admin-settings. Enable the "Use an external file storage backend" option, and fill in the s3 bucket, region, and SQS queue in the following format:

• File Storage Bucket: s3://<bucket-name>

• File Storage Region: <region>

• Notification Subscription: sqs://<queue-name>

Press "update settings and restart W&B" to apply the new settings.

Google Cloud Platform

To use a GCP Storage bucket as a file storage backend for W&B, you'll need to create a bucket, along with a pubsub topic and subscription configured to receive object creation messages from that bucket.

Create Pubsub Topic and Subscription

Navigate to Pub/Sub > Topics in the GCP Console, and click "Create topic". Choose a name and create a topic.

Then click "Create subscription" in the subscriptions table at the bottom of the page. Choose a name, and make sure Delivery Type is set to "Pull". Click "Create".

Make sure the service account or account that your instance is running as has access to this subscription.

Create Storage Bucket

Navigate to Storage > Browser in the GCP Console, and click "Create bucket". Make sure to choose "Standard" storage class.

Make sure the service account or account that your instance is running as has access to this bucket.

Create Pubsub Notification

Creating a notification stream from the Storage Bucket to the Pubsub Topic can unfortunately only be done in the console. Make sure you have gsutil installed, and logged into the correct GCP Project, then run the following:

gcloud pubsub topics list  # list names of topics for reference
gsutil ls                  # list names of buckets for reference
​
# create bucket notification
gsutil notification create -t <TOPIC-NAME> -f json gs://<BUCKET-NAME>

​Further reference is available on the Cloud Storage website.​

Add Signing Permissions

To create signed file URLs, your W&B instance also needs the iam.serviceAccounts.signBlob permission in GCP. You can add it by adding the Service Account Token Creator role to the service account or IAM member that your instance is running as.

Grant Permissions to Node Running W&B

The node on which W&B Local is running must be configured to permit access to s3 and sqs. Depending on the type of server deployment you've opted for, you may need to add the following policy statements to your node role:

{
   "Statement":[
      {
         "Sid":"",
         "Effect":"Allow",
         "Action":"s3:*",
         "Resource":"arn:aws:s3:::<WANDB_BUCKET>"
      },
      {
         "Sid":"",
         "Effect":"Allow",
         "Action":[
            "sqs:*"
         ],
         "Resource":"arn:aws:sqs:<REGION>:<ACCOUNT>:<WANDB_QUEUE>"
      }
   ]
}

Configure W&B Server

Finally, navigate to the W&B settings page at http(s)://YOUR-W&B-SERVER-HOST/admin-settings. Enable the "Use an external file storage backend" option, and fill in the s3 bucket, region, and SQS queue in the following format:

• File Storage Bucket: gs://<bucket-name>

• File Storage Region: blank

• Notification Subscription: pubsub:/<project-name>/<topic-name>/<subscription-name>

Press "update settings and restart W&B" to apply the new settings.

Azure

To use an Azure blob container as the file storage for W&B, you'll need to create a storage account (if you don't already have one you want to use), create a blob container and a queue within that storage account, and then create an event subscription that sends "blob created" notifications to the queue from the blob container.

Create a Storage Account

If you have a storage account you want to use already, you can skip this step.

Navigate to Storage Accounts > Add in the Azure portal. Select an Azure subscription, and select any resource group or create a new one. Enter a name for your storage account.

Click Review and Create, and then, on the summary screen, click Create:

Creating the blob container

Go to Storage Accounts in the Azure portal, and click on your new storage account. In the storage account dashboard, click on Blob service > Containers in the menu:

Create a new container, and set it to Private:

Go to Settings > CORS > Blob service, and enter the IP of your wandb server as an allowed origin, with allowed methods GET and PUT, and all headers allowed and exposed, then save your CORS settings.

Creating the Queue

Go to Queue service > Queues in your storage account, and create a new Queue:

Go to Events in your storage account, and create an event subscription:

Give the event subscription the Event Schema "Event Grid Schema", filter to only the "Blob Created" event type, set the Endpoint Type to Storage Queues, and then select the storage account/queue as the endpoint.

In the Filters tab, enable subject filtering for subjects beginning with /blobServices/default/containers/your-blob-container-name/blobs/

Configure W&B Server

Go to Settings > Access keys in your storage account, click "Show keys", and then copy either key1 > Key or key2 > Key. Set this key on your W&B server as the environment variable AZURE_STORAGE_KEY.

Finally, navigate to the W&B settings page at http(s)://YOUR-W&B-SERVER-HOST/admin-settings. Enable the "Use an external file storage backend" option, and fill in the s3 bucket, region, and SQS queue in the following format:

• File Storage Bucket: az://<storage-account-name>/<blob-container-name>

• Notification Subscription: az://<storage-account-name>/<queue-name>

Press "Update settings" to apply the new settings.

Slack

In order to integrate your local W&B installation with Slack, you'll need to create a suitable Slack application.

Creating the Slack application

Visit https://api.slack.com/apps and select Create New App in the top right.

You can name it whatever you like, but what's important is to select the same Slack workspace as the one you intend to use for alerts.

Configuring the Slack application

Now that we have a Slack application ready, we need to authorize for use as an OAuth bot. Select OAuth & Permissions in the sidebar to the left.

Under Scopes, supply the bot with the incoming_webhook scope.

Finally, configure the Redirect URL to point to your W&B installation. You should use the same value as what you set Frontend Host to in your local system settings. You can specify multiple URLs if you have different DNS mappings to your instance.

Hit Save URLs once finished.

To further secure your Slack application and prevent abuse, you can specify an IP range under Restrict API Token Usage, whitelisting the IP or IP range of your W&B instance(s).

Register your Slack application with W&B

Navigate to the System Settings page of your W&B instance. Check the box to enable a custom Slack application:

You'll need to supply your Slack application's client ID and secret, which you can find in the Basic Information tab.

That's it! You can now verify that everything is working by setting up a Slack integration in the W&B app. Visit this page for more detailed information.