Run without a desktop

Extract the matching Linux headless archive and run the daemon from the extracted directory. Keep the bundled web directory alongside it. Open http://127.0.0.1:7331 on that computer.

For a remote server, an SSH tunnel lets you reach the loopback UI: ssh -L 7331:127.0.0.1:7331 user@server. Then open http://127.0.0.1:7331 on your own computer, using a different local port if it is already occupied.

The deb and rpm packages run Toskar as the system service toskar.service (also reachable as yggdrasil.service), as the user yggdrasil, with its data in /var/lib/yggdrasil/.local/share/toskar (.local/share/yggdrasil for an install from before the rename to Toskar). Use systemctl status, restart, and stop, and journalctl -u toskar for its log. The headless archive does not install a service: the daemon accepts --data-dir for a custom data location, and Ctrl+C stops it in a terminal.

config.json in the data directory sets ports, addresses, discovery, and static peers, and TOSKAR_* environment variables override them for containers. The toskarctl command lists, creates, runs, and pauses automations from a terminal, and prints shell completion.

Behind a reverse proxy that signs people in, such as Authelia, Authentik, Cloudflare Access, or Tailscale, set TOSKAR_TRUSTED_PROXIES to the proxy's address. Toskar then takes the person from the proxy's Remote-User header, makes them the first time, and gives them a role from their groups: TOSKAR_PROXY_ADMIN_GROUPS and TOSKAR_PROXY_MEMBER_GROUPS, with TOSKAR_PROXY_DEFAULT_ROLE for everyone else. TOSKAR_PROXY_OWNER_USER is your own name there. Only the listed address is believed. With the proxy on the same computer, everything from that computer counts as the proxy's, so open Toskar through the proxy there too.

To let people sign in with Google, Microsoft, Okta, Authentik, Keycloak, or another OpenID Connect provider, register Toskar there with its address followed by /api/v1/oidc/callback, then set TOSKAR_OIDC_ISSUER, TOSKAR_OIDC_CLIENT_ID, and TOSKAR_OIDC_CLIENT_SECRET. The sign-in screen then shows Sign in with that provider. Groups become roles with TOSKAR_OIDC_ADMIN_GROUPS and TOSKAR_OIDC_MEMBER_GROUPS, and TOSKAR_OIDC_OWNER_EMAIL is your own address there.

tar -xzf yggdrasil-1.11.2-linux-amd64-headless.tar.gz
cd yggdrasil-1.11.2-linux-amd64-headless
./toskar