Run without a desktop

Extract the matching Linux headless archive and run the daemon from the extracted directory. Keep the bundled web directory alongside it. Open http://127.0.0.1:7331 on that computer.

For a remote server, an SSH tunnel lets you reach the loopback UI: ssh -L 7331:127.0.0.1:7331 user@server. Then open http://127.0.0.1:7331 on your own computer, using a different local port if it is already occupied.

The deb and rpm packages run Toskar as the system service toskar.service (also reachable as yggdrasil.service), as the user yggdrasil, with its data in /var/lib/yggdrasil/.local/share/toskar (.local/share/yggdrasil for an install from before the rename to Toskar). Use systemctl status, restart, and stop, and journalctl -u toskar for its log. The headless archive does not install a service: the daemon accepts --data-dir for a custom data location, and Ctrl+C stops it in a terminal.

config.json in the data directory sets ports, addresses, discovery, and static peers, and TOSKAR_* environment variables override them for containers. The toskarctl command lists, creates, runs, and pauses automations from a terminal, and prints shell completion.

Behind a reverse proxy that signs people in, such as Authelia, Authentik, Cloudflare Access, or Tailscale, set TOSKAR_TRUSTED_PROXIES to the proxy's address. Toskar then takes the person from the proxy's Remote-User header, makes them the first time, and gives them a role from their groups: TOSKAR_PROXY_ADMIN_GROUPS and TOSKAR_PROXY_MEMBER_GROUPS, with TOSKAR_PROXY_DEFAULT_ROLE for everyone else. TOSKAR_PROXY_OWNER_USER is your own name there. Only the listed address is believed. With the proxy on the same computer, everything from that computer counts as the proxy's, so open Toskar through the proxy there too.

To let people sign in with Google, Microsoft, Okta, Authentik, Keycloak, or another OpenID Connect provider, register Toskar there with its address followed by /api/v1/oidc/callback, then set TOSKAR_OIDC_ISSUER, TOSKAR_OIDC_CLIENT_ID, and TOSKAR_OIDC_CLIENT_SECRET. The sign-in screen then shows Sign in with that provider. Groups become roles with TOSKAR_OIDC_ADMIN_GROUPS and TOSKAR_OIDC_MEMBER_GROUPS, and TOSKAR_OIDC_OWNER_EMAIL is your own address there.

tar -xzf toskar-1.12.0-linux-amd64-headless.tar.gz
cd toskar-1.12.0-linux-amd64-headless
./toskar

The service

The Linux packages run Toskar as the system service toskar, which starts when the computer does. It runs as the user yggdrasil, and keeps its data in /var/lib/yggdrasil/.local/share/toskar. Install the packages with sudo, since they set up the service.

Check it, restart it, or read its log with systemd's usual commands. These need a Linux computer with the service, so they aren't run in CI.

systemctl status toskar
sudo systemctl restart toskar
journalctl -u toskar

Open Toskar from your own computer

At first, Toskar answers only on the server itself, at 127.0.0.1:7331. An SSH tunnel brings that address to your own computer, and nothing is opened to the network.

1. On your own computer, open a terminal and run ssh -L 7331:127.0.0.1:7331 you@server, with your username and the server's name. Leave it open.
2. Open http://127.0.0.1:7331 in a browser on your own computer.
3. The first time, set up a model as on any computer: choose what you'd like your AI to do, then Install recommended setup.

Through the tunnel, Toskar answers as it would on the server. This check, from your own computer, shows that it's running:

curl -s http://127.0.0.1:7331/api/v1/health

{…"status":"ok"…}

Tip: If your own computer runs Toskar too, 7331 is taken there. Use another port on your side, such as ssh -L 7400:127.0.0.1:7331 you@server, and open http://127.0.0.1:7400.

You're the Owner

Whoever installed Toskar is its Owner, and uses it from the server without signing in. A tunnel arrives as the server, so you're the Owner through it too. To add other people, or to sign in from another device, see People and sign-in.

Update

Once a day, Toskar asks toskar.ai for the latest version number, and nothing else. When there's a newer one, Settings shows it under About, such as Toskar 1.13.0 is available. Update the way you installed:

Running the install script again doesn't update: it says Toskar is already installed and running. A Linux package restarts the service on the new version by itself.

Settings for a server

config.json in the data directory sets ports, addresses, discovery, and static peers, and TOSKAR_* environment variables override them for containers. The toskarctl command lists, creates, runs, and pauses automations from a terminal, and prints shell completion.

The headless archive doesn't install a service. Extract it, run toskar from its folder with the web folder beside it, and stop it with Ctrl+C. Its --data-dir option keeps the data somewhere else.

tar -xzf toskar-1.12.0-linux-amd64-headless.tar.gz
cd toskar-1.12.0-linux-amd64-headless
./toskar

Sign in through a proxy or your organization's accounts

Behind a reverse proxy that signs people in, such as Authelia, Authentik, Cloudflare Access, or Tailscale, set TOSKAR_TRUSTED_PROXIES to the proxy's address. Toskar then takes the person from the proxy's Remote-User header, makes them the first time, and gives them a role from their groups: TOSKAR_PROXY_ADMIN_GROUPS and TOSKAR_PROXY_MEMBER_GROUPS, with TOSKAR_PROXY_DEFAULT_ROLE for everyone else. TOSKAR_PROXY_OWNER_USER is your own name there. Only the listed address is believed. With the proxy on the same computer, everything from that computer counts as the proxy's, so open Toskar through the proxy there too.

To let people sign in with Google, Microsoft, Okta, Authentik, Keycloak, or another OpenID Connect provider, register Toskar there with its address followed by /api/v1/oidc/callback, then set TOSKAR_OIDC_ISSUER, TOSKAR_OIDC_CLIENT_ID, and TOSKAR_OIDC_CLIENT_SECRET. The sign-in screen then shows Sign in with that provider. Groups become roles with TOSKAR_OIDC_ADMIN_GROUPS and TOSKAR_OIDC_MEMBER_GROUPS, and TOSKAR_OIDC_OWNER_EMAIL is your own address there.

Troubleshooting