> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gensparx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Podman

# Podman

Run the gensparx gateway in a **rootless** Podman container. Uses the same image as Docker (build from the repo [Dockerfile](https://github.com/gensparx/gensparx/blob/main/Dockerfile)).

## Requirements

* Podman (rootless)
* Sudo for one-time setup (create user, build image)

## Quick start

**1. One-time setup** (from repo root; creates user, builds image, installs launch script):

```bash theme={null}
./setup-podman.sh
```

This also creates a minimal `~gensparx/.gensparx/gensparx.json` (sets `gateway.mode="local"`) so the gateway can start without running the wizard.

By default the container is **not** installed as a systemd service, you start it manually (see below). For a production-style setup with auto-start and restarts, install it as a systemd Quadlet user service instead:

```bash theme={null}
./setup-podman.sh --quadlet
```

(Or set `GENSPARX_PODMAN_QUADLET=1`; use `--container` to install only the container and launch script.)

**2. Start gateway** (manual, for quick smoke testing):

```bash theme={null}
./scripts/run-gensparx-podman.sh launch
```

**3. Onboarding wizard** (e.g. to add channels or providers):

```bash theme={null}
./scripts/run-gensparx-podman.sh launch setup
```

Then open `http://127.0.0.1:18789/` and use the token from `~gensparx/.gensparx/.env` (or the value printed by setup).

## Systemd (Quadlet, optional)

If you ran `./setup-podman.sh --quadlet` (or `GENSPARX_PODMAN_QUADLET=1`), a [Podman Quadlet](https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html) unit is installed so the gateway runs as a systemd user service for the gensparx user. The service is enabled and started at the end of setup.

* **Start:** `sudo systemctl --machine gensparx@ --user start gensparx.service`
* **Stop:** `sudo systemctl --machine gensparx@ --user stop gensparx.service`
* **Status:** `sudo systemctl --machine gensparx@ --user status gensparx.service`
* **Logs:** `sudo journalctl --machine gensparx@ --user -u gensparx.service -f`

The quadlet file lives at `~gensparx/.config/containers/systemd/gensparx.container`. To change ports or env, edit that file (or the `.env` it sources), then `sudo systemctl --machine gensparx@ --user daemon-reload` and restart the service. On boot, the service starts automatically if lingering is enabled for gensparx (setup does this when loginctl is available).

To add quadlet **after** an initial setup that did not use it, re-run: `./setup-podman.sh --quadlet`.

## The gensparx user (non-login)

`setup-podman.sh` creates a dedicated system user `gensparx`:

* **Shell:** `nologin` — no interactive login; reduces attack surface.

* **Home:** e.g. `/home/gensparx` — holds `~/.gensparx` (config, workspace) and the launch script `run-gensparx-podman.sh`.

* **Rootless Podman:** The user must have a **subuid** and **subgid** range. Many distros assign these automatically when the user is created. If setup prints a warning, add lines to `/etc/subuid` and `/etc/subgid`:

  ```text theme={null}
  gensparx:100000:65536
  ```

  Then start the gateway as that user (e.g. from cron or systemd):

  ```bash theme={null}
  sudo -u gensparx /home/gensparx/run-gensparx-podman.sh
  sudo -u gensparx /home/gensparx/run-gensparx-podman.sh setup
  ```

* **Config:** Only `gensparx` and root can access `/home/gensparx/.gensparx`. To edit config: use the Control UI once the gateway is running, or `sudo -u gensparx $EDITOR /home/gensparx/.gensparx/gensparx.json`.

## Environment and config

* **Token:** Stored in `~gensparx/.gensparx/.env` as `GENSPARX_GATEWAY_TOKEN`. `setup-podman.sh` and `run-gensparx-podman.sh` generate it if missing (uses `openssl`, `python3`, or `od`).
* **Optional:** In that `.env` you can set provider keys (e.g. `GROQ_API_KEY`, `OLLAMA_API_KEY`) and other gensparx env vars.
* **Host ports:** By default the script maps `18789` (gateway) and `18790` (bridge). Override the **host** port mapping with `GENSPARX_PODMAN_GATEWAY_HOST_PORT` and `GENSPARX_PODMAN_BRIDGE_HOST_PORT` when launching.
* **Gateway bind:** By default, `run-gensparx-podman.sh` starts the gateway with `--bind loopback` for safe local access. To expose on LAN, set `GENSPARX_GATEWAY_BIND=lan` and configure `gateway.controlUi.allowedOrigins` (or explicitly enable host-header fallback) in `gensparx.json`.
* **Paths:** Host config and workspace default to `~gensparx/.gensparx` and `~gensparx/.gensparx/workspace`. Override the host paths used by the launch script with `GENSPARX_CONFIG_DIR` and `GENSPARX_WORKSPACE_DIR`.

## Useful commands

* **Logs:** With quadlet: `sudo journalctl --machine gensparx@ --user -u gensparx.service -f`. With script: `sudo -u gensparx podman logs -f gensparx`
* **Stop:** With quadlet: `sudo systemctl --machine gensparx@ --user stop gensparx.service`. With script: `sudo -u gensparx podman stop gensparx`
* **Start again:** With quadlet: `sudo systemctl --machine gensparx@ --user start gensparx.service`. With script: re-run the launch script or `podman start gensparx`
* **Remove container:** `sudo -u gensparx podman rm -f gensparx` — config and workspace on the host are kept

## Troubleshooting

* **Permission denied (EACCES) on config or auth-profiles:** The container defaults to `--userns=keep-id` and runs as the same uid/gid as the host user running the script. Ensure your host `GENSPARX_CONFIG_DIR` and `GENSPARX_WORKSPACE_DIR` are owned by that user.
* **Gateway start blocked (missing `gateway.mode=local`):** Ensure `~gensparx/.gensparx/gensparx.json` exists and sets `gateway.mode="local"`. `setup-podman.sh` creates this file if missing.
* **Rootless Podman fails for user gensparx:** Check `/etc/subuid` and `/etc/subgid` contain a line for `gensparx` (e.g. `gensparx:100000:65536`). Add it if missing and restart.
* **Container name in use:** The launch script uses `podman run --replace`, so the existing container is replaced when you start again. To clean up manually: `podman rm -f gensparx`.
* **Script not found when running as gensparx:** Ensure `setup-podman.sh` was run so that `run-gensparx-podman.sh` is copied to gensparx’s home (e.g. `/home/gensparx/run-gensparx-podman.sh`).
* **Quadlet service not found or fails to start:** Run `sudo systemctl --machine gensparx@ --user daemon-reload` after editing the `.container` file. Quadlet requires cgroups v2: `podman info --format '{{.Host.CgroupsVersion}}'` should show `2`.

## Optional: run as your own user

To run the gateway as your normal user (no dedicated gensparx user): build the image, create `~/.gensparx/.env` with `GENSPARX_GATEWAY_TOKEN`, and run the container with `--userns=keep-id` and mounts to your `~/.gensparx`. The launch script is designed for the gensparx-user flow; for a single-user setup you can instead run the `podman run` command from the script manually, pointing config and workspace to your home. Recommended for most users: use `setup-podman.sh` and run as the gensparx user so config and process are isolated.