OpenRAG 0.2.0__tar.gz → 0.2.1__tar.gz

{openrag-0.2.0/src/openrag.egg-info → openrag-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openrag
-Version: 0.2.0
+Version: 0.2.1
 Summary: Add your description here
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
@@ -51,68 +51,20 @@ OpenRAG is a comprehensive Retrieval-Augmented Generation platform that enables
 
 <a href="https://deepwiki.com/langflow-ai/openrag"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
 
-</div>
-<div align="center">
-  <a href="#quickstart" style="color: #0366d6;">Quickstart</a> &nbsp;&nbsp;|&nbsp;&nbsp;
-  <a href="#install-python-package" style="color: #0366d6;">Python package</a> &nbsp;&nbsp;|&nbsp;&nbsp;
-  <a href="#docker-or-podman-installation" style="color: #0366d6;">Docker or Podman</a> &nbsp;&nbsp;|&nbsp;&nbsp;
-  <a href="#development" style="color: #0366d6;">Development</a> &nbsp;&nbsp;|&nbsp;&nbsp;
-  <a href="#troubleshooting" style="color: #0366d6;">Troubleshooting</a>
-</div>
-
-## Quickstart
-
-To run OpenRAG without creating or modifying any project files, use `uvx`:
-
-```bash
-uvx openrag
-```
-
-This command runs OpenRAG without installing it to your project or globally.
-
-To run a specific version of OpenRAG, run `uvx --from openrag==VERSION openrag`.
-
-## Install Python package
-
-To add the OpenRAG Python package to a Python project, use `uv`:
-
-1. Create a new project with a virtual environment using `uv init`:
+## Install OpenRAG
 
-   ```bash
-   uv init YOUR_PROJECT_NAME
-   cd YOUR_PROJECT_NAME
-   ```
+To get started with OpenRAG, see the installation guides in the OpenRAG documentation:
 
-   The `(venv)` prompt doesn't change, but `uv` commands will automatically use the project's virtual environment.
-   For more information on virtual environments, see the [uv documentation](https://docs.astral.sh/uv/pip/environments).
-
-2. Add OpenRAG to your project:
-
-   ```bash
-   uv add openrag
-   ```
-
-   To add a specific version of OpenRAG, run `uv add openrag==VERSION`.
-
-3. Start the OpenRAG terminal user interface (TUI):
-
-   ```bash
-   uv run openrag
-   ```
-
-4. Continue with the [Quickstart](https://docs.openr.ag/quickstart).
-
-For all installation options, see the [OpenRAG installation guide](https://docs.openr.ag/install).
-
-## Docker or Podman installation
-
-By default, OpenRAG automatically starts the required containers and helps you manage them.
-To install OpenRAG with self-managed containers, see the [OpenRAG installation guide](https://docs.openr.ag/docker).
+* [Quickstart](https://docs.openr.ag/quickstart)
+* [Install the OpenRAG Python package](https://docs.openr.ag/install-options)
+* [Deploy self-managed services with Docker or Podman](https://docs.openr.ag/docker)
 
 ## Development
 
-For developers wanting to contribute to OpenRAG or set up a development environment, see [CONTRIBUTING.md](CONTRIBUTING.md).
+For developers who want to [contribute to OpenRAG](https://docs.openr.ag/support/contribute) or set up a development environment, see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## Troubleshooting
 
-For common issues and fixes, see [Troubleshoot OpenRAG](https://docs.openr.ag/support/troubleshoot).
+For assistance with OpenRAG, see [Troubleshoot OpenRAG](https://docs.openr.ag/support/troubleshoot) and visit the [Discussions page](https://github.com/langflow-ai/openrag/discussions).
+
+To report a bug or submit a feature request, visit the [Issues page](https://github.com/langflow-ai/openrag/issues).

openrag-0.2.1/README.md

@@ -0,0 +1,34 @@
+<div align="center">
+
+# OpenRAG
+
+<div align="center">
+  <a href="https://github.com/langflow-ai/langflow"><img src="https://img.shields.io/badge/Langflow-1C1C1E?style=flat&logo=langflow" alt="Langflow"></a>
+  &nbsp;&nbsp;
+  <a href="https://github.com/opensearch-project/OpenSearch"><img src="https://img.shields.io/badge/OpenSearch-005EB8?style=flat&logo=opensearch&logoColor=white" alt="OpenSearch"></a>
+  &nbsp;&nbsp;
+  <a href="https://github.com/docling-project/docling"><img src="https://img.shields.io/badge/Docling-000000?style=flat" alt="Langflow"></a>
+  &nbsp;&nbsp;
+</div>
+
+OpenRAG is a comprehensive Retrieval-Augmented Generation platform that enables intelligent document search and AI-powered conversations. Users can upload, process, and query documents through a chat interface backed by large language models and semantic search capabilities. The system utilizes Langflow for document ingestion, retrieval workflows, and intelligent nudges, providing a seamless RAG experience. Built with [Starlette](https://github.com/Kludex/starlette) and [Next.js](https://github.com/vercel/next.js). Powered by [OpenSearch](https://github.com/opensearch-project/OpenSearch), [Langflow](https://github.com/langflow-ai/langflow), and [Docling](https://github.com/docling-project/docling).
+
+<a href="https://deepwiki.com/langflow-ai/openrag"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
+
+## Install OpenRAG
+
+To get started with OpenRAG, see the installation guides in the OpenRAG documentation:
+
+* [Quickstart](https://docs.openr.ag/quickstart)
+* [Install the OpenRAG Python package](https://docs.openr.ag/install-options)
+* [Deploy self-managed services with Docker or Podman](https://docs.openr.ag/docker)
+
+## Development
+
+For developers who want to [contribute to OpenRAG](https://docs.openr.ag/support/contribute) or set up a development environment, see [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Troubleshooting
+
+For assistance with OpenRAG, see [Troubleshoot OpenRAG](https://docs.openr.ag/support/troubleshoot) and visit the [Discussions page](https://github.com/langflow-ai/openrag/discussions).
+
+To report a bug or submit a feature request, visit the [Issues page](https://github.com/langflow-ai/openrag/issues).

{openrag-0.2.0 → openrag-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "openrag"
-version = "0.2.0"
+version = "0.2.1"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.13"

{openrag-0.2.0 → openrag-0.2.1}/src/api/docling.py

@@ -1,5 +1,6 @@
 """Docling service proxy endpoints."""
 
+import os
 import socket
 import struct
 from pathlib import Path
@@ -73,9 +74,15 @@ def determine_docling_host() -> str:
     return "localhost"
 
 
-# Detect the host IP once at startup
-HOST_IP = determine_docling_host()
-DOCLING_SERVICE_URL = f"http://{HOST_IP}:5001"
+# Use explicit URL if provided, otherwise auto-detect host
+_docling_url_override = os.getenv("DOCLING_SERVE_URL")
+if _docling_url_override:
+    DOCLING_SERVICE_URL = _docling_url_override.rstrip("/")
+    HOST_IP = _docling_url_override  # For display in health responses
+    logger.info("Using DOCLING_SERVE_URL override: %s", DOCLING_SERVICE_URL)
+else:
+    HOST_IP = determine_docling_host()
+    DOCLING_SERVICE_URL = f"http://{HOST_IP}:5001"
 
 
 async def health(request: Request) -> JSONResponse:

{openrag-0.2.0 → openrag-0.2.1}/src/api/keys.py

@@ -4,6 +4,8 @@ API Key management endpoints.
 These endpoints use JWT cookie authentication (for the UI) and allow users
 to create, list, and revoke their API keys for use with the public API.
 """
+import json
+
 from starlette.requests import Request
 from starlette.responses import JSONResponse
 from utils.logging_config import get_logger
@@ -64,6 +66,17 @@ async def create_key_endpoint(request: Request, api_key_service):
 
     try:
         data = await request.json()
+    except json.JSONDecodeError:
+        return JSONResponse(
+            {
+                "success": False,
+                "error": "Invalid or missing JSON body",
+                "example": {"name": "My API Key"},
+            },
+            status_code=400,
+        )
+
+    try:
         name = data.get("name", "").strip()
 
         if not name:

{openrag-0.2.0 → openrag-0.2.1}/src/api/knowledge_filter.py

@@ -8,6 +8,42 @@ from utils.logging_config import get_logger
 logger = get_logger(__name__)
 
 
+def normalize_query_data(query_data: str | dict) -> str:
+    """
+    Normalize query_data to ensure all required fields exist with defaults.
+    This prevents frontend crashes when API-created filters have incomplete data.
+    """
+    # Parse if string
+    if isinstance(query_data, str):
+        try:
+            data = json.loads(query_data)
+        except json.JSONDecodeError:
+            data = {}
+    else:
+        data = query_data or {}
+
+    # Ensure filters object exists with all required fields
+    filters = data.get("filters") or {}
+    normalized_filters = {
+        "data_sources": filters.get("data_sources", ["*"]),
+        "document_types": filters.get("document_types", ["*"]),
+        "owners": filters.get("owners", ["*"]),
+        "connector_types": filters.get("connector_types", ["*"]),
+    }
+
+    # Build normalized query_data with defaults
+    normalized = {
+        "query": data.get("query", ""),
+        "filters": normalized_filters,
+        "limit": data.get("limit", 10),
+        "scoreThreshold": data.get("scoreThreshold", 0),
+        "color": data.get("color", "zinc"),
+        "icon": data.get("icon", "filter"),
+    }
+
+    return json.dumps(normalized)
+
+
 async def create_knowledge_filter(
     request: Request, knowledge_filter_service, session_manager
 ):
@@ -25,6 +61,15 @@ async def create_knowledge_filter(
     if not query_data:
         return JSONResponse({"error": "Query data is required"}, status_code=400)
 
+    # Normalize query_data to ensure all required fields exist
+    try:
+        normalized_query_data = normalize_query_data(query_data)
+    except Exception as e:
+        logger.error(f"Failed to normalize query_data: {e}")
+        return JSONResponse(
+            {"error": f"Invalid queryData format: {str(e)}"}, status_code=400
+        )
+
     user = request.state.user
     jwt_token = session_manager.get_effective_jwt_token(user.user_id, request.state.jwt_token)
 
@@ -34,7 +79,7 @@ async def create_knowledge_filter(
         "id": filter_id,
         "name": name,
         "description": description,
-        "query_data": query_data,  # Store the full search query JSON
+        "query_data": normalized_query_data,  # Store normalized query JSON with defaults
         "owner": user.user_id,
         "allowed_users": payload.get("allowedUsers", []),  # ACL field for future use
         "allowed_groups": payload.get("allowedGroups", []),  # ACL field for future use
@@ -158,12 +203,22 @@ async def update_knowledge_filter(
             {"error": "Failed to delete existing knowledge filter"}, status_code=500
         )
 
+    # Normalize query_data if provided, otherwise use existing
+    query_data = payload.get("queryData", existing_filter["query_data"])
+    try:
+        normalized_query_data = normalize_query_data(query_data)
+    except Exception as e:
+        logger.error(f"Failed to normalize query_data: {e}")
+        return JSONResponse(
+            {"error": f"Invalid queryData format: {str(e)}"}, status_code=400
+        )
+
     # Create updated knowledge filter document with same ID
     updated_filter = {
         "id": filter_id,
         "name": payload.get("name", existing_filter["name"]),
         "description": payload.get("description", existing_filter["description"]),
-        "query_data": payload.get("queryData", existing_filter["query_data"]),
+        "query_data": normalized_query_data,
         "owner": existing_filter["owner"],
         "allowed_users": payload.get(
             "allowedUsers", existing_filter.get("allowed_users", [])

{openrag-0.2.0 → openrag-0.2.1}/src/api/oidc.py

@@ -1,3 +1,5 @@
+import os
+
 from starlette.requests import Request
 from starlette.responses import JSONResponse
 import json
@@ -8,7 +10,11 @@ from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
 
 async def oidc_discovery(request: Request, session_manager):
     """OIDC discovery endpoint"""
-    base_url = str(request.base_url).rstrip("/")
+    openrag_fqdn = os.getenv("OPENRAG_FQDN")
+    if openrag_fqdn:
+        base_url = f"http://{openrag_fqdn}:8000"
+    else:
+        base_url = str(request.base_url).rstrip("/")
 
     discovery_config = {
         "issuer": base_url,
@@ -44,6 +50,10 @@ async def jwks_endpoint(request: Request, session_manager):
         # Get the public key from session manager
         public_key_pem = session_manager.public_key_pem
 
+        if public_key_pem is None:
+            # Symmetric key in use - no JWKS available
+            return JSONResponse({"keys": []})
+
         # Parse the PEM to extract key components
         public_key = serialization.load_pem_public_key(public_key_pem.encode())
 

{openrag-0.2.0 → openrag-0.2.1}/src/main.py

@@ -21,6 +21,7 @@ from functools import partial
 
 from starlette.applications import Starlette
 from starlette.routing import Route
+from starlette.responses import JSONResponse
 
 # Set multiprocessing start method to 'spawn' for CUDA compatibility
 multiprocessing.set_start_method("spawn", force=True)
@@ -456,6 +457,24 @@ async def _ingest_default_documents_langflow(services, file_paths):
         file_count=len(file_paths),
     )
 
+async def opensearch_health_ready(request):
+    """Readiness probe: verifies OpenSearch dependency is reachable."""
+    try:
+        # Fast check that the cluster is reachable/auth works
+        await asyncio.wait_for(clients.opensearch.info(), timeout=5.0)
+        return JSONResponse(
+            {"status": "ready", "dependencies": {"opensearch": "up"}},
+            status_code=200,
+        )
+    except Exception as e:
+        return JSONResponse(
+            {
+                "status": "not_ready",
+                "dependencies": {"opensearch": "down"},
+                "error": str(e),
+            },
+            status_code=503,
+        )
 
 async def _ingest_default_documents_openrag(services, file_paths):
     """Ingest default documents using traditional OpenRAG processor."""
@@ -1148,6 +1167,11 @@ async def create_app():
             ),
             methods=["GET"],
         ),
+        Route(
+            "/search/health",
+            opensearch_health_ready,
+            methods=["GET"],
+        ),
         # Models endpoints
         Route(
             "/models/openai",

{openrag-0.2.0 → openrag-0.2.1/src/openrag.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openrag
-Version: 0.2.0
+Version: 0.2.1
 Summary: Add your description here
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
@@ -51,68 +51,20 @@ OpenRAG is a comprehensive Retrieval-Augmented Generation platform that enables
 
 <a href="https://deepwiki.com/langflow-ai/openrag"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
 
-</div>
-<div align="center">
-  <a href="#quickstart" style="color: #0366d6;">Quickstart</a> &nbsp;&nbsp;|&nbsp;&nbsp;
-  <a href="#install-python-package" style="color: #0366d6;">Python package</a> &nbsp;&nbsp;|&nbsp;&nbsp;
-  <a href="#docker-or-podman-installation" style="color: #0366d6;">Docker or Podman</a> &nbsp;&nbsp;|&nbsp;&nbsp;
-  <a href="#development" style="color: #0366d6;">Development</a> &nbsp;&nbsp;|&nbsp;&nbsp;
-  <a href="#troubleshooting" style="color: #0366d6;">Troubleshooting</a>
-</div>
-
-## Quickstart
-
-To run OpenRAG without creating or modifying any project files, use `uvx`:
-
-```bash
-uvx openrag
-```
-
-This command runs OpenRAG without installing it to your project or globally.
-
-To run a specific version of OpenRAG, run `uvx --from openrag==VERSION openrag`.
-
-## Install Python package
-
-To add the OpenRAG Python package to a Python project, use `uv`:
-
-1. Create a new project with a virtual environment using `uv init`:
+## Install OpenRAG
 
-   ```bash
-   uv init YOUR_PROJECT_NAME
-   cd YOUR_PROJECT_NAME
-   ```
+To get started with OpenRAG, see the installation guides in the OpenRAG documentation:
 
-   The `(venv)` prompt doesn't change, but `uv` commands will automatically use the project's virtual environment.
-   For more information on virtual environments, see the [uv documentation](https://docs.astral.sh/uv/pip/environments).
-
-2. Add OpenRAG to your project:
-
-   ```bash
-   uv add openrag
-   ```
-
-   To add a specific version of OpenRAG, run `uv add openrag==VERSION`.
-
-3. Start the OpenRAG terminal user interface (TUI):
-
-   ```bash
-   uv run openrag
-   ```
-
-4. Continue with the [Quickstart](https://docs.openr.ag/quickstart).
-
-For all installation options, see the [OpenRAG installation guide](https://docs.openr.ag/install).
-
-## Docker or Podman installation
-
-By default, OpenRAG automatically starts the required containers and helps you manage them.
-To install OpenRAG with self-managed containers, see the [OpenRAG installation guide](https://docs.openr.ag/docker).
+* [Quickstart](https://docs.openr.ag/quickstart)
+* [Install the OpenRAG Python package](https://docs.openr.ag/install-options)
+* [Deploy self-managed services with Docker or Podman](https://docs.openr.ag/docker)
 
 ## Development
 
-For developers wanting to contribute to OpenRAG or set up a development environment, see [CONTRIBUTING.md](CONTRIBUTING.md).
+For developers who want to [contribute to OpenRAG](https://docs.openr.ag/support/contribute) or set up a development environment, see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## Troubleshooting
 
-For common issues and fixes, see [Troubleshoot OpenRAG](https://docs.openr.ag/support/troubleshoot).
+For assistance with OpenRAG, see [Troubleshoot OpenRAG](https://docs.openr.ag/support/troubleshoot) and visit the [Discussions page](https://github.com/langflow-ai/openrag/discussions).
+
+To report a bug or submit a feature request, visit the [Issues page](https://github.com/langflow-ai/openrag/issues).

{openrag-0.2.0 → openrag-0.2.1}/src/services/models_service.py

@@ -35,13 +35,7 @@ class ModelsService:
         "claude-opus-4-1-20250805",
         "claude-opus-4-20250514",
         "claude-sonnet-4-20250514",
-        "claude-3-7-sonnet-latest",
-        "claude-3-5-sonnet-latest",
         "claude-3-5-haiku-latest",
-        "claude-3-opus-latest",
-        "claude-3-sonnet-20240229",
-        "claude-3-5-sonnet-20240620",
-        "claude-3-5-sonnet-20241022",
         "claude-3-5-haiku-20241022",
         "claude-3-haiku-20240307",
     ]

{openrag-0.2.0 → openrag-0.2.1}/src/session_manager.py

@@ -60,13 +60,44 @@ class SessionManager:
             str, Any
         ] = {}  # user_id -> OpenSearch client
 
-        # Load RSA keys
         self.private_key_path = private_key_path
         self.public_key_path = public_key_path
-        self._load_rsa_keys()
+
+        # Configure JWT signing (checks env var first, falls back to key files)
+        self._configure_jwt_signing()
+
+    def _configure_jwt_signing(self):
+        """Configure JWT signing - supports env var or file-based keys"""
+        signing_key = os.getenv("JWT_SIGNING_KEY")
+
+        if signing_key:
+            if signing_key.startswith("-----BEGIN"):
+                # PEM format = asymmetric (RS256)
+                self.private_key = serialization.load_pem_private_key(
+                    signing_key.encode(), password=None
+                )
+                # Extract public key from private key
+                self.public_key = self.private_key.public_key()
+                self.public_key_pem = self.public_key.public_bytes(
+                    encoding=serialization.Encoding.PEM,
+                    format=serialization.PublicFormat.SubjectPublicKeyInfo
+                ).decode()
+                self.algorithm = "RS256"
+                logger.info("JWT signing configured with RSA key from environment")
+            else:
+                # Plain string = symmetric (HS256)
+                self.private_key = signing_key
+                self.public_key = signing_key  # Same key for verification
+                self.public_key_pem = None  # No JWKS for symmetric
+                self.algorithm = "HS256"
+                logger.info("JWT signing configured with symmetric key from environment")
+        else:
+            # Fall back to file-based RSA keys
+            self._load_rsa_keys()
+            self.algorithm = "RS256"
 
     def _load_rsa_keys(self):
-        """Load RSA private and public keys"""
+        """Load RSA private and public keys from files"""
         try:
             with open(self.private_key_path, "rb") as f:
                 self.private_key = serialization.load_pem_private_key(
@@ -76,7 +107,6 @@ class SessionManager:
             with open(self.public_key_path, "rb") as f:
                 self.public_key = serialization.load_pem_public_key(f.read())
 
-            # Also get public key in PEM format for JWKS
             self.public_key_pem = open(self.public_key_path, "r").read()
 
         except FileNotFoundError as e:
@@ -140,6 +170,9 @@ class SessionManager:
         """Create JWT token for an existing user"""
         # Use OpenSearch-compatible issuer for OIDC validation
         oidc_issuer = "http://openrag-backend:8000"
+        openrag_fqdn = os.getenv("OPENRAG_FQDN")
+        if openrag_fqdn:
+            oidc_issuer = f"http://{openrag_fqdn}:8000"
 
         # Create JWT token with OIDC-compliant claims
         now = datetime.utcnow()
@@ -158,9 +191,10 @@ class SessionManager:
             "preferred_username": user.email,
             "email_verified": True,
             "roles": ["openrag_user"],  # Backend role for OpenSearch
+            "user_roles": ["openrag_user"],  # compatible with OpenSearch's roles_key
         }
 
-        token = jwt.encode(token_payload, self.private_key, algorithm="RS256")
+        token = jwt.encode(token_payload, self.private_key, algorithm=self.algorithm)
         return token
 
     def verify_token(self, token: str) -> Optional[Dict[str, Any]]:
@@ -169,7 +203,7 @@ class SessionManager:
             payload = jwt.decode(
                 token,
                 self.public_key,
-                algorithms=["RS256"],
+                algorithms=[self.algorithm],
                 audience=["opensearch", "openrag"],
             )
             return payload

openrag-0.2.1/src/tui/_assets/docker-compose.gpu.yml

@@ -0,0 +1,12 @@
+services:
+  openrag-backend:
+    environment:
+      - NVIDIA_DRIVER_CAPABILITIES=compute,utility
+      - NVIDIA_VISIBLE_DEVICES=all
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: all
+              capabilities: [gpu]

{openrag-0.2.0 → openrag-0.2.1}/src/tui/_assets/docker-compose.yml

@@ -29,7 +29,7 @@ services:
       - "9200:9200"
       - "9600:9600"
     volumes:
-      - ${OPENSEARCH_DATA_PATH:-./opensearch-data}:/usr/share/opensearch/data:Z
+      - ${OPENSEARCH_DATA_PATH:-./opensearch-data}:/usr/share/opensearch/data:U,z
 
   dashboards:
     image: opensearchproject/opensearch-dashboards:3.0.0
@@ -81,7 +81,7 @@ services:
       - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
     volumes:
       - ${OPENRAG_DOCUMENTS_PATH:-./openrag-documents}:/app/openrag-documents:Z
-      - ${OPENRAG_KEYS_PATH:-./keys}:/app/keys:Z
+      - ${OPENRAG_KEYS_PATH:-./keys}:/app/keys:U,z
       - ${OPENRAG_FLOWS_PATH:-./flows}:/app/flows:U,z
       - ${OPENRAG_CONFIG_PATH:-./config}:/app/config:Z
       - ${OPENRAG_DATA_PATH:-./data}:/app/data:Z

{openrag-0.2.0 → openrag-0.2.1}/src/tui/main.py

@@ -1,5 +1,7 @@
 """Main TUI application for OpenRAG."""
 
+import os
+import subprocess
 import sys
 from pathlib import Path
 from typing import Iterable, Optional
@@ -683,6 +685,51 @@ def migrate_legacy_data_directories():
     logger.info("Data migration completed successfully")
 
 
+def generate_jwt_keys(keys_dir: Path):
+    """Generate RSA keys for JWT signing if they don't exist.
+
+    This pre-generates keys on the host so containers can read them,
+    avoiding permission issues with Podman rootless mode.
+    """
+    private_key_path = keys_dir / "private_key.pem"
+    public_key_path = keys_dir / "public_key.pem"
+
+    if private_key_path.exists() and public_key_path.exists():
+        logger.debug("JWT keys already exist")
+        return
+
+    try:
+        # Generate private key
+        subprocess.run(
+            ["openssl", "genrsa", "-out", str(private_key_path), "2048"],
+            check=True,
+            capture_output=True,
+        )
+        # Set restrictive permissions on private key (readable by owner only)
+        os.chmod(private_key_path, 0o600)
+
+        # Generate public key from private key
+        subprocess.run(
+            [
+                "openssl",
+                "rsa",
+                "-in", str(private_key_path),
+                "-pubout",
+                "-out", str(public_key_path),
+            ],
+            check=True,
+            capture_output=True,
+        )
+        # Set permissions on public key (readable by all)
+        os.chmod(public_key_path, 0o644)
+
+        logger.info("Generated RSA keys for JWT signing")
+    except FileNotFoundError:
+        logger.warning("openssl not found, skipping JWT key generation (will be generated in container)")
+    except subprocess.CalledProcessError as e:
+        logger.error(f"Failed to generate RSA keys: {e}")
+
+
 def setup_host_directories():
     """Initialize OpenRAG directory structure on the host.
 
@@ -703,11 +750,14 @@ def setup_host_directories():
         base_dir / "data",
         base_dir / "data" / "opensearch-data",
     ]
-    
+
     for directory in directories:
         directory.mkdir(parents=True, exist_ok=True)
         logger.debug(f"Ensured directory exists: {directory}")
 
+    # Generate JWT keys on host to avoid container permission issues
+    generate_jwt_keys(base_dir / "keys")
+
 
 def run_tui():
     """Run the OpenRAG TUI application."""

{openrag-0.2.0 → openrag-0.2.1}/src/tui/managers/docling_manager.py

@@ -37,9 +37,9 @@ class DoclingManager:
         self._starting = False
         self._external_process = False
 
-        # PID file to track docling-serve across sessions (in current working directory)
-        from pathlib import Path
-        self._pid_file = Path.cwd() / ".docling.pid"
+        # PID file to track docling-serve across sessions (centralized in ~/.openrag/tui/)
+        from utils.paths import get_tui_dir
+        self._pid_file = get_tui_dir() / ".docling.pid"
 
         # Log storage - simplified, no queue
         self._log_buffer: List[str] = []