Commit graph

103 commits

Author SHA1 Message Date
8a933fd9de fix: enable CrowdSec Local API for cscli
Add LAPI server configuration with credentials file path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 13:53:15 +01:00
e0de37b15f fix: simplify CrowdSec module
Remove LAPI server config causing null coercion error.
Detection-only mode for now; bouncer can be added later.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 13:50:44 +01:00
9a57a2c511 . 2026-03-18 12:49:08 +00:00
211693ef3b feat: add CrowdSec security module
- Wraps native NixOS CrowdSec service
- Configures SSH and nginx log acquisition
- Installs linux/nginx/sshd hub collections
- Supports IP whitelisting and ban duration config
- Optional nginx bouncer integration (requires manual API key setup)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 13:44:36 +01:00
db4f0f8f61 fix: remove duplicate SOPS declaration, clean up unused param
- Remove redundant vaultwarden_admin_token from configuration.nix
  (already declared in module)
- Remove unused pkgs parameter from vaultwarden module

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 12:37:09 +01:00
45b6997fac chore: disable Vaultwarden signup
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 12:12:19 +01:00
ea7ca739ba feat: enable Vaultwarden in configuration
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 12:08:22 +01:00
e2facd1fa9 feat: add Vaultwarden module
- Add native NixOS Vaultwarden service module
- Supports WebSocket for real-time sync notifications
- Integrates with nginx via extraLocations for /notifications/hub
- Configurable signup, invitations, and SMTP settings
- Uses SOPS for admin token secret management

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 12:07:26 +01:00
cbce4aa228 feat(nginx): add extraLocations option for WebSocket support
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 03:19:31 +01:00
a2a0dfaa58 docs: update Vaultwarden plan with nginx extraLocations fix
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 03:15:34 +01:00
5b584cdb11 Update Vaultwarden spec with review feedback
- Add module header comment pattern
- Clarify Nginx WebSocket integration with concrete example
- Add SOPS secrets and templates declarations
- Update Files to Modify table

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 03:06:55 +01:00
2304648927 Add Vaultwarden module design spec
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 03:04:01 +01:00
2bfcc7c2ff update 2026-03-18 01:51:16 +00:00
a87fd37489 Add Brave Search web search to OpenClaw
- Enable web_search tool with Brave provider
- Add openclaw_brave_api_key secret to SOPS configuration
- Add BRAVE_API_KEY to openclaw.env template

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 02:50:09 +01:00
2d7a67bac9 Add CLAUDE.md for future Claude Code instances
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 02:42:21 +01:00
4d9c61da10 Fix exec config: use valid options (security: full, ask: off)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 02:36:59 +01:00
3ef4234d07 Enable elevated tools with auto-approve (no permission prompts)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 02:36:04 +01:00
a91e6ac883 Add Discord token to config with env variable substitution
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 02:29:15 +01:00
9f734de29e Add allowFrom for Discord dmPolicy=open
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 02:26:40 +01:00
b5901efde8 Fix JSON syntax: add missing closing brace in openclaw-config.json
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 02:24:55 +01:00
99a424aa34 Add channels.discord config to Openclaw 2026-03-18 01:58:51 +01:00
19bcc4c5fc Use loopback binding for OpenClaw (no auth required) 2026-03-18 01:54:55 +01:00
636fbd0597 Fix gateway.bind to use 'lan' mode instead of legacy format 2026-03-18 01:52:26 +01:00
175c0acf22 Fix OpenClaw config volume path to /home/node 2026-03-18 01:47:37 +01:00
ae5e61cb6e Fix openclaw config syntax - use external json file
- Move openclaw config to separate json file
- Reference file directly in podman module
- Remove problematic builtins.toJSON with nested arrays

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 01:37:46 +01:00
a595445bd2 Convert Openclaw to Podman container
- Use official ghcr.io/openclaw/openclaw image
- configure via JSON config file
- containerized for better isolation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-18 01:35:02 +01:00
11a588a4d9 Fix api type to openai-completions 2026-03-17 21:38:46 +01:00
396d1bd048 Copy config to OpenClaw's actual config location 2026-03-17 21:35:28 +01:00
68240b7319 Set openclaw as owner of sops template 2026-03-17 21:32:37 +01:00
d7c3bd0775 Fix EnvironmentFile merge with mkMerge 2026-03-17 21:26:51 +01:00
2dd8ef2797 Add --allow-unconfigured flag to openclaw 2026-03-17 21:19:08 +01:00
50b99b008c Run openclaw gateway in foreground mode 2026-03-17 21:17:12 +01:00
ff397d7d8c Add bash to PATH for shell scripts 2026-03-17 21:15:11 +01:00
36880c0135 Fix PATH environment variable for git access 2026-03-17 21:13:47 +01:00
cd801d325b Add git to OpenClaw service PATH for npm deps 2026-03-17 21:12:18 +01:00
cf27c28389 Add home dir to ReadWritePaths for npm cache 2026-03-17 21:08:25 +01:00
b9976c04ef Fix cp command shell syntax in OpenClaw 2026-03-17 21:07:26 +01:00
416432be17 Fix OpenClaw systemd service configuration 2026-03-17 21:06:14 +01:00
da5a408853 Set maxTokens to 128k for all z.ai models 2026-03-17 21:04:00 +01:00
a26e75b7a7 Update z.ai API URL and models
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 21:03:26 +01:00
1d11816a55 Remove OpenAI, use z.ai for OpenClaw
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 20:59:05 +01:00
1748360922 Add z.ai API key to OpenClaw secrets
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 20:55:40 +01:00
3a885463f0 Add OpenClaw AI Agent module
- Systemd service running OpenClaw gateway
- Configurable via sops secrets
- Runs on localhost:18789

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 20:55:15 +01:00
f013863986 Simplify SearXNG module to use root-based podman
Remove complex rootless container setup that was causing
dependency issues with user-runtime-dir services.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 20:17:20 +01:00
e44340d3eb Update nixpkgs to unstable for Go 1.25 support
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 20:10:18 +01:00
1e26b2a3b5 Fix sops-nix version compatibility
Remove nixpkgs follows to allow sops-nix to use its own nixpkgs
with Go 1.25 support.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 20:07:34 +01:00
d71426adae . 2026-03-17 18:59:15 +00:00
24d01ac630 Add modular service configuration with SearXNG and Nginx
- Create modules/ directory with reusable NixOS modules
- Add system module for main user configuration
- Add podman module for rootless container support
- Add nginx module with automatic Let's Encrypt SSL
- Add searxng module with Anubis AI firewall protection
- Configure SearXNG at search.ashisgreat.xyz
- Enable nginx reverse proxy with HTTPS

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 19:47:43 +01:00
5dcb85e56d Add sops-nix for secrets management
- Add flake.nix with sops-nix input
- Configure sops with age key encryption
- Add .sops.yaml template for age key configuration
- Create secrets/ directory for encrypted secrets
- Add .gitignore for age keys and nix result symlinks

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 19:34:10 +01:00
58905b7666 Add security hardening and basic VPS setup
- Enable firewall with only SSH port 22 open, disable ping
- Harden SSH: disable root login and password auth
- Create non-root user 'ashie' with sudo access
- Add htop and tmux to system packages
- Enable automatic NixOS updates (no auto-reboot)
- Fix hostname syntax error (missing closing quote)
- Remove duplicate nixos/ subdirectory

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-17 19:28:26 +01:00