diff --git a/DOCS.md b/DOCS.md index 46633f7..ad45772 100644 --- a/DOCS.md +++ b/DOCS.md @@ -198,7 +198,7 @@ All options are set via **Settings → Apps/Add-ons → OpenClaw Assistant → C | Option | Type | Default | Description | |---|---|---|---| | `gateway_mode` | `local` / `remote` | `local` | **local**: run gateway in this add-on. **remote**: connect to an external gateway | -| `gateway_bind_mode` | `loopback` / `lan` | `loopback` | **loopback**: 127.0.0.1 only (secure). **lan**: all interfaces (LAN-accessible). Only applies when `gateway_mode` is `local` | +| `gateway_bind_mode` | `auto` / `loopback` / `lan` / `tailnet` | `loopback` | **loopback**: 127.0.0.1 only (secure). **lan**: all interfaces (LAN-accessible). **tailnet**: Tailscale interface only. **auto**: let OpenClaw choose bind behavior. Only applies when `gateway_mode` is `local` | | `gateway_port` | int | `18789` | Port for the gateway. Only applies when `gateway_mode` is `local` | | `gateway_public_url` | string | _(empty)_ | Public URL for the "Open Gateway Web UI" button. Example: `http://192.168.1.119:18789` | | `enable_openai_api` | bool | `false` | Enable the OpenAI-compatible `/v1/chat/completions` endpoint. Required for [Assist pipeline integration](#6c-assist-pipeline-integration-openai-api) | diff --git a/SECURITY.md b/SECURITY.md index b738432..b1d2f51 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -42,6 +42,8 @@ OpenClaw is an **agentic AI assistant** — it can plan, reason, and execute act When `gateway_bind_mode` is set to `lan`, the gateway is accessible to **all devices on your local network**. When exposed to the internet (via port forwarding or reverse proxy), it becomes accessible to **anyone**. +When `gateway_bind_mode` is set to `tailnet`, the gateway is exposed only on your Tailscale network. This significantly reduces exposure compared with `lan`, but all authenticated tailnet peers can still reach it. + **Risks**: - Unauthorized users could interact with your AI agent - API tokens could be intercepted over plain HTTP @@ -51,6 +53,7 @@ When `gateway_bind_mode` is set to `lan`, the gateway is accessible to **all dev - Use HTTPS whenever possible (reverse proxy with TLS) - Never expose the gateway port directly to the internet without authentication and encryption - Use `gateway_bind_mode: loopback` if you only need local access +- Prefer `gateway_bind_mode: tailnet` over `lan` when you need remote/private-network access - Keep your gateway auth token secret ### 3. Plain HTTP Authentication (`allow_insecure_auth`) @@ -147,7 +150,8 @@ AI agents that process external content (web pages, documents, emails) are vulne | Practice | Priority | |---|---| | Use HTTPS for remote access | High | -| Keep `gateway_bind_mode: loopback` unless LAN access is needed | High | +| Keep `gateway_bind_mode: loopback` unless network access is needed | High | +| Prefer `gateway_bind_mode: tailnet` over `lan` for remote/private access | High | | Only install skills from trusted sources | High | | Review exposed entities in Assist pipeline | High | | Keep the add-on updated | High | diff --git a/openclaw_assistant/CHANGELOG.md b/openclaw_assistant/CHANGELOG.md index dbec6fb..cfcb387 100644 --- a/openclaw_assistant/CHANGELOG.md +++ b/openclaw_assistant/CHANGELOG.md @@ -2,6 +2,25 @@ All notable changes to the OpenClaw Assistant Home Assistant Add-on will be documented in this file. +## [0.5.47] - 2026-02-21 + +### Added +- Add new `gateway_bind_mode` values: `auto` and `tailnet`. + +### Changed +- Update startup helper validation and CLI usage to support `auto|loopback|lan|tailnet` bind modes. +- Update add-on translations and docs for the expanded gateway bind mode options. + +## [0.5.46] - 2026-02-18 + +### Added +- New add-on option `force_ipv4_dns` to enable IPv4-first DNS ordering for Node network calls (`NODE_OPTIONS=--dns-result-order=ipv4first`), helping Telegram connectivity on IPv6-broken networks. + +### Changed +- Added translations for `force_ipv4_dns` option. +- Updated docs with `force_ipv4_dns` configuration and Telegram network troubleshooting note. +- Bump OpenClaw to 2026.2.17 + ## [0.5.45] - 2026-02-16 ### Changed diff --git a/openclaw_assistant/config.yaml b/openclaw_assistant/config.yaml index 17b3dfc..85e3ac4 100644 --- a/openclaw_assistant/config.yaml +++ b/openclaw_assistant/config.yaml @@ -59,6 +59,8 @@ options: # Gateway network bind mode: # - loopback: bind to 127.0.0.1 only (local access only, more secure) # - lan: bind to all interfaces (accessible from local network) + # - tailnet: bind only to Tailscale interface address (tailnet-only access) + # - auto: OpenClaw auto-select bind (upstream behavior) # Default is loopback for security. gateway_bind_mode: loopback @@ -90,7 +92,7 @@ schema: clean_session_locks_on_start: bool? clean_session_locks_on_exit: bool? gateway_mode: list(local|remote)? - gateway_bind_mode: list(loopback|lan)? + gateway_bind_mode: list(auto|loopback|lan|tailnet)? gateway_port: int(1,65535)? enable_openai_api: bool? allow_insecure_auth: bool? diff --git a/openclaw_assistant/oc_config_helper.py b/openclaw_assistant/oc_config_helper.py index 1fec9d6..d87c0f3 100644 --- a/openclaw_assistant/oc_config_helper.py +++ b/openclaw_assistant/oc_config_helper.py @@ -63,7 +63,7 @@ def apply_gateway_settings(mode: str, bind_mode: str, port: int, enable_openai_a Args: mode: "local" or "remote" - bind_mode: "loopback" or "lan" + bind_mode: "auto", "loopback", "lan", or "tailnet" port: Port number to listen on (must be 1-65535) enable_openai_api: Enable OpenAI-compatible Chat Completions endpoint allow_insecure_auth: Allow insecure HTTP authentication @@ -74,8 +74,8 @@ def apply_gateway_settings(mode: str, bind_mode: str, port: int, enable_openai_a return False # Validate bind mode - if bind_mode not in ["loopback", "lan"]: - print(f"ERROR: Invalid bind_mode '{bind_mode}'. Must be 'loopback' or 'lan'") + if bind_mode not in ["auto", "loopback", "lan", "tailnet"]: + print(f"ERROR: Invalid bind_mode '{bind_mode}'. Must be 'auto', 'loopback', 'lan', or 'tailnet'") return False # Validate port range @@ -157,7 +157,7 @@ def main(): if cmd == "apply-gateway-settings": if len(sys.argv) != 7: - print("Usage: oc_config_helper.py apply-gateway-settings ") + print("Usage: oc_config_helper.py apply-gateway-settings ") sys.exit(1) mode = sys.argv[2] bind_mode = sys.argv[3] diff --git a/openclaw_assistant/translations/bg.yaml b/openclaw_assistant/translations/bg.yaml index be72e85..17862bb 100644 --- a/openclaw_assistant/translations/bg.yaml +++ b/openclaw_assistant/translations/bg.yaml @@ -45,7 +45,7 @@ configuration: gateway_bind_mode: name: Режим на свързване на Gateway - description: Режим на мрежово свързване - loopback (само 127.0.0.1, по-сигурно) или lan (всички интерфейси, достъпно от локалната мрежа) + description: Режим на мрежово свързване - auto (OpenClaw избира), loopback (само 127.0.0.1, по-сигурно), lan (всички интерфейси) или tailnet (само Tailscale интерфейс). gateway_port: name: Порт на Gateway diff --git a/openclaw_assistant/translations/de.yaml b/openclaw_assistant/translations/de.yaml index 4478793..5a8bb39 100644 --- a/openclaw_assistant/translations/de.yaml +++ b/openclaw_assistant/translations/de.yaml @@ -45,7 +45,7 @@ configuration: gateway_bind_mode: name: Gateway-Bindungsmodus - description: Netzwerk-Bindungsmodus - loopback (nur 127.0.0.1, sicherer) oder lan (alle Schnittstellen, vom lokalen Netzwerk aus zugänglich) + description: Netzwerk-Bindungsmodus - auto (OpenClaw wählt), loopback (nur 127.0.0.1, sicherer), lan (alle Schnittstellen) oder tailnet (nur Tailscale-Schnittstelle). gateway_port: name: Gateway-Port diff --git a/openclaw_assistant/translations/en.yaml b/openclaw_assistant/translations/en.yaml index d8c7bf1..c635135 100644 --- a/openclaw_assistant/translations/en.yaml +++ b/openclaw_assistant/translations/en.yaml @@ -45,7 +45,7 @@ configuration: gateway_bind_mode: name: Gateway Bind Mode - description: Network bind mode - loopback (127.0.0.1 only, more secure) or lan (all interfaces, accessible from local network) + description: Network bind mode - auto (OpenClaw selects), loopback (127.0.0.1 only, more secure), lan (all interfaces), or tailnet (Tailscale interface only). gateway_port: name: Gateway Port diff --git a/openclaw_assistant/translations/es.yaml b/openclaw_assistant/translations/es.yaml index 62de2b8..dd5be34 100644 --- a/openclaw_assistant/translations/es.yaml +++ b/openclaw_assistant/translations/es.yaml @@ -45,7 +45,7 @@ configuration: gateway_bind_mode: name: Modo de enlace del Gateway - description: Modo de enlace de red - loopback (solo 127.0.0.1, más seguro) o lan (todas las interfaces, accesible desde la red local) + description: Modo de enlace de red: auto (OpenClaw selecciona), loopback (solo 127.0.0.1, más seguro), lan (todas las interfaces) o tailnet (solo interfaz Tailscale). gateway_port: name: Puerto del Gateway diff --git a/openclaw_assistant/translations/pl.yaml b/openclaw_assistant/translations/pl.yaml index ddcc614..317e252 100644 --- a/openclaw_assistant/translations/pl.yaml +++ b/openclaw_assistant/translations/pl.yaml @@ -41,7 +41,7 @@ configuration: gateway_bind_mode: name: Tryb bindowania Gateway - description: Tryb bindowania sieci - loopback (tylko 127.0.0.1, bardziej bezpieczny) lub lan (wszystkie interfejsy, dostępny z sieci lokalnej) + description: Tryb bindowania sieci - auto (OpenClaw wybiera), loopback (tylko 127.0.0.1, bezpieczniej), lan (wszystkie interfejsy) lub tailnet (tylko interfejs Tailscale). gateway_port: name: Port Gateway diff --git a/openclaw_assistant/translations/pt-BR.yaml b/openclaw_assistant/translations/pt-BR.yaml index c676e30..ed6d138 100644 --- a/openclaw_assistant/translations/pt-BR.yaml +++ b/openclaw_assistant/translations/pt-BR.yaml @@ -45,7 +45,7 @@ configuration: gateway_bind_mode: name: Modo de Vinculação do Gateway - description: Modo de vinculação de rede - loopback (somente 127.0.0.1, mais seguro) ou lan (todas as interfaces, acessível pela rede local) + description: Modo de vinculação de rede - auto (OpenClaw escolhe), loopback (somente 127.0.0.1, mais seguro), lan (todas as interfaces) ou tailnet (somente interface Tailscale). gateway_port: name: Porta do Gateway