feat: Expand gateway_bind_mode options to include 'auto' and 'tailnet'; update documentation and translations
This commit is contained in:
techartdev
@@ -198,7 +198,7 @@ All options are set via **Settings → Apps/Add-ons → OpenClaw Assistant → C
|
||||
| Option | Type | Default | Description |
|
||||
|---|---|---|---|
|
||||
| `gateway_mode` | `local` / `remote` | `local` | **local**: run gateway in this add-on. **remote**: connect to an external gateway |
|
||||
| `gateway_bind_mode` | `loopback` / `lan` | `loopback` | **loopback**: 127.0.0.1 only (secure). **lan**: all interfaces (LAN-accessible). Only applies when `gateway_mode` is `local` |
|
||||
| `gateway_bind_mode` | `auto` / `loopback` / `lan` / `tailnet` | `loopback` | **loopback**: 127.0.0.1 only (secure). **lan**: all interfaces (LAN-accessible). **tailnet**: Tailscale interface only. **auto**: let OpenClaw choose bind behavior. Only applies when `gateway_mode` is `local` |
|
||||
| `gateway_port` | int | `18789` | Port for the gateway. Only applies when `gateway_mode` is `local` |
|
||||
| `gateway_public_url` | string | _(empty)_ | Public URL for the "Open Gateway Web UI" button. Example: `http://192.168.1.119:18789` |
|
||||
| `enable_openai_api` | bool | `false` | Enable the OpenAI-compatible `/v1/chat/completions` endpoint. Required for [Assist pipeline integration](#6c-assist-pipeline-integration-openai-api) |
|
||||
|
||||
+5
-1
@@ -42,6 +42,8 @@ OpenClaw is an **agentic AI assistant** — it can plan, reason, and execute act
|
||||
|
||||
When `gateway_bind_mode` is set to `lan`, the gateway is accessible to **all devices on your local network**. When exposed to the internet (via port forwarding or reverse proxy), it becomes accessible to **anyone**.
|
||||
|
||||
When `gateway_bind_mode` is set to `tailnet`, the gateway is exposed only on your Tailscale network. This significantly reduces exposure compared with `lan`, but all authenticated tailnet peers can still reach it.
|
||||
|
||||
**Risks**:
|
||||
- Unauthorized users could interact with your AI agent
|
||||
- API tokens could be intercepted over plain HTTP
|
||||
@@ -51,6 +53,7 @@ When `gateway_bind_mode` is set to `lan`, the gateway is accessible to **all dev
|
||||
- Use HTTPS whenever possible (reverse proxy with TLS)
|
||||
- Never expose the gateway port directly to the internet without authentication and encryption
|
||||
- Use `gateway_bind_mode: loopback` if you only need local access
|
||||
- Prefer `gateway_bind_mode: tailnet` over `lan` when you need remote/private-network access
|
||||
- Keep your gateway auth token secret
|
||||
|
||||
### 3. Plain HTTP Authentication (`allow_insecure_auth`)
|
||||
@@ -147,7 +150,8 @@ AI agents that process external content (web pages, documents, emails) are vulne
|
||||
| Practice | Priority |
|
||||
|---|---|
|
||||
| Use HTTPS for remote access | High |
|
||||
| Keep `gateway_bind_mode: loopback` unless LAN access is needed | High |
|
||||
| Keep `gateway_bind_mode: loopback` unless network access is needed | High |
|
||||
| Prefer `gateway_bind_mode: tailnet` over `lan` for remote/private access | High |
|
||||
| Only install skills from trusted sources | High |
|
||||
| Review exposed entities in Assist pipeline | High |
|
||||
| Keep the add-on updated | High |
|
||||
|
||||
@@ -2,6 +2,25 @@
|
||||
|
||||
All notable changes to the OpenClaw Assistant Home Assistant Add-on will be documented in this file.
|
||||
|
||||
## [0.5.47] - 2026-02-21
|
||||
|
||||
### Added
|
||||
- Add new `gateway_bind_mode` values: `auto` and `tailnet`.
|
||||
|
||||
### Changed
|
||||
- Update startup helper validation and CLI usage to support `auto|loopback|lan|tailnet` bind modes.
|
||||
- Update add-on translations and docs for the expanded gateway bind mode options.
|
||||
|
||||
## [0.5.46] - 2026-02-18
|
||||
|
||||
### Added
|
||||
- New add-on option `force_ipv4_dns` to enable IPv4-first DNS ordering for Node network calls (`NODE_OPTIONS=--dns-result-order=ipv4first`), helping Telegram connectivity on IPv6-broken networks.
|
||||
|
||||
### Changed
|
||||
- Added translations for `force_ipv4_dns` option.
|
||||
- Updated docs with `force_ipv4_dns` configuration and Telegram network troubleshooting note.
|
||||
- Bump OpenClaw to 2026.2.17
|
||||
|
||||
## [0.5.45] - 2026-02-16
|
||||
|
||||
### Changed
|
||||
|
||||
@@ -59,6 +59,8 @@ options:
|
||||
# Gateway network bind mode:
|
||||
# - loopback: bind to 127.0.0.1 only (local access only, more secure)
|
||||
# - lan: bind to all interfaces (accessible from local network)
|
||||
# - tailnet: bind only to Tailscale interface address (tailnet-only access)
|
||||
# - auto: OpenClaw auto-select bind (upstream behavior)
|
||||
# Default is loopback for security.
|
||||
gateway_bind_mode: loopback
|
||||
|
||||
@@ -90,7 +92,7 @@ schema:
|
||||
clean_session_locks_on_start: bool?
|
||||
clean_session_locks_on_exit: bool?
|
||||
gateway_mode: list(local|remote)?
|
||||
gateway_bind_mode: list(loopback|lan)?
|
||||
gateway_bind_mode: list(auto|loopback|lan|tailnet)?
|
||||
gateway_port: int(1,65535)?
|
||||
enable_openai_api: bool?
|
||||
allow_insecure_auth: bool?
|
||||
|
||||
@@ -63,7 +63,7 @@ def apply_gateway_settings(mode: str, bind_mode: str, port: int, enable_openai_a
|
||||
|
||||
Args:
|
||||
mode: "local" or "remote"
|
||||
bind_mode: "loopback" or "lan"
|
||||
bind_mode: "auto", "loopback", "lan", or "tailnet"
|
||||
port: Port number to listen on (must be 1-65535)
|
||||
enable_openai_api: Enable OpenAI-compatible Chat Completions endpoint
|
||||
allow_insecure_auth: Allow insecure HTTP authentication
|
||||
@@ -74,8 +74,8 @@ def apply_gateway_settings(mode: str, bind_mode: str, port: int, enable_openai_a
|
||||
return False
|
||||
|
||||
# Validate bind mode
|
||||
if bind_mode not in ["loopback", "lan"]:
|
||||
print(f"ERROR: Invalid bind_mode '{bind_mode}'. Must be 'loopback' or 'lan'")
|
||||
if bind_mode not in ["auto", "loopback", "lan", "tailnet"]:
|
||||
print(f"ERROR: Invalid bind_mode '{bind_mode}'. Must be 'auto', 'loopback', 'lan', or 'tailnet'")
|
||||
return False
|
||||
|
||||
# Validate port range
|
||||
@@ -157,7 +157,7 @@ def main():
|
||||
|
||||
if cmd == "apply-gateway-settings":
|
||||
if len(sys.argv) != 7:
|
||||
print("Usage: oc_config_helper.py apply-gateway-settings <local|remote> <loopback|lan> <port> <enable_openai_api:true|false> <allow_insecure:true|false>")
|
||||
print("Usage: oc_config_helper.py apply-gateway-settings <local|remote> <auto|loopback|lan|tailnet> <port> <enable_openai_api:true|false> <allow_insecure:true|false>")
|
||||
sys.exit(1)
|
||||
mode = sys.argv[2]
|
||||
bind_mode = sys.argv[3]
|
||||
|
||||
@@ -45,7 +45,7 @@ configuration:
|
||||
|
||||
gateway_bind_mode:
|
||||
name: Режим на свързване на Gateway
|
||||
description: Режим на мрежово свързване - loopback (само 127.0.0.1, по-сигурно) или lan (всички интерфейси, достъпно от локалната мрежа)
|
||||
description: Режим на мрежово свързване - auto (OpenClaw избира), loopback (само 127.0.0.1, по-сигурно), lan (всички интерфейси) или tailnet (само Tailscale интерфейс).
|
||||
|
||||
gateway_port:
|
||||
name: Порт на Gateway
|
||||
|
||||
@@ -45,7 +45,7 @@ configuration:
|
||||
|
||||
gateway_bind_mode:
|
||||
name: Gateway-Bindungsmodus
|
||||
description: Netzwerk-Bindungsmodus - loopback (nur 127.0.0.1, sicherer) oder lan (alle Schnittstellen, vom lokalen Netzwerk aus zugänglich)
|
||||
description: Netzwerk-Bindungsmodus - auto (OpenClaw wählt), loopback (nur 127.0.0.1, sicherer), lan (alle Schnittstellen) oder tailnet (nur Tailscale-Schnittstelle).
|
||||
|
||||
gateway_port:
|
||||
name: Gateway-Port
|
||||
|
||||
@@ -45,7 +45,7 @@ configuration:
|
||||
|
||||
gateway_bind_mode:
|
||||
name: Gateway Bind Mode
|
||||
description: Network bind mode - loopback (127.0.0.1 only, more secure) or lan (all interfaces, accessible from local network)
|
||||
description: Network bind mode - auto (OpenClaw selects), loopback (127.0.0.1 only, more secure), lan (all interfaces), or tailnet (Tailscale interface only).
|
||||
|
||||
gateway_port:
|
||||
name: Gateway Port
|
||||
|
||||
@@ -45,7 +45,7 @@ configuration:
|
||||
|
||||
gateway_bind_mode:
|
||||
name: Modo de enlace del Gateway
|
||||
description: Modo de enlace de red - loopback (solo 127.0.0.1, más seguro) o lan (todas las interfaces, accesible desde la red local)
|
||||
description: Modo de enlace de red: auto (OpenClaw selecciona), loopback (solo 127.0.0.1, más seguro), lan (todas las interfaces) o tailnet (solo interfaz Tailscale).
|
||||
|
||||
gateway_port:
|
||||
name: Puerto del Gateway
|
||||
|
||||
@@ -41,7 +41,7 @@ configuration:
|
||||
|
||||
gateway_bind_mode:
|
||||
name: Tryb bindowania Gateway
|
||||
description: Tryb bindowania sieci - loopback (tylko 127.0.0.1, bardziej bezpieczny) lub lan (wszystkie interfejsy, dostępny z sieci lokalnej)
|
||||
description: Tryb bindowania sieci - auto (OpenClaw wybiera), loopback (tylko 127.0.0.1, bezpieczniej), lan (wszystkie interfejsy) lub tailnet (tylko interfejs Tailscale).
|
||||
|
||||
gateway_port:
|
||||
name: Port Gateway
|
||||
|
||||
@@ -45,7 +45,7 @@ configuration:
|
||||
|
||||
gateway_bind_mode:
|
||||
name: Modo de Vinculação do Gateway
|
||||
description: Modo de vinculação de rede - loopback (somente 127.0.0.1, mais seguro) ou lan (todas as interfaces, acessível pela rede local)
|
||||
description: Modo de vinculação de rede - auto (OpenClaw escolhe), loopback (somente 127.0.0.1, mais seguro), lan (todas as interfaces) ou tailnet (somente interface Tailscale).
|
||||
|
||||
gateway_port:
|
||||
name: Porta do Gateway
|
||||
|
||||
Reference in New Issue
Block a user