Merge pull request #67 from megamen32/main

Add configurable outbound proxy support via add-on http_proxy option
2026-02-22 23:19:28 +02:00
parent e33bcf030a d118102c11
commit 9d0332a36a
13 changed files with 121 additions and 3 deletions
@@ -217,6 +217,7 @@ All options are set via **Settings → Apps/Add-ons → OpenClaw Assistant → C
 | Option | Type | Default | Description |
 |---|---|---|---|
 | `homeassistant_token` | string | _(empty)_ | Optional HA long-lived access token (use at own risk, can be very unsecure but very powerful). Saved to `/config/secrets/homeassistant.token` for use by scripts/skills |
+| `http_proxy` | string | _(empty)_ | Optional outbound proxy URL for HTTP/HTTPS requests from OpenClaw and Node tools. Example: `http://192.168.2.1:3128`. When set, the add-on also applies `NO_PROXY/no_proxy` defaults for localhost and private network ranges. |

 ### Router SSH

@@ -606,6 +607,18 @@ If Telegram is configured but polling fails with network fetch errors:
 3. Keep `channels.telegram.network.autoSelectFamily: false` (default on Node 22).
 4. If still failing, check host/VM IPv6 routing and DNS configuration.

+### Outbound proxy not applied
+
+**Symptom**: External API/network calls still fail in restricted networks even after setting proxy.
+
+**Checks**:
+1. Set add-on option `http_proxy` with full URL format: `http://host:port` (example: `http://192.168.2.1:3128`).
+2. Restart the add-on after changing configuration.
+3. Check logs for `INFO: Outbound HTTP/HTTPS proxy enabled from add-on configuration.`
+4. If you see `WARN: Invalid http_proxy value`, fix the URL format and restart.
+5. Local traffic bypass is applied automatically via `NO_PROXY/no_proxy` defaults:
+   `localhost,127.0.0.1,::1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,.local`
+
 ### Skills disappearing after update

 Built-in skills are synced to persistent storage on each startup. If skills are missing:
@@ -15,6 +15,7 @@ This repository contains a Home Assistant add-on that runs **OpenClaw** inside *
 - **Web Terminal** — browser-based terminal embedded in Home Assistant
 - **Assist Pipeline** — use OpenClaw as a conversation agent via the OpenAI-compatible API
 - **Browser Automation** — Chromium included for web scraping and automation skills
+- **Proxy Support** — optional outbound `http_proxy` setting for HTTP/HTTPS traffic
 - **Persistent Storage** — skills, config, and workspace survive add-on updates
 - **Bundled Tools** — git, vim, nano, bat, fd, ripgrep, curl, jq, python3, pnpm, Homebrew

@@ -2,11 +2,22 @@

 All notable changes to the OpenClaw Assistant Home Assistant Add-on will be documented in this file.

+## [0.5.49] - 2026-02-22
+
+### Added
+- New add-on option `http_proxy` for configuring outbound HTTP/HTTPS proxy from Home Assistant settings.
+
+### Changed
+- Export `HTTP_PROXY`, `HTTPS_PROXY`, `http_proxy`, and `https_proxy` from add-on config at startup.
+- Add translations for the new `http_proxy` option.
+- Document proxy configuration in README and DOCS.
+
 ## [0.5.48] - 2026-02-22

 ### Changed
 - Bump OpenClaw to 2026.2.21-2.
 - Add Home Assistant `share` and `media` mounts to the add-on (`map: share:rw, media:rw`).
+- Keep official OpenClaw npm release and add startup proxy shim for `HTTP_PROXY/HTTPS_PROXY` support in undici fetch.

 ## [0.5.47] - 2026-02-21

@@ -100,7 +100,7 @@ RUN if [ -x /home/linuxbrew/.linuxbrew/bin/brew ]; then \
    fi
 USER root

-# Install OpenClaw globally
+# Install OpenClaw globally (official npm release)
 RUN npm config set fund false && npm config set audit false \
 && npm install -g openclaw@2026.2.21-2

@@ -124,6 +124,7 @@ fi
 EOF
 COPY run.sh /run.sh
 COPY oc_config_helper.py /oc_config_helper.py
+COPY openclaw-proxy-shim.cjs /usr/local/lib/openclaw-proxy-shim.cjs
 COPY nginx.conf.tpl /etc/nginx/nginx.conf.tpl
 COPY landing.html.tpl /etc/nginx/landing.html.tpl
 RUN chmod +x /run.sh /oc_config_helper.py \
@@ -1,5 +1,5 @@
 name: OpenClaw Assistant
-version: "0.5.48"
+version: "0.5.49"
 slug: openclaw_assistant
 description: Run OpenClaw Assistant (OpenClaw-compatible) as a Home Assistant add-on.
 url: https://github.com/techartdev/OpenClawHomeAssistant
@@ -41,6 +41,10 @@ options:
  # Optional: Home Assistant long-lived token (for local HA API scripts/tools)
  homeassistant_token: ""

+  # Optional: outbound HTTP/HTTPS proxy for OpenClaw network access.
+  # Example: "http://192.168.2.1:3128"
+  http_proxy: ""
+
  # Optional: Router SSH defaults (leave empty if you don't need router automation)
  # This is a generic SSH configuration intended for a router/firewall or any network device
  # reachable from inside the HA host LAN.
@@ -91,6 +95,7 @@ schema:
  terminal_port: int(1024,65535)?
  gateway_public_url: str?
  homeassistant_token: str?
+  http_proxy: str?

  router_ssh_host: str
  router_ssh_user: str
@@ -104,4 +109,3 @@ schema:
  enable_openai_api: bool?
  allow_insecure_auth: bool?
  force_ipv4_dns: bool?
-
@@ -0,0 +1,29 @@
+"use strict";
+
+/**
+ * Enable HTTP(S) proxy support for Node/undici before OpenClaw initializes.
+ * We load undici from OpenClaw's own node_modules path to avoid relying on
+ * global module resolution from this shim's location.
+ */
+(function applyProxyFromEnv() {
+  const hasProxyEnv =
+    !!process.env.HTTPS_PROXY ||
+    !!process.env.HTTP_PROXY ||
+    !!process.env.https_proxy ||
+    !!process.env.http_proxy;
+
+  if (!hasProxyEnv) {
+    return;
+  }
+
+  try {
+    const path = require("node:path");
+    const globalModulesRoot =
+      process.env.OPENCLAW_GLOBAL_NODE_MODULES || "/usr/lib/node_modules";
+    const undiciPath = path.join(globalModulesRoot, "openclaw", "node_modules", "undici");
+    const { EnvHttpProxyAgent, setGlobalDispatcher } = require(undiciPath);
+    setGlobalDispatcher(new EnvHttpProxyAgent());
+  } catch (_err) {
+    // Keep startup resilient if module layout changes in future releases.
+  }
+})();
@@ -20,6 +20,7 @@ fi
 TZNAME=$(jq -r '.timezone // "Europe/Sofia"' "$OPTIONS_FILE")
 GW_PUBLIC_URL=$(jq -r '.gateway_public_url // empty' "$OPTIONS_FILE")
 HA_TOKEN=$(jq -r '.homeassistant_token // empty' "$OPTIONS_FILE")
+ADDON_HTTP_PROXY=$(jq -r '.http_proxy // empty' "$OPTIONS_FILE")
 ENABLE_TERMINAL=$(jq -r '.enable_terminal // true' "$OPTIONS_FILE")
 TERMINAL_PORT_RAW=$(jq -r '.terminal_port // 7681' "$OPTIONS_FILE")

@@ -57,6 +58,26 @@ export TZ="$TZNAME"
 # Reduce risk of secrets ending up in logs
 set +x

+# Optional outbound proxy from add-on settings.
+# If set, apply it to both HTTP and HTTPS for Node/undici/OpenClaw tooling.
+if [ -n "$ADDON_HTTP_PROXY" ]; then
+  if [[ "$ADDON_HTTP_PROXY" =~ ^https?://[^[:space:]]+$ ]]; then
+    # Keep local traffic direct to avoid accidental proxying of loopback/LAN services.
+    DEFAULT_NO_PROXY="localhost,127.0.0.1,::1,192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,.local"
+
+    export HTTP_PROXY="$ADDON_HTTP_PROXY"
+    export HTTPS_PROXY="$ADDON_HTTP_PROXY"
+    export http_proxy="$ADDON_HTTP_PROXY"
+    export https_proxy="$ADDON_HTTP_PROXY"
+    export NO_PROXY="${NO_PROXY:+${NO_PROXY},}${DEFAULT_NO_PROXY}"
+    export no_proxy="${no_proxy:+${no_proxy},}${DEFAULT_NO_PROXY}"
+    echo "INFO: Outbound HTTP/HTTPS proxy enabled from add-on configuration."
+    echo "INFO: Applied NO_PROXY defaults for localhost/private network ranges."
+  else
+    echo "WARN: Invalid http_proxy value in add-on options; expected URL like http://host:port"
+  fi
+fi
+
 # Optional network hardening/workaround: force IPv4-first DNS ordering for Node.js.
 # Helps in environments where IPv6 resolves but has no working egress.
 if [ "$FORCE_IPV4_DNS" = "true" ] || [ "$FORCE_IPV4_DNS" = "1" ]; then
@@ -347,6 +368,20 @@ else
  echo "INFO: Run 'openclaw onboard' first, then restart the add-on"
 fi

+# ------------------------------------------------------------------------------
+# Proxy shim for undici/OpenClaw startup
+# Keep official OpenClaw npm release while enabling HTTP(S)_PROXY support.
+# ------------------------------------------------------------------------------
+OPENCLAW_GLOBAL_NODE_MODULES="$(HOME=/root npm root -g 2>/dev/null || true)"
+if [ -f /usr/local/lib/openclaw-proxy-shim.cjs ]; then
+  if [ -n "${NODE_OPTIONS:-}" ]; then
+    export NODE_OPTIONS="--require /usr/local/lib/openclaw-proxy-shim.cjs ${NODE_OPTIONS}"
+  else
+    export NODE_OPTIONS="--require /usr/local/lib/openclaw-proxy-shim.cjs"
+  fi
+  export OPENCLAW_GLOBAL_NODE_MODULES
+fi
+
 echo "Starting OpenClaw Assistant gateway (openclaw)..."
 openclaw gateway run &
 GW_PID=$!
@@ -18,6 +18,10 @@ configuration:
  homeassistant_token:
    name: Home Assistant токен
    description: Опционално - дълготраен токен на Home Assistant за локални API скриптове/инструменти
+
+  http_proxy:
+    name: Изходящ HTTP прокси
+    description: Опционално - URL на прокси за изходящи HTTP/HTTPS заявки (пример - http://192.168.2.1:3128)
  
  router_ssh_host:
    name: SSH хост на рутер
@@ -18,6 +18,10 @@ configuration:
  homeassistant_token:
    name: Home Assistant Token
    description: Optional - Langlebiger Home Assistant Token für lokale API-Skripte/Tools
+
+  http_proxy:
+    name: Ausgehender HTTP-Proxy
+    description: Optional - Proxy-URL für ausgehende HTTP/HTTPS-Anfragen (Beispiel - http://192.168.2.1:3128)
  
  router_ssh_host:
    name: Router SSH-Host
@@ -18,6 +18,10 @@ configuration:
  homeassistant_token:
    name: Home Assistant Token
    description: Optional - Home Assistant long-lived token for local HA API scripts/tools
+
+  http_proxy:
+    name: Outbound HTTP Proxy
+    description: Optional - Proxy URL for outbound HTTP/HTTPS requests (example - http://192.168.2.1:3128)
  
  router_ssh_host:
    name: Router SSH Host
@@ -18,6 +18,10 @@ configuration:
  homeassistant_token:
    name: Token de Home Assistant
    description: Opcional - Token de larga duración de Home Assistant para scripts/herramientas de API local
+
+  http_proxy:
+    name: Proxy HTTP de salida
+    description: Opcional - URL de proxy para solicitudes HTTP/HTTPS salientes (ejemplo - http://192.168.2.1:3128)
  
  router_ssh_host:
    name: Host SSH del router
@@ -18,6 +18,10 @@ configuration:
  homeassistant_token:
    name: Token Home Assistant
    description: Opcjonalnie - długoterminowy token Home Assistant dla lokalnych skryptów/narzędzi API HA
+
+  http_proxy:
+    name: Wychodzący proxy HTTP
+    description: Opcjonalnie - URL proxy dla wychodzących żądań HTTP/HTTPS (przykład - http://192.168.2.1:3128)
  
  router_ssh_host:
    name: Host SSH routera
@@ -18,6 +18,10 @@ configuration:
  homeassistant_token:
    name: Token do Home Assistant
    description: Opcional - Token de longa duração do Home Assistant para scripts/ferramentas da API local do HA
+
+  http_proxy:
+    name: Proxy HTTP de saída
+    description: Opcional - URL de proxy para requisições HTTP/HTTPS de saída (exemplo - http://192.168.2.1:3128)
  
  router_ssh_host:
    name: Host SSH do Roteador