configuration:
  timezone:
    name: Timezone
    description: Timezone for the add-on (e.g., Europe/Sofia, America/New_York)
  
  enable_terminal:
    name: Enable Web Terminal
    description: Enable web terminal Button inside Home Assistant (Ingress) via ttyd
  
  terminal_port:
    name: Terminal Port
    description: Port number for the web terminal (default - 7681). Change if this port conflicts with another service.
  
  gateway_public_url:
    name: Gateway Public URL
    description: Public base URL for opening the Gateway Web UI in a new tab (not embedded). Example - https://example.duckdns.org:12345 or http://192.168.1.10:18789
  
  homeassistant_token:
    name: Home Assistant Token
    description: Optional - Home Assistant long-lived token for local HA API scripts/tools

  http_proxy:
    name: Outbound HTTP Proxy
    description: Optional - Proxy URL for outbound HTTP/HTTPS requests (example - http://192.168.2.1:3128)
  
  router_ssh_host:
    name: Router SSH Host
    description: Optional - Router/firewall SSH hostname or IP address
  
  router_ssh_user:
    name: Router SSH User
    description: Optional - Router/firewall SSH username
  
  router_ssh_key_path:
    name: Router SSH Key Path
    description: Path to SSH private key for router access (default - /data/keys/router_ssh)
  
  clean_session_locks_on_start:
    name: Clean Session Locks on Start
    description: Cleanup stale session lock files left after crashes/restarts when add-on starts
  
  clean_session_locks_on_exit:
    name: Clean Session Locks on Exit
    description: Cleanup session lock files when add-on stops gracefully
  
  gateway_mode:
    name: Gateway Mode
    description: Gateway operation mode - local (run gateway locally, recommended) or remote (connect to a remote gateway)
    options:
      local: "Local (recommended)"
      remote: "Remote"

  gateway_bind_mode:
    name: Gateway Bind Mode
    description: Network bind mode - loopback (127.0.0.1 only, most secure), lan (all interfaces), or tailnet (Tailscale interface only). Overridden by access_mode presets.
    options:
      loopback: "Loopback (127.0.0.1 only, most secure)"
      lan: "LAN (all interfaces)"
      tailnet: "Tailnet (Tailscale only)"

  gateway_port:
    name: Gateway Port
    description: Port number for the OpenClaw gateway to listen on (default - 18789)

  access_mode:
    name: Access Mode
    description: "Simplifies secure access setup. Overrides gateway_bind_mode and gateway_auth_mode when not set to Custom."
    options:
      custom: "Custom (use individual settings)"
      local_only: "Local Only (loopback + token, Ingress only)"
      lan_https: "LAN HTTPS (built-in HTTPS proxy — recommended for phones)"
      lan_reverse_proxy: "LAN Reverse Proxy (external proxy with trusted-proxy auth)"
      tailnet_https: "Tailscale HTTPS (Tailscale bind + token)"

  gateway_auth_mode:
    name: Gateway Auth Mode
    description: Gateway auth mode - token (default) or trusted-proxy (for HTTPS reverse proxies). Overridden when access_mode is not Custom.
    options:
      token: "Token (default)"
      trusted-proxy: "Trusted Proxy (for reverse proxies)"

  gateway_trusted_proxies:
    name: Gateway Trusted Proxies
    description: Comma-separated trusted proxy IP/CIDR list for trusted-proxy mode (example - 127.0.0.1,192.168.88.0/24).

  enable_openai_api:
    name: Enable OpenAI API
    description: Enable OpenAI-compatible Chat Completions endpoint. Allows using OpenClaw as a conversation agent in HA Assist pipeline via Extended OpenAI Conversation (HACS) or any OpenAI-compatible client.
  force_ipv4_dns:
    name: Force IPv4 DNS Order
    description: Force IPv4-first DNS ordering for Node network calls. Useful when IPv6 DNS resolves but IPv6 internet routing is broken (can affect Telegram API polling).