fix: openclaw gateway bind lan and correct controlUi origin - #1356
Conversation
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughSummary by CodeRabbit
WalkthroughConfiguration updates to the OpenClaw gateway: network binding changes from loopback to LAN, Tailscale configuration block is removed, and the allowed origin is updated with port 18789. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRFixed OpenClaw gateway binding from What changed?
Description generated by Mesa. Update settings |
There was a problem hiding this comment.
Pull request overview
This PR updates the OpenClaw gateway configuration templates to match the known-working production setup for LAN/Tailscale access and corrects the Control UI CORS origin for the Tailscale hostname.
Changes:
- Switch
gateway.bindfromloopbacktolanto allow non-local access. - Remove unused
gateway.tailscale.mode: serveconfiguration. - Update
controlUi.allowedOriginsto include the Tailscale hostname with the correct:18789port.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| config/openclaw/openclaw.tpl.json | Updates the source OpenClaw config template for LAN binding and Control UI allowed origins; removes unused tailscale block. |
| config/openclaw/openclaw.template.json | Updates the generated OpenClaw config output to reflect the same gateway binding and Control UI origin changes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the gateway configuration in openclaw.template.json and openclaw.tpl.json by changing the bind mode to lan, removing the Tailscale serve configuration, and updating the allowed origins. The review feedback identifies a potential protocol mismatch where https is used with port 18789, suggesting a switch to http to avoid connection failures and noting inconsistencies with other client configurations.
| "http://127.0.0.1:18789", | ||
| "https://openclaw.shunkakinoki.com", | ||
| "https://kyber.tail950b36.ts.net" | ||
| "https://kyber.tail950b36.ts.net:18789" |
There was a problem hiding this comment.
The Tailscale origin uses https with port 18789. If the gateway is serving plain HTTP (as suggested by the localhost entries and the openclaw gateway command in hydrate.sh), this protocol should likely be http. Using https on an HTTP port will cause connection failures in the browser.
Additionally, there is an inconsistency with the client configuration in hydrate.sh (line 105) and its test in spec/openclaw_hydrate_spec.sh (line 169), which both expect the gateway to be accessible via wss:// on the default port (443). If the gateway is now accessed via port 18789 and the Tailscale proxy is removed, the client configuration should also be updated to include the port.
| "https://kyber.tail950b36.ts.net:18789" | |
| "http://kyber.tail950b36.ts.net:18789" |
| "http://127.0.0.1:18789", | ||
| "https://openclaw.shunkakinoki.com", | ||
| "https://kyber.tail950b36.ts.net" | ||
| "https://kyber.tail950b36.ts.net:18789" |
There was a problem hiding this comment.
The Tailscale origin uses https with port 18789. If the gateway is serving plain HTTP (as suggested by the localhost entries and the openclaw gateway command in hydrate.sh), this protocol should likely be http. Using https on an HTTP port will cause connection failures in the browser.
Additionally, there is an inconsistency with the client configuration in hydrate.sh (line 105) and its test in spec/openclaw_hydrate_spec.sh (line 169), which both expect the gateway to be accessible via wss:// on the default port (443). If the gateway is now accessed via port 18789 and the Tailscale proxy is removed, the client configuration should also be updated to include the port.
| "https://kyber.tail950b36.ts.net:18789" | |
| "http://kyber.tail950b36.ts.net:18789" |
Summary
loopbacktolanto allow LAN/Tailscale access (was causing startup failures when config drifted)tailscale.mode: serveconfig (not used by current OpenClaw version):18789port to Tailscale controlUi origin to match actual gateway portContext
The live
openclaw.jsonon kyber drifted from the declarative template — gateway mode was overwritten toremote(client mode), causing crash loops. The template already had the correct model config (minimax-m2.7), butgateway.bindwas set toloopbackinstead oflan, which doesn't match the working production config.Test plan
openclaw-gateway.servicestarts and stays running🤖 Generated with Claude Code
Summary by cubic
Switch the OpenClaw gateway to bind on LAN and fix the
controlUiorigin port to match:18789, preventing crash loops and enabling LAN/Tailscale access.gateway.bindfromloopbacktolanfor LAN/Tailscale reachability.mode: serveconfig.:18789tokyber.tail950b36.ts.netincontrolUi.allowedOriginsto match the gateway port.Written for commit 66c6720. Summary will update on new commits.