fix(gateway): update Tailscale configuration and change bind address to loopback by shunkakinoki · Pull Request #1855 · shunkakinoki/dotfiles

shunkakinoki · 2026-05-25T19:07:05Z

Summary by cubic

Tightened gateway exposure and aligned Tailscale access. Gateway now binds to loopback, uses Tailscale serve mode, and allowed origins match the Tailscale HTTPS endpoint.

Bug Fixes
- Change bind from "lan" to "loopback" to keep the gateway local-only.
- Add gateway.tailscale config: mode: "serve", resetOnExit: false for stable Tailscale serving.
- Update allowed origin from https://kyber.tail950b36.ts.net:18789 to https://kyber.tail950b36.ts.net to match Tailscale HTTPS.

^{Written for commit ed126e5. Summary will update on new commits. Review in cubic}

…to loopback

indent-zero · 2026-05-25T19:07:07Z

PR Summary

Reconfigures the openclaw gateway to be fronted by Tailscale Serve instead of binding to LAN directly, tightening the listener and aligning the public URL with the existing port-less client config. The gateway now listens on loopback only, declares a new gateway.tailscale block to manage a Tailscale Serve mapping (persisting it across restarts), and updates the CORS allow-list to match the default-443 URL clients already use.

Change gateway.bind from "lan" to "loopback" so the local HTTP listener no longer accepts tailnet/LAN traffic directly
Add gateway.tailscale = { mode: "serve", resetOnExit: false } so openclaw stands up a Tailscale Serve front and leaves the mapping in place across gateway restarts
Replace the https://kyber.tail950b36.ts.net:18789 allowed origin with https://kyber.tail950b36.ts.net to match the Serve URL on 443 and the existing client wss:// URL in config/openclaw/hydrate.sh
Apply the same edits to both openclaw.template.json (rendered) and openclaw.tpl.json (source-of-truth template kept in sync by scripts/llm-update.sh)

Issues

1 potential issue found:

controlUi.allowedOrigins now mixes loopback (http://localhost:18789, http://127.0.0.1:18789), the public site, and the Tailscale Serve URL on 443, but JSON has no comments to record why each entry exists; if the gateway is ever rebound off loopback the role of the :18789 localhost entries becomes ambiguous. → Autofix

CI Checks

All actionable CI checks passed. Mesa Description reported a neutral conclusion (not a failure) — this check just annotates the PR with a generated description and does not gate merging.

mesa-dot-dev · 2026-05-25T19:07:09Z

You do not have enough credits to review this pull request. Please purchase more credits to continue.

coderabbitai · 2026-05-25T19:07:16Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 90a097c3-ff18-4130-b3f4-8f5e500374fd

📥 Commits

Reviewing files that changed from the base of the PR and between 0ac9cd7 and ed126e5.

📒 Files selected for processing (2)

config/openclaw/openclaw.template.json
config/openclaw/openclaw.tpl.json

📝 Walkthrough

Summary by CodeRabbit

Chores
- Updated gateway network binding to local-only mode
- Added Tailscale integration support to configuration
- Modified control interface authorized origins

Walkthrough

This PR updates OpenClaw gateway configuration in both template and tpl files by switching network binding from lan to loopback, adding Tailscale serve integration with resetOnExit: false, and adjusting the control UI allowed origins to remove the :18789 port suffix from the kyber endpoint.

Changes

OpenClaw Gateway Configuration

Layer / File(s)	Summary
Gateway network binding and Tailscale integration `config/openclaw/openclaw.template.json`, `config/openclaw/openclaw.tpl.json`	Gateway `bind` changes from `lan` to `loopback`, `tailscale` configuration is added with `mode: "serve"` and `resetOnExit: false`, and `controlUi.allowedOrigins` is updated to replace `kyber.tail950b36.ts.net:18789` with `https://kyber.tail950b36.ts.net` across both configuration files.

Possibly Related PRs

shunkakinoki/dotfiles#1240: Adds gateway.auth.allowTailscale: true and related gateway authentication flags; directly related Tailscale gateway integration at the configuration level.
shunkakinoki/dotfiles#1356: Modifies the same gateway fields in opposing directions—switches bind to lan, removes Tailscale configuration, and adjusts control UI origins with the :18789 port.

Poem

🐰 A rabbit hops through config states,
From LAN to loopback—changes fate,
Tailscale serves with steady hand,
Origins trimmed by careful brand,
Templates dance in sync again! ✨

🎯 1 (Trivial) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main changes: updating Tailscale configuration and changing the gateway bind address from 'lan' to 'loopback', which aligns with the actual modifications in both configuration files.
Description check	✅ Passed	The description is directly related to the changeset, providing detailed explanations of the bug fixes including the bind address change, Tailscale configuration additions, and allowed origin updates that match the actual file modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch openclaw-tailscale

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request updates the gateway configuration templates to bind to the loopback interface, configures Tailscale integration in "serve" mode, and removes the port number from the Tailnet origin URL. The reviewer raised valid points regarding security and maintainability: first, setting resetOnExit to false may leave dangling endpoints, so changing it to true is recommended; second, hardcoding a specific Tailnet domain reduces reusability, and a template placeholder should be used instead; finally, openclaw.tpl.json appears to be a duplicate of openclaw.template.json and should be removed if unused.

gemini-code-assist · 2026-05-25T19:07:59Z

+    "bind": "loopback",
+    "tailscale": {
+      "mode": "serve",
+      "resetOnExit": false


Setting resetOnExit to false means that the Tailscale serve/funnel configuration will persist even after the OpenClaw gateway process exits. This can leave dangling public/Tailnet endpoints pointing to an inactive port, which is an operational and potential security risk if another local process binds to that port later. Consider setting resetOnExit to true to ensure clean teardown on exit.

Suggested change

"resetOnExit": false

"resetOnExit": true

gemini-code-assist · 2026-05-25T19:07:59Z

        "http://127.0.0.1:18789",
        "https://openclaw.shunkakinoki.com",
-        "https://kyber.tail950b36.ts.net:18789"
+        "https://kyber.tail950b36.ts.net"


Hardcoding a specific Tailnet domain (kyber.tail950b36.ts.net) in the template file reduces the reusability of this configuration across different environments or hosts. Consider using a template placeholder (e.g., __TAILSCALE_DOMAIN__) and replacing it dynamically during the hydration process, similar to how other secrets and variables are handled.

Suggested change

"https://kyber.tail950b36.ts.net"

"https://__TAILSCALE_DOMAIN__"

Worth flagging that kyber.tail950b36.ts.net is hardcoded in several other places in this repo, so templating it only here would be an incomplete fix:

config/openclaw/hydrate.sh:111 — client wss://kyber.tail950b36.ts.net

home-manager/programs/ssh/default.nix:40 — SSH hostname

config/k3s/activate.sh:63 — TAILSCALE_DNS

config/k3s/config.yaml:5 — k3s TLS SAN

spec/openclaw_hydrate_spec.sh:174 and spec/ssh_config_spec.sh:10 — tests asserting the literal host

If you want to make this generic, the domain probably belongs in inputs.host (alongside isKyber) and should be threaded through all of the above, not just this one allow-list entry.

gemini-code-assist · 2026-05-25T19:07:59Z

  "gateway": {
    "mode": "local",
-    "bind": "lan",
+    "bind": "loopback",
+    "tailscale": {
+      "mode": "serve",
+      "resetOnExit": false
+    },
    "controlUi": {
      "allowedOrigins": [
        "http://localhost:18789",
        "http://127.0.0.1:18789",
        "https://openclaw.shunkakinoki.com",
-        "https://kyber.tail950b36.ts.net:18789"
+        "https://kyber.tail950b36.ts.net"
      ]
    },
    "auth": {


This file (openclaw.tpl.json) appears to be a duplicate of openclaw.template.json. However, config/openclaw/default.nix only references openclaw.template.json. Keeping duplicate template files increases maintenance overhead and the risk of configuration drift. If openclaw.tpl.json is indeed redundant and unused, consider deleting it.

openclaw.tpl.json is not a duplicate — it's the source-of-truth template and is referenced by scripts/llm-update.sh:

config/openclaw/openclaw.tpl.json -> config/openclaw/openclaw.template.json

openclaw.tpl.json carries placeholders like __CLAUDE_OPUS__ / __CLAUDE_OPUS_PRETTY__ for model IDs/names, and llm-update.sh renders those into the concrete model versions (claude-opus-4-7, Claude Opus 4.7, …) in openclaw.template.json, which is what config/openclaw/default.nix then consumes at activation time. A diff between the two files confirms the only differences are exactly those model-ID placeholders. Deleting openclaw.tpl.json would break the llm-update.sh rendering pipeline.

indent-zero · 2026-05-25T19:09:52Z

        "http://127.0.0.1:18789",
        "https://openclaw.shunkakinoki.com",
-        "https://kyber.tail950b36.ts.net:18789"
+        "https://kyber.tail950b36.ts.net"


Origin allow-list intent is undocumented: After this PR the list spans three transports — direct loopback (http://localhost:18789, http://127.0.0.1:18789), the public site (https://openclaw.shunkakinoki.com), and the new Tailscale Serve URL (https://kyber.tail950b36.ts.net on 443). Since JSON can't carry comments, consider documenting in config/openclaw/README (or a sibling doc) that the loopback entries exist for local browser access on Kyber while the tailnet entry depends on gateway.tailscale.mode = "serve" and bind = "loopback". Otherwise, if the gateway is ever rebound back to LAN the meaning of the :18789 entries becomes ambiguous.

cubic-dev-ai

No issues found across 2 files

_{Re-trigger cubic}

fix(gateway): update Tailscale configuration and change bind address …

ed126e5

…to loopback

gemini-code-assist Bot reviewed May 25, 2026

View reviewed changes

indent-zero Bot reviewed May 25, 2026

View reviewed changes

cubic-dev-ai Bot reviewed May 25, 2026

View reviewed changes

shunkakinoki merged commit 8eb9227 into main May 26, 2026
41 checks passed

shunkakinoki deleted the openclaw-tailscale branch May 26, 2026 08:34

	"https://kyber.tail950b36.ts.net"
	"https://__TAILSCALE_DOMAIN__"

Conversation

shunkakinoki commented May 25, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

indent-zero Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mesa-dot-dev Bot commented May 25, 2026

Uh oh!

coderabbitai Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Possibly Related PRs

Poem

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 25, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 25, 2026

Choose a reason for hiding this comment

Uh oh!

indent-zero Bot May 25, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 25, 2026

Choose a reason for hiding this comment

Uh oh!

indent-zero Bot May 25, 2026

Choose a reason for hiding this comment

Uh oh!

indent-zero Bot May 25, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

shunkakinoki commented May 25, 2026 •

edited by cubic-dev-ai Bot

Loading

indent-zero Bot commented May 25, 2026 •

edited

Loading

coderabbitai Bot commented May 25, 2026 •

edited

Loading