Skip to content

fix(gateway): update Tailscale configuration and change bind address to loopback #1855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 1 commit into from
May 26, 2026
+12 −4
Merged

fix(gateway): update Tailscale configuration and change bind address to loopback #1855

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions config/openclaw/openclaw.template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -971,13 +971,17 @@
},
"gateway": {
"mode": "local",
"bind": "lan",
"bind": "loopback",
"tailscale": {
"mode": "serve",
"resetOnExit": false

@gemini-code-assist gemini-code-assist Bot May 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

Setting resetOnExit to false means that the Tailscale serve/funnel configuration will persist even after the OpenClaw gateway process exits. This can leave dangling public/Tailnet endpoints pointing to an inactive port, which is an operational and potential security risk if another local process binds to that port later. Consider setting resetOnExit to true to ensure clean teardown on exit.

Suggested change
"resetOnExit": false
"resetOnExit": true

},
"controlUi": {
"allowedOrigins": [
"http://localhost:18789",
"http://127.0.0.1:18789",
"https://openclaw.shunkakinoki.com",
"https://kyber.tail950b36.ts.net:18789"
"https://kyber.tail950b36.ts.net"

@gemini-code-assist gemini-code-assist Bot May 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Hardcoding a specific Tailnet domain (kyber.tail950b36.ts.net) in the template file reduces the reusability of this configuration across different environments or hosts. Consider using a template placeholder (e.g., __TAILSCALE_DOMAIN__) and replacing it dynamically during the hydration process, similar to how other secrets and variables are handled.

Suggested change
"https://kyber.tail950b36.ts.net"
"https://__TAILSCALE_DOMAIN__"

@indent-zero indent-zero Bot May 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Worth flagging that kyber.tail950b36.ts.net is hardcoded in several other places in this repo, so templating it only here would be an incomplete fix:

  • config/openclaw/hydrate.sh:111 — client wss://kyber.tail950b36.ts.net
  • home-manager/programs/ssh/default.nix:40 — SSH hostname
  • config/k3s/activate.sh:63 — TAILSCALE_DNS
  • config/k3s/config.yaml:5 — k3s TLS SAN
  • spec/openclaw_hydrate_spec.sh:174 and spec/ssh_config_spec.sh:10 — tests asserting the literal host

If you want to make this generic, the domain probably belongs in inputs.host (alongside isKyber) and should be threaded through all of the above, not just this one allow-list entry.

@indent-zero indent-zero Bot May 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Origin allow-list intent is undocumented: After this PR the list spans three transports — direct loopback (http://localhost:18789, http://127.0.0.1:18789), the public site (https://openclaw.shunkakinoki.com), and the new Tailscale Serve URL (https://kyber.tail950b36.ts.net on 443). Since JSON can't carry comments, consider documenting in config/openclaw/README (or a sibling doc) that the loopback entries exist for local browser access on Kyber while the tailnet entry depends on gateway.tailscale.mode = "serve" and bind = "loopback". Otherwise, if the gateway is ever rebound back to LAN the meaning of the :18789 entries becomes ambiguous.

]
},
"auth": {
Expand Down
8 changes: 6 additions & 2 deletions config/openclaw/openclaw.tpl.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -971,13 +971,17 @@
},
"gateway": {
"mode": "local",
"bind": "lan",
"bind": "loopback",
"tailscale": {
"mode": "serve",
"resetOnExit": false
},
"controlUi": {
"allowedOrigins": [
"http://localhost:18789",
"http://127.0.0.1:18789",
"https://openclaw.shunkakinoki.com",
"https://kyber.tail950b36.ts.net:18789"
"https://kyber.tail950b36.ts.net"
]
},
"auth": {
Comment on lines 972 to 987

@gemini-code-assist gemini-code-assist Bot May 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This file (openclaw.tpl.json) appears to be a duplicate of openclaw.template.json. However, config/openclaw/default.nix only references openclaw.template.json. Keeping duplicate template files increases maintenance overhead and the risk of configuration drift. If openclaw.tpl.json is indeed redundant and unused, consider deleting it.

@indent-zero indent-zero Bot May 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

openclaw.tpl.json is not a duplicate — it's the source-of-truth template and is referenced by scripts/llm-update.sh:

config/openclaw/openclaw.tpl.json -> config/openclaw/openclaw.template.json

openclaw.tpl.json carries placeholders like __CLAUDE_OPUS__ / __CLAUDE_OPUS_PRETTY__ for model IDs/names, and llm-update.sh renders those into the concrete model versions (claude-opus-4-7, Claude Opus 4.7, …) in openclaw.template.json, which is what config/openclaw/default.nix then consumes at activation time. A diff between the two files confirms the only differences are exactly those model-ID placeholders. Deleting openclaw.tpl.json would break the llm-update.sh rendering pipeline.

Expand Down
Loading