ja/mw-macbook-pro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: bump OpenClaw node version to 2026.3.28 and align remote maintenance docs

Browse Source 
- Update OpenClaw version references from 2026.3.13 to 2026.3.28 in README.md, docs/OPENCLAW_ARCHITECTURE.md, and gateway_plugins.txt.
- Remove outdated MacOS maintenance instructions (log rotation, credential syncing) from remote luca project.
- Redirect remote luca documentation to explicitly refer back to the mw-macbook-pro repository for MacOS-specific routines.
- Updated CHANGELOG to reflect version bump and cross-repo document alignments.
- Removed completed implementation plan.

Co-authored-by: Junie <junie@jetbrains.com>
This commit is contained in:
mw
2026-03-30 17:08:57 +02:00
co-authored by Junie
parent f54fc1d9cd
commit a28a4a049b
20 changed files with 1468 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/OPENCLAW_ARCHITECTURE.md
+13 -11
View File
@@ -12,21 +12,19 @@ The connection from this MacBook to the gateway uses a multi-layered tunnel to e
The underlying transport is the Tailscale mesh network. This MacBook (`100.64.0.12`) sees the Luca server at `100.64.0.39`.
#### B. Layer 2: SSH Tunnel (Container Entry)
* **Service**: `ai.openclaw.ssh-tunnel.plist`
* **Command**: `ssh -N -L 18789:172.18.0.2:18789 root@100.64.0.39 -p 2222`
* **Service**: Handled natively by `/Applications/OpenClaw.app`
* **Command**: `ssh -N -L 18789:127.0.0.1:18789 -p 2222 root@100.64.0.39`
* **How it works**:
1. The MacBook initiates an SSH connection to port `2222` on Luca's Tailscale IP. Port `2222` is the SSH server running **inside** the `agent-zero` Docker container.
2. The `-L 18789:172.18.0.2:18789` switch creates a local loopback listener on this MacBook (`127.0.0.1:18789`).
3. Traffic sent to `127.0.0.1:18789` is forwarded through the encrypted SSH tunnel directly to the container's internal IP and port (`172.18.0.2:18789`).
4. Since the SSH server is inside the container, `172.18.0.2` is the container's internal interface IP, which the OpenClaw gateway is listening on.
1. The MacBook Companion App initiates an SSH connection to port `2222` on Luca's Tailscale IP. Port `2222` is the SSH server running **inside** the `agent-zero` Docker container.
2. The `-L 18789:127.0.0.1:18789` switch creates a local loopback listener on this MacBook (`127.0.0.1:18789`).
3. Traffic sent to `127.0.0.1:18789` is forwarded through the encrypted SSH tunnel directly to the container's internal port (`18789`).
#### C. Layer 3: WebSocket Node Connection
* **Service**: `ai.openclaw.node.plist`
* **Command**: `openclaw node run --host 127.0.0.1 --port 18789`
* **Service**: `OpenClaw.app` Mac Companion App
* **How it works**:
1. The node process starts on the MacBook.
2. It connects to `ws://127.0.0.1:18789`. Because of the SSH tunnel above, this connects it to the remote gateway on Luca.
3. It authenticates using the `OPENCLAW_GATEWAY_TOKEN` provided in the environment variables.
1. The node process runs embedded within the Companion App.
2. It uses the provided SSH tunnel transparently based on the settings in `~/.openclaw/openclaw.json`.
3. It authenticates using the stored remote token.
### 2. Component Layout
@@ -45,3 +43,7 @@ The underlying transport is the Tailscale mesh network. This MacBook (`100.64.0.
### 4. Why 127.0.0.1?
The MacBook's node configures the gateway URL as `ws://127.0.0.1:18789` because OpenClaw's security policy prohibits sending operator/node tokens over unencrypted (`ws://`) connections to **remote** IP addresses. However, `127.0.0.1` is considered "local" and always trusted. The SSH tunnel transparently wraps the local connection in encryption for its journey over the network.
### 5. Maintenance Delegation
Note: Specific maintenance and configuration tasks associated with this Mac node—including credentials rotation for tools running here, app updates (`OpenClaw.app`), tunnel configuration, and Mac-based logs (`newsyslog`)—are explicitly delegated to this project repository (`mw-macbook-pro`) and the remote operator logged in via `ssh MWsatwareAG@100.64.0.12`. These responsibilities have been intentionally removed from the Manjaro server's maintenance purview to ensure proper separation of concerns.