ja/mw-macbook-pro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1 Commit 1 Branch 0 Tags
a704e1c36a34a794f3087caffcc82ccabad3b77e
T
Clone
Open with VS Code Open with VSCodium Open with Intellij IDEA
Download ZIP Download TAR.GZ Download BUNDLE

README.md

MacBook Pro Node - OpenClaw Gateway Integration

Overview

This repository documents the OpenClaw gateway integration for the satware AG MacBook Pro, configured as a remote tool node controlled by the agent-zero Docker container running on the Manjaro PC.

System Information

Property Value
Hostname satware-AG-MacBook-Pro.local
OS macOS 26.3 (Tahoe)
Kernel Darwin 25.3.0 (x86_64)
User MWsatwareAG
Local IP 10.11.206.26 (en0)
Tailscale IP 100.64.0.12
OpenClaw Version core v2026.3.2

Node Configuration

Node ID

77b912f45a10c92e2970574186426b16f898488c9cd201335235be27d076cdf0

Connection Architecture

┌─────────────────────┐     Tailscale      ┌─────────────────────┐
│   MacBook Pro       │     100.64.0.x     │   Manjaro PC        │
│   (Tool Node)       │◄──────────────────►│   (Gateway Host)    │
│                     │                     │                     │
│  OpenClaw.app       │    WebSocket        │  agent-zero         │
│  (remote mode)      │◄──────────────────►│  Docker container   │
│                     │    ws://:18789      │  Port 18789         │
│                     │                     │                     │
│  SSH Client         │    SSH Tunnel       │  SSH Server         │
│                     │──────────────────►│  Port 2222          │
└─────────────────────┘                     └─────────────────────┘

MacBook OpenClaw Config (~/.openclaw/openclaw.json)

{
  "mode": "remote",
  "remote": {
    "sshIdentity": "/Users/MWsatwareAG/.ssh/id_ed25519",
    "sshTarget": "root@100.64.0.39:2222",
    "url": "ws://100.64.0.39:18789"
  }
}

Security Policy (~/.openclaw/exec-approvals.json)

{
  "version": 1,
  "defaults": {
    "security": "full"
  },
  "agents": {},
  "nodes": {
    "77b912f45a10c92e2970574186426b16f898488c9cd201335235be27d076cdf0": {
      "displayName": "satware AG MacBook Pro",
      "security": "full",
      "allowlist": [
        "system.run",
        "system.run.prepare",
        "system.which",
        "browser.proxy"
      ]
    }
  }
}

Node Capabilities

Capability Commands Status
system system.run, system.run.prepare, system.which ✅ Working
browser browser.proxy ⚠️ Requires browser session
camera camera.list, camera.snap, camera.clip ❌ Not supported on darwin
screen screen.record ❌ Not in allowlist for darwin
canvas canvas.snapshot, canvas.present, etc. ❌ Not supported on darwin

Note

: Camera, screen, and canvas commands are not available on macOS (darwin platform). These features are primarily designed for iOS/mobile nodes.

Tested Commands

system.run

Execute shell commands on the MacBook node.

# Basic invocation pattern
docker exec agent-zero openclaw nodes invoke \
  --node "77b912f45a10c92e2970574186426b16f898488c9cd201335235be27d076cdf0" \
  --command "system.run" \
  --params '{"command":["<cmd>","<args>"]}'

Working Commands

Command Result Notes
hostname ✅ Returns satware-AG-MacBook-Pro.local
uname -a ✅ Darwin 25.3.0 x86_64
sw_vers ✅ macOS 26.3 (Build 25D125)
ls -la /Users/MWsatwareAG ✅ Full filesystem access
/sbin/ifconfig en0 ✅ Network interface info
/usr/bin/curl -s https://httpbin.org/ip ✅ External network access
node --version ✅ Node.js available at /usr/local/bin/node
python3 --version ✅ Python3 at /usr/bin/python3
git --version ✅ Git at /usr/local/bin/git

Known Issues

Issue Cause Solution
spawn ENOENT errors Command not in PATH Use full path (e.g., /sbin/ifconfig)
Tailscale CLI timeout GUI app requires interaction Use alternative network commands
browser.proxy Not Found No browser session running Start browser first

system.which

Find binary locations on the node.

docker exec agent-zero openclaw nodes invoke \
  --node "77b912f45a10c92e2970574186426b16f898488c9cd201335235be27d076cdf0" \
  --command "system.which" \
  --params '{"bins":["node","python3","git"]}'

Returns:

{"bins":{"node":"/usr/local/bin/node","python3":"/usr/bin/python3","git":"/usr/local/bin/git"}}

Quick Reference Commands

Check Node Status

docker exec agent-zero openclaw nodes status

Describe Node Capabilities

docker exec agent-zero openclaw nodes describe --node "77b912f45a10c92e2970574186426b16f898488c9cd201335235be27d076cdf0"

Run Shell Command

docker exec agent-zero openclaw nodes run --node "77b912f45a10c92e2970574186426b16f898488c9cd201335235be27d076cdf0" --raw "uname -a"

Gateway Configuration

The OpenClaw gateway runs inside the agent-zero Docker container on the Manjaro PC.

Gateway Access URLs

URL Description
http://127.0.0.1:18789/ Localhost access (Control UI)
http://localhost:18789/ Localhost access (Control UI)
http://100.64.0.39:18789/ Tailscale LAN access
ws://100.64.0.39:18789 WebSocket endpoint for nodes

Gateway Configuration (/home/ja/internal/luca/openclaw-data/openclaw.json)

Key gateway settings:

{
  "gateway": {
    "port": 18789,
    "mode": "local",
    "bind": "lan",
    "controlUi": {
      "allowedOrigins": [
        "http://localhost:18789",
        "http://127.0.0.1:18789",
        "https://localhost:18789",
        "http://100.64.0.39:18789"
      ],
      "allowInsecureAuth": true
    }
  }
}

Exec Approvals Configuration (/home/ja/internal/luca/openclaw-data/exec-approvals.json)

Node-specific security policy:

{
  "version": 1,
  "defaults": { "security": "full" },
  "nodes": {
    "77b912f45a10c92e2970574186426b16f898488c9cd201335235be27d076cdf0": {
      "displayName": "satware AG MacBook Pro",
      "security": "full",
      "allowlist": ["system.run", "system.run.prepare", "system.which", "browser.proxy"]
    }
  }
}

Network Configuration

Gateway (Manjaro PC)

  • Tailscale IP: 100.64.0.39
  • WebSocket Port: 18789
  • SSH Port: 2222

MacBook Pro

  • Tailscale IP: 100.64.0.12
  • Local IP: 10.11.206.26
  • External IP: 77.24.181.185 (via curl httpbin.org/ip)

Security Considerations

  1. exec-approvals.json: Currently set to "security": "full" for testing

    • Consider "allowlist" mode for production
    • Define specific allowed commands in allowlist

  2. SSH Access: MacBook has SSH key-based access to gateway container

    • Key: ~/.ssh/id_ed25519
    • Target: root@100.64.0.39:2222

  3. WebSocket Connection: Unencrypted (ws:// not wss://)

    • Traffic stays within Tailscale mesh network
    • Consider TLS termination for external access

Files

File Location Purpose
openclaw.json ~/.openclaw/openclaw.json Node configuration
exec-approvals.json ~/.openclaw/exec-approvals.json Security policy
paired.json Gateway: openclaw-data/devices/paired.json Paired devices registry
authorized_keys Gateway: ssh-keys/authorized_keys SSH access keys

Related Documentation

Verification Status

Last Verified: 2026-03-04 04:41 CET

Component Status
Node Connection ✅ Connected
Gateway Health ✅ OK (33ms)
system.run ✅ Working
Capabilities browser, system

MacBook launchd Services

Service Status Purpose
com.satware.openclaw-tunnel Running SSH tunnel to gateway
com.satware.openclaw-node Loaded OpenClaw node process
ai.openclaw.node Running Node service
ai.openclaw.gateway Running Gateway service

Management Commands (on MacBook)

# Check service status
launchctl list | grep openclaw

# Restart SSH tunnel
launchctl unload ~/Library/LaunchAgents/com.satware.openclaw-tunnel.plist
launchctl load ~/Library/LaunchAgents/com.satware.openclaw-tunnel.plist

Verify from Gateway

# Check node status
docker exec agent-zero openclaw nodes status

# Test command execution
docker exec agent-zero openclaw nodes invoke \
  --node "77b912f45a10c92e2970574186426b16f898488c9cd201335235be27d076cdf0" \
  --command "system.run" \
  --params '{"command":["hostname"]}'

SSH system health check (2026-03-04 05:12 CET)

Target checked: MWsatwareAG@100.64.0.12

Snapshot

Area Result Notes
Reachability ✅ OK SSH login successful
OS ✅ OK macOS 26.3, Darwin 25.3.0
Uptime/Load ✅ OK Uptime ~12h; load avg ~3.0 on 16 logical CPUs
CPU ⚠️ Watch Short-term spikes from openclaw-gateway, RustDesk, Weather widget
Memory ✅ OK 16 GB total (hw.memsize: 17179869184)
Disk ✅ OK APFS main container ~18% used; high free capacity
Recent errors ✅ None critical in sample No critical/fatal lines surfaced in 2h sample
Listening ports ⚠️ Review 22, 5900, 3283, Tailscale/RustDesk-related listeners

Key commands used

ssh -o BatchMode=yes -o ConnectTimeout=10 MWsatwareAG@100.64.0.12 'sw_vers; uname -a; uptime; sysctl vm.loadavg'
ssh -o BatchMode=yes -o ConnectTimeout=10 MWsatwareAG@100.64.0.12 'sysctl hw.memsize; df -h; diskutil apfs list | head -n 80'
ssh -o BatchMode=yes -o ConnectTimeout=10 MWsatwareAG@100.64.0.12 'ps -Ao pid,pcpu,pmem,comm | sort -k2 -nr | head -n 10'
ssh -o BatchMode=yes -o ConnectTimeout=10 MWsatwareAG@100.64.0.12 'netstat -anv -p tcp | grep LISTEN | head -n 20'

Next steps

  1. Run a 5-10 minute process sample to confirm whether high CPU from openclaw-gateway is transient.
  2. Validate which externally reachable services are required (22, 5900, 3283, RustDesk/Tailscale).
  3. If hardening is required, disable unneeded listeners and re-test remote workflows.
  4. Add an automated daily health snapshot job and keep results in this repository.

Last updated: 2026-03-04

Reference in New Issue View Git Blame Copy Permalink
S
Description
MacBook Pro Node - OpenClaw Gateway Integration
Readme
393 KiB
Languages
Shell 89.4%
Python 10.6%