Gateway runs in its own node:22-alpine container with host networking,
installs openclaw@latest on first boot (persisted to /var/openclaw/gateway).
Control center also switches to host networking so ws://127.0.0.1:18789
reaches the gateway's loopback. UI_BIND_ADDRESS locked to 127.0.0.1.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Patch app source at startup to change default language from zh to en
- Add basicAuth (ironmagma) to nginx vhost for claw.quineglobal.com
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Cloudflare is in Flexible SSL mode so it hits our origin over HTTP.
forceSSL was causing an infinite HTTP->HTTPS redirect loop. Switch to
addSSL so HTTPS still works for direct connections while HTTP serves
normally through Cloudflare.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Paperless-ngx uses WebSockets to push task completion status to the
browser. Without Upgrade/Connection headers the UI hangs indefinitely
after upload while waiting for the done notification.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
recommendedProxySettings already injects Host, X-Real-IP, X-Forwarded-*
via an include in the location block. Our explicit extraConfig set them
again, causing Django to receive 'host,host' and reject with DisallowedHost.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The vnc-desktop container no longer runs a desktop environment. KDE Plasma
and Xvnc now run directly on the host via a vnc-kde systemd service, with
port 5901 firewalled to the podman bridge subnet only. The container is
reduced to a websockify bridge forwarding the noVNC web UI to hetzner-host:5901.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
