openclaw: fix app container mount so CLI probes can connect to gateway

Remove :ro from the .openclaw volume so the CLI can write state files
on startup (it was crashing immediately with EROFS). Add
OPENCLAW_GATEWAY_TOKEN so the CLI bypasses the device identity
handshake when auth=none, allowing the gateway reachability probe to
succeed before the device is auto-approved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nixos/arion-openclaw/arion-compose.nix

@@ -2,24 +2,50 @@
 {
   project.name = "openclaw";
 
-  networks.openclaw.external = false;
-
   services = {
+    gateway = {
+      service = {
+        image = "node:22-alpine";
+        container_name = "openclaw-gateway";
+        restart = "unless-stopped";
+        network_mode = "host";
+        volumes = [
+          "/var/openclaw/gateway:/app"
+          "/root/.openclaw:/root/.openclaw"
+        ];
+        environment = {
+          OPENCLAW_HOME = "/root/.openclaw";
+        };
+        command = [
+          "sh" "-c"
+          ''
+            set -e
+            if [ ! -f /app/node_modules/.bin/openclaw ]; then
+              cd /app && npm install openclaw@latest
+            fi
+            exec /app/node_modules/.bin/openclaw gateway --port 18789 --dev --auth none
+          ''
+        ];
+      };
+    };
+
     app = {
       service = {
-        image = "node:lts-alpine";
+        image = "node:22-alpine";
         container_name = "openclaw";
         restart = "unless-stopped";
-        networks = [ "openclaw" ];
+        network_mode = "host";
         volumes = [
           "/var/openclaw/app:/app"
-          "/root/.openclaw:/root/.openclaw:ro"
+          "/var/openclaw/gateway:/gateway"
+          "/root/.openclaw:/root/.openclaw"
         ];
-        ports = [ "127.0.0.1:4310:4310" ];
         environment = {
           PORT = "4310";
-          UI_BIND_ADDRESS = "0.0.0.0";
+          UI_BIND_ADDRESS = "127.0.0.1";
           OPENCLAW_HOME = "/root/.openclaw";
+          OPENCLAW_BIN_PATH = "/gateway/node_modules/.bin/openclaw";
+          OPENCLAW_GATEWAY_TOKEN = "openclaw-local-dev";
         };
         command = [
           "sh" "-c"
@@ -35,6 +61,9 @@
               sed -i "s|OPENCLAW_HOME=.*|OPENCLAW_HOME=/root/.openclaw|" .env
               sed -i "s|PORT=.*|PORT=4310|" .env
             fi
+            sed -i 's/resolveUiLanguage(url.searchParams, "zh")/resolveUiLanguage(url.searchParams, "en")/g' src/ui/server.ts
+            sed -i 's/hasExplicitLanguage ? resolvedLanguage : "zh"/hasExplicitLanguage ? resolvedLanguage : "en"/g' src/ui/server.ts
+            sed -i 's/language: "zh",/language: "en",/g' src/runtime/ui-preferences.ts
             npm install
             npm run build
             exec npm run dev:ui

nixos/linux.nix

@@ -243,6 +243,7 @@ in {
     "d /var/paperless/postgres 0755 root root"
     "d /var/paperless/redis 0755 root root"
     "d /var/openclaw/app 0755 root root"
+    "d /var/openclaw/gateway 0755 root root"
     "d /var/riverside/files 0755 root root"
     "d /var/riverside/postgres 0755 root root"
     "d /var/lib/gitea-runner/ubuntu 0755 gitea-runner gitea-runner"

nixos/nginx.nix

@@ -56,6 +56,7 @@
         enableACME = true;
         forceSSL = false;
         addSSL = true;
+        basicAuthFile = "/var/openclaw/htpasswd";
 
         locations."/" = {
           proxyPass = "http://127.0.0.1:4310/";