disable claw

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nixos/arion-openclaw/arion-compose.nix

@@ -0,0 +1,45 @@
+{ pkgs, ... }:
+{
+  project.name = "openclaw";
+
+  networks.openclaw.external = false;
+
+  services = {
+    app = {
+      service = {
+        image = "node:lts-alpine";
+        container_name = "openclaw";
+        restart = "unless-stopped";
+        networks = [ "openclaw" ];
+        volumes = [
+          "/var/openclaw/app:/app"
+          "/root/.openclaw:/root/.openclaw:ro"
+        ];
+        ports = [ "127.0.0.1:4310:4310" ];
+        environment = {
+          PORT = "4310";
+          OPENCLAW_HOME = "/root/.openclaw";
+        };
+        command = [
+          "sh" "-c"
+          ''
+            set -e
+            apk add --no-cache git
+            if [ ! -d /app/repo ]; then
+              git clone https://github.com/TianyiDataScience/openclaw-control-center.git /app/repo
+            fi
+            cd /app/repo
+            if [ ! -f .env ]; then
+              cp .env.example .env
+              sed -i "s|OPENCLAW_HOME=.*|OPENCLAW_HOME=/root/.openclaw|" .env
+              sed -i "s|PORT=.*|PORT=4310|" .env
+            fi
+            npm install
+            npm run build
+            exec npm run dev:ui
+          ''
+        ];
+      };
+    };
+  };
+}

nixos/arion-openclaw/arion-pkgs.nix

@@ -0,0 +1,3 @@
+import <nixpkgs> {
+  system = "x86_64-linux";
+}

nixos/firewall.nix

@@ -20,6 +20,5 @@
   networking.firewall.extraCommands = ''
     iptables -I nixos-fw -s 10.89.0.0/16 -p udp --dport 53 -j nixos-fw-accept
     iptables -I nixos-fw -s 10.89.0.0/16 -p tcp --dport 53 -j nixos-fw-accept
-    iptables -I nixos-fw -s 10.89.0.0/16 -p tcp --dport 5901 -j nixos-fw-accept
   '';
 }

nixos/linux.nix

@@ -18,8 +18,6 @@
   nixPkgs = specialArgs.nixPkgs;
   ourRustVersion = pkgs.rust-bin.selectLatestNightlyWith (toolchain: toolchain.complete);
 
-  vncContext = builtins.path { path = ./vnc-desktop; name = "vnc-desktop-context"; };
-
   ourRustPlatform = nixPkgs.makeRustPlatform {
     rustc = ourRustVersion;
     cargo = ourRustVersion;
@@ -114,8 +112,8 @@ in {
     }
   ];
 
-  # KDE Plasma on the host — the noVNC container (vnc-desktop) is a thin WebSocket
-  # proxy that connects to the VNC server started here.
+  # KDE Plasma on the host — the novnc systemd service (websockify) proxies
+  # WebSocket traffic from nginx to the VNC server started here.
   services.xserver = {
     enable = true;
     desktopManager.plasma5.enable = true;
@@ -175,6 +173,7 @@ in {
     projects.riverside.settings = import ./arion-riverside/arion-compose.nix;
     projects.pluto.settings = import ./arion-pluto/arion-compose.nix;
     projects.paperless.settings = import ./arion-paperless/arion-compose.nix;
+    #projects.openclaw.settings = import ./arion-openclaw/arion-compose.nix;
   };
 
   # The arion NixOS module sets backend = "podman-socket" but doesn't inject
@@ -184,36 +183,20 @@ in {
   systemd.services.arion-riverside.environment.DOCKER_HOST = "unix:///run/podman/podman.sock";
   systemd.services.arion-pluto.environment.DOCKER_HOST = "unix:///run/podman/podman.sock";
   systemd.services.arion-paperless.environment.DOCKER_HOST = "unix:///run/podman/podman.sock";
+  #systemd.services.arion-openclaw.environment.DOCKER_HOST = "unix:///run/podman/podman.sock";
 
-  # Build the VNC desktop image locally from the Dockerfile — no registry push/pull needed.
-  # vncContext is a Nix store path that changes whenever any file under vnc-desktop/ changes,
-  # which causes build-vnc-image to re-run and podman-vnc-desktop to restart on nixos-rebuild.
-  systemd.services.build-vnc-image = {
-    description = "Build VNC desktop container image from Dockerfile";
-    wantedBy = [ "podman-vnc-desktop.service" ];
-    before    = [ "podman-vnc-desktop.service" ];
+  systemd.services.novnc = {
+    description = "noVNC WebSocket proxy for VNC desktop";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "vnc-kde.service" "network.target" ];
     serviceConfig = {
-      Type            = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = pkgs.writeShellScript "build-vnc-image" ''
-        STAMP=/var/lib/build-vnc-image/context-hash
-        EXPECTED="${vncContext}"
-        if [ -f "$STAMP" ] && [ "$(cat "$STAMP")" = "$EXPECTED" ]; then
-          echo "VNC image is up to date, skipping build"
-          exit 0
-        fi
-        echo "Building VNC desktop image..."
-        ${pkgs.podman}/bin/podman build \
-          -t forge.quinefoundation.com/ironmagma/vnc-desktop:latest \
-          ${vncContext}
-        mkdir -p "$(dirname "$STAMP")"
-        echo "$EXPECTED" > "$STAMP"
-      '';
+      Type = "simple";
+      Restart = "on-failure";
+      RestartSec = "3s";
+      ExecStart = "${pkgs.python3Packages.websockify}/bin/websockify --web ${pkgs.novnc}/share/webapps/novnc 127.0.0.1:6080 localhost:5901";
     };
   };
 
-  systemd.services.podman-vnc-desktop.restartTriggers = [ "${vncContext}" ];
-
   services.gitea-actions-runner.instances."ubuntu" = {
     enable = true;
     name = "ubuntu";
@@ -259,6 +242,7 @@ in {
     "d /var/paperless/consume 0755 root root"
     "d /var/paperless/postgres 0755 root root"
     "d /var/paperless/redis 0755 root root"
+    "d /var/openclaw/app 0755 root root"
     "d /var/riverside/files 0755 root root"
     "d /var/riverside/postgres 0755 root root"
     "d /var/lib/gitea-runner/ubuntu 0755 gitea-runner gitea-runner"
@@ -307,18 +291,6 @@ in {
       #   ports = ["8081:80"];
       # };
 
-      "vnc-desktop" = {
-        autoStart = true;
-        image = "forge.quinefoundation.com/ironmagma/vnc-desktop:latest";
-        environmentFiles = [ config.age.secrets.vnc-password.path ];
-        volumes = [ "/root/.ssh:/root/host-ssh:ro" ];
-        ports = [ "127.0.0.1:6080:6080" ];
-        extraOptions = [
-          "--add-host=hetzner-host:host-gateway"
-          "--pids-limit=-1"
-        ];
-      };
-
       "navidrome" = {
         autoStart = true;
         environment = {
@@ -479,6 +451,7 @@ in {
     "acme-selfsigned-www.philippeterson.com.service"
     "acme-selfsigned-riverside.coldairnetworks.com.service"
     "acme-selfsigned-vnc.quinefoundation.com.service"
+    "acme-selfsigned-claw.quineglobal.com.service"
     "acme-selfsigned-webdav.philippeterson.com.service"
     "acme-selfsigned-pluto.philippeterson.com.service"
     "acme-selfsigned-paperless.philippeterson.com.service"

nixos/nginx.nix

@@ -52,6 +52,22 @@
         };
       };
 
+      "claw.quineglobal.com" = {
+        enableACME = true;
+        forceSSL = true;
+
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:4310/";
+          extraConfig = ''
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $host;
+            proxy_read_timeout 86400;
+          '';
+        };
+      };
+
       "hyper.quineglobal.com" = {
         enableACME = true;
         forceSSL = false;