kossakovsky/selfhost-ai v1.14.0

on GitHub

Added

• OpenClaw - New optional openclaw profile that adds OpenClaw, a personal AI agent with a web dashboard (OPENCLAW_HOSTNAME) and a Telegram bot. The dashboard is behind Caddy basic auth (OPENCLAW_USERNAME / OPENCLAW_PASSWORD) and OpenClaw's own gateway password (OPENCLAW_GATEWAY_PASSWORD), all generated by the installer. OpenClaw's device pairing cannot be turned off, so every new browser is approved once with the new make openclaw a="devices approve <requestId>" passthrough. The installer asks for an optional Telegram bot token (OPENCLAW_TELEGRAM_BOT_TOKEN); DMs keep OpenClaw's pairing policy (make openclaw a="pairing approve telegram <CODE>"). A one-shot openclaw-init container runs on every docker compose up (install, make update, make restart): it copies the SSH key into a volume owned by the container user and enforces the gateway settings the stack depends on (local mode, LAN bind, password auth, allowed origin, private-range trusted proxies, and Telegram on while a token is set); the rest of the config is left to the dashboard. A failed config update does not stop the rest of the stack. The agent gets full server access by design: the image adds the Docker CLI, the Docker socket is mounted with the socket's group, and 05_configure_services.sh authorizes a generated SSH key for the installing user (ssh host inside the container, using the port sshd really listens on). The key moves with the detected user and is removed from authorized_keys by the next install or make update with the profile off; the key files stay in openclaw/ssh/. A failed openclaw-init config update is reported by make doctor. The LLM provider is configured in the dashboard.

Upgrade

Upgrade with make update. Nothing changes for existing services.

• OpenClaw (optional, new profile): select it in the wizard.
  • The installer generates the dashboard credentials and asks for a Telegram bot token, which you may leave empty.
  • It authorizes an SSH key for your user, so the agent gets full server access (ssh host, Docker socket).
  • After the first login, approve the browser with make openclaw a="devices list", then make openclaw a="devices approve <requestId>".
  • Pick an LLM provider and model in the dashboard.

Full Changelog: v1.13.0...v1.14.0