kossakovsky/selfhost-ai v1.14.1

on GitHub

Changed

• OpenClaw - The dashboard opens right after the Caddy basic-auth login: no second (gateway) password and no browser approval with make openclaw a="devices approve ..." any more. The gateway now runs in OpenClaw's trusted-proxy mode. Caddy passes the authenticated user in X-Forwarded-User over a new private openclaw-proxy Docker network that only Caddy and OpenClaw join. openclaw-init sets gateway.trustedProxies to exactly that network's subnet, so containers on the stack's default network cannot forge the header; any process on the host itself (the subnet's gateway address) is trusted too, so do not enable the profile on a server shared with untrusted local users. If the subnet cannot be determined, the trusted-proxy settings are rejected or a stale pre-1.14.1 openclaw-init container is reused, openclaw-init tries to fall back to the previous password login with no trusted proxy; make doctor, make restart and the final report of install / make update show it. Only OPENCLAW_USERNAME is accepted, and new browsers are auto-approved with admin scope. The basic-auth password is now the only key to the agent, and through it to the server. OPENCLAW_GATEWAY_PASSWORD remains for the local CLI (make openclaw a="...") and the password-login fallback, and is no longer shown on the Welcome Page. Upgrading: make update or make restart recreate the containers, which attaches Caddy to the new network (with make start the dashboard returns 502 until make restart); no browser needs approving again.

Upgrade

Run make update (or make restart). The containers are recreated, which attaches Caddy to the new openclaw-proxy network.

• OpenClaw: log in with the basic-auth credentials from the Welcome Page, and the dashboard opens straight away.
  • With make start, the dashboard returns 502 until you run make restart.
  • If make doctor or the final report shows an openclaw-init error, OpenClaw has fallen back to password login: use OPENCLAW_GATEWAY_PASSWORD from .env, then make openclaw a="devices approve <requestId>".
• Security note: any process on the server itself can reach OpenClaw as a trusted proxy. Do not enable the openclaw profile on a server shared with untrusted local users.

Full Changelog: v1.14.0...v1.14.1