@@ -0,0 +1,109 @@
1+---
2+summary: "Run the OpenClaw Gateway on EasyRunner with Podman and Caddy"
3+read_when:
4+ - Deploying OpenClaw on EasyRunner
5+ - Running the Gateway behind EasyRunner's Caddy proxy
6+ - Choosing persistent volumes and auth for a hosted Gateway
7+title: "EasyRunner"
8+---
9+10+EasyRunner can host the OpenClaw Gateway as a small containerized app behind its
11+Caddy proxy. This guide assumes an EasyRunner host that runs Podman-compatible
12+Compose apps and exposes HTTPS through Caddy.
13+14+## Before you begin
15+16+- An EasyRunner server with a domain routed to it.
17+- A built or published OpenClaw container image.
18+- A persistent config volume for `/home/node/.openclaw`.
19+- A persistent workspace volume for `/workspace`.
20+- A strong Gateway token or password.
21+22+Keep device auth enabled when possible. If your reverse proxy deployment cannot
23+carry device identity correctly, fix trusted-proxy settings first; use
24+dangerous auth bypasses only for a fully private, operator-controlled network.
25+26+## Compose app
27+28+Create an EasyRunner app with a Compose file shaped like this:
29+30+```yaml
31+services:
32+openclaw:
33+image: ghcr.io/openclaw/openclaw:latest
34+restart: unless-stopped
35+environment:
36+OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
37+OPENCLAW_HOME: /home/node
38+OPENCLAW_STATE_DIR: /home/node/.openclaw
39+OPENCLAW_CONFIG_PATH: /home/node/.openclaw/openclaw.json
40+OPENCLAW_WORKSPACE_DIR: /workspace
41+volumes:
42+ - openclaw-config:/home/node/.openclaw
43+ - openclaw-workspace:/workspace
44+labels:
45+caddy: openclaw.example.com
46+caddy.reverse_proxy: "{{upstreams 1455}}"
47+command: ["openclaw", "gateway", "--bind", "lan", "--port", "1455"]
48+49+volumes:
50+openclaw-config:
51+openclaw-workspace:
52+```
53+54+Replace `openclaw.example.com` with your Gateway hostname. Store
55+`OPENCLAW_GATEWAY_TOKEN` in EasyRunner's secret/environment manager instead of
56+committing it to the app definition.
57+58+## Configure OpenClaw
59+60+Inside the persistent config volume, keep the Gateway reachable only through
61+the proxy and require auth:
62+63+```json5
64+{
65+ gateway: {
66+ bind: "lan",
67+ port: 1455,
68+ auth: {
69+ token: "${OPENCLAW_GATEWAY_TOKEN}",
70+ },
71+ },
72+}
73+```
74+75+If Caddy terminates TLS for the Gateway, configure trusted proxy settings for
76+the exact proxy path rather than disabling auth checks globally. See
77+[Trusted proxy auth](/gateway/trusted-proxy-auth).
78+79+## Verify
80+81+From your workstation:
82+83+```bash
84+openclaw gateway probe --url https://openclaw.example.com --token <token>
85+openclaw gateway status --url https://openclaw.example.com --token <token>
86+```
87+88+From the EasyRunner host, check the app logs for a listening Gateway and no
89+startup SecretRef, plugin, or channel auth failures.
90+91+## Updates and backups
92+93+- Pull or build the new OpenClaw image, then redeploy the EasyRunner app.
94+- Back up the `openclaw-config` volume before updates.
95+- Back up `openclaw-workspace` if agents write durable project data there.
96+- Run `openclaw doctor` after major updates to catch config migrations and
97+service warnings.
98+99+## Troubleshooting
100+101+- `gateway probe` cannot connect: confirm the Caddy hostname points at the app
102+and that the container listens on `0.0.0.0:1455`.
103+- Auth fails: rotate the token in EasyRunner secrets and the local client
104+command together.
105+- Files are root-owned after restore: repair the mounted volumes so the
106+container user can write `/home/node/.openclaw` and `/workspace`.
107+- Browser or channel plugins fail: check whether the required external
108+binaries, network egress, and mounted credentials are available inside the
109+container.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。