fix: harden Nexus runtime health and rollback

2026-07-10 00:37:24 +02:00
parent dbda764190
commit 706ff82ccd
7 changed files with 106 additions and 68 deletions
@@ -68,8 +68,8 @@ Ansatz. Das Backend fungiert bereits als sichere Schicht zwischen allen Akteuren
 │                                                                   │
 │  ALLE Gateway-Calls → Authorization: Bearer <Gateway-Password>   │
 └──────────────┬──────────────────────────────┬────────────────────┘
-               │ host.docker.internal:18789    │
-               │ (Gateway loopback/lan)        │
+               │ openclaw-gateway-bao:18789    │
+               │ (internes Docker-DNS)         │
               ▼                               │
 ┌──────────────────────────────┐              │
 │ OpenClaw Gateway Container    │              │
@@ -199,7 +199,7 @@ Ebene 4: X-Agent-Id Header (Agent-Identität für Task-State-Enforcement)
 ```
 POST /api/v1/operations/snapshot
  → DashboardService → OpenClawGatewayClient.InvokeToolAsync()
-    → POST http://host.docker.internal:18789/tools/invoke
+    → POST http://openclaw-gateway-bao:18789/tools/invoke
       Authorization: Bearer <Gateway-Password>
 ```

@@ -220,7 +220,7 @@ POST /api/v1/operations/snapshot

 ### 5.2 Docker-Netzwerk & Gateway-Bind

-**Aktuelles Problem:**
+**Aktueller Stand (2026-07-09):**
 ```
 compose.yaml:
  api:
@@ -228,32 +228,27 @@ compose.yaml:
      - host.docker.internal:host-gateway
    networks:
      - nexus
-      - openclaw_default  ← API-Container ist im Gateway-Netzwerk
+      - openclaw_default

 Gateway-Konfiguration:
-  gateway.bind: "loopback"  ← Bindet nur 127.0.0.1 IM GATEWAY-CONTAINER
+  gateway.bind: "lan"
+
+Nexus-Konfiguration:
+  OPENCLAW_BASE_URL=http://openclaw-gateway-bao:18789
 ```

 **Ergebnis:**
- `host.docker.internal:18789` funktioniert, weil `extra_hosts` auf den Docker-Host zeigt
- ABER: Docker-Port-Forward (wenn vorhanden) sendet an Container-IP, nicht loopback
- Die `openclaw_default` Netzwerk-Mitgliedschaft des API-Containers wird NICHT genutzt
+- Nexus erreicht das Gateway direkt über Docker-DNS im gemeinsamen `openclaw_default`-Netz.
+- Der Umweg über einen nicht veröffentlichten Host-Port entfällt.
+- Der produktive Aggregat-Healthcheck prüft neben PostgreSQL auch die Runtime-Verbindung.

-**Empfehlung (siehe gateway-api-research.md, Abschnitt 6):**
-```json5
-// openclaw.json
-{
-  gateway: {
-    bind: "lan"  // war "loopback"
-  }
-}
-```
+Der frühere Pfad `host.docker.internal:18789` war auf dem VPS nicht erreichbar und ist obsolet.

-Alternativ: API-Container über Gateway-Container-Namen ansprechen:
+Produktive Einstellung:
 ```yaml
-Integrations__OpenClaw__BaseUrl: http://openclaw_gateway:18789
+Integrations__OpenClaw__BaseUrl: http://openclaw-gateway-bao:18789
 ```
-(Vorausgesetzt der Gateway-Container heißt `openclaw_gateway` und ist im `openclaw_default` Netzwerk)
+Beide Container müssen Mitglied im `openclaw_default`-Netzwerk sein.

 ### 5.3 MCP-artige Integration: Bewertung

@@ -290,30 +290,30 @@ The Nexus compose.yaml already includes the full integration infrastructure:

 ```yaml
 api:
-  extra_hosts:
-    - host.docker.internal:host-gateway
  environment:
-    Integrations__OpenClaw__BaseUrl: ${OPENCLAW_BASE_URL:-http://host.docker.internal:18789}
+    Integrations__OpenClaw__BaseUrl: ${OPENCLAW_BASE_URL:-http://openclaw-gateway-bao:18789}
    Integrations__OpenClaw__Token: ${OPENCLAW_GATEWAY_TOKEN:-}
    Integrations__OpenClaw__Password: ${OPENCLAW_GATEWAY_PASSWORD:-}
+  networks:
+    - nexus
+    - openclaw_default
 ```

 The API container:
- Uses `host.docker.internal:18789` to reach the Gateway via the Docker host
- Has `extra_hosts` configured for `host.docker.internal`
+- Uses Docker DNS (`openclaw-gateway-bao:18789`) in the shared `openclaw_default` network
+- Does not depend on a published host port for the Gateway
 - Reads token/password from `.env` via `OPENCLAW_GATEWAY_PASSWORD`

-### Known Issue: Gateway Bind = loopback
+### Resolved Routing Issue (2026-07-09)

-The Gateway binds to `127.0.0.1` (`gateway.bind: "loopback"`). This means it only listens inside the gateway container's loopback interface.
+The old `host.docker.internal:18789` route was unreachable because no usable host port was published. The Gateway is now reached directly by its container DNS name.

 | Scenario | Works? | Why |
 |----------|--------|-----|
-| Gateway with `--network host` | ✅ Yes | Process sees host's 127.0.0.1 directly |
-| Gateway with `-p 18789:18789` + loopback bind | ❌ No | Port forward sends to container IP, not loopback |
-| Gateway with `-p 18789:18789` + lan bind | ✅ Yes | Listens on all interfaces including container IP |
+| `host.docker.internal:18789` | ❌ No | No reachable host listener on the VPS |
+| `openclaw-gateway-bao:18789` in `openclaw_default` | ✅ Yes | Direct container-to-container routing via Docker DNS |

-**Fix**: Change `gateway.bind` from `"loopback"` to `"lan"` (binds `0.0.0.0`):
+The Gateway must listen on its container interface (`gateway.bind: "lan"`):

 ```json5
 {
@@ -325,8 +325,8 @@ The Gateway binds to `127.0.0.1` (`gateway.bind: "loopback"`). This means it onl

 **Test command (from Nexus API container):**
 ```bash
-curl -s http://host.docker.internal:18789/health
-# Expected: 200 if gateway bind is lan/container IP is reachable
+curl -s http://openclaw-gateway-bao:18789/
+# Expected: HTTP 200 from inside nexus-api-1
 ```

 ### Required .env Vars for Nexus