From 8ad8c956ebebf2d9c327edb39f9367964f5d329b Mon Sep 17 00:00:00 2001
From: DevOps <devops@noveria.net>
Date: Sun, 12 Jul 2026 15:08:49 +0200
Subject: [PATCH] =?UTF-8?q?fix(deploy):=20sanitized=20agent=20config=20?=
 =?UTF-8?q?=E2=80=94=20use=20Docker=20to=20read=20openclaw.json?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Gitea runner doesn't have direct filesystem access to
/home/projekte_bao/openclaw/, so the previous python3 inline extraction
would fail silently and no agents-sanitized.json would be generated.

Now the deploy script uses a Docker container with bind mounts to read
openclaw.json (readonly) and write agents-sanitized.json to the host.

This completes the P4 migration: Nexus no longer needs read access to
openclaw.json for any code path or deployment step.
---
 .gitea/scripts/deploy-nexus.sh | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/.gitea/scripts/deploy-nexus.sh b/.gitea/scripts/deploy-nexus.sh
index 0c06348..f62a086 100755
--- a/.gitea/scripts/deploy-nexus.sh
+++ b/.gitea/scripts/deploy-nexus.sh
@@ -105,6 +105,40 @@ git archive --format=tar HEAD | docker run --rm -i \
     chown -R "$dest_owner" /dest
   '
 
+# ── Sanitized agents config for Nexus (no secrets) ──
+echo "Generating sanitized agents config for Nexus (no secrets from openclaw.json)"
+AGENTS_SANITIZED_PATH="/home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json"
+OPENCLAW_CONFIG="/home/projekte_bao/openclaw/data/openclaw/openclaw.json"
+OPENCLAW_CONFIG_DIR="/home/projekte_bao/openclaw/data/openclaw"
+
+# Use Docker to read openclaw.json (runner doesn't have direct host fs access)
+if docker run --rm \
+  -v "$OPENCLAW_CONFIG:/input/openclaw.json:ro" \
+  -v "$OPENCLAW_CONFIG_DIR:/output" \
+  python:3.12-alpine \
+  python3 -c "
+import json, sys, os
+config_path = '/input/openclaw.json'
+output_path = '/output/agents-sanitized.json'
+if not os.path.isfile(config_path):
+    print(f'WARNING: openclaw.json not found at {config_path} — agents-sanitized.json NOT generated', file=sys.stderr)
+    sys.exit(1)
+with open(config_path) as f:
+    data = json.load(f)
+agents = data.get('agents')
+if agents is None:
+    print('ERROR: \"agents\" key not found in openclaw.json', file=sys.stderr)
+    sys.exit(1)
+with open(output_path, 'w') as f:
+    json.dump({'agents': agents}, f, indent=2)
+    f.write('\n')
+print(f'Sanitized agents config written ({len(agents.get(\"list\", []))} agents)')
+" 2>&1; then
+  echo "Sanitized agents config written to $AGENTS_SANITIZED_PATH"
+else
+  echo "WARNING: Failed to generate agents-sanitized.json — Nexus will use fallback agent IDs" >&2
+fi
+
 echo "Building and starting Docker compose stack"
 docker run --rm \
   -v "$DEPLOY_PATH:/workspace/nexus" \