From f4bee442dbfa27a531e0c9d717407a997964fab8 Mon Sep 17 00:00:00 2001
From: DevOps <devops@noveria.net>
Date: Sun, 12 Jul 2026 13:08:43 +0200
Subject: [PATCH] =?UTF-8?q?feat:=20sanitized=20agent=20config=20=E2=80=94?=
 =?UTF-8?q?=20Nexus=20no=20longer=20reads=20secrets=20from=20openclaw.json?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Mount agents-sanitized.json (agents key only, no secrets) instead of full openclaw.json
- Update AgentService default path from /home/node/.openclaw/openclaw.json to /etc/nexus/agents-sanitized.json
- Add AgentConfigPath env var to compose for explicit path configuration
- Generate sanitized file in deploy-nexus.sh before each deploy using Python extraction
- Add agents-sanitized.json to .gitignore

Eliminates the fragile ACL on openclaw.json (uid 1654) that causes 500 errors
on the Board endpoint when lost.
---
 .gitea/scripts/deploy-nexus.sh   | 22 ++++++++++++++++++++++
 .gitignore                       |  3 +++
 backend/Services/AgentService.cs |  2 +-
 compose.yaml                     |  3 ++-
 4 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/.gitea/scripts/deploy-nexus.sh b/.gitea/scripts/deploy-nexus.sh
index 9bfb1d3..fc12c02 100755
--- a/.gitea/scripts/deploy-nexus.sh
+++ b/.gitea/scripts/deploy-nexus.sh
@@ -106,6 +106,28 @@ git archive --format=tar HEAD | docker run --rm -i \
     chown -R "$dest_owner" /dest
   '
 
+# ── Sanitized agents config for Nexus (no secrets) ──
+echo "Generating sanitized agents config for Nexus"
+AGENTS_SANITIZED_PATH="/home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json"
+OPENCLAW_CONFIG="/home/projekte_bao/openclaw/data/openclaw/openclaw.json"
+if [ -f "$OPENCLAW_CONFIG" ]; then
+  python3 -c "
+import json, sys
+with open('$OPENCLAW_CONFIG') as f:
+    data = json.load(f)
+agents = data.get('agents')
+if agents is None:
+    print('ERROR: \"agents\" key not found in openclaw.json', file=sys.stderr)
+    sys.exit(1)
+with open('$AGENTS_SANITIZED_PATH', 'w') as f:
+    json.dump({'agents': agents}, f, indent=2)
+"
+  chmod 644 "$AGENTS_SANITIZED_PATH" 2>/dev/null || true
+  echo "Sanitized agents config written to $AGENTS_SANITIZED_PATH"
+else
+  echo "WARNING: openclaw.json not found at $OPENCLAW_CONFIG — agents-sanitized.json NOT generated" >&2
+fi
+
 echo "Building and starting Docker compose stack"
 docker run --rm \
   -v "$DEPLOY_PATH:/workspace/nexus" \
diff --git a/.gitignore b/.gitignore
index 8aa1781..f3cd44c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,3 +39,6 @@ frontend/.corepack-home/
 
 # Claude local config (per-developer, not repo-shared)
 .claude/
+
+# Sanitized agent config (generated on host, not committed)
+backend/agents-sanitized.json
diff --git a/backend/Services/AgentService.cs b/backend/Services/AgentService.cs
index 538a3c2..1856958 100644
--- a/backend/Services/AgentService.cs
+++ b/backend/Services/AgentService.cs
@@ -235,7 +235,7 @@ public sealed class AgentService(IConfiguration configuration, IAgentRuntime run
     private async Task<IReadOnlyList<AgentConfig>> LoadAgentConfigsAsync(CancellationToken cancellationToken)
     {
         var path = configuration.GetValue<string>("AgentConfigPath")
-            ?? "/home/node/.openclaw/openclaw.json";
+            ?? "/etc/nexus/agents-sanitized.json";
 
         if (!File.Exists(path))
             return BuildFallbackConfigs();
diff --git a/compose.yaml b/compose.yaml
index 5adfc29..1288f9d 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -64,6 +64,7 @@ services:
       Integrations__OpenClaw__Password: ${OPENCLAW_GATEWAY_PASSWORD:-}
       Admin__ResetToken: ${Admin__ResetToken:-}
       NexusApiKey: ${NEXUS_API_KEY:-}
+      AgentConfigPath: /etc/nexus/agents-sanitized.json
     extra_hosts:
       - host.docker.internal:host-gateway
     depends_on:
@@ -77,7 +78,7 @@ services:
       retries: 3
       start_period: 15s
     volumes:
-      - /home/projekte_bao/openclaw/data/openclaw/openclaw.json:/home/node/.openclaw/openclaw.json:ro
+      - /home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json:/etc/nexus/agents-sanitized.json:ro
       - /home/projekte_bao/openclaw/data/openclaw/workspace-iris:/mnt/workspace-iris
       - /home/projekte_bao/openclaw/data/openclaw/workspace-programmer:/mnt/workspace-programmer
       - /home/projekte_bao/openclaw/data/openclaw/workspace-reviewer:/mnt/workspace-reviewer