feat: sanitized agent config — Nexus no longer reads secrets from openclaw.json

- Mount agents-sanitized.json (agents key only, no secrets) instead of full openclaw.json - Update AgentService default path from /home/node/.openclaw/openclaw.json to /etc/nexus/agents-sanitized.json - Add AgentConfigPath env var to compose for explicit path configuration - Generate sanitized file in deploy-nexus.sh before each deploy using Python extraction - Add agents-sanitized.json to .gitignore Eliminates the fragile ACL on openclaw.json (uid 1654) that causes 500 errors on the Board endpoint when lost.
2026-07-12 13:08:43 +02:00
parent 7f1d5b706d
commit f4bee442db
4 changed files with 28 additions and 2 deletions
@@ -39,3 +39,6 @@ frontend/.corepack-home/

 # Claude local config (per-developer, not repo-shared)
 .claude/
+
+# Sanitized agent config (generated on host, not committed)
+backend/agents-sanitized.json