- Mount agents-sanitized.json (agents key only, no secrets) instead of full openclaw.json
- Update AgentService default path from /home/node/.openclaw/openclaw.json to /etc/nexus/agents-sanitized.json
- Add AgentConfigPath env var to compose for explicit path configuration
- Generate sanitized file in deploy-nexus.sh before each deploy using Python extraction
- Add agents-sanitized.json to .gitignore
Eliminates the fragile ACL on openclaw.json (uid 1654) that causes 500 errors
on the Board endpoint when lost.
Remove --force-recreate from docker compose up so Postgres persists
across deploys unless its image or config actually changed.
Add Auth Smoke checks before declaring deploy success:
- SeedAudit owner_created key must exist in DB
- Owner login flow must return 401 (invalid_credentials) — proving
auth pipeline is functional and DB is reachable
Deploy fails (exit 1) if any smoke check fails (fail-closed).
46 lines changed in deploy-nexus.sh.
devops