fix(deploy): sanitized agent config — use Docker to read openclaw.json

The Gitea runner doesn't have direct filesystem access to
/home/projekte_bao/openclaw/, so the previous python3 inline extraction
would fail silently and no agents-sanitized.json would be generated.

Now the deploy script uses a Docker container with bind mounts to read
openclaw.json (readonly) and write agents-sanitized.json to the host.

This completes the P4 migration: Nexus no longer needs read access to
openclaw.json for any code path or deployment step.

.gitea/scripts/deploy-nexus.sh

@@ -1,20 +1,15 @@
 #!/bin/sh
 set -eu
 
-DEPLOY_PATH="${DEPLOY_PATH:-/home/projekte_bao/openclaw/data/openclaw/workspace/nexus}"
+DEPLOY_PATH="${DEPLOY_PATH:-/home/projekte_bao/nexus}"
 ENV_TMPFILE_TEMPLATE="${ENV_TMPFILE:-/tmp/nexus-deploy-env}"
-COMPOSE_SCRIPT_TEMPLATE="${COMPOSE_SCRIPT:-/tmp/nexus-compose-deploy.sh}"
 ENV_TMPFILE=""
-COMPOSE_SCRIPT=""
 BASE_URL="${BASE_URL:-https://nexus.noveria.net}"
 
 cleanup() {
   if [ -n "$ENV_TMPFILE" ] && [ -f "$ENV_TMPFILE" ]; then
     shred -u "$ENV_TMPFILE" 2>/dev/null || rm -f "$ENV_TMPFILE"
   fi
-  if [ -n "$COMPOSE_SCRIPT" ]; then
-    rm -f "$COMPOSE_SCRIPT"
-  fi
 }
 trap cleanup EXIT INT TERM
 
@@ -39,8 +34,7 @@ secure_tmpfile() {
 }
 
 ENV_TMPFILE="$(secure_tmpfile "$ENV_TMPFILE_TEMPLATE")"
-COMPOSE_SCRIPT="$(secure_tmpfile "$COMPOSE_SCRIPT_TEMPLATE")"
+chmod 600 "$ENV_TMPFILE"
-chmod 600 "$ENV_TMPFILE" "$COMPOSE_SCRIPT"
 
 if [ ! -f VERSION ]; then
   echo "VERSION file not found" >&2
@@ -111,25 +105,55 @@ git archive --format=tar HEAD | docker run --rm -i \
     chown -R "$dest_owner" /dest
   '
 
-echo "Building and starting Docker compose stack"
+# ── Sanitized agents config for Nexus (no secrets) ──
-cat > "$COMPOSE_SCRIPT" <<'EOF_DEPLOY'
+echo "Generating sanitized agents config for Nexus (no secrets from openclaw.json)"
-#!/bin/sh
+AGENTS_SANITIZED_PATH="/home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json"
-set -eu
+OPENCLAW_CONFIG="/home/projekte_bao/openclaw/data/openclaw/openclaw.json"
-cat > /tmp/nexus-deploy-env
+OPENCLAW_CONFIG_DIR="/home/projekte_bao/openclaw/data/openclaw"
-docker compose --env-file /tmp/nexus-deploy-env build
-docker compose --env-file /tmp/nexus-deploy-env up -d --force-recreate --remove-orphans --wait
-docker compose --env-file /tmp/nexus-deploy-env ps
-rm -f /tmp/nexus-deploy-env
-EOF_DEPLOY
 
+# Use Docker to read openclaw.json (runner doesn't have direct host fs access)
+if docker run --rm \
+  -v "$OPENCLAW_CONFIG:/input/openclaw.json:ro" \
+  -v "$OPENCLAW_CONFIG_DIR:/output" \
+  python:3.12-alpine \
+  python3 -c "
+import json, sys, os
+config_path = '/input/openclaw.json'
+output_path = '/output/agents-sanitized.json'
+if not os.path.isfile(config_path):
+    print(f'WARNING: openclaw.json not found at {config_path} — agents-sanitized.json NOT generated', file=sys.stderr)
+    sys.exit(1)
+with open(config_path) as f:
+    data = json.load(f)
+agents = data.get('agents')
+if agents is None:
+    print('ERROR: \"agents\" key not found in openclaw.json', file=sys.stderr)
+    sys.exit(1)
+with open(output_path, 'w') as f:
+    json.dump({'agents': agents}, f, indent=2)
+    f.write('\n')
+print(f'Sanitized agents config written ({len(agents.get(\"list\", []))} agents)')
+" 2>&1; then
+  echo "Sanitized agents config written to $AGENTS_SANITIZED_PATH"
+else
+  echo "WARNING: Failed to generate agents-sanitized.json — Nexus will use fallback agent IDs" >&2
+fi
+
+echo "Building and starting Docker compose stack"
 docker run --rm \
   -v "$DEPLOY_PATH:/workspace/nexus" \
   -v /var/run/docker.sock:/var/run/docker.sock \
-  -v "$COMPOSE_SCRIPT:/deploy.sh:ro" \
   -w /workspace/nexus \
   -i \
   docker:cli \
-  sh /deploy.sh < "$ENV_TMPFILE"
+  sh -c 'set -eu
+    umask 077
+    cat > /tmp/nexus-deploy-env
+    trap '\''rm -f /tmp/nexus-deploy-env'\'' EXIT INT TERM
+    docker compose --env-file /tmp/nexus-deploy-env build
+    docker compose --env-file /tmp/nexus-deploy-env up -d --force-recreate --remove-orphans --wait
+    docker compose --env-file /tmp/nexus-deploy-env ps
+  ' < "$ENV_TMPFILE"
 
 echo "Verifying image provenance"
 for container in nexus-api-1 nexus-web-1; do

.gitea/workflows/backup.yaml

@@ -47,7 +47,7 @@ jobs:
     env:
       ENV_TMPFILE: /tmp/nexus-backup-env
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
-      DEPLOY_PATH: /home/projekte_bao/openclaw/data/openclaw/workspace/nexus
+      DEPLOY_PATH: /home/projekte_bao/nexus
       BACKUP_CONTAINER_NAME: nexus-postgres-1
 
     steps:

.gitea/workflows/ci.yaml

@@ -112,7 +112,7 @@ jobs:
       gitea.event_name == 'push' &&
       gitea.ref == 'refs/heads/main'
     env:
-      DEPLOY_PATH: /home/projekte_bao/openclaw/data/openclaw/workspace/nexus
+      DEPLOY_PATH: /home/projekte_bao/nexus
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
       ENV_JWT_KEY: ${{ secrets.ENV_JWT_KEY }}
       ENV_OPENCLAW_TOKEN: ${{ secrets.ENV_OPENCLAW_TOKEN }}

.gitea/workflows/deploy.yaml

@@ -13,7 +13,7 @@ jobs:
     name: Deploy Nexus
     runs-on: linux
     env:
-      DEPLOY_PATH: /home/projekte_bao/openclaw/data/openclaw/workspace/nexus
+      DEPLOY_PATH: /home/projekte_bao/nexus
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
       ENV_JWT_KEY: ${{ secrets.ENV_JWT_KEY }}
       ENV_OPENCLAW_TOKEN: ${{ secrets.ENV_OPENCLAW_TOKEN }}

.gitea/workflows/rollback.yaml

@@ -42,7 +42,7 @@ jobs:
     name: Rollback Nexus
     runs-on: linux
     env:
-      DEPLOY_PATH: /home/projekte_bao/openclaw/data/openclaw/workspace/nexus
+      DEPLOY_PATH: /home/projekte_bao/nexus
       ENV_TMPFILE: /tmp/nexus-rollback-env
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
       ENV_JWT_KEY: ${{ secrets.ENV_JWT_KEY }}
@@ -271,7 +271,7 @@ jobs:
           echo "│  Letzter bekannter funktionierender Stand:                  │"
           echo "│  → 'git log --oneline -5' zeigt letzte Commits             │"
           echo "│  → Manuellen Rollback erwägen:                              │"
-          echo "│      cd /home/projekte_bao/openclaw/data/openclaw/workspace/nexus        │"
+          echo "│      cd /home/projekte_bao/nexus                                      │"
           echo "│      docker compose up -d (vorheriger Stand)                │"
           echo "│                                                             │"
           echo "└─────────────────────────────────────────────────────────────┘"