| #!/usr/bin/env bash |
| set -euo pipefail |
|
|
| OPENCLAW_USER="${OPENCLAW_USER:-root}" |
| OPENCLAW_GROUP="${OPENCLAW_GROUP:-root}" |
| OPENCLAW_HOME="${OPENCLAW_HOME:-/root}" |
| OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR:-/root/.openclaw}" |
| OPENCLAW_CONFIG_PATH="${OPENCLAW_CONFIG_PATH:-${OPENCLAW_STATE_DIR}/openclaw.json}" |
| OPENCLAW_WORKSPACE_DIR="${OPENCLAW_WORKSPACE_DIR:-${OPENCLAW_STATE_DIR}/workspace}" |
| OPENCLAW_GATEWAY_BIND="${OPENCLAW_GATEWAY_BIND:-lan}" |
| OPENCLAW_GATEWAY_PORT="${OPENCLAW_GATEWAY_PORT:-7860}" |
| OPENCLAW_INIT_GATEWAY_MODE="${OPENCLAW_INIT_GATEWAY_MODE:-local}" |
| OPENCLAW_GATEWAY_AUTH_MODE="${OPENCLAW_GATEWAY_AUTH_MODE:-token}" |
| OPENCLAW_LLM_PROVIDER="${OPENCLAW_LLM_PROVIDER:-thirdparty}" |
| OPENCLAW_LLM_MODEL="${OPENCLAW_LLM_MODEL:-}" |
| OPENCLAW_LLM_API="${OPENCLAW_LLM_API:-openai-completions}" |
| OPENCLAW_LLM_BASE_URL_ENV="${OPENCLAW_LLM_BASE_URL_ENV:-OPENCLAW_LLM_BASE_URL}" |
| OPENCLAW_LLM_API_KEY_ENV="${OPENCLAW_LLM_API_KEY_ENV:-OPENCLAW_LLM_API_KEY}" |
| OPENCLAW_BACKUP_ENABLED="${OPENCLAW_BACKUP_ENABLED:-true}" |
| OPENCLAW_BACKUP_CRON="${OPENCLAW_BACKUP_CRON:-*/30 * * * *}" |
| OPENCLAW_BACKUP_SOURCE_DIR="${OPENCLAW_BACKUP_SOURCE_DIR:-${OPENCLAW_STATE_DIR}}" |
| OPENCLAW_BACKUP_ROOT_CONFIG_DIR="${OPENCLAW_BACKUP_ROOT_CONFIG_DIR:-/root/.config}" |
| OPENCLAW_BACKUP_ROOT_CODEX_DIR="${OPENCLAW_BACKUP_ROOT_CODEX_DIR:-/root/.codex}" |
| OPENCLAW_BACKUP_ROOT_CLAUDE_DIR="${OPENCLAW_BACKUP_ROOT_CLAUDE_DIR:-/root/.claude}" |
| OPENCLAW_BACKUP_ROOT_AGENTS_DIR="${OPENCLAW_BACKUP_ROOT_AGENTS_DIR:-/root/.agents}" |
| OPENCLAW_BACKUP_ROOT_SSH_DIR="${OPENCLAW_BACKUP_ROOT_SSH_DIR:-/root/.ssh}" |
| OPENCLAW_BACKUP_ROOT_NPM_DIR="${OPENCLAW_BACKUP_ROOT_NPM_DIR:-/root/.npm}" |
| OPENCLAW_BACKUP_ROOT_LARK_CLI_DIR="${OPENCLAW_BACKUP_ROOT_LARK_CLI_DIR:-/root/.lark-cli}" |
| OPENCLAW_BACKUP_ENV_FILE_PATH="${OPENCLAW_BACKUP_ENV_FILE_PATH:-/etc/openclaw-backup.env}" |
| OPENCLAW_STDOUT_LOG_PATH="${OPENCLAW_STDOUT_LOG_PATH:-/var/log/openclaw/gateway.stdout.log}" |
| OPENCLAW_STDERR_LOG_PATH="${OPENCLAW_STDERR_LOG_PATH:-/var/log/openclaw/gateway.stderr.log}" |
| OPENCLAW_SSHX_AUTO_START="${OPENCLAW_SSHX_AUTO_START:-false}" |
| OPENCLAW_GATEWAY_CONTROLUI_ALLOW_INSECURE_AUTH="${OPENCLAW_GATEWAY_CONTROLUI_ALLOW_INSECURE_AUTH:-false}" |
| OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH="${OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH:-false}" |
| OPENCLAW_CHILD_PID="" |
| OPENCLAW_SSHX_PID="" |
| OPENCLAW_SHUTDOWN_BACKUP_DONE=0 |
|
|
| export HOME="$OPENCLAW_HOME" |
| export OPENCLAW_HOME |
| export OPENCLAW_STATE_DIR |
| export OPENCLAW_CONFIG_PATH |
| export OPENCLAW_BACKUP_ENV_FILE_PATH |
| OPENCLAW_STEP_INDEX=0 |
| OPENCLAW_ENTRYPOINT_TAG="openclaw-entrypoint" |
|
|
| timestamp_utc() { |
| date -u +"%Y-%m-%dT%H:%M:%SZ" |
| } |
|
|
| log_info() { |
| printf '[%s] %s: %s\n' "$(timestamp_utc)" "$OPENCLAW_ENTRYPOINT_TAG" "$*" |
| } |
|
|
| log_warn() { |
| printf '[%s] %s: %s\n' "$(timestamp_utc)" "$OPENCLAW_ENTRYPOINT_TAG" "$*" >&2 |
| } |
|
|
| run_step() { |
| local description="$1" |
| shift |
| OPENCLAW_STEP_INDEX=$((OPENCLAW_STEP_INDEX + 1)) |
| log_info "step ${OPENCLAW_STEP_INDEX} start: ${description}" |
| "$@" |
| log_info "step ${OPENCLAW_STEP_INDEX} done: ${description}" |
| } |
|
|
| is_true() { |
| local value |
| value="$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')" |
| [[ "$value" == "1" || "$value" == "true" || "$value" == "yes" || "$value" == "on" ]] |
| } |
|
|
| generate_gateway_token() { |
| if command -v openssl >/dev/null 2>&1; then |
| openssl rand -hex 32 |
| else |
| python3 - <<'PY' |
| import secrets |
| print(secrets.token_hex(32)) |
| PY |
| fi |
| } |
|
|
| mkdir_state_dirs() { |
| mkdir -p "$OPENCLAW_STATE_DIR" "$OPENCLAW_WORKSPACE_DIR" |
| mkdir -p "$OPENCLAW_STATE_DIR/identity" |
| mkdir -p "$OPENCLAW_STATE_DIR/agents/main/agent" |
| mkdir -p "$OPENCLAW_STATE_DIR/agents/main/sessions" |
| mkdir -p "$OPENCLAW_STATE_DIR/logs" |
| mkdir -p "$(dirname "$OPENCLAW_STDOUT_LOG_PATH")" "$(dirname "$OPENCLAW_STDERR_LOG_PATH")" |
| touch "$OPENCLAW_STDOUT_LOG_PATH" "$OPENCLAW_STDERR_LOG_PATH" |
| } |
|
|
| fix_permissions() { |
| local path |
|
|
| if [[ "$(id -u)" -ne 0 ]]; then |
| return 0 |
| fi |
|
|
| if [[ -e "$OPENCLAW_HOME" ]]; then |
| chown "$OPENCLAW_USER:$OPENCLAW_GROUP" "$OPENCLAW_HOME" |
| fi |
|
|
| for path in \ |
| "$OPENCLAW_STATE_DIR" \ |
| "$OPENCLAW_WORKSPACE_DIR" \ |
| "$OPENCLAW_STDOUT_LOG_PATH" \ |
| "$OPENCLAW_STDERR_LOG_PATH" \ |
| "$(dirname "$OPENCLAW_STDOUT_LOG_PATH")" \ |
| "$(dirname "$OPENCLAW_STDERR_LOG_PATH")"; do |
| if [[ -e "$path" ]]; then |
| chown -R "$OPENCLAW_USER:$OPENCLAW_GROUP" "$path" |
| fi |
| done |
| } |
|
|
| write_or_update_config() { |
| local existing_token |
| existing_token="" |
|
|
| if [[ -f "$OPENCLAW_CONFIG_PATH" ]]; then |
| existing_token="$(python3 - <<'PY' |
| import json |
| import os |
| |
| config_path = os.environ["OPENCLAW_CONFIG_PATH"] |
| try: |
| with open(config_path, "r", encoding="utf-8") as fh: |
| cfg = json.load(fh) |
| token = cfg.get("gateway", {}).get("auth", {}).get("token", "") |
| if isinstance(token, str): |
| print(token.strip()) |
| except Exception: |
| pass |
| PY |
| )" |
| fi |
|
|
| if [[ -z "${OPENCLAW_GATEWAY_TOKEN:-}" ]]; then |
| if [[ -n "$existing_token" ]]; then |
| OPENCLAW_GATEWAY_TOKEN="$existing_token" |
| else |
| OPENCLAW_GATEWAY_TOKEN="$(generate_gateway_token)" |
| fi |
| fi |
| export OPENCLAW_GATEWAY_TOKEN |
|
|
| OPENCLAW_GATEWAY_PORT="$OPENCLAW_GATEWAY_PORT" \ |
| OPENCLAW_GATEWAY_BIND="$OPENCLAW_GATEWAY_BIND" \ |
| OPENCLAW_INIT_GATEWAY_MODE="$OPENCLAW_INIT_GATEWAY_MODE" \ |
| OPENCLAW_CONFIG_PATH="$OPENCLAW_CONFIG_PATH" \ |
| OPENCLAW_GATEWAY_TOKEN="$OPENCLAW_GATEWAY_TOKEN" \ |
| OPENCLAW_GATEWAY_PASSWORD="${OPENCLAW_GATEWAY_PASSWORD:-}" \ |
| OPENCLAW_GATEWAY_AUTH_MODE="$OPENCLAW_GATEWAY_AUTH_MODE" \ |
| OPENCLAW_LLM_PROVIDER="$OPENCLAW_LLM_PROVIDER" \ |
| OPENCLAW_LLM_MODEL="$OPENCLAW_LLM_MODEL" \ |
| OPENCLAW_LLM_API="$OPENCLAW_LLM_API" \ |
| OPENCLAW_LLM_BASE_URL_ENV="$OPENCLAW_LLM_BASE_URL_ENV" \ |
| OPENCLAW_LLM_API_KEY_ENV="$OPENCLAW_LLM_API_KEY_ENV" \ |
| OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_ALLOW_HOST_HEADER_ORIGIN_FALLBACK="${OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_ALLOW_HOST_HEADER_ORIGIN_FALLBACK:-true}" \ |
| OPENCLAW_GATEWAY_CONTROLUI_ALLOW_INSECURE_AUTH="$OPENCLAW_GATEWAY_CONTROLUI_ALLOW_INSECURE_AUTH" \ |
| OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH="$OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH" \ |
| OPENCLAW_INIT_CONTROL_UI_ALLOWED_ORIGINS="${OPENCLAW_INIT_CONTROL_UI_ALLOWED_ORIGINS:-}" \ |
| python3 - <<'PY' |
| import json |
| import os |
| import sys |
| from pathlib import Path |
|
|
| config_path = Path(os.environ["OPENCLAW_CONFIG_PATH"]) |
| config = {} |
| if config_path.exists(): |
| try: |
| config = json.loads(config_path.read_text(encoding="utf-8")) |
| except Exception: |
| config = {} |
|
|
| provider = os.environ.get("OPENCLAW_LLM_PROVIDER", "thirdparty").strip() or "thirdparty" |
| model = (os.environ.get("OPENCLAW_LLM_MODEL") or "").strip() |
| api = os.environ.get("OPENCLAW_LLM_API", "openai-completions").strip() or "openai-completions" |
| base_env_name = os.environ.get("OPENCLAW_LLM_BASE_URL_ENV", "OPENCLAW_LLM_BASE_URL").strip() or "OPENCLAW_LLM_BASE_URL" |
| key_env_name = os.environ.get("OPENCLAW_LLM_API_KEY_ENV", "OPENCLAW_LLM_API_KEY").strip() or "OPENCLAW_LLM_API_KEY" |
| base_url_value = (os.environ.get(base_env_name) or "").strip() |
| api_key_value = (os.environ.get(key_env_name) or "").strip() |
|
|
| missing_llm_env = [] |
| if not model: |
| missing_llm_env.append("OPENCLAW_LLM_MODEL") |
| if not base_url_value: |
| missing_llm_env.append(base_env_name) |
| if not api_key_value: |
| missing_llm_env.append(key_env_name) |
| custom_llm_ready = not missing_llm_env |
| model_ref = f"{provider}/{model}" if custom_llm_ready else "" |
|
|
| if missing_llm_env: |
| print( |
| "openclaw: skip custom LLM model configuration because missing: " |
| + ", ".join(missing_llm_env), |
| file=sys.stderr, |
| ) |
| sshx_auto_start = (os.environ.get("OPENCLAW_SSHX_AUTO_START") or "false").strip().lower() in { |
| "1", |
| "true", |
| "yes", |
| "on", |
| } |
| if not sshx_auto_start: |
| print( |
| "openclaw: if you want to configure LLM via sshx, consider setting OPENCLAW_SSHX_AUTO_START=true", |
| file=sys.stderr, |
| ) |
|
|
| fallback_allowed_origins = [f"http://127.0.0.1:{os.environ.get('OPENCLAW_GATEWAY_PORT', '7860')}"] |
| allowed_origins = fallback_allowed_origins |
| raw_allowed_origins = (os.environ.get("OPENCLAW_INIT_CONTROL_UI_ALLOWED_ORIGINS") or "").strip() |
| if raw_allowed_origins: |
| try: |
| parsed = json.loads(raw_allowed_origins) |
| if isinstance(parsed, list): |
| normalized = [] |
| for value in parsed: |
| if isinstance(value, str): |
| item = value.strip() |
| if item: |
| normalized.append(item) |
| if normalized: |
| allowed_origins = normalized |
| except Exception: |
| pass |
|
|
| fallback_origin = (os.environ.get("OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_ALLOW_HOST_HEADER_ORIGIN_FALLBACK") or "true").lower() in { |
| "1", |
| "true", |
| "yes", |
| "on", |
| } |
| allow_insecure_auth = (os.environ.get("OPENCLAW_GATEWAY_CONTROLUI_ALLOW_INSECURE_AUTH") or "false").lower() in { |
| "1", |
| "true", |
| "yes", |
| "on", |
| } |
| disable_device_auth = (os.environ.get("OPENCLAW_GATEWAY_CONTROLUI_DANGEROUSLY_DISABLE_DEVICE_AUTH") or "false").lower() in { |
| "1", |
| "true", |
| "yes", |
| "on", |
| } |
|
|
| gateway = config.get("gateway") |
| if not isinstance(gateway, dict): |
| gateway = {} |
| gateway["mode"] = os.environ.get("OPENCLAW_INIT_GATEWAY_MODE", "local") |
| gateway["bind"] = os.environ.get("OPENCLAW_GATEWAY_BIND", "lan") |
| auth = gateway.get("auth") |
| if not isinstance(auth, dict): |
| auth = {} |
|
|
| token_value = (os.environ.get("OPENCLAW_GATEWAY_TOKEN") or "").strip() |
| password_value = (os.environ.get("OPENCLAW_GATEWAY_PASSWORD") or "").strip() |
| if token_value: |
| auth["token"] = token_value |
| if password_value: |
| auth["password"] = password_value |
|
|
| valid_auth_modes = {"none", "token", "password", "trusted-proxy"} |
| mode_env = (os.environ.get("OPENCLAW_GATEWAY_AUTH_MODE") or "").strip().lower() |
| existing_mode = auth.get("mode") |
| if mode_env in valid_auth_modes: |
| auth["mode"] = mode_env |
| elif password_value and not token_value: |
| auth["mode"] = "password" |
| elif token_value and not password_value: |
| auth["mode"] = "token" |
| elif token_value and password_value: |
| auth["mode"] = "token" |
| elif isinstance(existing_mode, str) and existing_mode.strip().lower() in valid_auth_modes: |
| auth["mode"] = existing_mode.strip().lower() |
| else: |
| auth["mode"] = "token" |
|
|
| gateway["auth"] = auth |
| gateway.setdefault("controlUi", {}) |
| gateway["controlUi"]["allowedOrigins"] = allowed_origins |
| gateway["controlUi"]["dangerouslyAllowHostHeaderOriginFallback"] = fallback_origin |
| gateway["controlUi"]["allowInsecureAuth"] = allow_insecure_auth |
| gateway["controlUi"]["dangerouslyDisableDeviceAuth"] = disable_device_auth |
| config["gateway"] = gateway |
|
|
| agents = config.get("agents") |
| if not isinstance(agents, dict): |
| agents = {} |
| defaults = agents.get("defaults") |
| if not isinstance(defaults, dict): |
| defaults = {} |
| if custom_llm_ready: |
| defaults["model"] = {"primary": model_ref} |
| allow_models = defaults.get("models") |
| if not isinstance(allow_models, dict): |
| allow_models = {} |
| allow_models.setdefault(model_ref, {"alias": "Default"}) |
| defaults["models"] = allow_models |
| agents["defaults"] = defaults |
| config["agents"] = agents |
|
|
| if custom_llm_ready: |
| models_cfg = config.get("models") |
| if not isinstance(models_cfg, dict): |
| models_cfg = {} |
| models_cfg["mode"] = "merge" |
| providers = models_cfg.get("providers") |
| if not isinstance(providers, dict): |
| providers = {} |
| provider_cfg = providers.get(provider) |
| if not isinstance(provider_cfg, dict): |
| provider_cfg = {} |
| provider_cfg["baseUrl"] = f"${{{base_env_name}}}" |
| provider_cfg["apiKey"] = f"${{{key_env_name}}}" |
| provider_cfg["api"] = api |
| provider_cfg["models"] = [{"id": model, "name": model}] |
| providers[provider] = provider_cfg |
| models_cfg["providers"] = providers |
| config["models"] = models_cfg |
|
|
| config_path.parent.mkdir(parents=True, exist_ok=True) |
| config_path.write_text(json.dumps(config, indent=2, ensure_ascii=False) + "\n", encoding="utf-8") |
| os.chmod(config_path, 0o600) |
| PY |
| } |
|
|
| write_backup_env_file() { |
| local backup_env_file |
| local keys=( |
| HF_TOKEN |
| HUGGINGFACE_HUB_TOKEN |
| OPENCLAW_BACKUP_DATASET_REPO |
| OPENCLAW_BACKUP_REPO_TYPE |
| OPENCLAW_BACKUP_PATH_PREFIX |
| OPENCLAW_BACKUP_LATEST_NAME |
| OPENCLAW_BACKUP_KEEP_COUNT |
| OPENCLAW_BACKUP_PRIVATE |
| OPENCLAW_BACKUP_WORK_DIR |
| OPENCLAW_BACKUP_SOURCE_DIR |
| OPENCLAW_BACKUP_ROOT_CONFIG_DIR |
| OPENCLAW_BACKUP_ROOT_CODEX_DIR |
| OPENCLAW_BACKUP_ROOT_CLAUDE_DIR |
| OPENCLAW_BACKUP_ROOT_AGENTS_DIR |
| OPENCLAW_BACKUP_ROOT_SSH_DIR |
| OPENCLAW_BACKUP_ROOT_NPM_DIR |
| OPENCLAW_BACKUP_ROOT_LARK_CLI_DIR |
| OPENCLAW_STATE_DIR |
| ) |
|
|
| backup_env_file="${OPENCLAW_BACKUP_ENV_FILE_PATH:-/etc/openclaw-backup.env}" |
| if [[ "$(id -u)" -ne 0 && "$backup_env_file" == "/etc/openclaw-backup.env" ]]; then |
| backup_env_file="${OPENCLAW_STATE_DIR}/openclaw-backup.env" |
| fi |
|
|
| mkdir -p "$(dirname "$backup_env_file")" |
| if ! : > "$backup_env_file"; then |
| echo "openclaw: cannot write backup env file at $backup_env_file" >&2 |
| return 1 |
| fi |
|
|
| for key in "${keys[@]}"; do |
| printf '%s=%q\n' "$key" "${!key:-}" >> "$backup_env_file" |
| done |
| OPENCLAW_BACKUP_ENV_FILE_PATH="$backup_env_file" |
| export OPENCLAW_BACKUP_ENV_FILE_PATH |
|
|
| if [[ "$(id -u)" -eq 0 ]]; then |
| chown "$OPENCLAW_USER:$OPENCLAW_GROUP" "$backup_env_file" |
| chmod 640 "$backup_env_file" |
| else |
| chmod 600 "$backup_env_file" |
| fi |
| } |
|
|
| setup_backup_cron() { |
| if [[ "$(id -u)" -ne 0 ]]; then |
| echo "openclaw: backup cron requires root; skip cron setup" >&2 |
| return 0 |
| fi |
|
|
| if ! is_true "$OPENCLAW_BACKUP_ENABLED"; then |
| return 0 |
| fi |
|
|
| if [[ -z "${OPENCLAW_BACKUP_DATASET_REPO:-}" ]]; then |
| echo "openclaw: backup enabled but OPENCLAW_BACKUP_DATASET_REPO is empty; skip cron" >&2 |
| return 0 |
| fi |
|
|
| if ! write_backup_env_file; then |
| echo "openclaw: backup env file unavailable; skip cron setup" >&2 |
| return 0 |
| fi |
|
|
| cat > /etc/cron.d/openclaw-backup <<EOFCRON |
| SHELL=/bin/bash |
| PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin |
| OPENCLAW_BACKUP_ENV_FILE_PATH=${OPENCLAW_BACKUP_ENV_FILE_PATH} |
| ${OPENCLAW_BACKUP_CRON} ${OPENCLAW_USER} /usr/local/bin/openclaw-backup-cron.sh >> /var/log/openclaw/backup.log 2>&1 |
| EOFCRON |
| chmod 0644 /etc/cron.d/openclaw-backup |
| touch /var/log/openclaw/backup.log |
| chown "$OPENCLAW_USER:$OPENCLAW_GROUP" /var/log/openclaw/backup.log |
|
|
| if pgrep -x cron >/dev/null 2>&1; then |
| return 0 |
| fi |
|
|
| cron |
| } |
|
|
| restore_from_backup_on_startup() { |
| if [[ -z "${OPENCLAW_BACKUP_DATASET_REPO:-}" ]]; then |
| echo "openclaw: startup restore skipped (OPENCLAW_BACKUP_DATASET_REPO is empty)" >&2 |
| return 0 |
| fi |
|
|
| if ! write_backup_env_file; then |
| echo "openclaw: backup env file unavailable; skip startup restore" >&2 |
| return 0 |
| fi |
| if /usr/local/bin/openclaw-restore.sh; then |
| echo "openclaw: restore finished" |
| else |
| echo "openclaw: restore skipped or failed, continue startup" >&2 |
| fi |
| } |
|
|
| run_as_node() { |
| local cmd=("$@") |
| if [[ "$(id -u)" -eq 0 ]]; then |
| exec gosu "$OPENCLAW_USER:$OPENCLAW_GROUP" "${cmd[@]}" >>"$OPENCLAW_STDOUT_LOG_PATH" 2>>"$OPENCLAW_STDERR_LOG_PATH" |
| fi |
| exec "${cmd[@]}" >>"$OPENCLAW_STDOUT_LOG_PATH" 2>>"$OPENCLAW_STDERR_LOG_PATH" |
| } |
|
|
| run_as_node_background() { |
| local cmd=("$@") |
| if [[ "$(id -u)" -eq 0 ]]; then |
| gosu "$OPENCLAW_USER:$OPENCLAW_GROUP" "${cmd[@]}" >>"$OPENCLAW_STDOUT_LOG_PATH" 2>>"$OPENCLAW_STDERR_LOG_PATH" & |
| else |
| "${cmd[@]}" >>"$OPENCLAW_STDOUT_LOG_PATH" 2>>"$OPENCLAW_STDERR_LOG_PATH" & |
| fi |
| OPENCLAW_CHILD_PID="$!" |
| } |
|
|
| start_sshx_background() { |
| if ! is_true "$OPENCLAW_SSHX_AUTO_START"; then |
| return 0 |
| fi |
|
|
| if ! command -v sshx >/dev/null 2>&1; then |
| echo "openclaw: OPENCLAW_SSHX_AUTO_START=true but sshx not found; skip auto start" >&2 |
| return 0 |
| fi |
|
|
| if [[ "$(id -u)" -eq 0 ]]; then |
| gosu "$OPENCLAW_USER:$OPENCLAW_GROUP" sshx >/proc/1/fd/1 2>/proc/1/fd/2 & |
| else |
| sshx >/proc/1/fd/1 2>/proc/1/fd/2 & |
| fi |
| OPENCLAW_SSHX_PID="$!" |
| echo "openclaw: sshx started in background (pid=$OPENCLAW_SSHX_PID)" |
| } |
|
|
| stop_sshx_background() { |
| if [[ -n "$OPENCLAW_SSHX_PID" ]] && kill -0 "$OPENCLAW_SSHX_PID" >/dev/null 2>&1; then |
| echo "openclaw: stopping sshx background process (pid=$OPENCLAW_SSHX_PID)" |
| kill "$OPENCLAW_SSHX_PID" >/dev/null 2>&1 || true |
| wait "$OPENCLAW_SSHX_PID" >/dev/null 2>&1 || true |
| fi |
| } |
|
|
| backup_on_shutdown() { |
| if [[ "$OPENCLAW_SHUTDOWN_BACKUP_DONE" -eq 1 ]]; then |
| return 0 |
| fi |
| OPENCLAW_SHUTDOWN_BACKUP_DONE=1 |
|
|
| if [[ -z "${OPENCLAW_BACKUP_DATASET_REPO:-}" ]]; then |
| echo "openclaw: shutdown backup skipped (OPENCLAW_BACKUP_DATASET_REPO is empty)" >&2 |
| return 0 |
| fi |
|
|
| if ! write_backup_env_file; then |
| echo "openclaw: backup env file unavailable; skip shutdown backup" >&2 |
| return 0 |
| fi |
| echo "openclaw: running shutdown backup" |
| if /usr/local/bin/openclaw-backup-cron.sh; then |
| echo "openclaw: shutdown backup completed" |
| else |
| echo "openclaw: shutdown backup failed, container will still exit" >&2 |
| fi |
| } |
|
|
| run_gateway_with_shutdown_backup() { |
| local gateway_exit_code=0 |
| local shutting_down=0 |
|
|
| on_gateway_signal() { |
| local signal="$1" |
| if [[ "$shutting_down" -eq 1 ]]; then |
| return 0 |
| fi |
| shutting_down=1 |
| log_warn "received ${signal}, preparing graceful shutdown" |
|
|
| if [[ -n "$OPENCLAW_CHILD_PID" ]] && kill -0 "$OPENCLAW_CHILD_PID" >/dev/null 2>&1; then |
| kill -s "$signal" "$OPENCLAW_CHILD_PID" >/dev/null 2>&1 || kill "$OPENCLAW_CHILD_PID" >/dev/null 2>&1 || true |
| if ! wait "$OPENCLAW_CHILD_PID"; then |
| gateway_exit_code=$? |
| fi |
| fi |
|
|
| log_info "gateway process stopped with code ${gateway_exit_code}" |
| stop_sshx_background |
| backup_on_shutdown |
| trap - TERM INT QUIT |
| exit "$gateway_exit_code" |
| } |
|
|
| trap 'on_gateway_signal TERM' TERM |
| trap 'on_gateway_signal INT' INT |
| trap 'on_gateway_signal QUIT' QUIT |
|
|
| log_info "starting gateway process (bind=${OPENCLAW_GATEWAY_BIND}, port=${OPENCLAW_GATEWAY_PORT})" |
| run_as_node_background openclaw gateway --allow-unconfigured --bind "$OPENCLAW_GATEWAY_BIND" --port "$OPENCLAW_GATEWAY_PORT" "$@" |
| log_info "gateway process started (pid=${OPENCLAW_CHILD_PID})" |
| if ! wait "$OPENCLAW_CHILD_PID"; then |
| gateway_exit_code=$? |
| fi |
| log_info "gateway process exited (pid=${OPENCLAW_CHILD_PID}, code=${gateway_exit_code})" |
|
|
| stop_sshx_background |
| backup_on_shutdown |
| trap - TERM INT QUIT |
| return "$gateway_exit_code" |
| } |
|
|
| main() { |
| if [[ "$#" -eq 0 ]]; then |
| set -- gateway |
| fi |
|
|
| local subcommand="$1" |
| shift || true |
|
|
| if [[ "$subcommand" == "gateway" ]]; then |
| log_info "starting gateway bootstrap sequence" |
| run_step "prepare runtime directories" mkdir_state_dirs |
| run_step "restore state from backup (if configured)" restore_from_backup_on_startup |
| run_step "write or update gateway config" write_or_update_config |
| run_step "fix file ownership and permissions" fix_permissions |
| run_step "setup backup cron (if enabled)" setup_backup_cron |
| run_step "start sshx background service (if enabled)" start_sshx_background |
| OPENCLAW_STEP_INDEX=$((OPENCLAW_STEP_INDEX + 1)) |
| log_info "step ${OPENCLAW_STEP_INDEX} start: launch gateway" |
| run_gateway_with_shutdown_backup "$@" |
| local gateway_exit_code=$? |
| if [[ "$gateway_exit_code" -ne 0 ]]; then |
| log_warn "gateway exited with non-zero code ${gateway_exit_code}" |
| return "$gateway_exit_code" |
| fi |
| log_info "step ${OPENCLAW_STEP_INDEX} done: launch gateway" |
| else |
| log_info "starting subcommand: openclaw ${subcommand}" |
| run_as_node openclaw "$subcommand" "$@" |
| fi |
| } |
|
|
| main "$@" |
|
|
