Create setup-hf-config.mjs

setup-hf-config.mjs

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+/**
+ * setup-hf-config.mjs
+ * Schreibt/merged ~/.openclaw/openclaw.json für Hugging Face Spaces.
+ *
+ * Erwartete ENV/Secrets (HF Settings → Variables and secrets):
+ * - Secrets:
+ *   - OPENCLAW_GATEWAY_TOKEN (oder Fallback: OPENCLAW_TOKEN)
+ *   - HF_TOKEN (optional, je nach OpenClaw/HF-Use)
+ * - Variables:
+ *   - OPENCLAW_CONTROL_UI_ALLOWED_ORIGINS="https://morris5444-openclaw.hf.space"
+ *   - OPENCLAW_GATEWAY_TRUSTED_PROXIES="10.0.0.0/8" oder IP-Liste
+ *   - OPENCLAW_HF_DEFAULT_MODEL="huggingface/Qwen/Qwen2.5-Coder-32B-Instruct" (optional)
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+
+const home = process.env.OPENCLAW_HOME || process.env.HOME || "/home/user";
+const stateDir = path.join(home, ".openclaw");
+const configPath = path.join(stateDir, "openclaw.json");
+
+function readGatewayToken() {
+  // Fallback: du nutzt aktuell OPENCLAW_TOKEN. Das akzeptieren wir.
+  const tok =
+    process.env.OPENCLAW_GATEWAY_TOKEN?.trim() ||
+    process.env.OPENCLAW_TOKEN?.trim() ||
+    "";
+  return tok;
+}
+
+function splitCsv(val) {
+  return val
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+const defaultModel =
+  process.env.OPENCLAW_HF_DEFAULT_MODEL?.trim() ||
+  "huggingface/Qwen/Qwen2.5-Coder-32B-Instruct";
+
+const gatewayToken = readGatewayToken();
+const gatewayPassword = process.env.OPENCLAW_GATEWAY_PASSWORD?.trim() || "";
+
+// Diese IPs sind aus funktionierenden HF/OpenClaw-Setups bekannt.
+// Du kannst stattdessen OPENCLAW_GATEWAY_TRUSTED_PROXIES=10.0.0.0/8 setzen,
+// falls OpenClaw CIDR akzeptiert – sonst nimm die Liste.
+const DEFAULT_HF_TRUSTED_PROXY_IPS = [
+  "10.16.4.123",
+  "10.16.34.155",
+  "10.20.1.9",
+  "10.20.1.222",
+  "10.20.26.157",
+  "10.20.31.87",
+];
+
+const trustedProxiesRaw = process.env.OPENCLAW_GATEWAY_TRUSTED_PROXIES?.trim() || "";
+const trustedProxies =
+  trustedProxiesRaw.length > 0 ? splitCsv(trustedProxiesRaw) : DEFAULT_HF_TRUSTED_PROXY_IPS;
+
+const allowedOriginsRaw = process.env.OPENCLAW_CONTROL_UI_ALLOWED_ORIGINS?.trim() || "";
+const allowedOrigins = allowedOriginsRaw.length > 0 ? splitCsv(allowedOriginsRaw) : [];
+
+let config = {};
+if (fs.existsSync(configPath)) {
+  try {
+    config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+  } catch {
+    config = {};
+  }
+}
+
+// --- Merge / Defaults ---
+config.gateway ??= {};
+config.gateway.mode = "local";
+config.gateway.bind = "lan";
+
+// Trusted proxies (HF Reverse Proxy)
+config.gateway.trustedProxies = trustedProxies;
+
+// Default model
+config.agents ??= {};
+config.agents.defaults ??= {};
+config.agents.defaults.model ??= {};
+config.agents.defaults.model.primary = defaultModel;
+
+// Auth
+if (gatewayToken || gatewayPassword) {
+  config.gateway.auth ??= {};
+  if (gatewayToken) {
+    config.gateway.auth.mode = "token";
+    config.gateway.auth.token = gatewayToken;
+  } else {
+    config.gateway.auth.mode = "password";
+    config.gateway.auth.password = gatewayPassword;
+  }
+
+  // HF Spaces: Device Auth ist oft unpraktisch.
+  config.gateway.controlUi ??= {};
+  config.gateway.controlUi.dangerouslyDisableDeviceAuth = true;
+}
+
+// Control UI allowed origins (wichtig für HF Domain)
+if (allowedOrigins.length > 0) {
+  config.gateway.controlUi ??= {};
+  config.gateway.controlUi.allowedOrigins = allowedOrigins;
+}
+
+// Persist
+fs.mkdirSync(stateDir, { recursive: true });
+fs.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+
+console.log(
+  `[openclaw-hf-setup] wrote ${configPath} trustedProxies=${trustedProxies.length} allowedOrigins=${allowedOrigins.length}`
+);