dannydannydanny/dotfiles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: add git/nodejs to openclaw, configure GitHub PAT credential helper 🔑

Browse source 
Adds git and nodejs to openclaw-gateway service PATH. Configures a
git credential helper that reads a fine-grained PAT from
/etc/openclaw/github-token. Creates /var/lib/openclaw/repos for
repo clones.
This commit is contained in:
DannyDannyDanny 2026-04-04 12:06:08 +02:00
parent 369e96cbd7
commit 52649f500a
1 changed files with 19 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

20
nixos/hosts/phantom-ship.nix
View file

@ -87,6 +87,7 @@ in
services.openclaw-gateway = {
enable = true;
environmentFiles = [ "/etc/openclaw/env" ];
servicePath = [ pkgs.git pkgs.nodejs ];
config = {
gateway.mode = "local";
channels.telegram = {
@ -96,12 +97,29 @@ in
};
};
# OpenClaw gateway needs write access to its config dir for runtime state.
# OpenClaw gateway needs write access to its config dir and repo clones.
systemd.tmpfiles.rules = [
"d /etc/openclaw 0775 root openclaw - -"
"d /var/lib/openclaw/repos 0750 openclaw openclaw - -"
];
# Git config for the openclaw user: credential helper reads PAT from file.
# PAT (not in repo): /etc/openclaw/github-token (fine-grained, scoped to specific repos)
environment.etc."openclaw/gitconfig" = {
text = ''
[user]
name = OpenClaw Bot
email = noreply@openclaw.local
[credential "https://github.com"]
helper = "!f() { echo username=x-access-token; echo password=$(cat /etc/openclaw/github-token); }; f"
[safe]
directory = /var/lib/openclaw/repos
'';
mode = "0644";
};
# Harden the openclaw-gateway systemd service.
systemd.services.openclaw-gateway.environment.GIT_CONFIG_GLOBAL = "/etc/openclaw/gitconfig";
systemd.services.openclaw-gateway.serviceConfig = {
ProtectHome = "read-only";
ProtectSystem = "strict";