openai: wire Adolf OpenClaw gateway on Matrix [Adolf P6]

Build adolf:local with the matrix extension bundled (OPENCLAW_EXTENSIONS),
route mtx.alogins.net to host-gateway to dodge hairpin NAT, and wire
ADOLF_KEY/Matrix creds through openai/.env (now gitignored + untracked;
it previously held Langfuse keys in cleartext git history). Runtime
openclaw.json + SOUL.md live in the adolf-state volume, not this repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

.gitignore

@@ -1,2 +1,3 @@
 adolf/.env
 seafile/.env
+openai/.env

openai/.env

@@ -1,2 +0,0 @@
-LANGFUSE_PUBLIC_KEY=pk-lf-9a00d546-2fbd-4215-9b0e-0a54362e884b
-LANGFUSE_SECRET_KEY=sk-lf-b91caabb-7544-4012-830e-2b9e409609d3

openai/docker-compose.yml

@@ -121,11 +121,19 @@ services:
       - "host.docker.internal:host-gateway"
     restart: unless-stopped
 
-  # Adolf — OpenClaw fork (Matrix-first personal assistant). Skeleton only:
+  # Adolf — OpenClaw fork (Matrix-first personal assistant). Runtime config
-  # real config (Matrix channel, SOUL.md, model provider -> adolf-llm:8010) is
+  # (Matrix channel, SOUL.md, model provider -> adolf-llm:8010, MCP registry,
-  # wired in P6. Not started until its config/keys exist. Source: /home/alvis/adolf.
+  # gateway.tools.allow for cron/nodes) is wired in P6 and lives in the
+  # adolf-state VOLUME (openclaw.json + SOUL.md), not in this repo. Matrix
+  # creds and ADOLF_KEY come from openai/.env (gitignored, never committed).
+  # Source: /home/alvis/adolf.
   adolf:
-    build: ../../adolf
+    build:
+      context: ../../adolf
+      # Matrix is opt-in at build time (see adolf/Dockerfile); without this,
+      # the gateway logs "no-channel-owner" and channels.matrix is inert.
+      args:
+        OPENCLAW_EXTENSIONS: matrix
     image: adolf:local
     container_name: adolf
     environment:
@@ -136,11 +144,22 @@ services:
       - OPENCLAW_CONFIG_DIR=/home/node/.openclaw
       - OPENCLAW_WORKSPACE_DIR=/home/node/.openclaw/workspace
       - OPENCLAW_GATEWAY_TOKEN=${ADOLF_GATEWAY_TOKEN:-}
+      - ADOLF_KEY=${ADOLF_KEY:-}
+      - MATRIX_HOMESERVER=${MATRIX_HOMESERVER:-}
+      - MATRIX_USER_ID=${MATRIX_USER_ID:-}
+      - MATRIX_PASSWORD=${MATRIX_PASSWORD:-}
+      - MATRIX_DEVICE_NAME=${MATRIX_DEVICE_NAME:-Adolf OpenClaw Gateway}
       - TZ=Europe/Riga
     volumes:
       - adolf-state:/home/node/.openclaw
     extra_hosts:
       - "host.docker.internal:host-gateway"
+      # mtx.alogins.net's public A record can't hairpin-NAT back through the
+      # router from inside a container; route it to the host gateway instead,
+      # matching matrix/docker-compose.yml's lk-jwt-service (same problem,
+      # same fix). Caddy on the host terminates TLS on :443 and proxies to
+      # synapse:8008.
+      - "mtx.alogins.net:host-gateway"
     cap_drop:
       - NET_RAW
       - NET_ADMIN