alvis
bedb527145
Some checks failed
ClawSweeper Dispatch / dispatch (push) Has been cancelled
CodeQL / Security High (actions) (push) Has been cancelled
CodeQL / Security High (channel-runtime-boundary) (push) Has been cancelled
CodeQL / Security High (core-auth-secrets) (push) Has been cancelled
CodeQL / Security High (mcp-process-tool-boundary) (push) Has been cancelled
CodeQL / Security High (network-ssrf-boundary) (push) Has been cancelled
CodeQL / Security High (plugin-trust-boundary) (push) Has been cancelled
CodeQL / Security High (process-exec-boundary) (push) Has been cancelled
Docs Sync Publish Repo / sync-publish-repo (push) Has been cancelled
Docs / docs (push) Has been cancelled
OpenClaw Stable Main Closeout / Resolve stable release closeout inputs (push) Has been cancelled
OpenClaw Stable Main Closeout / Verify stable main closeout (push) Has been cancelled
Workflow Sanity / no-tabs (push) Has been cancelled
Workflow Sanity / actionlint (push) Has been cancelled
Workflow Sanity / generated-doc-baselines (push) Has been cancelled
CI / runner-admission (push) Has been cancelled
CI / preflight (push) Has been cancelled
CI / security-fast (push) Has been cancelled
CI / pnpm-store-warmup (push) Has been cancelled
CI / build-artifacts (push) Has been cancelled
CI / native-i18n (push) Has been cancelled
CI / ${{ matrix.check_name }} (push) Has been cancelled
CI / ${{ matrix.checkName }} (push) Has been cancelled
CI / checks-node-compat-node22 (push) Has been cancelled
CI / check-bundled-channel-config-metadata (push) Has been cancelled
CI / check-dependencies (push) Has been cancelled
CI / check-guards (push) Has been cancelled
CI / check-lint (push) Has been cancelled
CI / check-prod-types (push) Has been cancelled
CI / check-shrinkwrap (push) Has been cancelled
CI / check-test-types (push) Has been cancelled
CI / check-additional-boundaries-a (push) Has been cancelled
CI / check-additional-boundaries-bcd (push) Has been cancelled
CI / check-additional-extension-bundled (push) Has been cancelled
CI / check-additional-extension-channels (push) Has been cancelled
CI / check-additional-extension-package-boundary (push) Has been cancelled
CI / check-additional-runtime-topology-architecture (push) Has been cancelled
CI / check-session-accessor-boundary (push) Has been cancelled
CI / check-session-transcript-reader-boundary (push) Has been cancelled
CI / check-docs (push) Has been cancelled
CI / skills-python (push) Has been cancelled
CI / macos-swift (push) Has been cancelled
CI / ios-build (push) Has been cancelled
CI / ci-timings-summary (push) Has been cancelled
Native App Locale Refresh / Refresh native fa (push) Has been cancelled
Native App Locale Refresh / Refresh native fr (push) Has been cancelled
Native App Locale Refresh / Refresh native hi (push) Has been cancelled
Native App Locale Refresh / Refresh native id (push) Has been cancelled
Native App Locale Refresh / Refresh native it (push) Has been cancelled
Native App Locale Refresh / Refresh native ja-JP (push) Has been cancelled
Control UI Locale Refresh / plan (push) Has been cancelled
Control UI Locale Refresh / Refresh ${{ matrix.locale }} (push) Has been cancelled
Control UI Locale Refresh / Commit control UI locale refresh (push) Has been cancelled
Live Media Runner Image / Build live media runner image (push) Has been cancelled
Native App Locale Refresh / Refresh native ar (push) Has been cancelled
Native App Locale Refresh / Refresh native de (push) Has been cancelled
Native App Locale Refresh / Refresh native es (push) Has been cancelled
Native App Locale Refresh / Refresh native ko (push) Has been cancelled
Native App Locale Refresh / Refresh native nl (push) Has been cancelled
Native App Locale Refresh / Refresh native pl (push) Has been cancelled
Native App Locale Refresh / Refresh native pt-BR (push) Has been cancelled
Native App Locale Refresh / Refresh native ru (push) Has been cancelled
Native App Locale Refresh / Refresh native sv (push) Has been cancelled
Native App Locale Refresh / Refresh native th (push) Has been cancelled
Native App Locale Refresh / Refresh native tr (push) Has been cancelled
Native App Locale Refresh / Refresh native uk (push) Has been cancelled
Native App Locale Refresh / Refresh native vi (push) Has been cancelled
Native App Locale Refresh / Refresh native zh-CN (push) Has been cancelled
Native App Locale Refresh / Refresh native zh-TW (push) Has been cancelled
Native App Locale Refresh / Commit native locale refresh (push) Has been cancelled
Plugin Init Scaffold Validation / Validate provider scaffold (push) Has been cancelled
Plugin NPM Release / preview_plugins_npm (push) Has been cancelled
Plugin NPM Release / Validate release publish approval (push) Has been cancelled
Plugin NPM Release / preview_plugin_pack (push) Has been cancelled
Plugin NPM Release / publish_plugins_npm (push) Has been cancelled
Sandbox Common Smoke / sandbox-common-smoke (push) Has been cancelled
Website Installer Sync / static (push) Has been cancelled
Website Installer Sync / linux-docker (push) Has been cancelled
Website Installer Sync / macos-installer (push) Has been cancelled
Website Installer Sync / windows-installer (push) Has been cancelled
Website Installer Sync / sync-website (push) Has been cancelled
Adolf is a fork/vendored clone of github.com/openclaw/openclaw (v2026.6.11), free to diverge. Tree copied sans upstream .git; upstream remote added for future syncs. Node pinned to 24 (.nvmrc); engines already require >=22.19. Preserves docs/ARCHITECTURE.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2
73 lines
2.6 KiB
Markdown
73 lines
2.6 KiB
Markdown
---
|
|
summary: "Network hub: gateway surfaces, pairing, discovery, and security"
|
|
read_when:
|
|
- You need the network architecture + security overview
|
|
- You are debugging local vs tailnet access or pairing
|
|
- You want the canonical list of networking docs
|
|
title: "Network"
|
|
---
|
|
|
|
This hub links the core docs for how OpenClaw connects, pairs, and secures
|
|
devices across localhost, LAN, and tailnet.
|
|
|
|
## Core model
|
|
|
|
Most operations flow through the Gateway (`openclaw gateway`), a single long-running process that owns channel connections and the WebSocket control plane.
|
|
|
|
- **Loopback first**: the Gateway WS defaults to `ws://127.0.0.1:18789`.
|
|
Non-loopback binds refuse to start without a valid gateway auth path:
|
|
shared-secret token/password auth, or a correctly configured non-loopback
|
|
`trusted-proxy` deployment.
|
|
- **One Gateway per host** is recommended. For isolation, run multiple gateways with isolated profiles and ports ([Multiple Gateways](/gateway/multiple-gateways)).
|
|
- **Canvas host** is served on the same port as the Gateway (`/__openclaw__/canvas/`, `/__openclaw__/a2ui/`), protected by Gateway auth when bound beyond loopback.
|
|
- **Remote access** is typically an SSH tunnel or Tailscale VPN ([Remote Access](/gateway/remote)).
|
|
|
|
Key references:
|
|
|
|
- [Gateway architecture](/concepts/architecture)
|
|
- [Gateway protocol](/gateway/protocol)
|
|
- [Gateway runbook](/gateway)
|
|
- [Web surfaces + bind modes](/web)
|
|
|
|
## Pairing + identity
|
|
|
|
- [Pairing overview (DM + nodes)](/channels/pairing)
|
|
- [Gateway-owned node pairing](/gateway/pairing)
|
|
- [Devices CLI (pairing + token rotation)](/cli/devices)
|
|
- [Pairing CLI (DM approvals)](/cli/pairing)
|
|
|
|
Local trust:
|
|
|
|
- Direct local loopback connects (no forwarded/proxy headers) can be
|
|
auto-approved for pairing to keep same-host UX smooth.
|
|
- OpenClaw also has a narrow backend/container-local self-connect path for
|
|
trusted shared-secret helper flows.
|
|
- Tailnet and LAN clients, including same-host tailnet binds, still require
|
|
explicit pairing approval.
|
|
|
|
## Discovery + transports
|
|
|
|
- [Discovery and transports](/gateway/discovery)
|
|
- [Bonjour / mDNS](/gateway/bonjour)
|
|
- [Remote access (SSH)](/gateway/remote)
|
|
- [Tailscale](/gateway/tailscale)
|
|
|
|
## Nodes + transports
|
|
|
|
- [Nodes overview](/nodes)
|
|
- [Bridge protocol (legacy nodes, historical)](/gateway/bridge-protocol)
|
|
- [Node runbook: iOS](/platforms/ios)
|
|
- [Node runbook: Android](/platforms/android)
|
|
|
|
## Security
|
|
|
|
- [Security overview](/gateway/security)
|
|
- [Gateway config reference](/gateway/configuration)
|
|
- [Troubleshooting](/gateway/troubleshooting)
|
|
- [Doctor](/gateway/doctor)
|
|
|
|
## Related
|
|
|
|
- [Gateway runbook](/gateway)
|
|
- [Remote access](/gateway/remote)
|