docker-compose.yml

# CameraClaw — OpenClaw Docker Compose
# Manages OpenClaw instances with virtual desktop for monitoring.
# The openclaw:local image is built by deploy.sh with KasmVNC + desktop packages.

services:
  openclaw-gateway:
    image: ${OPENCLAW_IMAGE:-openclaw:local}
    pull_policy: never
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      HOME: /home/node
      TERM: xterm-256color
      DISPLAY: ":99"
      LANG: en_US.UTF-8
      LC_ALL: en_US.UTF-8
      LANGUAGE: en_US:en
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
      # LLM API keys — injected by monitor.js based on api_key_source config
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      OPENAI_BASE_URL: ${OPENAI_BASE_URL:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
    volumes:
      - ${OPENCLAW_CONFIG_DIR:-~/.openclaw}:/home/node/.openclaw
      - ${OPENCLAW_WORKSPACE_DIR:-~/.openclaw/workspace}:/home/node/.openclaw/workspace
    ports:
      - "${OPENCLAW_GATEWAY_PORT:-18789}:18789"
      - "${OPENCLAW_BRIDGE_PORT:-18790}:18790"
      - "${OPENCLAW_KASMVNC_PORT:-6080}:6080"
    init: true
    restart: unless-stopped
    shm_size: "512m"
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        # Clean up stale lock files from previous runs
        rm -f /tmp/.X99-lock /tmp/.X11-unix/X99

        # --- Bypass ALL kasmvncserver interactive prompts ---

        # 1) Create write user at $HOME/.kasmpasswd (line 1173 of kasmvncserver)
        printf 'password\npassword\n' | kasmvncpasswd -u user -w /home/node/.kasmpasswd

        # 2) Pre-create xstartup with XFCE + Windows-like theme (skips CreateXstartupIfNeeded)
        mkdir -p /home/node/.vnc
        cat > /home/node/.vnc/xstartup << 'XEOF'
        #!/bin/sh
        export LANG=en_US.UTF-8
        export LC_ALL=en_US.UTF-8

        # Apply Windows-like XFCE settings before starting the session
        mkdir -p /home/node/.config/xfce4/xfconf/xfce-perchannel-xml

        # Window manager: Greybird theme (clean, Windows-like)
        cat > /home/node/.config/xfce4/xfconf/xfce-perchannel-xml/xfwm4.xml << 'XFWM'
        <?xml version="1.0" encoding="UTF-8"?>
        <channel name="xfwm4" version="1.0">
          <property name="general" type="empty">
            <property name="theme" type="string" value="Greybird"/>
            <property name="title_font" type="string" value="Sans Bold 9"/>
          </property>
        </channel>
        XFWM

        # GTK theme + icons
        cat > /home/node/.config/xfce4/xfconf/xfce-perchannel-xml/xsettings.xml << 'XSET'
        <?xml version="1.0" encoding="UTF-8"?>
        <channel name="xsettings" version="1.0">
          <property name="Net" type="empty">
            <property name="ThemeName" type="string" value="Greybird"/>
            <property name="IconThemeName" type="string" value="Adwaita"/>
          </property>
          <property name="Gtk" type="empty">
            <property name="FontName" type="string" value="Sans 10"/>
          </property>
        </channel>
        XSET

        # Desktop: solid dark background, no icons
        cat > /home/node/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-desktop.xml << 'XDESK'
        <?xml version="1.0" encoding="UTF-8"?>
        <channel name="xfce4-desktop" version="1.0">
          <property name="desktop-icons" type="empty">
            <property name="style" type="int" value="0"/>
          </property>
          <property name="backdrop" type="empty">
            <property name="screen0" type="empty">
              <property name="monitorVNC-0" type="empty">
                <property name="workspace0" type="empty">
                  <property name="color-style" type="int" value="0"/>
                  <property name="rgba1" type="array">
                    <value type="uint" value="8738"/>
                    <value type="uint" value="10280"/>
                    <value type="uint" value="13878"/>
                    <value type="uint" value="65535"/>
                  </property>
                  <property name="image-style" type="int" value="0"/>
                </property>
              </property>
            </property>
          </property>
        </channel>
        XDESK

        # Panel: single bottom panel (Windows-like taskbar)
        cat > /home/node/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml << 'XPANEL'
        <?xml version="1.0" encoding="UTF-8"?>
        <channel name="xfce4-panel" version="1.0">
          <property name="configver" type="int" value="2"/>
          <property name="panels" type="array">
            <value type="int" value="1"/>
            <property name="panel-1" type="empty">
              <property name="position" type="string" value="p=8;x=640;y=708"/>
              <property name="length" type="uint" value="100"/>
              <property name="position-locked" type="bool" value="true"/>
              <property name="size" type="uint" value="30"/>
              <property name="plugin-ids" type="array">
                <value type="int" value="1"/>
                <value type="int" value="2"/>
                <value type="int" value="3"/>
                <value type="int" value="4"/>
                <value type="int" value="5"/>
              </property>
            </property>
          </property>
          <property name="plugins" type="empty">
            <property name="plugin-1" type="string" value="applicationsmenu"/>
            <property name="plugin-2" type="string" value="tasklist"/>
            <property name="plugin-3" type="string" value="separator">
              <property name="expand" type="bool" value="true"/>
              <property name="style" type="uint" value="0"/>
            </property>
            <property name="plugin-4" type="string" value="systray"/>
            <property name="plugin-5" type="string" value="clock"/>
          </property>
        </channel>
        XPANEL

        dbus-launch --exit-with-session startxfce4
        XEOF
        chmod +x /home/node/.vnc/xstartup

        # 3) Replace select-de.sh with a no-op (ConfigureDeToRun calls it
        #    OUTSIDE the $skipxstartup guard, so -noxstartup won't help)
        printf '#!/bin/sh\nexit 0\n' > /usr/lib/kasmvncserver/select-de.sh
        chmod +x /usr/lib/kasmvncserver/select-de.sh

        # 4) Force KasmVNC web client to English (it auto-detects browser language,
        #    picking up zh-CN from macOS). Replace all navigator language references
        #    in the bundled JS files that KasmVNC serves.
        for f in /usr/share/kasmvnc/www/dist/*.bundle.js; do
          [ -f "$$f" ] || continue
          sed -i "s/window\.navigator\.languages/['en-US']/g; s/navigator\.languages/['en-US']/g; s/navigator\.language/\"en-US\"/g; s/navigator\.userLanguage/\"en-US\"/g" "$$f" 2>/dev/null || true
        done

        # 4) Configure KasmVNC for HTTP (not HTTPS) — simpler for local Docker,
        #    avoids self-signed cert issues with Electron webview.
        cat > /home/node/.vnc/kasmvnc.yaml << 'VNCEOF'
        logging:
          log_writer_name: all
          log_dest: logfile
          level: 30
        network:
          protocol: http
          websocket_port: 6080
          interface: 0.0.0.0
          ssl:
            require_ssl: false
        user_session:
          idle_timeout: never
        runtime_configuration:
          allow_client_to_override_kasm_server_settings: false
        VNCEOF

        # Start KasmVNC (wrapper handles Xvnc + web client).
        # -publicIP 127.0.0.1 skips STUN/ICE queries (block in Docker).
        # -disableBasicAuth removes the login prompt in the web client.
        /usr/bin/kasmvncserver :99 \
          -geometry 1280x720 \
          -websocketPort 6080 \
          -disableBasicAuth \
          -FrameRate 30 \
          -interface 0.0.0.0 \
          -publicIP 127.0.0.1 \
          -sslOnly 0
        sleep 5

        # Create OpenClaw config ONLY if it doesn't already exist.
        # monitor.js pre-writes this file with API keys + gateway settings
        # before docker compose up, so we must not overwrite it.
        mkdir -p /home/node/.openclaw
        if [ ! -f /home/node/.openclaw/openclaw.json ]; then
        cat > /home/node/.openclaw/openclaw.json << 'CFGEOF'
        {
          "gateway": {
            "controlUi": {
              "dangerouslyAllowHostHeaderOriginFallback": true,
              "allowInsecureAuth": true
            }
          }
        }
        CFGEOF
        fi

        # Create desktop shortcut to OpenClaw Control UI (with auth token)
        # NOTE: $$ escaping is required — Docker Compose interprets single $
        # as env-var substitution; $$ produces a literal $ for the shell.
        GATEWAY_URL="http://localhost:18789"
        TOKEN="${OPENCLAW_GATEWAY_TOKEN}"
        mkdir -p /home/node/Desktop
        cat > /home/node/Desktop/OpenClaw.desktop << SHORTCUT
        [Desktop Entry]
        Version=1.0
        Type=Application
        Name=OpenClaw Control
        Comment=Open the OpenClaw Control UI
        Icon=web-browser
        Exec=chromium --no-sandbox --test-type "$${GATEWAY_URL}?token=$${TOKEN}"
        Terminal=false
        Categories=Network;WebBrowser;
        SHORTCUT
        chmod +x /home/node/Desktop/OpenClaw.desktop

        # Start OpenClaw gateway in a terminal (logs visible on desktop)
        DISPLAY=:99 xfce4-terminal --geometry=120x25+10+10 \
          --title="OpenClaw Gateway" \
          -e "openclaw gateway --bind lan --port 18789 --allow-unconfigured" &

        # Wait for gateway to be ready (poll port 18789, up to 30s)
        echo "Waiting for gateway on port 18789..."
        for i in $$(seq 1 30); do
          if wget -q --spider http://localhost:18789/ 2>/dev/null; then
            echo "Gateway is ready (after $${i}s)"
            break
          fi
          sleep 1
        done

        # Auto-open Chromium to OpenClaw gateway
        DISPLAY=:99 chromium --no-sandbox --test-type \
          --start-maximized \
          "$${GATEWAY_URL}?token=$${TOKEN}" &

        # Keep container alive
        wait

  openclaw-cli:
    image: ${OPENCLAW_IMAGE:-openclaw:local}
    environment:
      HOME: /home/node
      TERM: xterm-256color
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
      BROWSER: echo
    volumes:
      - ${OPENCLAW_CONFIG_DIR:-~/.openclaw}:/home/node/.openclaw
      - ${OPENCLAW_WORKSPACE_DIR:-~/.openclaw/workspace}:/home/node/.openclaw/workspace
    stdin_open: true
    tty: true
    init: true
    entrypoint: ["openclaw"]