openclaw/nix-openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/nix-openclaw.git synced 2026-07-25 05:35:30 -04:00
Code Issues 31 Packages Projects Releases Wiki Activity

[Feature] Add NixOS module for running gateway as isolated system user #10

New Issue
Open
opened 2026-02-15 17:04:28 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:04:28 -05:00
Owner
Copy Link
Copy Source

Originally created by @jeanlucthumm on GitHub (Jan 26, 2026).

Summary

The current module only supports home-manager (user-level systemd service). This means the gateway runs with full access to the user's personal files, SSH keys, credentials, etc.

Upstream issue: https://github.com/clawdbot/clawdbot/issues/2341

Proposal

Add a NixOS module (nixosModules.clawdbot) that:

  1. Creates a dedicated clawdbot system user with minimal privileges
  2. Runs the gateway as a system-level systemd service
  3. Applies systemd hardening options:
    • DynamicUser=true or dedicated user
    • ProtectHome=true
    • PrivateTmp=true
    • NoNewPrivileges=true
    • ProtectSystem=strict
    • etc.
  4. Manages credentials in the isolated user's home

Use Case

Security-conscious users who want to run clawdbot on a server without exposing their personal files to the LLM.

Notes

  • Claude OAuth credentials would need to be set up separately for the clawdbot user
  • Could coexist with the home-manager module for different use cases
Originally created by @jeanlucthumm on GitHub (Jan 26, 2026). ## Summary The current module only supports home-manager (user-level systemd service). This means the gateway runs with full access to the user's personal files, SSH keys, credentials, etc. Upstream issue: https://github.com/clawdbot/clawdbot/issues/2341 ## Proposal Add a NixOS module (`nixosModules.clawdbot`) that: 1. Creates a dedicated `clawdbot` system user with minimal privileges 2. Runs the gateway as a system-level systemd service 3. Applies systemd hardening options: - `DynamicUser=true` or dedicated user - `ProtectHome=true` - `PrivateTmp=true` - `NoNewPrivileges=true` - `ProtectSystem=strict` - etc. 4. Manages credentials in the isolated user's home ## Use Case Security-conscious users who want to run clawdbot on a server without exposing their personal files to the LLM. ## Notes - Claude OAuth credentials would need to be set up separately for the clawdbot user - Could coexist with the home-manager module for different use cases
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
enhancement
maintainer-roadmap
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/nix-openclaw#10
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?