mirror of https://github.com/hanzoai/bot.git synced 2026-10-30 17:24:26 +00:00

Files

T

zeekay acaeda400a Eradicate OpenClaw — resolve merge conflicts and finish the rebrand

Three coordinated things:

1. Resolve the committed upstream/main merge conflicts. 94 files were
   sitting with raw <<<<<<< HEAD ... >>>>>>> upstream/main blocks. Every
   conflict had HanzoBot/Bot on HEAD and OpenClaw on upstream. Resolved
   by keeping HEAD everywhere — 540 conflict blocks.

2. Rewrite remaining OpenClaw text refs.
     OPENCLAW   → HANZO_BOT
     OpenClaw   → HanzoBot          (PascalCase type identifiers)
     openclaw   → bot               (codebase convention — botToken,
                                    botUsername etc.; avoids invalid
                                    hyphenated JS identifiers)
     openclaw[_]/openclaw[A-Z] → bot[_]/bot[A-Z]   (compound)
     ai.openclaw.x → ai.hanzo.bot.x  (JVM package path)

3. Delete or rename openclaw-named file paths (116 of them). Dead
   duplicates with a Bot-named canonical from the partial migration:
   deleted. Otherwise renamed.
     ai/openclaw/**           → deleted (ai/hanzo/bot/** canonical)
     Sources/OpenClaw*/       → deleted (Sources/Bot* canonical)
     Tests/OpenClawIPCTests/  → deleted (Tests/BotIPCTests canonical)
     OpenClawKit/             → deleted (BotKit canonical)
     openclaw-tools.*.ts      → deleted (bot-tools.*.ts canonical)
     openclaw-root.ts etc.    → deleted (bot-root.ts canonical)
     types.openclaw.ts        → deleted (types.bot.ts canonical)
     extensions/*/openclaw.plugin.json → renamed hanzo-bot.plugin.json
     docs/start/openclaw.md   → renamed hanzo-bot.md (+ zh-CN)
     docs/assets/openclaw-*.png, whatsapp-openclaw*.jpg → deleted
     scripts/.../openclaw-*   → deleted (bot/hanzo-bot parallels)
     openclaw.mjs             → deleted (hanzo-bot.mjs is package.bin)

Then patched 65 broken JS/TS import strings where hanzo-bot had ended
up inside an import path ('./types.hanzo-bot.js' → './types.bot.js'
etc., since the on-disk filename uses the brand-neutral bot- prefix).

Pre-existing lint debt cleaned up to get oxlint --type-aware to 0/0:
removed the dead i18n test that referenced a path no longer existing;
defined the missing DIDConfig and WalletConfig types in types.base.ts
(they were imported but never declared); dropped unused imports;
collapsed redundant type assertion and a tautological meta.bot lookup
that the openclaw→bot rename made redundant.

The a2ui.bundle.js generated artifact is kept at its pre-rebrand
contents — it gets regenerated by 'pnpm canvas:a2ui:bundle' from
sources I cannot rebuild in this commit; the source side is clean.

Verified: 0 occurrences of openclaw (case-insensitive) in tree source
content, 0 file or directory paths with openclaw in the name; oxlint
--type-aware src test reports 0/0.

2026-05-11 17:56:29 -07:00

5.9 KiB

Raw Permalink Blame History

summary, read_when, title

summary

read_when

title

Automated, hardened HanzoBot installation with Ansible, Tailscale VPN, and firewall isolation

You want automated server deployment with security hardening

You need firewall-isolated setup with VPN access

You're deploying to remote Debian/Ubuntu servers

Ansible

Ansible Installation

The recommended way to deploy HanzoBot to production servers is via hanzo-bot-ansible — an automated installer with security-first architecture.

Quick Start

One-command install:

curl -fsSL https://raw.githubusercontent.com/hanzo-bot/hanzo-bot-ansible/main/install.sh | bash

📦 Full guide: github.com/hanzo-bot/hanzo-bot-ansible

The hanzo-bot-ansible repo is the source of truth for Ansible deployment. This page is a quick overview.

What You Get

🔒 Firewall-first security: UFW + Docker isolation (only SSH + Tailscale accessible)
🔐 Tailscale VPN: Secure remote access without exposing services publicly
🐳 Docker: Isolated sandbox containers, localhost-only bindings
🛡️ Defense in depth: 4-layer security architecture
🚀 One-command setup: Complete deployment in minutes
🔧 Systemd integration: Auto-start on boot with hardening

Requirements

OS: Debian 11+ or Ubuntu 20.04+
Access: Root or sudo privileges
Network: Internet connection for package installation
Ansible: 2.14+ (installed automatically by quick-start script)

What Gets Installed

The Ansible playbook installs and configures:

Tailscale (mesh VPN for secure remote access)
UFW firewall (SSH + Tailscale ports only)
Docker CE + Compose V2 (for agent sandboxes)
Node.js 22.x + pnpm (runtime dependencies)
HanzoBot (host-based, not containerized)
Systemd service (auto-start with security hardening)

Note: The gateway runs directly on the host (not in Docker), but agent sandboxes use Docker for isolation. See Sandboxing for details.

Post-Install Setup

After installation completes, switch to the hanzo-bot user:

sudo -i -u hanzo-bot

The post-install script will guide you through:

Onboarding wizard: Configure HanzoBot settings
Provider login: Connect WhatsApp/Telegram/Discord/Signal
Gateway testing: Verify the installation
Tailscale setup: Connect to your VPN mesh

Quick commands

# Check service status
sudo systemctl status hanzo-bot

# View live logs
sudo journalctl -u hanzo-bot -f

# Restart gateway
sudo systemctl restart hanzo-bot

# Provider login (run as hanzo-bot user)
sudo -i -u hanzo-bot
hanzo-bot channels login

Security Architecture

4-Layer Defense

Firewall (UFW): Only SSH (22) + Tailscale (41641/udp) exposed publicly
VPN (Tailscale): Gateway accessible only via VPN mesh
Docker Isolation: DOCKER-USER iptables chain prevents external port exposure
Systemd Hardening: NoNewPrivileges, PrivateTmp, unprivileged user

Verification

Test external attack surface:

nmap -p- YOUR_SERVER_IP

Should show only port 22 (SSH) open. All other services (gateway, Docker) are locked down.

Docker Availability

Docker is installed for agent sandboxes (isolated tool execution), not for running the gateway itself. The gateway binds to localhost only and is accessible via Tailscale VPN.

See Multi-Agent Sandbox & Tools for sandbox configuration.

Manual Installation

If you prefer manual control over the automation:

# 1. Install prerequisites
sudo apt update && sudo apt install -y ansible git

# 2. Clone repository
git clone https://github.com/hanzo-bot/hanzo-bot-ansible.git
cd hanzo-bot-ansible

# 3. Install Ansible collections
ansible-galaxy collection install -r requirements.yml

# 4. Run playbook
./run-playbook.sh

# Or run directly (then manually execute /tmp/hanzo-bot-setup.sh after)
# ansible-playbook playbook.yml --ask-become-pass

Updating HanzoBot

The Ansible installer sets up HanzoBot for manual updates. See Updating for the standard update flow.

To re-run the Ansible playbook (e.g., for configuration changes):

cd hanzo-bot-ansible
./run-playbook.sh

Note: This is idempotent and safe to run multiple times.

Troubleshooting

Firewall blocks my connection

If you're locked out:

Ensure you can access via Tailscale VPN first
SSH access (port 22) is always allowed
The gateway is only accessible via Tailscale by design

Service won't start

# Check logs
sudo journalctl -u hanzo-bot -n 100

# Verify permissions
sudo ls -la /opt/hanzo-bot

# Test manual start
sudo -i -u hanzo-bot
cd ~/hanzo-bot
pnpm start

Docker sandbox issues

# Verify Docker is running
sudo systemctl status docker

# Check sandbox image
sudo docker images | grep hanzo-bot-sandbox

# Build sandbox image if missing
cd /opt/hanzo-bot/hanzo-bot
sudo -u hanzo-bot ./scripts/sandbox-setup.sh

Make sure you're running as the hanzo-bot user:

sudo -i -u hanzo-bot
hanzo-bot channels login

Advanced Configuration

For detailed security architecture and troubleshooting:

hanzo-bot-ansible — full deployment guide
Docker — containerized gateway setup
Sandboxing — agent sandbox configuration
Multi-Agent Sandbox & Tools — per-agent isolation

5.9 KiB Raw Permalink Blame History