Create setup-hf-config.mjs

setup-hf-config.mjs

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+/**
+ * One-time setup for OpenClaw on Hugging Face Spaces.
+ * Runs at container startup; writes or merges openclaw.json from env (Secrets/Variables):
+ * - agents.defaults.model.primary from OPENCLAW_HF_DEFAULT_MODEL (default: DeepSeek-R1).
+ * - gateway.auth: OPENCLAW_GATEWAY_TOKEN (token) or OPENCLAW_GATEWAY_PASSWORD (password); token wins if both set.
+ * - gateway.controlUi.dangerouslyDisableDeviceAuth when auth is set (no device pairing in Spaces).
+ * - gateway.trustedProxies from OPENCLAW_GATEWAY_TRUSTED_PROXIES, or default HF proxy IPs so the UI works without extra config.
+ * - gateway.controlUi.allowedOrigins from OPENCLAW_CONTROL_UI_ALLOWED_ORIGINS (comma-separated origins).
+ * HF_TOKEN is read by the gateway at runtime; this script only writes the above into config.
+ */
+import fs from "node:fs";
+import path from "node:path";
+
+const home = process.env.OPENCLAW_HOME || process.env.HOME || "/home/user";
+const stateDir = path.join(home, ".openclaw");
+const configPath = path.join(stateDir, "openclaw.json");
+
+// Token: env var, or read from file if OPENCLAW_GATEWAY_TOKEN_FILE is set (for platforms that mount secrets as files)
+function readGatewayToken() {
+  const fromEnv = process.env.OPENCLAW_GATEWAY_TOKEN?.trim();
+  if (fromEnv) return fromEnv;
+  const filePath = process.env.OPENCLAW_GATEWAY_TOKEN_FILE?.trim();
+  if (filePath && fs.existsSync(filePath)) {
+    try {
+      return fs.readFileSync(filePath, "utf-8").trim();
+    } catch {
+      return "";
+    }
+  }
+  return "";
+}
+
+const defaultModel =
+  process.env.OPENCLAW_HF_DEFAULT_MODEL?.trim() || "huggingface/deepseek-ai/DeepSeek-R1";
+const gatewayToken = readGatewayToken();
+const gatewayPassword = process.env.OPENCLAW_GATEWAY_PASSWORD?.trim();
+
+// Trusted proxies: from env, or default HF Space proxy IPs so the Control UI works without setting OPENCLAW_GATEWAY_TRUSTED_PROXIES
+const DEFAULT_HF_TRUSTED_PROXY_IPS = [
+  "10.16.4.123",
+  "10.16.34.155",
+  "10.20.1.9",
+  "10.20.1.222",
+  "10.20.26.157",
+  "10.20.31.87",
+];
+const trustedProxiesRaw = process.env.OPENCLAW_GATEWAY_TRUSTED_PROXIES?.trim();
+const trustedProxies =
+  trustedProxiesRaw && trustedProxiesRaw.length > 0
+    ? trustedProxiesRaw.split(",").map((s) => s.trim()).filter(Boolean)
+    : DEFAULT_HF_TRUSTED_PROXY_IPS;
+// Comma-separated origins allowed for Control UI/WebSocket (e.g. https://your-space.hf.space)
+const allowedOriginsRaw = process.env.OPENCLAW_CONTROL_UI_ALLOWED_ORIGINS?.trim();
+const allowedOrigins = allowedOriginsRaw
+  ? allowedOriginsRaw.split(",").map((s) => s.trim()).filter(Boolean)
+  : [];
+
+let config = {};
+if (fs.existsSync(configPath)) {
+  try {
+    config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+  } catch {
+    // keep config empty
+  }
+}
+
+if (!config.agents) config.agents = {};
+if (!config.agents.defaults) config.agents.defaults = {};
+if (!config.agents.defaults.model) config.agents.defaults.model = {};
+config.agents.defaults.model.primary = defaultModel;
+
+// Auth: token wins if both set; otherwise password
+const useTokenAuth = Boolean(gatewayToken);
+const usePasswordAuth = Boolean(gatewayPassword) && !useTokenAuth;
+if (useTokenAuth || usePasswordAuth) {
+  if (!config.gateway) config.gateway = {};
+  if (!config.gateway.auth) config.gateway.auth = {};
+  if (useTokenAuth) {
+    config.gateway.auth.mode = "token";
+    config.gateway.auth.token = gatewayToken;
+  } else {
+    config.gateway.auth.mode = "password";
+    config.gateway.auth.password = gatewayPassword;
+  }
+}
+// So Control UI can connect with token/password only (no device pairing); Spaces have no CLI for approve.
+if (useTokenAuth || usePasswordAuth) {
+  if (!config.gateway) config.gateway = {};
+  if (!config.gateway.controlUi) config.gateway.controlUi = {};
+  config.gateway.controlUi.dangerouslyDisableDeviceAuth = true;
+}
+
+// Always set trustedProxies (we have a default for HF so the Control UI works behind the HF proxy)
+if (!config.gateway) config.gateway = {};
+config.gateway.trustedProxies = trustedProxies;
+
+if (allowedOrigins.length > 0) {
+  if (!config.gateway) config.gateway = {};
+  if (!config.gateway.controlUi) config.gateway.controlUi = {};
+  config.gateway.controlUi.allowedOrigins = allowedOrigins;
+}
+
+fs.mkdirSync(stateDir, { recursive: true });
+fs.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+
+// Startup log: confirm env was applied (check token_present=1 and auth=token so the UI can connect)
+const authKind = useTokenAuth ? "token" : usePasswordAuth ? "password" : "none";
+const parts = [
+  `token_present=${useTokenAuth ? "1" : "0"}`,
+  `password_present=${usePasswordAuth ? "1" : "0"}`,
+  `auth=${authKind}`,
+  `trustedProxies=${trustedProxies.length}`,
+  `allowedOrigins=${allowedOrigins.length}`,
+];
+console.log(`[openclaw-hf-setup] ${parts.join(" ")} -> ${configPath}`);
+if (authKind === "none") {
+  console.warn(
+    "[openclaw-hf-setup] No auth set. Add OPENCLAW_GATEWAY_TOKEN or OPENCLAW_GATEWAY_PASSWORD in Space Secrets, then restart.",
+  );
+}