@simplehomelab/deployrr 6.0.0-rc3

package/apps/unofficial/openclaw/files/pre-install.sh

@@ -0,0 +1,174 @@
+#!/bin/bash
+# OpenClaw pre-install hook
+# Clones the OpenClaw repo and builds the Docker image with extra packages
+# Uses upstream pnpm build with OPENCLAW_DOCKER_APT_PACKAGES and OPENCLAW_INSTALL_BROWSER
+# Includes: git, curl, jq, build-essential, Chromium/Playwright baked into image
+# Auto-configures 9Router integration if available
+
+
+BUILD_DIR="$DOCKER_FOLDER/appdata/openclaw/build"
+IMAGE_NAME="deployrr/openclaw:latest"
+CONFIG_DIR="$DOCKER_FOLDER/appdata/shared/openclaw-cli"
+APP_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+# Step 1: Check if image already exists
+f_print_substep "Checking for existing OpenClaw image..."
+if sudo docker image inspect "$IMAGE_NAME" &>/dev/null; then
+	f_print_substep "Image $IMAGE_NAME already exists"
+	f_print_substep "To rebuild, run: sudo docker rmi $IMAGE_NAME"
+else
+	# Step 2: Clone or update the OpenClaw repository
+	f_print_substep "Preparing OpenClaw source code..."
+	if [[ -d "$BUILD_DIR/.git" ]]; then
+		f_print_substep "Updating existing repository..."
+		if ! sudo git -C "$BUILD_DIR" pull --ff-only; then
+			f_print_substep "Pull failed, re-cloning..."
+			sudo rm -rf "$BUILD_DIR"
+			if ! sudo git clone --depth 1 https://github.com/openclaw/openclaw.git "$BUILD_DIR"; then
+				f_print_error "Failed to clone OpenClaw repository"
+				return 1
+			fi
+		fi
+	else
+		f_print_substep "Cloning OpenClaw repository (this may take a minute)..."
+		sudo mkdir -p "$(dirname "$BUILD_DIR")"
+		sudo rm -rf "$BUILD_DIR"
+		if ! sudo git clone --depth 1 https://github.com/openclaw/openclaw.git "$BUILD_DIR"; then
+			f_print_error "Failed to clone OpenClaw repository"
+			return 1
+		fi
+	fi
+
+	# Fix permissions so build context is readable
+	sudo chmod -R a+rX "$BUILD_DIR"
+
+	# Step 3: Validate build context has essential files
+	for _required_file in package.json pnpm-lock.yaml .npmrc pnpm-workspace.yaml; do
+		if ! sudo test -f "$BUILD_DIR/$_required_file"; then
+			f_print_error "Build context missing '$_required_file' — clone may have failed"
+			f_print_error "Try removing $BUILD_DIR and re-running the installer"
+			return 1
+		fi
+	done
+	f_print_substep "Build context validated ($(sudo du -sh "$BUILD_DIR" | cut -f1) source tree)"
+
+	# Step 4: Copy the full Dockerfile into the build context
+	f_print_substep "Using full-featured Dockerfile (pnpm + extra packages)..."
+	sudo cp "$APP_DIR/Dockerfile.full" "$BUILD_DIR/Dockerfile.full"
+
+	# Step 7: Build the Docker image with extra packages (using full paths, no cd needed)
+	f_print_substep "Building OpenClaw image (this may take 10-15 minutes)..."
+	f_print_substep "Image name: $IMAGE_NAME"
+	f_print_substep "Includes: git, curl, jq, build-essential, Chromium/Playwright"
+	if sudo docker build -t "$IMAGE_NAME" -f "$BUILD_DIR/Dockerfile.full" "$BUILD_DIR"; then
+		f_print_success "OpenClaw image built successfully"
+	else
+		f_print_error "Failed to build OpenClaw image"
+		return 1
+	fi
+fi
+
+# Step 8: Read the gateway token Deployrr generated and write it to the service env file.
+# We use env_file: in compose (not Docker secrets) because Docker Compose standalone secrets
+# are bind-mounted with the host file's permissions (root:root 0600), and mode: in compose
+# does NOT override host permissions for file-type secrets. env_file is read by the Docker
+# daemon (root) and injected as env vars — the container process never reads any file.
+f_print_substep "Reading gateway token from Docker secret..."
+sudo mkdir -p "$DOCKER_FOLDER/secrets"
+GATEWAY_TOKEN=$(sudo cat "$DOCKER_FOLDER/secrets/openclaw_gateway_token" 2>/dev/null)
+if [[ -z "$GATEWAY_TOKEN" ]]; then
+	f_print_error "Gateway token secret not found — Deployrr should have created it before pre-install"
+	return 1
+fi
+
+# Write the env file that compose injects via env_file:
+# root:root 0600 — only root can read it on the host; Docker daemon reads it as root
+sudo bash -c "printf 'OPENCLAW_GATEWAY_TOKEN=%s\n' '$GATEWAY_TOKEN' > '$DOCKER_FOLDER/secrets/openclaw.env'"
+sudo chmod 600 "$DOCKER_FOLDER/secrets/openclaw.env"
+sudo chown root:root "$DOCKER_FOLDER/secrets/openclaw.env"
+export OPENCLAW_GATEWAY_TOKEN="$GATEWAY_TOKEN"
+f_print_success "Gateway token written to env file (root:root 0600)"
+
+# Step 6b: Clean stale device identity/pairing state from previous installs
+# These directories cache device-auth and paired-device data tied to the old token.
+# Without cleaning them, a new token causes "1008: pairing required" errors.
+f_print_substep "Cleaning stale device pairing state..."
+for _stale_dir in identity devices credentials sessions; do
+    if sudo test -d "$CONFIG_DIR/$_stale_dir"; then
+        sudo rm -rf "$CONFIG_DIR/$_stale_dir"
+        f_print_substep "Removed stale $_stale_dir directory"
+    fi
+done
+
+# Step 7: Ensure config directory exists
+# NOTE: openclaw.json is written in post-install AFTER the container starts.
+# The container overwrites openclaw.json on first startup (normalizes it),
+# so writing it here would be immediately discarded. Post-install writes it
+# after the container has done its first-run initialization, then restarts
+# the container so it picks up allowInsecureAuth and trustedProxies.
+f_print_substep "Preparing OpenClaw config directory..."
+sudo mkdir -p "$CONFIG_DIR"
+
+
+
+# Step 8: Set ownership of ALL volume-mounted directories (container runs as node:1000)
+f_print_substep "Setting directory ownership (UID 1000 for node user)..."
+sudo mkdir -p "$DOCKER_FOLDER/appdata/openclaw/home"
+sudo chown -R 1000:1000 "$CONFIG_DIR"
+sudo chown -R 1000:1000 "$DOCKER_FOLDER/appdata/openclaw/workspace"
+sudo chown -R 1000:1000 "$DOCKER_FOLDER/appdata/openclaw/home"
+
+# Step 9: Run non-interactive onboard to create device identity
+# This is CRITICAL — without it, the gateway has no approved devices and
+# all connections (browser UI, CLI) get "1008: pairing required".
+# Upstream flow: build → onboard → start gateway. We replicate this with raw docker run.
+f_print_substep "Running OpenClaw onboarding (creating device identity)..."
+
+# Build onboard args — with or without 9Router provider
+ONBOARD_ARGS=(
+	"onboard" "--non-interactive" "--accept-risk"
+	"--gateway-port" "18789"
+	"--gateway-bind" "lan"
+	"--no-install-daemon"
+	"--skip-skills"
+)
+
+# If 9Router is running, configure it as the provider during onboard
+if sudo docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^9router$'; then
+	ONBOARD_ARGS+=(
+		"--auth-choice" "custom-api-key"
+		"--custom-base-url" "http://9router:20128/v1"
+		"--custom-model-id" "auto"
+		"--custom-api-key" "sk_9router"
+		"--custom-provider-id" "9router"
+		"--custom-compatibility" "openai"
+	)
+fi
+
+# Run onboard via raw docker run (not compose — avoids timing issues)
+# Must use same volumes so identity is written to the shared config dir
+# Pass OPENCLAW_GATEWAY_TOKEN so onboarding registers this gateway's identity
+# with the correct token (the one Deployrr generated and stored in the secret).
+if sudo docker run --rm \
+	-e HOME=/home/node \
+	-e OPENCLAW_GATEWAY_TOKEN="$GATEWAY_TOKEN" \
+	-v "$CONFIG_DIR:/home/node/.openclaw" \
+	-v "$DOCKER_FOLDER/appdata/openclaw/workspace:/home/node/.openclaw/workspace" \
+	--user 1000:1000 \
+	"$IMAGE_NAME" \
+	node openclaw.mjs "${ONBOARD_ARGS[@]}" 2>&1; then
+	f_print_success "Device identity created — pairing will be automatic"
+else
+	f_print_warning "Onboard returned non-zero (may still work — identity might already exist)"
+fi
+
+# Step 10: Verify Docker socket access for sandbox support
+f_print_substep "Checking Docker socket access for sandbox support..."
+if [[ -S /var/run/docker.sock ]]; then
+	f_print_substep "Docker socket available — sandbox features enabled"
+	f_print_substep "Chromium/Playwright pre-installed in image (no first-run download needed)"
+else
+	f_print_warning "Docker socket not found — sandbox features will be limited"
+fi
+
+f_print_success "OpenClaw pre-install completed"

package/apps/unofficial/openclaw/manifest.json

@@ -0,0 +1,178 @@
+{
+    "$schema": "../../../apps/manifest-schema.json",
+    "version": "1.2",
+    "app": {
+        "sname": "openclaw",
+        "pname": "OpenClaw",
+        "description": "Power-user OpenClaw deployment with agent sandboxing, persistent home volume, and Playwright browser support. WARNING: Mounts Docker socket to enable agent sandbox containers — grants the container access to the host Docker daemon.",
+        "descriptionShort": "AI assistant w/ sandbox (9Router rec.)",
+        "icon": "https://raw.githubusercontent.com/openclaw/openclaw/main/ui/public/favicon.svg",
+        "category": "unofficial",
+        "menuNumber": "06",
+        "tags": [
+            "ai",
+            "development",
+            "coding",
+            "llm",
+            "pro",
+            "risky"
+        ]
+    },
+    "deployment": {
+        "type": "single",
+        "compose": "compose.yml",
+        "profiles": [
+            "apps",
+            "all"
+        ],
+        "networks": [
+            "default"
+        ],
+        "build": {
+            "imageName": "deployrr/openclaw:latest",
+            "localBuild": true
+        },
+        "webui": true,
+        "port": 18789,
+        "protocol": "http"
+    },
+    "requirements": {
+        "prerequisites": [
+            "prerequisites",
+            "pro"
+        ]
+    },
+    "env": {
+        "variables": [
+            {
+                "name": "OPENCLAW_PORT",
+                "description": "OpenClaw gateway web interface port",
+                "type": "port",
+                "default": 18789,
+                "prompt": true,
+                "required": true,
+                "validation": {
+                    "type": "port",
+                    "min": 1,
+                    "max": 65535
+                }
+            },
+            {
+                "name": "OPENCLAW_OLLAMA_HEARTBEAT",
+                "description": "Route heartbeats to Ollama (free) instead of paid API",
+                "promptText": "Route heartbeats to a FREE local LLM via Ollama?\n\nBy default, OpenClaw heartbeats use your paid API.\nIf you have Ollama installed, this will pull llama3.2:3b\nand route heartbeat checks through it instead — saving\n~$5-15/month on API costs.\n\nRequires: Ollama container running.\n\nType 'yes' to enable or 'no' to skip:",
+                "type": "string",
+                "default": "no",
+                "prompt": true,
+                "required": false
+            }
+        ],
+        "secrets": [
+            {
+                "name": "openclaw_gateway_token",
+                "description": "Gateway authentication token — passed to the gateway process via OPENCLAW_GATEWAY_TOKEN env var. Generated by Deployrr and stored as a Docker secret.",
+                "type": "random",
+                "length": 32,
+                "addToCompose": false
+            },
+            {
+                "name": "openclaw.env",
+                "description": "Derived env file written by pre-install containing OPENCLAW_GATEWAY_TOKEN. Used by compose via env_file: since Docker standalone secrets cannot override host file permissions.",
+                "type": "derived",
+                "addToCompose": false
+            }
+        ],
+        "constants": [
+            {
+                "name": "OPENCLAW_CONFIG_DIR",
+                "value": "$DOCKERDIR/appdata/openclaw/config",
+                "description": "OpenClaw configuration directory"
+            },
+            {
+                "name": "OPENCLAW_WORKSPACE_DIR",
+                "value": "$DOCKERDIR/appdata/openclaw/workspace",
+                "description": "OpenClaw workspace directory"
+            }
+        ]
+    },
+    "hooks": {
+        "preInstall": {
+            "runOnUpdate": true,
+            "dialog": {
+                "type": "warning",
+                "title": "OpenClaw - RISKY Deployment",
+                "message": "\\Z1⚠ SECURITY WARNING:\\Zn This deployment mounts the Docker socket.\\n\\nThis grants the container full access to your host Docker daemon, which allows it to:\\n• Create and destroy containers on your host\\n• Access host networking and volumes\\n• Potentially escalate privileges\\n\\nThis enables the \\Z4Agent Sandbox\\Zn feature (isolated containers per agent) and \\Z4Playwright\\Zn browser automation.\\n\\nOnly install this if you understand the risks.\\n\\nDo you want to proceed?"
+            },
+            "script": "files/pre-install.sh"
+        },
+        "postInstall": {
+            "script": "files/post-install.sh",
+            "messages": [
+                {
+                    "style": "info",
+                    "text": "OpenClaw gateway is running at http://$SERVER_LAN_IP:$OPENCLAW_PORT"
+                },
+                {
+                    "style": "note",
+                    "text": "Your gateway token has been saved to $DOCKER_FOLDER/secrets/openclaw_gateway_token"
+                },
+                {
+                    "style": "info",
+                    "text": "Traefik handles authentication automatically — no token or device pairing needed via your domain URL."
+                },
+                {
+                    "style": "info",
+                    "text": "If 9Router is installed: Open 9Router dashboard → Providers → connect at least one provider → OpenClaw is ready!"
+                },
+                {
+                    "style": "note",
+                    "text": "If 9Router is NOT installed: Configure API providers manually via OpenClaw Settings or use: docker exec -it openclaw openclaw configure"
+                },
+                {
+                    "style": "warning",
+                    "text": "Docker socket is mounted — this container can manage host Docker resources."
+                },
+                {
+                    "style": "info",
+                    "text": "Agent sandbox enabled. Build sandbox image: sudo docker compose run --rm openclaw node /app/node_modules/playwright-core/cli.js install chromium"
+                },
+                {
+                    "style": "info",
+                    "text": "If Ollama heartbeat was configured, heartbeats use ollama/llama3.2:3b (free) instead of your paid API."
+                },
+                {
+                    "style": "info",
+                    "text": "For more info: https://docs.openclaw.ai/install/docker#power-user-%2F-full-featured-container-opt-in"
+                }
+            ],
+            "copyValue": "$OPENCLAW_GATEWAY_TOKEN",
+            "copyLabel": "Copy Token"
+        }
+    },
+    "folders": {
+        "appdata": [
+            "config",
+            "workspace"
+        ]
+    },
+    "traefik": {
+        "supported": true
+    },
+    "dashboard": {
+        "enabled": true,
+        "location": "local",
+        "showStats": true,
+        "portVariable": "OPENCLAW_PORT"
+    },
+    "status": {
+        "file": "06_openclaw_status",
+        "successMessage": "OpenClaw Setup Completed",
+        "telemetryAction": "openclaw"
+    },
+    "removal": {
+        "browserLocalStorageKeys": [
+            "openclaw.control.settings.v1",
+            "openclaw-device-identity-v1"
+        ]
+    }
+}

package/apps/version_pins

@@ -0,0 +1,67 @@
+# CORE APPS
+AUTHENTIK_VERSION_PIN_DEFAULT='2025.12.1'
+AUTHENTIKWORKER_VERSION_PIN_DEFAULT='2025.12.1'
+AUTHENTIKPOSTGRESQL_VERSION_PIN_DEFAULT='16-alpine'
+AUTHELIA_VERSION_PIN_DEFAULT='4.39.15'
+TINYAUTH_VERSION_PIN_DEFAULT='v5'
+TRAEFIK_VERSION_PIN_DEFAULT='3.6'
+TRAEFIKBOUNCER_VERSION_PIN_DEFAULT='v1.4.7'
+DEPLOYRRDASHBOARD_VERSION_PIN_DEFAULT='v1.9.0'
+NPM_VERSION_PIN_DEFAULT='2.13.2'
+OAUTH_VERSION_PIN_DEFAULT='latest'
+
+# OFFICIAL APPS
+POSTGRESQL_VERSION_PIN_DEFAULT='18-alpine'
+N8N_VERSION_PIN_DEFAULT='2.7.0'
+N8NPOSTGRESQL_VERSION_PIN_DEFAULT='18-alpine'
+IMMICH_VERSION_PIN_DEFAULT='v2.5.3'
+IMMICHPOSTGRESQL_VERSION_PIN_DEFAULT='14-vectorchord0.4.3-pgvectors0.2.0'
+IMMICHREDIS_VERSION_PIN_DEFAULT='alpine'
+IMMICHMACHINELEARNING_VERSION_PIN_DEFAULT='v2.5.3'
+AUTOBRR_VERSION_PIN_DEFAULT='latest'
+AUTOBRRPOSTGRESQL_VERSION_PIN_DEFAULT='18-alpine'
+GAMEVAULT_VERSION_PIN_DEFAULT='latest'
+GAMEVAULTPOSTGRESQL_VERSION_PIN_DEFAULT='18-alpine'
+DOCKHAND_VERSION_PIN_DEFAULT='latest'
+DOCKHANDPOSTGRESQL_VERSION_PIN_DEFAULT='18-alpine'
+GUACAMOLE_VERSION_PIN_DEFAULT='latest'
+GUACAMOLEMARIADB_VERSION_PIN_DEFAULT='latest'
+GUACD_VERSION_PIN_DEFAULT='latest'
+FLOWISE_VERSION_PIN_DEFAULT='latest'
+FLOWISEPOSTGRESQL_VERSION_PIN_DEFAULT='18-alpine'
+FLOWISEREDIS_VERSION_PIN_DEFAULT='alpine'
+SEARXNGREDIS_VERSION_PIN_DEFAULT='alpine'
+PDFDING_VERSION_PIN_DEFAULT='latest'
+PDFDINGPOSTGRESQL_VERSION_PIN_DEFAULT='18-alpine'
+NEXTCLOUD_VERSION_PIN_DEFAULT='latest'
+NEXTCLOUDMARIADB_VERSION_PIN_DEFAULT='latest'
+NEXTCLOUDREDIS_VERSION_PIN_DEFAULT='alpine'
+SCRUTINY_VERSION_PIN_DEFAULT='master-web'
+SCRUTINYINFLUXDB_VERSION_PIN_DEFAULT='2-alpine'
+PAPERLESSNGX_VERSION_PIN_DEFAULT='latest'
+PAPERLESSNGXMARIADB_VERSION_PIN_DEFAULT='latest'
+PAPERLESSNGXREDIS_VERSION_PIN_DEFAULT='alpine'
+GOTENBERG_VERSION_PIN_DEFAULT='latest'
+TIKA_VERSION_PIN_DEFAULT='latest'
+LANGFUSE_VERSION_PIN_DEFAULT='3'
+LANGFUSEWORKER_VERSION_PIN_DEFAULT='3'
+LANGFUSEPOSTGRESQL_VERSION_PIN_DEFAULT='17-alpine'
+LANGFUSEREDIS_VERSION_PIN_DEFAULT='7-alpine'
+LANGFUSECLICKHOUSE_VERSION_PIN_DEFAULT='latest'
+LANGFUSEMINIO_VERSION_PIN_DEFAULT='latest'
+SUPABASE_VERSION_PIN_DEFAULT='2026.02.16-sha-26c615c'
+SUPABASEKONG_VERSION_PIN_DEFAULT='2.8.1'
+SUPABASEAUTH_VERSION_PIN_DEFAULT='v2.186.0'
+SUPABASEREST_VERSION_PIN_DEFAULT='v14.5'
+SUPABASEREALTIME_VERSION_PIN_DEFAULT='v2.76.5'
+SUPABASESTORAGE_VERSION_PIN_DEFAULT='v1.37.8'
+SUPABASEIMGPROXY_VERSION_PIN_DEFAULT='v3.30.1'
+SUPABASEMETA_VERSION_PIN_DEFAULT='v0.95.2'
+SUPABASEFUNCTIONS_VERSION_PIN_DEFAULT='v1.70.3'
+SUPABASEANALYTICS_VERSION_PIN_DEFAULT='1.31.2'
+SUPABASEDB_VERSION_PIN_DEFAULT='15.8.1.085'
+SUPABASEVECTOR_VERSION_PIN_DEFAULT='0.53.0-alpine'
+SUPABASEPOOLER_VERSION_PIN_DEFAULT='2.7.4'
+
+# COMMUNITY APPS
+# (none yet)

package/bin/deployrr-init.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DEPLOYRR_DIR="/opt/deployrr"
+
+echo "🚀 Deployrr Installer"
+echo "━━━━━━━━━━━━━━━━━━━━━"
+
+if [[ $EUID -ne 0 ]]; then
+  echo "This installer requires root privileges."
+  echo "Run: sudo npx @simplehomelab/deployrr"
+  exit 1
+fi
+
+# Create runtime directories
+mkdir -p "$DEPLOYRR_DIR/apps"
+
+# Copy app files from npm package
+echo "📦 Installing app files..."
+cp -r "$SCRIPT_DIR/apps/"* "$DEPLOYRR_DIR/apps/"
+cp "$SCRIPT_DIR/latest-version" "$DEPLOYRR_DIR/" 2>/dev/null || true
+cp "$SCRIPT_DIR/announcement" "$DEPLOYRR_DIR/" 2>/dev/null || true
+
+# Detect architecture
+ARCH=$(uname -m)
+case "$ARCH" in
+  x86_64)  ARCH_SUFFIX="" ;;
+  aarch64) ARCH_SUFFIX="-arm" ;;
+  *)
+    echo "❌ Unsupported architecture: $ARCH"
+    exit 1
+    ;;
+esac
+
+VERSION=$(cat "$SCRIPT_DIR/latest-version" 2>/dev/null || echo "6.0")
+BINARY="deployrr_v${VERSION}${ARCH_SUFFIX}.app"
+
+echo "📥 Downloading Deployrr v${VERSION} (${ARCH})..."
+if curl -fsSL -o "$DEPLOYRR_DIR/$BINARY" \
+  "https://files.deployrr.app/binary/${VERSION}/${ARCH}"; then
+  chmod +x "$DEPLOYRR_DIR/$BINARY"
+  echo ""
+  echo "✅ Deployrr v${VERSION} installed to $DEPLOYRR_DIR/$BINARY"
+  echo "   Run: sudo $DEPLOYRR_DIR/$BINARY"
+else
+  echo "❌ Download failed. Check your internet connection."
+  exit 1
+fi

package/latest-version

@@ -0,0 +1 @@
+6.0

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@simplehomelab/deployrr",
+  "version": "6.0.0-rc3",
+  "description": "Deployrr - Docker homelab deployment manager",
+  "bin": {
+    "deployrr": "./bin/deployrr-init.sh"
+  },
+  "files": [
+    "apps/",
+    "bin/",
+    "latest-version",
+    "announcement"
+  ],
+  "keywords": ["docker", "homelab", "deployment", "compose"],
+  "author": "SimpleHomelab",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/SimpleHomelab/Deployrr.git"
+  }
+}