openclaw.nomad.hcl

job "openclaw" {
  datacenters = ["dc1"]
  type        = "service"

  group "openclaw" {
    count = 1
    network {
      port "http" {
        to = 18789
      }
      port "xpra" {
        to = 7756
      }
      port "ran" {
        to = 8080
      }
    }

    task "openclaw" {
      driver = "docker"

      config {
        image      = "justmiles/carapace:v0.0.7"
        force_pull = false
        ports      = ["http", "ran", "xpra"]
        volumes = [
          "/mnt/data/nomad/openclaw/tailscale:/home/openclaw/.tailscale",
          "/mnt/data/nomad/openclaw/config:/home/openclaw/.openclaw",
          "/mnt/data/nomad/openclaw/workspace:/workspace",
        ]
      }

      env {
        HOME            = "/home/openclaw"
        NODE_ENV        = "production"
        TERM            = "xterm-256color"
        PATH            = "/home/linuxbrew/.linuxbrew/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
        XDG_CONFIG_HOME = "/home/openclaw/.openclaw"

        OPENCLAW_GATEWAY_TOKEN = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
        OPENCLAW_GATEWAY_BIND  = "lan"
        OPENCLAW_GATEWAY_PORT  = 18789
        GOG_KEYRING_PASSWORD   = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

        AWS_REGION            = "us-west-1"
        AWS_ACCESS_KEY_ID     = "XXXXXXXXX"
        AWS_SECRET_ACCESS_KEY = "XXXXXXXXX"

        TS_AUTH_KEY      = "tskey-auth-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
        TS_HOSTNAME      = "kit"
        TS_STATE_DIR     = "/home/openclaw/.tailscale"
        TS_ACCEPT_ROUTES = "true"
        TS_USERSPACE     = "true"
        TS_ACCEPT_DNS    = "true"
        TS_EXTRA_ARGS    = "--ssh"
      }

      resources {
        cpu        = 1024 * 4
        memory     = 2048 * 8
        memory_max = 2048 * 10
      }
    }

    service {
      name     = "openclaw"
      port     = "http"
      provider = "nomad"
      tags = [
        "traefik.enable=true",
        "traefik.http.routers.openclaw.rule=Host(`openclaw.justmiles.net`)",
        "traefik.http.routers.openclaw.tls.certresolver=letsencryptViaRoute53",
        "traefik.http.routers.openclaw.middlewares=localnetwork@file",
      ]
    }

    service {
      name     = "openclaw-xpra"
      port     = "xpra"
      provider = "nomad"
      tags = [
        "traefik.enable=true",
        "traefik.http.routers.openclaw-xpra.rule=Host(`openclaw-xpra.justmiles.net`)",
        "traefik.http.routers.openclaw-xpra.tls.certresolver=letsencryptViaRoute53",
        "traefik.http.routers.openclaw-xpra.middlewares=localnetwork@file",
      ]
    }

    service {
      name     = "openclaw-ran"
      port     = "ran"
      provider = "nomad"
      tags = [
        "traefik.enable=true",
        "traefik.http.routers.openclaw-ran.rule=Host(`files.justmiles.io`)",
        "traefik.http.routers.openclaw-ran.entrypoints=tunneld",
      ]
    }
  }
}