{"id":44859028,"url":"https://github.com/pomerium/openclaw-pomerium-guide","last_synced_at":"2026-02-17T08:37:56.933Z","repository":{"id":337458184,"uuid":"1150778806","full_name":"pomerium/openclaw-pomerium-guide","owner":"pomerium","description":"A guide for hardening access to OpenClaw","archived":false,"fork":false,"pushed_at":"2026-02-09T16:55:07.000Z","size":17,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-02-09T20:28:51.245Z","etag":null,"topics":["clawdbot","iap","identity-aware-proxy","moltbot","openclaw","ssh"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pomerium.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-02-05T17:20:15.000Z","updated_at":"2026-02-09T16:55:10.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/pomerium/openclaw-pomerium-guide","commit_stats":null,"previous_names":["pomerium/openclaw-pomerium-guide"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/pomerium/openclaw-pomerium-guide","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pomerium%2Fopenclaw-pomerium-guide","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pomerium%2Fopenclaw-pomerium-guide/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pomerium%2Fopenclaw-pomerium-guide/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pomerium%2Fopenclaw-pomerium-guide/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pomerium","download_url":"https://codeload.github.com/pomerium/openclaw-pomerium-guide/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pomerium%2Fopenclaw-pomerium-guide/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29537914,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-17T08:11:05.436Z","status":"ssl_error","status_checked_at":"2026-02-17T08:09:38.860Z","response_time":100,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["clawdbot","iap","identity-aware-proxy","moltbot","openclaw","ssh"],"created_at":"2026-02-17T08:37:56.778Z","updated_at":"2026-02-17T08:37:56.868Z","avatar_url":"https://github.com/pomerium.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Securing Access to OpenClaw Gateway\n\n\u003e [!WARNING]\n\u003e **Security Scope:** OpenClaw (formerly known as Moltbot and Clawdbot) is not production-ready software and has known security limitations. **This guide secures access to OpenClaw** (SSH and gateway portal) using Pomerium's identity-aware proxy, but **does not address OpenClaw's internal security model**. For details on OpenClaw's security considerations, see the [OpenClaw Gateway Security documentation](https://docs.openclaw.ai/gateway/security).\n\u003e\n\u003e **What Pomerium Secures:**\n\u003e\n\u003e - User authentication and identity verification\n\u003e - Access control to SSH and gateway endpoints\n\u003e - Network-level protection\n\u003e\n\u003e **What This Guide Does NOT Secure:**\n\u003e\n\u003e - OpenClaw's internal operations and tool execution\n\u003e - Code or commands run by authenticated users\n\n\nA containerized deployment of [OpenClaw](https://openclaw.ai/) deployment secured by Pomerium's zero-trust identity-aware proxy.\n\n## Getting Started\n\nFor complete setup instructions, configuration options, and troubleshooting, please refer to the [comprehensive guide](https://docs.pomerium.com/guides/openclaw-gateway).\n\n## Quick Setup\n\n### New to Pomerium SSH? (Recommended Path)\n\n```bash\n# 1. Clone this repository\n\n# git clone\ngit clone https://github.com/pomerium/openclaw-pomerium-guide\n\n# via GitHub CLI\ngh repo clone pomerium/openclaw-pomerium-guide\n\ncd openclaw-pomerium-guide\n\n# 2. Configure environment\ncp .env.example .env\n# Edit .env with your Pomerium Zero token and cluster domain\n\n# 3. Generate SSH keys\n./setup-ssh.sh\n\n# 4. Start services\ndocker-compose up -d\n```\n\n### Already Have Pomerium SSH Configured?\n\nIf you already have SSH routes configured in Pomerium Zero with a User CA key:\n\n```bash\n# 1. Clone this repository (same as above)\n\n# 2. Configure environment (same as above)\n\n# 3. Copy your existing User CA public key\n# Instead of running setup-ssh.sh, manually copy your existing public key:\ncp /path/to/your/existing/pomerium_user_ca_key.pub ./openclaw-data/pomerium-ssh/\n\n# 4. Start services\ndocker-compose up -d\n```\n\n**Note:** Generating new SSH keys will invalidate your existing Pomerium SSH configuration. Only run `./setup-ssh.sh` if you're setting up Pomerium SSH for the first time or intentionally rotating your keys.\n\nFor detailed prerequisites, network requirements, and step-by-step instructions, see the [full guide](https://deploy-preview-2084--pomerium-docs.netlify.app/docs/guides/openclaw-gateway).\n\n## What's Included\n\n- **Pomerium**: Zero-trust authentication proxy on port 443\n- **OpenClaw Gateway**: AI assistant that takes action across your digital life\n- **Verify**: Pomerium's verification service for testing authentication\n\n## Architecture\n\nOpenClaw is distributed as an npm package and doesn't provide an official Docker image. This repository includes a custom Dockerfile (`openclaw/Dockerfile`) that builds a gateway container with:\n\n- OpenClaw CLI installed from npm\n- SSH server with Pomerium User CA integration\n- Git for agent operations\n- Persistent workspace mounted at `/claw/workspace`\n\nThe gateway runs on an internal Docker network with none of those ports exposed to the internet. All access is proxied through Pomerium, which provides identity-aware, zero-trust access control. SSH traffic via port 2200 and HTTPS traffic via port 443 are secured with context-based authorization policies that verify user identity and device posture before granting access. See the [deployment guide](https://docs.pomerium.com/guides/openclaw-gateway) for detailed architecture and security considerations. Where you deploy, port 22 will typically be open by default. Once Pomerium is configured, you can disable direct port 22 access (recommended), ensuring all SSH connections are authenticated and authorized through Pomerium's policy engine.\n\n## References\n\nFor issues or questions, please refer to:\n- [OpenClaw Gateway Guide](https://docs.pomerium.com/guides/openclaw-gateway)\n- [Pomerium Documentation](https://www.pomerium.com/docs)\n- [OpenClaw](https://openclaw.ai)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpomerium%2Fopenclaw-pomerium-guide","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpomerium%2Fopenclaw-pomerium-guide","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpomerium%2Fopenclaw-pomerium-guide/lists"}