#### docker-compose.yaml
```yaml
services:
  curl:
    image: alpine/curl
    container_name: curl
    environment:
      HTTP_PROXY: http://mihomo:1080 # or http://host.docker.internal:1080
      HTTPS_PROXY: http://mihomo:1080 # or http://host.docker.internal:1080
      ALL_PROXY: socks5://mihomo:1080 # or socks5://host.docker.internal:1080
      NO_PROXY: localhost,127.0.0.0/8,host.docker.internal
    command: curl -I https://google.com
    extra_hosts:
      - host.docker.internal:host-gateway
  mihomo:
    container_name: mihomo
    image: metacubex/mihomo:latest
    restart: unless-stopped
    volumes:
      - ${PWD}/mihomo/:/root/.config/mihomo/
    ports:
      - 127.0.0.1:1080:1080
      - 127.0.0.1:1080:1080/udp
    extra_hosts:
      - host.docker.internal:host-gateway
```

#### ${PWD}/mihomo/config.yaml
```yaml
mixed-port: 1080
ipv6: false
allow-lan: true
mode: "rule"
log-level: "warning"
# ···
```


```shell
sudo tee /etc/docker/daemon.json <<-'EOF'
{
  "proxies": {
    "http-proxy": "http://127.0.0.1:1080",
    "https-proxy": "http://127.0.0.1:1080",
    "no-proxy": "localhost,127.0.0.0/8"
  }
}
EOF

mkdir ~/.docker/
tee ~/.docker/config.json <<-'EOF'
{
 "proxies": {
   "default": {
     "httpProxy": "http://mihomo:1080",
     "httpsProxy": "http://mihomo:1080",
     "noProxy": "localhost,127.0.0.0/8"
   }
 }
}
EOF

sudo systemctl daemon-reload
sudo systemctl restart docker
```

```shell
# 检查是否已存在 HTTP_PROXY 配置，若不存在则追加
if ! sudo grep -q "^HTTP_PROXY=" /etc/environment; then
    sudo tee -a /etc/environment << EOF

# Proxy Configuration
https_proxy="http://127.0.0.1:1080"
http_proxy="http://127.0.0.1:1080"
all_proxy="socks5://127.0.0.1:1080"
no_proxy="localhost,127.0.0.0/8"
EOF
    echo "✓ 代理配置已追加"
else
    echo "⚠ 代理配置已存在，跳过追加"
fi
```

**参考链接**:
- [Mihomo 官方文档](https://wiki.metacubex.one/)
- [Docker 官方文档 - 使用代理](https://docs.docker.com/network/proxy/)

Mihomo for docker

# OpenClaw Docker 部署文档

## 概述

OpenClaw 是一个强大的 AI Agent 平台，支持通过 Docker 进行快速部署。本文档将指导您完成 OpenClaw 的 Docker 部署、配置和使用流程。

### 功能特性

- 🚀 容器化部署，环境隔离
- 🔒 支持 Caddy 反向代理和自动 HTTPS
- 🤖 内置 QQ 机器人频道支持
- 🛠️ 可选的沙箱隔离机制
- 📊 内置健康检查

---

## 前提条件

在开始部署之前，请确保您的系统满足以下要求：

- Docker Engine 20.10+ 
- Docker Compose V2
- 至少 2GB 可用内存
- 已配置域名（如需公开访问）

---

## 目录结构

```
.
├── docker-compose.yaml
├── openclaw/
│   ├── Dockerfile
│   ├── config/           # OpenClaw 配置目录
│   └── workspace/        # 工作空间目录
└── caddy/                # Caddy 数据目录（自动创建）
```

---

## 部署步骤

### 第一步：创建目录结构

```bash
mkdir -p openclaw/config/
mkdir -p openclaw/workspace/
chmod a+rw -R openclaw/
```

### 第二步：创建配置文件

#### docker-compose.yaml

```yaml
services:
  caddy:
    container_name: caddy
    image: caddy:alpine
    restart: unless-stopped
    depends_on:
      - openclaw
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    configs:
      - source: Caddyfile
        target: /etc/caddy/Caddyfile
    volumes:
      - ${PWD}/caddy/:/data/caddy/
      
  openclaw:
    build:
      dockerfile: ${PWD}/openclaw/Dockerfile
    container_name: openclaw
    environment:
      HOME: /home/node
      TERM: xterm-256color
    volumes:
      - ${PWD}/openclaw/config/:/home/node/.openclaw/
      - ${PWD}/openclaw/workspace/:/home/node/.openclaw/workspace/
      ## Uncomment the lines below to enable sandbox isolation
      ## (agents.defaults.sandbox). Requires Docker CLI in the image
      ## (build with --build-arg OPENCLAW_INSTALL_DOCKER_CLI=1) or use
      ## docker-setup.sh with OPENCLAW_SANDBOX=1 for automated setup.
      ## Set DOCKER_GID to the host's docker group GID (run: stat -c '%g' /var/run/docker.sock).
      # - /var/run/docker.sock:/var/run/docker.sock
    # group_add:
    #   - "${DOCKER_GID:-999}"
    # ports:
    #   - "18789:18789"
    #   - "18790:18790"
    restart: unless-stopped
    command: openclaw gateway --bind lan --port 18789

configs:
  Caddyfile:
    content: |
      openclaw.uing.vip {
        # since the container will share the network with wg-easy
        # we can use the proper container name
        reverse_proxy openclaw:18789 {
          header_up Host {host}
          header_up X-Real-IP {remote_host}
          header_up X-Forwarded-For {remote_host}
          header_up X-Forwarded-Proto {scheme}
        }
        # tls internal
        encode zstd gzip
        log {
          output stdout
          format console
          level  ERROR
        }
      }
```

> ⚠️ **重要提示**：请将 `openclaw.uing.vip` 替换为您自己的域名。

#### Dockerfile

```dockerfileFROM ghcr.io/openclaw/openclaw:main-slim

MAINTAINER cainiao <565499699@qq.com>

ENV NODE_OPTIONS "--max-old-space-size=4096" 

USER root

# 配置国内镜像源(阿里云)
RUN npm config set registry https://registry.npmmirror.com && \
    sed -i 's#deb.debian.org#mirrors.aliyun.com#g' /etc/apt/sources.list.d/debian.sources
    
# 配置国内镜像源(腾讯云)
# RUN npm config set registry http://mirrors.cloud.tencent.com/npm/ && \
#     sed -i 's#deb.debian.org#mirrors.cloud.tencent.com#g' /etc/apt/sources.list.d/debian.sources
    
# ClawHub, the skill dock for sharp agents.
RUN npm install -g clawhub@latest

# Skills - The CLI for the open agent skills ecosystem.
RUN npm install -g skills

# MCPorter 🧳 - Call MCPs from TypeScript or as CLI?
RUN npm install -g mcporter@latest

# QQ Bot Channel Plugin for OpenClaw
RUN apt update && \
    apt install -y ffmpeg && \
    rm -rf /var/lib/apt/lists/* && \
    openclaw plugins install @tencent-connect/openclaw-qqbot

# USER node

HEALTHCHECK --interval=3m --timeout=10s --start-period=15s --retries=3 \
  CMD node -e "fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

CMD ["node", "openclaw.mjs", "gateway", "--allow-unconfigured"]

```

### 第三步：构建镜像

```bash
docker compose build openclaw
```

### 第四步：初始化配置

进入容器进行初始配置：

```bash
docker compose run --rm openclaw bash
```

在容器内执行以下命令：

```bash
# 启动配置向导
openclaw onboard

# 设置允许的控制台访问域名
openclaw config set gateway.controlUi.allowedOrigins[2] "https://openclaw.uing.vip"

# 禁用设备认证（可选，根据安全需求决定）
openclaw config set gateway.controlUi.dangerouslyDisableDeviceAuth true

# 配置 QQ 机器人频道（如需要）
# 访问 https://q.qq.com/qqbot/openclaw/login.html 获取 token
openclaw channels add --channel qqbot --token "AppID:AppSecret"

# 退出容器
exit
```

> 💡 **提示**：将 `AppID:AppSecret` 替换为您在 QQ 机器人平台申请的实际凭证。

---

## 启动服务

```bash
docker compose up -d
```

---

## 使用指南

### 访问控制面板

#### 步骤一：获取访问 Token

```bash
docker compose exec openclaw bash
openclaw dashboard --no-open
```

输出示例：
```
Dashboard URL: http://127.0.0.1:18789/#token=your_token_here
```

#### 步骤二：访问 Web 界面

访问地址格式：
```
https://your-domain.com/#token={token}
```

例如：`https://openclaw.uing.vip/#token=your_token_here`

---

## 运维管理

### 进入容器执行命令

```bash
docker compose exec openclaw bash
```

### 查看日志

```bash
# 查看所有服务日志
docker compose logs

# 查看 OpenClaw 服务日志
docker compose logs openclaw

# 实时跟踪日志
docker compose logs -f openclaw
```

### 重启服务

```bash
docker compose restart
```

### 停止服务

```bash
docker compose down
```

---

## 故障排除

| 问题 | 可能原因 | 解决方案 |
|------|----------|----------|
| 无法访问 Web 界面 | 域名解析未生效 | 检查 DNS 配置 |
| Token 无效 | Token 过期 | 重新运行 `openclaw dashboard --no-open` |
| 容器启动失败 | 权限问题 | 检查目录权限 `chmod a+rw -R openclaw/` |
| QQ 机器人无法连接 | Token 错误 | 检查 AppID 和 AppSecret 配置 |

---

## 参考链接

- [OpenClaw 官方文档](https://github.com/openclaw/openclaw)
- [QQ 机器人开放平台](https://q.qq.com/qqbot/openclaw/login.html)
- [Caddy 官方文档](https://caddyserver.com/docs/)
- [Docker Compose 文档](https://docs.docker.com/compose/)、


OpenClaw Docker 部署

我需要从外部访问家里（公司）的内部（NAS等），需要搭建一个 VPN。

网络环境：
1. 公网 IP 服务器一台（我是用了阿里云轻量应用服务器）
2. 位于公司（家里）路由器一台（ImmortalWrt），IP地址:192.168.10.1
3. 位于路由器下边的NAS一台, IP地址:192.168.10.6
4. 位于外部网络（使用手机流量）手机一台

操作步骤：

1. 在服务器上配置域名、防火墙配置（需要开放 tcp 80/tcp 443/udp 51820 端口 ）、系统更新、禁用 ROOT 密码登录等前期安全配置操作。

2. 在服务器上使用 docker-compose 部署 WireGuard Easy (The easiest way to run WireGuard VPN + Web-based Admin UI.)。

```yaml
services:
  caddy:
    container_name: caddy
    image: caddy:alpine
    restart: unless-stopped
    depends_on:
      - wg-easy
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    configs:
      - source: Caddyfile
        target: /etc/caddy/Caddyfile
    volumes:
      - ${PWD}/caddy:/data/caddy/
    networks:
      - wg
  wg-easy:
    environment:
    #  Optional:
     - PORT=80
    #  - HOST=0.0.0.0
    #  - INSECURE=false
      - DISABLE_IPV6=true
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    volumes:
      - ${PWD}/wg-easy:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - "51820:51820/udp"
      # - "51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
      # - NET_RAW # ⚠️ Uncomment if using Podman
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      # - net.ipv6.conf.all.disable_ipv6=0
      # - net.ipv6.conf.all.forwarding=1
      # - net.ipv6.conf.default.forwarding=1
    networks:
      wg:
        ipv4_address: 10.42.42.42
        # ipv6_address: fdcc:ad94:bacf:61a3::2a

networks:
  wg:
    driver: bridge
    # enable_ipv6: true
    ipam:
      driver: default
      config:
        - subnet: 10.42.42.0/24
        # - subnet: fdcc:ad94:bacf:61a3::/64
        
configs:
  Caddyfile:
    content: |
      wg-easy.uing.vip {
        # since the container will share the network with wg-easy
        # we can use the proper container name
        reverse_proxy wg-easy:80
        # tls internal
        encode zstd gzip
        log {
          output stdout
          format console
          level  ERROR
        }
      }
```
3. 登录 WireGuard Easy 页面，配置一下用户名、密码、域名、端口（默认）。
4. 设置 WireGuard Easy， 首页右上角用户图标 -> 管理面板 -> 网络配置

![WireGuard-Easy-Network-Setting.png](/static/img/9c2ba59442e02f4e4ef51507c435a848.WireGuard-Easy-Network-Setting.png)

5. 返回首页 -> 客户端管理 -> 新建 -> ImmortalWrt -> 创建客户端 -> 编辑 -> 保存更改 **(重点：配置服务器允许 IP 时，需要重启 wg-easy 容器 或者 公网服务器)**

![WireGuard-Easy-ImmortalWrt-Setting.png](/static/img/9c1cb31c43dc68883d1b4d76c0947479.WireGuard-Easy-ImmortalWrt-Setting.png)

6. 客户端管理 -> 新建 -> cainiao-xiaomi13 -> 创建客户端
 
7. 在客户端管理页面把 ImmortalWrt 和 cainiao-xiaomi13 配置文件下

8. 登录路由器，安装 luci-proto-wireguard 软件，并重启路由器

9. 重启完成后，登录路由器，网络 -> 接口 -> 添加新接口… -> 名称：wg0 -> 协议：WireGuard VPN -> 创建接口

10. 导入配置文件 -> 拖动步骤7下载的 ImmortalWrt.conf 到对应的地方 -> 导入设置

11. 防火墙设置 -> 创建/分配防火墙区域 -> 自定义: vpn

12. 对端 -> 第一项 -> 编辑 -> 保存

![WireGuard-Easy-ImmortalWrt-Peek-Setting.png](/static/img/e202f5115388c4704ec9978b7f61fce3.WireGuard-Easy-ImmortalWrt-Peek-Setting.png)

13. 保存 -> 保存并应用

14. 网络 -> 防火墙 -> 区域 -> 添加

![WireGuard-Easy-ImmortalWrt-Firewall-Zone-Settings .png](/static/img/3540e0d8087d8f0e7cc51ffdfee37868.WireGuard-Easy-ImmortalWrt-Firewall-Zone-Settings%20.png)

15. 保存 -> 保存并应用 -> 重启路由器



16. 在小米手机上安装 [WireGuard 客户端](https://www.wireguard.com/install/#android-play-store-direct-apk-file) -> 打开应用 -> + -> 两种方法（导入配置/扫描二维码） -> 开启。
 
 - 导入步骤 7 下载的 cainiao-xiaomi13.conf（需要更名，名称太长 WireGuard for Android 不支持）配置文件。
 
 - 打开 WireGuard Easy 页面 -> 客户端管理 -> cainiao-xiaomi13 -> 二维码图标

17. 切换到手机流量并打开浏览器访问 http://192.168.10.1 / http://192.168.10.6:8000 如果能打开，WireGuard VPN 正常工作了

参考：

  - [WireGuard Easy Github](https://github.com/wg-easy/wg-easy)
  - [Caddy Reverse Proxy](https://wg-easy.github.io/wg-easy/latest/examples/tutorials/caddy/)
  - [WireGuard Easy for docker-compose.yml](https://github.com/wg-easy/wg-easy/blob/master/docker-compose.yml)
  - [WireGuard Client](https://www.wireguard.com/install/)

使用 WireGuard Easy 搭建 WireGuard VPN


```shell
brew install macos-fuse-t/homebrew-cask/fuse-t mounty

git clone https://github.com/macos-fuse-t/ntfs-3g.git
cd ntfs-3g

brew install automake autoconf libtool libgcrypt pkg-config gnutls
./autogen.sh
./configure  \
        --prefix=/usr/local \
        --exec-prefix=/usr/local \
        --with-fuse=external \
        --sbindir=/usr/local/bin \
        --bindir=/usr/local/bin
make -j"$(sysctl -n hw.ncpu)"
sudo make install

brew uninstall m4 libgpg-error libtasn1 libtool gmp nettle p11-kit autoconf automake libgcrypt unbound libevent gnutls
rm -rf /opt/homebrew/etc/unbound /opt/homebrew/etc/gnutls
```


参考：
- https://github.com/LeoDBFR/NTFS-MacOS-13-26
- https://github.com/macos-fuse-t/fuse-t
- https://mounty.app/#installation


macOS 15-26 读写 NTFS 格式硬盘

我不小心格式化了EFI分区，导致无法启动 Grub。

1. 使用Ubuntu镜像引导到安装界面，选择试用Ubuntu。
2. 打开终端，输入以下命令。
```bash
sudo mount /dev/sdb1 /mnt
sudo mount /dev/sdb2 /mnt/boot/efi

sudo mount --bind /dev /mnt/dev
sudo mount --bind /dev/pts /mnt/dev/pts
sudo mount --bind /proc /mnt/proc
sudo mount --bind /sys /mnt/sys

sudo chroot /mnt
grub-install --target=x86_64-efi /dev/sdb
grub-install --recheck /dev/sdb
exit

sudo umount /mnt/sys
sudo umount /mnt/proc
sudo umount /mnt/dev/pts
sudo umount /mnt/dev
sudo umount /mnt
```

3. 重启系统


> 还有另外一种不需要 chroot 的方法（未尝试）
```bash
# sudo apt install grub-efi

sudo mount /dev/sdb1 /mnt
sudo mount /dev/sdb2 /mnt/boot/efi

sudo grub-install --target=x86_64-efi /dev/sdb --efi-directory=/mnt/boot/efi --boot-directory=/mnt/boot
```



