From f8dcd3ed837584a4456f10e0915b17e81698660e Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sat, 4 Apr 2026 14:00:36 +0100 Subject: [PATCH] docs: refresh tailscale auth mirrors --- docs/gateway/tailscale.md | 6 ++++-- docs/help/faq.md | 1 + docs/platforms/mac/remote.md | 2 +- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/docs/gateway/tailscale.md b/docs/gateway/tailscale.md index 6bc5187698..af09e9609a 100644 --- a/docs/gateway/tailscale.md +++ b/docs/gateway/tailscale.md @@ -22,8 +22,10 @@ Tailscale provides HTTPS, routing, and (for Serve) identity headers. Set `gateway.auth.mode` to control the handshake: +- `none` (private ingress only) - `token` (default when `OPENCLAW_GATEWAY_TOKEN` is set) - `password` (shared secret via `OPENCLAW_GATEWAY_PASSWORD` or config) +- `trusted-proxy` (identity-aware reverse proxy; see [Trusted Proxy Auth](/gateway/trusted-proxy-auth)) When `tailscale.mode = "serve"` and `gateway.auth.allowTailscale` is `true`, Control UI/WebSocket auth can use Tailscale identity headers @@ -38,8 +40,8 @@ still require token/password auth. This tokenless flow assumes the gateway host is trusted. If untrusted local code may run on the same host, disable `gateway.auth.allowTailscale` and require token/password auth instead. -To require explicit credentials, set `gateway.auth.allowTailscale: false` or -force `gateway.auth.mode: "password"`. +To require explicit shared-secret credentials, set `gateway.auth.allowTailscale: false` +and use `gateway.auth.mode: "token"` or `"password"`. ## Config examples diff --git a/docs/help/faq.md b/docs/help/faq.md index d3fb388285..6acd9d5ed3 100644 --- a/docs/help/faq.md +++ b/docs/help/faq.md @@ -167,6 +167,7 @@ Quick answers plus deeper troubleshooting for real-world setups (local dev, VPS, - **Tailscale Serve** (recommended): keep bind loopback, run `openclaw gateway --tailscale serve`, open `https:///`. If `gateway.auth.allowTailscale` is `true`, identity headers satisfy Control UI/WebSocket auth (no token, assumes trusted gateway host); HTTP APIs still require token/password. - **Tailnet bind**: run `openclaw gateway --bind tailnet --token ""`, open `http://:18789/`, paste token in dashboard settings. + - **Identity-aware reverse proxy**: keep the Gateway behind a non-loopback trusted proxy, configure `gateway.auth.mode: "trusted-proxy"`, then open the proxy URL. - **SSH tunnel**: `ssh -N -L 18789:127.0.0.1:18789 user@host` then open `http://127.0.0.1:18789/` and paste the token in Control UI settings. See [Dashboard](/web/dashboard) and [Web surfaces](/web) for bind modes and auth details. diff --git a/docs/platforms/mac/remote.md b/docs/platforms/mac/remote.md index 631e5c88d2..a49a434398 100644 --- a/docs/platforms/mac/remote.md +++ b/docs/platforms/mac/remote.md @@ -57,7 +57,7 @@ Remote mode supports two transports: - Prefer loopback binds on the remote host and connect via SSH or Tailscale. - SSH tunneling uses strict host-key checking; trust the host key first so it exists in `~/.ssh/known_hosts`. -- If you bind the Gateway to a non-loopback interface, require token/password auth. +- If you bind the Gateway to a non-loopback interface, require valid Gateway auth: token, password, or an identity-aware reverse proxy with `gateway.auth.mode: "trusted-proxy"`. - See [Security](/gateway/security) and [Tailscale](/gateway/tailscale). ## WhatsApp login flow (remote)