openclaw-integration

Drive the whole AI portfolio from your phone. This repo is the OpenClaw control plane that wires four sibling services together behind one chat bot — securely, over Tailscale, with nothing exposed to the public internet.

Why

Instead of SSHing into a box to run job searches, ERP lookups, or multi-step agent tasks, you message a Telegram bot. OpenClaw routes each request to the right service as a skill (or a native MCP server) over a private Docker network, and can run scheduled "heartbeat" jobs (e.g. a weekday morning remote-job digest).

This is integration + configuration + docs — there is no application source code here; the work is done by the sibling repos.

What's wired in

Service	Repo	How
Jobs API	ai-job-aggregator	skill job-hunt (GET /search)
Demo ERP	mcp-erp-server	native MCP, read-only
Task runner	ai-agents-framework	skill agent-run (POST /run)
Model provider	self-hosted-ai	Ollama ollama/llama3.1

terraform-aws-modules is deployment infrastructure and intentionally sits outside the live runtime. Full map: INTEGRATION.md.

Quickstart

cp .env.example .env                  # fill in TELEGRAM_BOT_TOKEN, etc.
cp openclaw.json ~/.openclaw/openclaw.json
cp -r workspace/* ~/.openclaw/workspace/

docker compose up -d --build          # ollama + the three service repos on 'clawnet'
docker exec -it ollama ollama pull llama3.1
openclaw doctor                       # validate before exposing anything

Set your Telegram numeric id in openclaw.json (channels.telegram.allowFrom), message the bot once, then openclaw pairing approve telegram <code>. Full guide: INTEGRATION.md.

Testing

This repo is configuration + docs, so the tests assert that the shipped artifacts are internally consistent and that the documented security posture actually holds in the config (loopback-only Gateway, pairing required, single-owner allowlist, sandboxed non-main sessions, read-only ERP, no committed secrets, docs in sync with openclaw.json).

# Python checks (no Docker required)
pip install -r tests/requirements.txt
pytest

# Compose-spec smoke check (requires Docker; validates docker-compose.yml standalone)
./scripts/compose-config-check.sh

CI runs both on every push and pull request — see .github/workflows/ci.yml.

Security

The Gateway binds 127.0.0.1:18789 only — remote access is Tailscale-only. Pairing is required, the allowlist holds only the owner's id, non-main sessions are Docker-sandboxed with dangerous tools denied, and the ERP is read-only. See INTEGRATION.md → Security.

License

MIT © Antoni Romera Luis