refactor: switch openclaw and hermes to their official images

openclaw/compose.yml

@@ -1,19 +1,13 @@
 services:
   openclaw:
-    image: coollabsio/openclaw:latest
+    build: .
     restart: unless-stopped
     environment:
-      - AUTH_USERNAME=${AUTH_USERNAME:-admin}
-      - AUTH_PASSWORD=${AUTH_PASSWORD:?required}
       - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN:?required}
+      - OPENCLAW_PUBLIC_ORIGIN=${OPENCLAW_PUBLIC_ORIGIN:?required}
+      - OPENCLAW_TRUSTED_PROXIES=${OPENCLAW_TRUSTED_PROXIES:-10.0.0.0/16}
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
-      - PORT=8080
-      - OPENCLAW_GATEWAY_PORT=18789
-      - OPENCLAW_STATE_DIR=/data/.openclaw
-      - OPENCLAW_WORKSPACE_DIR=/data/workspace
-      - BROWSER_CDP_URL=http://browser:9223
-      - 'OPENCLAW_CONFIG_JSON={"gateway":{"trustedProxies":["127.0.0.1"]}}'
-      # - OPENCLAW_PRIMARY_MODEL=${OPENCLAW_PRIMARY_MODEL:-}
+      - TZ=${TZ:-Asia/Ho_Chi_Minh}
       # - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
       # - OPENAI_API_KEY=${OPENAI_API_KEY:-}
       # - GEMINI_API_KEY=${GEMINI_API_KEY:-}
@@ -23,9 +17,7 @@ services:
       # - CEREBRAS_API_KEY=${CEREBRAS_API_KEY:-}
       # - VENICE_API_KEY=${VENICE_API_KEY:-}
       # - MOONSHOT_API_KEY=${MOONSHOT_API_KEY:-}
-      # - MOONSHOT_BASE_URL=${MOONSHOT_BASE_URL:-https://api.moonshot.ai/v1}
       # - KIMI_API_KEY=${KIMI_API_KEY:-}
-      # - KIMI_BASE_URL=${KIMI_BASE_URL:-https://api.moonshot.ai/anthropic}
       # - MINIMAX_API_KEY=${MINIMAX_API_KEY:-}
       # - ZAI_API_KEY=${ZAI_API_KEY:-}
       # - AI_GATEWAY_API_KEY=${AI_GATEWAY_API_KEY:-}
@@ -33,57 +25,27 @@ services:
       # - SYNTHETIC_API_KEY=${SYNTHETIC_API_KEY:-}
       # - COPILOT_GITHUB_TOKEN=${COPILOT_GITHUB_TOKEN:-}
       # - XIAOMI_API_KEY=${XIAOMI_API_KEY:-}
+      # - OLLAMA_API_KEY=${OLLAMA_API_KEY:-}
       # - DEEPGRAM_API_KEY=${DEEPGRAM_API_KEY:-}
       # - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-}
       # - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-}
       # - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN:-}
       # - AWS_REGION=${AWS_REGION:-us-east-1}
-      # - BEDROCK_PROVIDER_FILTER=${BEDROCK_PROVIDER_FILTER:-anthropic}
-      # - OLLAMA_BASE_URL=${OLLAMA_BASE_URL:-}
       # - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
       # - DISCORD_BOT_TOKEN=${DISCORD_BOT_TOKEN:-}
       # - SLACK_BOT_TOKEN=${SLACK_BOT_TOKEN:-}
       # - SLACK_APP_TOKEN=${SLACK_APP_TOKEN:-}
-      # - WHATSAPP_ENABLED=${WHATSAPP_ENABLED:-}
-      # - OPENCLAW_ALLOWED_ORIGINS=${OPENCLAW_ALLOWED_ORIGINS:-}
-      # - OPENCLAW_GATEWAY_BIND=${OPENCLAW_GATEWAY_BIND:-loopback}
-      # - BROWSER_DEFAULT_PROFILE=${BROWSER_DEFAULT_PROFILE:-openclaw}
-      # - BROWSER_EVALUATE_ENABLED=${BROWSER_EVALUATE_ENABLED:-true}
-      # - BROWSER_SNAPSHOT_MODE=${BROWSER_SNAPSHOT_MODE:-efficient}
-      # - BROWSER_REMOTE_TIMEOUT_MS=${BROWSER_REMOTE_TIMEOUT_MS:-1500}
-      # - BROWSER_REMOTE_HANDSHAKE_TIMEOUT_MS=${BROWSER_REMOTE_HANDSHAKE_TIMEOUT_MS:-3000}
-      # - HOOKS_ENABLED=${HOOKS_ENABLED:-false}
-      # - HOOKS_PATH=${HOOKS_PATH:-/hooks}
-      # - OPENCLAW_DOCKER_APT_PACKAGES=${OPENCLAW_DOCKER_APT_PACKAGES:-}
     volumes:
-      - openclaw-data:/data
-    depends_on:
-      browser:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "curl", "-sf", "http://127.0.0.1:8080/healthz"]
-      interval: 10s
-      timeout: 10s
-      retries: 5
-
-  # Chromium the agent drives over CDP.
-  browser:
-    image: coollabsio/openclaw-browser:latest
-    restart: unless-stopped
-    shm_size: 2g
-    environment:
-      - PUID=1000
-      - PGID=1000
-      - CHROME_CLI=--remote-debugging-port=9222
-      - TZ=Etc/UTC
-    volumes:
-      - browser-data:/config
-    healthcheck:
-      test: ["CMD-SHELL", "bash -c ':> /dev/tcp/127.0.0.1/9222' || exit 1"]
-      interval: 5s
-      timeout: 5s
-      retries: 10
+      - openclaw-state:/home/node/.openclaw
+      - openclaw-workspace:/home/node/.openclaw/workspace
+      - openclaw-secrets:/home/node/.config/openclaw
+    cap_drop:
+      - NET_RAW
+      - NET_ADMIN
+    security_opt:
+      - no-new-privileges:true
 
 volumes:
-  openclaw-data:
-  browser-data:
+  openclaw-state:
+  openclaw-workspace:
+  openclaw-secrets: