Remove macOS support, make Tailscale optional, and fix installation issues by justin-russell · Pull Request #1 · hintjen/openclaw-ansible

justin-russell · 2026-02-06T22:35:45Z

Summary

This PR removes macOS support from the playbook (Linux-only), makes Tailscale installation optional (disabled by default), and fixes multiple installation and user environment issues discovered during testing.

Major Changes

🔧 Platform Support

Remove macOS support: Removed all macOS/Homebrew/zsh related tasks and dependencies
- Playbook now only supports Debian/Ubuntu Linux
- Updated install.sh to reflect Linux-only support
- Fixed repository URLs to point to openclaw/openclaw-ansible

🌐 Tailscale Made Optional

Add tailscale_enabled variable (default: false)
- Users must explicitly opt-in to Tailscale installation
- When disabled: no packages, firewall rules, or sudoers entries created
- Conditional welcome messages and documentation
- Converted show-lobster.sh to Jinja2 template for dynamic port display

🐛 Installation Fixes

Multiple critical fixes for user environment and installation flow:

Home directory ownership: Fixed clawdbot home directory being owned by root instead of clawdbot user
Login shell environment: Added .bash_profile to source .bashrc for login shells (sudo su - clawdbot)
PNPM PATH configuration: Added PNPM_HOME to PATH in all pnpm installation tasks
Binary path resolution: Fixed clawdbot binary path in systemd service and verification tasks
Task ordering: Moved .bashrc configuration to run after user creation
Welcome message cleanup: Suppressed permission errors when removing welcome file

🧪 Testing Infrastructure

Docker-based CI test harness: Added containerized test environment
- Ubuntu 22.04 and 24.04 test images
- Automated playbook validation
- Test with both Tailscale enabled/disabled scenarios
Comprehensive testing documentation: Added docs/testing.md with test procedures

Security Improvements

Tailscale now opt-in only (reduces attack surface by default)
Scoped sudoers entries only created when needed
Fixed file permissions and ownership issues

Documentation Updates

Updated architecture.md to reflect Tailscale as optional
Updated configuration.md with tailscale_enabled variable documentation
Added testing.md with comprehensive test procedures
Updated all example configurations

Commit Log

refactor: remove macOS/Homebrew/zsh support and fix audit findings
feat: make Tailscale optional (default: disabled)
refactor: simplify install.sh to only install dependencies
fix: move .bashrc configuration after user creation
fix: add PNPM_HOME to PATH in pnpm installation tasks
fix: correct clawdbot binary path resolution
fix: create .bash_profile to source .bashrc for login shells
fix: suppress permission error when removing welcome message
fix: ensure clawdbot home directory has correct ownership
feat: add Docker-based CI test harness for playbook validation
docs: add comprehensive testing documentation
revert: restore install.sh to main branch version
refactor: remove macOS support and fix repository URL in install.sh

Testing

✅ Tested on Ubuntu 22.04 VPS
✅ Verified with Tailscale disabled (default)
✅ Verified with Tailscale enabled
✅ All installation issues resolved
✅ User environment loads correctly on login

Breaking Changes

⚠️ macOS is no longer supported - Users on macOS should use Docker or a Linux VM
⚠️ Tailscale is disabled by default - Set tailscale_enabled: true to install Tailscale

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Resolves conflicts between OpenClaw rename and security hardening: - Applied scoped sudo permissions with openclaw naming - Added dynamic UID to service template - Merged security features (fail2ban, unattended-upgrades) - Added ansible.posix collection and fixed authorized_key FQCN - Updated comments to reference OpenClaw instead of Clawdbot Co-Authored-By: olsonale <olsonale@users.noreply.github.com> Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Remove bare-metal macOS support due to system-level permission risks. Linux-only deployment provides better security isolation. Changes: - Remove macOS-specific task files (firewall, docker, tailscale, system-tools) - Remove Homebrew and zsh dependencies (Linux-only now) - Add macOS detection with explicit failure message - Update README with deprecation notice and rationale - Simplify install.sh to Debian/Ubuntu only - Remove multi-OS orchestrator files Security rationale: System-level modifications on primary host OS introduce significant risks. Future support may use virtualization. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Major changes: - Make Tailscale optional (tailscale_enabled: false by default) - Add ci_test mode to skip Docker/firewall/systemd tasks in CI - Add Docker-based CI test harness (convergence, verification, idempotency) - Convert show-lobster.sh to template for conditional Tailscale display - Update firewall to conditionally open Tailscale port CI Test Harness: - tests/Dockerfile.ubuntu2404 - Ubuntu container with Ansible - tests/entrypoint.sh - Test execution (convergence → verify → idempotency) - tests/verify.yml - Post-install assertions - tests/run-tests.sh - Local test runner - Validates ~75% of playbook (skips Docker-in-Docker, firewall, systemd) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Bug fixes: - Create .bash_profile to source .bashrc for login shells (fixes environment not loading for sudo su - openclaw) - Simplify install.sh to only install dependencies (no longer downloads/runs playbook automatically) - Update install.sh messaging and instructions Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

This reverts commit 3f5d9aa.

Fixes environment not loading when using 'sudo su - openclaw'. Login shells need .bash_profile to source .bashrc. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Complete functional parity with PR openclaw#16 while preserving openclaw naming. Initial fixes (7): - Add home directory ownership fix to prevent permission errors - Move .bashrc configuration from system-tools to user.yml - Add ci_test conditionals to all systemd-related tasks - Fix binary path resolution (use PATH instead of hardcoded paths) - Remove all Homebrew path references - Update pnpm installation to use idempotent check-first approach - Change apt upgrade to use ci_test conditional Additional fixes from comprehensive double-check (7): - Use ansible.builtin.authorized_key instead of ansible.posix - Remove ansible.posix collection dependency from requirements.yml - Remove "Connect Tailscale VPN" from completion message (now optional) - Add comprehensive security entries to .gitignore - Add network interface validation in firewall configuration - Improve pnpm config idempotency with proper change detection - Add install_mode validation with clear error messages Files modified: 12 - .gitignore: Added security-related ignore patterns - playbook.yml: Fixed apt upgrade conditional - requirements.yml: Removed ansible.posix dependency - run-playbook.sh: Removed optional Tailscale from completion - roles/openclaw/tasks/user.yml: Multiple critical fixes - roles/openclaw/tasks/system-tools-linux.yml: Removed .bashrc config - roles/openclaw/tasks/firewall-linux.yml: Added validation - roles/openclaw/tasks/nodejs.yml: Improved pnpm check - roles/openclaw/tasks/openclaw.yml: Added validation and idempotency - roles/openclaw/tasks/openclaw-release.yml: Fixed paths - roles/openclaw/tasks/openclaw-development.yml: Fixed paths - roles/openclaw/templates/openclaw-host.service.j2: Fixed PATH and ExecStart All functional changes from PR openclaw#16 are now incorporated with correct openclaw naming throughout. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

…refs - Add ansible.posix collection to requirements.yml (>=1.5.0) - Change ansible.builtin.authorized_key to ansible.posix.authorized_key - Update documentation references from clawdbot to openclaw - Fix Jinja2 template lstrip_blocks to use boolean instead of string Addresses PR openclaw#16 maintainer feedback for clawdbot → openclaw rename. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

- Update LICENSE copyright from Clawdbot to OpenClaw Contributors - Change CLAWDBOT_DEV_DIR to OPENCLAW_DEV_DIR in docs and upgrade notes - Update security.md overview text - Update UPGRADE_NOTES.md section heading Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

olsonale and others added 15 commits February 2, 2026 21:17

refactor: rename role directory clawdbot -> openclaw

981d75b

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

refactor: rename clawdbot task and template files to openclaw

c0ac8ad

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

refactor: rename clawdbot_* variables and system user to openclaw

ff64dad

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

refactor: update npm package from clawdbot to openclaw

1e31e95

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

refactor: update GitHub and documentation URLs

8a012e7

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

refactor: update user-facing text from Clawdbot to OpenClaw

af9bcd0

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs: update documentation for OpenClaw rename

dd50f73

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Update playbook.yml

5c93fa3

Revert "fix: add critical bug fixes from PR openclaw#16"

76fcee8

This reverts commit 3f5d9aa.

fix: create .bash_profile to source .bashrc for login shells

42a882b

Fixes environment not loading when using 'sudo su - openclaw'. Login shells need .bash_profile to source .bashrc. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

justin-russell force-pushed the remove-macos-support branch from 21a2f28 to 1f552e4 Compare February 10, 2026 15:46

justin-russell and others added 2 commits February 13, 2026 14:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Remove macOS support, make Tailscale optional, and fix installation issues#1

Remove macOS support, make Tailscale optional, and fix installation issues#1
justin-russell wants to merge 17 commits intomainfrom
remove-macos-support

justin-russell commented Feb 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Conversation

justin-russell commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Major Changes

🔧 Platform Support

🌐 Tailscale Made Optional

🐛 Installation Fixes

🧪 Testing Infrastructure

Security Improvements

Documentation Updates

Commit Log

Testing

Breaking Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

justin-russell commented Feb 6, 2026 •

edited

Loading