# VPS Baseline Discovery - 2026-05-15

Owner: VPS_EXECUTOR
Task: T4-VPS-baseline
Mode: read-only discovery

## Safety Confirmation

- No service restart, reload, approval, token rotation, image change, bind mount change, Nginx route edit, or Docker compose edit was performed.
- No secret file contents were read or captured. In particular, `.env.openclaw` and private key/certificate contents were not read.
- The frozen `smartmotor.cloud` website content, static assets, Nginx routing files, bind mounts, images, and service state were not modified.

## Control Plane Repository

- Workspace: `/home/ubuntu/openclaw-control-plane`
- Branch: `main`
- Git status at collection time: `## main...origin/main`
- Last commit: `9e05c877f9cc19270f2a42c9a36399065c56854b` (`Sync agent state from PC at 2026-05-15 11:32:38`)
- No local repo modifications were present before evidence/handoff/task updates.

## Host and Service Workspace

- Hostname: `VM-0-13-ubuntu`
- Kernel: `Linux 6.8.0-49-generic x86_64`
- Timestamp: `2026-05-15T03:41:43Z`
- `/opt/service`: not present.
- `/opt/services`: present and used as the service workspace.
- `/opt/services/docker-composite.yml`: not present.
- OpenClaw compose file present: `/opt/services/docker-compose.openclaw.yml`

## Docker Stack

Docker versions:

- Docker Engine: `27.5.1`
- Docker Compose: `v2.32.4`

Running containers:

| Container | Image | Status | Ports / Exposure |
|---|---|---|---|
| `openclaw-gateway` | `ghcr.io/openclaw/openclaw:latest` | Up 5 days, healthy | No host port published |
| `nginx-proxy` | `nginx:alpine` | Up 6 days | Host `80` and `443` published |
| `gitea` | `gitea/gitea:latest` | Up 6 days | Container `3000`, host `2222->22` |
| `confluence` | `atlassian/confluence-server:latest` | Up 6 days | Container `8090-8091` |
| `postgres_conf` | `postgres:14` | Up 6 days, healthy | Container `5432` |

Container inspect summary:

- `openclaw-gateway`: `status=running`, `health=healthy`, network `services_appnet`
- `nginx-proxy`: `status=running`, `health=none`, network `services_appnet`
- `gitea`: `status=running`, `health=none`, network `services_appnet`
- `confluence`: `status=running`, `health=none`, network `services_appnet`
- `postgres_conf`: `status=running`, `health=healthy`, network `services_appnet`

Network members on `services_appnet`:

- `postgres_conf`: `172.19.0.2/16`
- `gitea`: `172.19.0.3/16`
- `confluence`: `172.19.0.4/16`
- `nginx-proxy`: `172.19.0.5/16`
- `openclaw-gateway`: `172.19.0.6/16`

## OpenClaw Gateway

Compose summary from `/opt/services/docker-compose.openclaw.yml`:

- Service: `openclaw-gateway`
- Image: `ghcr.io/openclaw/openclaw:latest`
- Command: `node openclaw.mjs gateway --bind lan --port 18789`
- Config bind mount: `/opt/services/openclaw-config -> /home/node/.openclaw`
- Workspace bind mount: `/opt/services/openclaw-workspace -> /home/node/.openclaw/workspace`
- Network: external `services_appnet`
- Healthcheck probes `http://127.0.0.1:18789/healthz`

Gateway local health probe from inside the container:

- `http://127.0.0.1:18789/healthz`
- Result: `status=200`
- Body summary: `{"ok":true,"status":"live"}`

## Nginx and Routes

Nginx container summary:

- Container: `nginx-proxy`
- Image: `nginx:alpine`
- Entrypoint: `/docker-entrypoint.sh`
- Command: `nginx -g 'daemon off;'`
- Published ports: host `80` and `443`
- Bind mounts:
  - `/opt/services/nginx/conf.d -> /etc/nginx/conf.d`
  - `/opt/services/nginx/ssl -> /etc/nginx/ssl`
  - `/opt/services/nginx/html -> /usr/share/nginx/html`

Route/config observations:

- `/opt/services/nginx/conf.d` was empty at collection time.
- `nginx -T` inside the container produced no `server_name` or `proxy_pass` lines for `openclaw.smartmotor.cloud`.
- Public and local TLS endpoint checks still returned:
  - `smartmotor.cloud`: `200`
  - `git.smartmotor.cloud`: `200`
  - `wiki.smartmotor.cloud`: `302` to login
  - `openclaw.smartmotor.cloud`: `200`

This is a baseline observation only. No route file was modified and no reload was performed.

## Gitea, Confluence, and Postgres

High-level status:

- `gitea`: container running on `services_appnet`, container port `3000`, host SSH port `2222`.
- `confluence`: container running on `services_appnet`, container ports `8090-8091`.
- `postgres_conf`: container running and healthy on `services_appnet`, container port `5432`.
- HTTPS availability checks:
  - `https://git.smartmotor.cloud/`: `200`
  - `https://wiki.smartmotor.cloud/`: `302` to login

## OpenClaw CLI / Approval Commands

Host PATH:

- `openclaw`: not found on the VPS host PATH.

Gateway container:

- CLI available by running `node openclaw.mjs` inside `openclaw-gateway`.
- Version banner: `OpenClaw 2026.5.7 (unknown)`.
- Command help confirmed available for:
  - `openclaw devices approve [options] [requestId]`
  - `openclaw nodes pending [options]`
  - `openclaw nodes approve [options] <requestId>`

Only `--help` was executed. No pending request was listed, no request was approved, and no token/password option was supplied.

## Notes for VPS_VERIFIER

- Verify the apparent Nginx route/config drift: endpoints respond, but the mounted `/etc/nginx/conf.d` is empty and `nginx -T` did not show server blocks or proxy routes.
- Verify whether `/opt/services/docker-composite.yml` is expected to exist; the baseline found `/opt/services/docker-compose.openclaw.yml` instead.
- Verify that absence of host PATH `openclaw` is acceptable because the CLI is available inside the Gateway container.