OpenClaw via the TrueNAS app

Apps and Virtualization
1

Hi,

Does anyone have a reliable set of instructions for installing the OpenClaw app via the TrueNAS official image?

I am stuck in a loop where I’ve set up a gateway token and also put OpenClaw’s web UI behind a reverse proxy using Nginx Proxy Manager. The web authentication flow says I have to approve the request on the command line using “OpenClaw devices approve” and this is failing in lots of ways.

I’ve been around many loops of trying to figure out the exact issue (I think it’s related to the CLI tool’s own permissions in the context, as I keep getting errors relating to approving permissions I don’t already have) but I’m just wanting to start again from scratch.

2

Just to add a bit more detail to what I’ve tried (at least my latest attempt to start from scratch)

  • Install the app via TrueNAS Scale “Discover Apps”
  • Set a gateway token in the UI, leave everything else as default
  • Set up a reverse proxy with SSL in Nginx Proxy Manager so that I have an SSL URL that redirects to the exposed port. This also has Web Sockets support enabled.
  • On this URL, I get the OpenClaw Control page, where the WSS URL is set (wss://claw.local.domain) and I enter the same Gateway Token

At this point the page says:

Device pairing required

This browser needs one-time approval from the Gateway host before it can use the Control UI.

Run openclaw devices list on the Gateway host.

Approve this request: openclaw devices approve dcd45aca-e3ae-4ee7-9670-9f4c0794328a.

Reconnect after the approval completes.

If I enter docker sh on the container, I can run openclaw devices list. That fails with

[openclaw] Could not start the CLI.
[openclaw] Reason: gateway closed (1006 abnormal closure (no close frame)): no close reason
Gateway target: ws://127.0.0.1:18789
Source: local loopback
Config: /home/node/.openclaw/openclaw.json
Bind: loopback

The way I resolve this is by passing a --url and a --token like so:

openclaw device list –url “ws://127.0.0.1:30262” --token “$OPENCLAW_GATEWAY_TOKEN”

Pending (1)
┌──────────────────────────────────────┬────────────────────────────────────────┬───────────────────────────────────────────────────────────────────────────────────┬────────────────────┬────────┬─────────────┐
│ Request │ Device │ Requested │ Approved │ Age │ Status │
├──────────────────────────────────────┼────────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────────────┼────────────────────┼────────┼─────────────┤
│ 5c3c724a-e5c0-4eae-834d-e556960cbac1 │ 8d78fb52c8f877ab1c30d01b034f60fb1b0281 │ roles: operator; scopes: operator.admin, operator.approvals, operator.pairing, │ none │ 1m ago │ new pairing │
│ │ eca14bf0ded0655b4d9e82cafe │ operator.read, operator.write │ │ │ │
└──────────────────────────────────────┴────────────────────────────────────────┴───────────────────────────────────────────────────────────────────────────────────┴────────────────────┴────────┴─────────────┘
Paired (1)
┌───────────────────────────────────────────────────────────────────────────────────────┬─────────────────────────────────┬───────────────────────────────────────┬────────────────────────────────┬────────────┐
│ Device │ Roles │ Scopes │ Tokens │ IP │
├───────────────────────────────────────────────────────────────────────────────────────┼─────────────────────────────────┼───────────────────────────────────────┼────────────────────────────────┼────────────┤
│ 6bab07ba1c9bb08893127cd04d783cc25a48b3f518d67cb31f709f02afcb5933 │ operator │ operator.pairing │ operator │ │
└───────────────────────────────────────────────────────────────────────────────────────┴─────────────────────────────────┴───────────────────────────────────────┴────────────────────────────────┴────────────┘

(sorry that it’s messy)

What seems to be consistent is the device ID that I think is the browser (8d78…) and the list of requested tokens. I also note that device id 6bab… that I think might be the openclaw CLI that has only the scope openclaw.pairing.

If I then run openclaw devices approve with the request ID from the table I get:

[openclaw] Could not start the CLI.
[openclaw] Reason: gateway closed (1008): pairing required: device is asking for more scopes than currently approved (requestId: 2d876e6e-c614-46bf-935d-b509a506d
Gateway target: ws://127.0.0.1:30262
Source: cli --url

I’ve made many attempts to getting around this with various commands suggested in forums and by different AI tools, but fundamentally I don’t seem to be able to move beyond this.