How to connect Google Calendar to my claw?

[amitzur]

Context

I am setting up NanoClaw on a remote VPS. I connected WhatsApp and then wanted to connect it with my Google Calendar.
I got stuck, here's everything I had to do.

Steps I took

1. Asked the agent to read my calendar. The request went through the OneCLI proxy and returned app_not_connected with this link:

   http://172.17.0.1:10254/p/<project>/connections?connect=google-calendar&source=agent
   

2. Couldn't open the link. 172.17.0.1 is the Docker bridge address on the server, so my phone and laptop can't reach it. The agent guessed it was a gateway misconfiguration and told me to ask the operator (me).
3. Opened an SSH tunnel from my laptop and opened the link with localhost instead of the bridge IP:

   ssh -N -L 10254:172.17.0.1:10254 <user>@<server>

4. Got the OneCLI dashboard asking for a Google OAuth client ID and secret. Nothing in NanoClaw mentions this. From the OneCLI docs I learned that self-hosted OneCLI needs your own OAuth app for every provider (app credentials).
5. Created an OAuth app in Google Cloud Console: new project, enabled the Calendar API, set up the consent screen (External, added myself as a test user), created a Web application client with redirect URI http://localhost:10254/v1/apps/google-calendar/callback, and pasted the client ID and secret into OneCLI.
6. Clicked connect and Google rejected the redirect:

   device_id and device_name are required for private IP: http://172.17.0.1:10254/v1/apps/google-calendar/callback
   

   OneCLI builds its OAuth callback from APP_URL, which on this install is the bridge IP. Google won't accept a private IP as a callback for a web client.

Questions

1. Should I change OneCLI's APP_URL to http://localhost:10254** in ~/.onecli/ for this to work?
2. Is this the intended way to connect Google Calendar (or Gmail) on a self-hosted NanoClaw? Is there a simpler path I missed?
3. Is APP_URL on the bridge IP expected after /add-onecli on Linux? From what I can see, setup.ts sets ONECLI_BIND_HOST to the bridge IP so containers can reach the gateway, and APP_URL ends up on the same address. That breaks Google OAuth on any Linux install, headless or not, because Google never accepts a private-IP callback.
4. For headless installs, what's the recommended way to open connect links? A tunnel works, but nothing documents it, and the agent itself didn't know.

Suggestions

I'm happy to send a PR once I know which direction you want:

• Have /add-onecli set APP_URL=http://localhost:<port> (or ask for it) instead of leaving it on the bridge IP.
• Add a "Connecting Google apps on a self-hosted gateway" section to the add-onecli skill: the OAuth app steps, the exact redirect URIs, the 7-day Testing-mode expiry, and the SSH tunnel for headless servers.
• Update the onecli-gateway container skill so that when connect_url points at a private address, the agent explains the tunnel instead of calling it a misconfiguration.

Related

• chore(skills): remove stale qodo and Google MCP skills #3172: removal of /add-gcal-tool
• fix(setup/onecli): restrict OneCLI admin API and Postgres to loopback after install #2433: the OneCLI admin API on :10254 is unauthenticated, so exposing the dashboard publicly is not a fix