Skip to content

v1.3.0 - Native Deployment for Ubuntu 24.04 LTS

Choose a tag to compare

View all tags
@yi-john-huang yi-john-huang released this 16 Feb 17:59
· 43 commits to master since this release
v1.3.0
1250ee1

🎉 What's New in v1.3.0

Native Deployment for Ubuntu 24.04 LTS

This release introduces native systemd deployment as a lightweight alternative to Docker Compose, perfect for resource-constrained environments like VPS or edge devices.

✨ New Features

  • 🚀 Interactive Installer (deploy/native/install-native.sh)

    • One-command deployment with guided configuration
    • Automatic dependency installation (Python 3.12, Node.js, Caddy, uv)
    • Configurable HDD mount point for backups and audit logs
    • Optional Telegram and WhatsApp webhook setup

  • 🔒 Security Hardening

    • systemd sandboxing (ProtectSystem=strict, NoNewPrivileges)
    • Minimal file permissions (separate users: openclaw, ocproxy)
    • Read-only filesystems with explicit write paths
    • Capability dropping and namespace restrictions

  • 🌐 Caddy Reverse Proxy

    • Automatic HTTPS with Let's Encrypt (domain mode)
    • Self-signed TLS for localhost testing
    • HTTP/2 and WebSocket support

  • 📊 Operational Tools

    • Health check script (openclaw-health-check) for monitoring
    • Daily automated backups to configurable location (30-day retention)
    • Uninstaller for clean removal

  • 📖 Comprehensive Documentation

    • Deployment guide (deploy/native/DEPLOYMENT.md)
    • Docker vs native comparison (deploy/native/COMPARISON.md)
    • Verification checklist for production readiness

🐛 Bug Fixes

Fixed 3 critical installer issues discovered in code review (PR #9):

  1. Missing /etc/caddy/ directory - Installer now creates directory before copying Caddyfile (was crashing at Phase 8)
  2. Missing caddy.service - Added systemd unit file for manually-installed Caddy binary (was failing systemctl enable caddy)
  3. Hardcoded /mnt/data paths - Replaced with ${HDD_MOUNT} template variable with sed substitution during installation (was causing silent audit log data loss)

All files now use proper templating with runtime configuration substitution.

📦 Installation

Docker Compose (existing):

git clone https://github.com/yi-john-huang/openclaw-secure-stack.git
cd openclaw-secure-stack
docker compose up -d

Native systemd (new):

git clone https://github.com/yi-john-huang/openclaw-secure-stack.git
cd openclaw-secure-stack
sudo ./deploy/native/install-native.sh

See deploy/native/DEPLOYMENT.md for detailed instructions.

📊 Test Coverage

✅ 529 tests passing (100% pass rate)

  • 47 integration tests
  • 482 unit tests
  • Full coverage for proxy, governance, webhooks, and security scanner

🔗 Full Changelog

See CHANGELOG.md for complete details.

Upgrading from v1.2.0?

This release is additive (new deployment option). Existing Docker Compose deployments continue to work without changes. No breaking changes to APIs or configuration.

Assets 2
Loading