Knowledge Base Durable knowledge base for OpenClaw sessions: decisions, procedures, integrations, troubleshooting, and follow-up actions. Knowledge Base Index OClaw Knowledge Base This book records durable, non-secret knowledge from OpenClaw work. Credentials, API keys, token values, and other sensitive secrets are intentionally excluded. How this book is maintained Add or update pages after meaningful sessions. Record decisions, verified procedures, integration status, troubleshooting outcomes, and follow-up actions. Keep transient chat noise and secret material out of the knowledge base. Prefer one page per system or topic, with this index linking the durable record. Current integration status BookStack BookStack API access is working. Existing books observed before this book was created: AI and OpenClaw. BookStack credentials are configured through protected secret storage. The BookStack API token requires Access System API permission. UniFi Cloud Site Manager API access through api.ui.com was verified read-only. Observed environment: one console/site, five networks, eight firewall zones, 145 policies, and zero ACL rules. Reverse proxy host: 192.168.1.117. The reverse-proxy port-forward was tightened to expose ports 80 and 443; port 8080 was removed. Port 80 is useful for HTTP-to-HTTPS redirects or certificate validation; 443 is the primary public service port. Recommended follow-up: enable logging on the specific WAN-to-reverse-proxy firewall allow rule and keep other administrative ports private. A public DNS port-forward and Home-to-Camera/IoT access were flagged for intentionality and least-privilege review. No firewall changes were made by the assistant. Proxmox Dedicated page: Proxmox Read-Only Integration. Hostname: pve.stargrid.com.au, resolving internally to 192.168.1.115. API endpoint: https://pve.stargrid.com.au:8006/api2/json. API token identity: oc@pve!oc; permission: PVEAuditor at path /. Token secret is protected in OpenClaw secret storage as PROXMOX_API_TOKEN; no secret is recorded here. Direct read-only API validation succeeded and returned node JSON. The certificate is issued to the Proxmox hostname by the cluster CA; clients need to trust that CA or explicitly disable TLS verification. OpenClaw's protected egress path still returns HTTP 502 for this private-LAN destination; this is separate from Proxmox authentication. OpenClaw Gateway and secrets Gateway was previously inspected as a healthy systemd user service owned by stark, listening on localhost port 18789. Protected credentials should be stored through OpenClaw secret storage and never pasted into chat. Secret allowlists must match the exact destination hostname or IP used by the request. Existing troubleshooting lesson: a reachable service with HTTP 401 indicates routing is working and authentication/configuration remains the issue; a 502 may indicate the protected egress path or proxy rather than the target service. Follow-up queue Enable logging on the UniFi reverse-proxy allow rule. Resolve the OpenClaw protected egress path and retry the read-only Proxmox inventory check. Add focused pages for UniFi firewall review, Proxmox health review, and OpenClaw operations as those topics are revisited. Last updated: 2026-09-12 UTC. Proxmox Read-Only Integration Proxmox Read-Only Integration Last verified: 2026-09-12 UTC. Connection Proxmox hostname: pve.stargrid.com.au Resolves internally to 192.168.1.115. API endpoint: https://pve.stargrid.com.au:8006/api2/json The certificate is issued to pve.stargrid.com.au by the Proxmox cluster CA and is not publicly trusted. Current clients must disable TLS verification or trust the Proxmox CA; do not record or distribute the private key. API token Token identity: oc@pve!oc Permission: PVEAuditor at path /. The token secret is stored in OpenClaw protected secret storage as PROXMOX_API_TOKEN. Never put the token secret in BookStack, chat, scripts, or committed configuration. Verification A direct read-only request to /api2/json/nodes returned valid node JSON using the token. This confirms the token identity, secret, endpoint, and PVEAuditor permission are working. read -rsp "Proxmox token secret: " TOKEN echo curl -k -H 'Authorization: PVEAPIToken=oc@pve!oc='"$TOKEN" \\ https://pve.stargrid.com.au:8006/api2/json/nodes unset TOKEN OpenClaw status A local read-only skill was created at skills/proxmox-readonly. It is restricted to version, node, guest inventory, storage, and health GET requests. The OpenClaw protected egress path currently returns HTTP 502 for this private-LAN destination; this is separate from Proxmox authentication and should be resolved before relying on gateway-side automated checks. Safety boundary This integration is read-only. Do not start, stop, restart, delete, create, modify, or snapshot Proxmox guests through it. BookStack Integration and Skills Configuration Status — 2026-09-12 BookStack Integration and Skills Configuration Status Summary BookStack has been actively used as the OpenClaw durable knowledge base. Previous sessions successfully authenticated to the BookStack API and created or updated books, chapters, pages, infrastructure documentation, and diagrams. Confirmed historical operation BookStack host: https://book.stargrid.com.au A read-only API test previously succeeded and returned the AI and OpenClaw books. The OClaw book was created as the durable OpenClaw knowledge base. The Chris's IT Infrastructure book was created and populated from read-only UniFi inventory. Infrastructure pages include network overview, gateway/switch/access point inventory, camera inventory, connected clients, firewall/access policy summary, VLAN/wireless inventory, and a topology diagram. Later sessions continued writing documentation and diagrams to BookStack. What went wrong The local workspace skill remained present at workspace/skills/bookstack/SKILL.md, but its configuration had drifted: skills.entries.bookstack.enabled was set to false, so OpenClaw marked the skill disabled. The stored BookStack credentials were still present in OpenClaw's protected secret store, but the skill readiness check could not see them as injected environment variables. The skill was therefore reported as disabled or needing setup even though the BookStack service and credentials had previously worked. The exact session that changed those settings was not identified. The most likely cause is configuration drift during the recent model/session/plugin cleanup. Repair status The BookStack skill has been re-enabled with skills.entries.bookstack.enabled: true. The three stored credential names remain present: BOOKSTACK_URL, BOOKSTACK_TOKEN_ID, and BOOKSTACK_TOKEN_SECRET. Credential values and token secrets are intentionally not recorded in this page. The current skill checker still reports the environment requirements as unresolved because the per-skill environment injection mapping is not currently restored. Do not re-enter or publish the token secret in BookStack, chat, scripts, or committed configuration. Operational lesson A successful BookStack API connection and OpenClaw skill readiness are separate checks. The API credentials can remain healthy while the skill is disabled or its environment injection is missing. When this happens, verify both: BookStack API connectivity using the gateway-managed secret environment. skills.entries.bookstack.enabled and the skill's environment injection/readiness configuration. Follow-up Restore the supported secret-to-environment injection path for the workspace BookStack skill, then run a read-only list_books test and confirm that openclaw skills info bookstack reports ready. AgentMail Email Integration AgentMail Setup Configured: 2026-09-13 Owner: Christopher Tan OpenClaw configuration AgentMail skill: installed from ClawHub ( agentmail 1.1.1) OpenClaw skill entry: enabled Credential reference: AGENTMAIL_API_KEY in protected secret storage API host: api.agentmail.to API key is intentionally not recorded here. Inboxes mastercontrol@agentmail.to — primary OpenClaw AgentMail inbox workerb@agentmail.to — secondary worker inbox; currently created and accessible Python integration Python packages: agentmail, python-dotenv SDK imports verified successfully. AgentMail API base: https://api.agentmail.to/v0 Verification Primary inbox listing: successful ( HTTP 200) Primary inbox message retrieval: successful ( HTTP 200) Send/receive self-test: successful; sent and retrieved subject OpenClaw AgentMail self-test. Worker B thread listing: successful ( HTTP 200); currently zero threads. Operational notes Use the protected secret prompt for key replacement; never put API keys in chat or this page. AgentMail send endpoint is /v0/inboxes/{inbox_id}/messages/send. Creating additional inboxes is subject to the AgentMail plan inbox limit.