# Knowledge Base Index

# OClaw Knowledge Base

This book records durable, non-secret knowledge from OpenClaw work. Credentials, API keys, token values, and other sensitive secrets are intentionally excluded.

## How this book is maintained

- Add or update pages after meaningful sessions.
- Record decisions, verified procedures, integration status, troubleshooting outcomes, and follow-up actions.
- Keep transient chat noise and secret material out of the knowledge base.
- Prefer one page per system or topic, with this index linking the durable record.

## Current integration status

### BookStack

- BookStack API access is working.
- Existing books observed before this book was created: **AI** and **OpenClaw**.
- BookStack credentials are configured through protected secret storage.
- The BookStack API token requires **Access System API** permission.

### UniFi

- Cloud Site Manager API access through `api.ui.com` was verified read-only.
- Observed environment: one console/site, five networks, eight firewall zones, 145 policies, and zero ACL rules.
- Reverse proxy host: `192.168.1.117`.
- The reverse-proxy port-forward was tightened to expose ports `80` and `443`; port `8080` was removed.
- Port 80 is useful for HTTP-to-HTTPS redirects or certificate validation; 443 is the primary public service port.
- Recommended follow-up: enable logging on the specific WAN-to-reverse-proxy firewall allow rule and keep other administrative ports private.
- A public DNS port-forward and Home-to-Camera/IoT access were flagged for intentionality and least-privilege review.
- No firewall changes were made by the assistant.

### Proxmox

- Dedicated page: [Proxmox Read-Only Integration](/books/oclaw/page/proxmox-read-only-integration).
- Hostname: `pve.stargrid.com.au`, resolving internally to `192.168.1.115`.
- API endpoint: `https://pve.stargrid.com.au:8006/api2/json`.
- API token identity: `oc@pve!oc`; permission: `PVEAuditor` at path `/`.
- Token secret is protected in OpenClaw secret storage as `PROXMOX_API_TOKEN`; no secret is recorded here.
- Direct read-only API validation succeeded and returned node JSON.
- The certificate is issued to the Proxmox hostname by the cluster CA; clients need to trust that CA or explicitly disable TLS verification.
- OpenClaw's protected egress path still returns HTTP 502 for this private-LAN destination; this is separate from Proxmox authentication.

### OpenClaw Gateway and secrets

- Gateway was previously inspected as a healthy systemd user service owned by `stark`, listening on localhost port 18789.
- Protected credentials should be stored through OpenClaw secret storage and never pasted into chat.
- Secret allowlists must match the exact destination hostname or IP used by the request.
- Existing troubleshooting lesson: a reachable service with HTTP 401 indicates routing is working and authentication/configuration remains the issue; a 502 may indicate the protected egress path or proxy rather than the target service.

## Follow-up queue

1. Enable logging on the UniFi reverse-proxy allow rule.
2. Resolve the OpenClaw protected egress path and retry the read-only Proxmox inventory check.
3. Add focused pages for UniFi firewall review, Proxmox health review, and OpenClaw operations as those topics are revisited.

*Last updated: 2026-09-12 UTC.*