Téléverser les fichiers vers "/"

.env

@@ -0,0 +1 @@
+TZ=Europe/Paris

docker-compose.yml

@@ -0,0 +1,46 @@
+services:
+  socket-proxy:
+    image: tecnativa/docker-socket-proxy:latest
+    container_name: socket-proxy
+    restart: unless-stopped
+    networks:
+      - tan-network
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONTAINERS=1
+      - IMAGES=1
+      - NETWORKS=1
+      - SERVICES=1
+      - TASKS=1
+      - INFO=1
+      - PING=1
+      - VERSION=1
+      - POST=0
+
+  openclaw:
+    image: ghcr.io/openclaw/openclaw:latest
+    container_name: openclaw
+    restart: unless-stopped
+    depends_on:
+      - socket-proxy
+    networks:
+      - tan-network
+    volumes:
+      - /home/docker/openclaw/data:/app/data
+      - ./config:/app/config
+    environment:
+      - TZ=Europe/Paris
+      - OPENCLAW_BASE_URL=https://claw.tondomaine.tld
+      - DOCKER_HOST=tcp://socket-proxy:2375
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.openclaw.rule=Host(`claw.tondomaine.tld`)
+      - traefik.http.routers.openclaw.entrypoints=websecure
+      - traefik.http.routers.openclaw.tls=true
+      - traefik.http.routers.openclaw.middlewares=authentik@docker
+      - traefik.http.services.openclaw.loadbalancer.server.port=3000
+
+networks:
+  tan-network:
+    external: true

docker_exec.json

@@ -0,0 +1,14 @@
+{
+  "name": "docker-exec",
+  "mode": "restricted",
+  "capabilities": [
+    "restart_container",
+    "stop_container"
+  ],
+  "rules": [
+    "demander confirmation explicite",
+    "interdire nextcloud",
+    "interdire authentik",
+    "interdire traefik"
+  ]
+}

docker_safe.json

@@ -0,0 +1,13 @@
+{
+  "name": "docker-safe",
+  "mode": "safe",
+  "capabilities": [
+    "list_containers",
+    "inspect_container",
+    "logs"
+  ],
+  "rules": [
+    "aucune modification",
+    "aucun restart"
+  ]
+}

infra_doctor.json

@@ -0,0 +1,16 @@
+{
+  "name": "infra-doctor",
+  "mode": "safe",
+  "description": "Analyse de l'infrastructure et diagnostic",
+  "capabilities": [
+    "docker_ps",
+    "docker_stats",
+    "docker_logs",
+    "system_info"
+  ],
+  "rules": [
+    "lecture seule",
+    "aucune action destructive",
+    "toujours expliquer avant conclusion"
+  ]
+}