#9426: Coolify deploy hardening: compose, bootstrap, Traefik

## Summary Production-ready Coolify deployment setup with hardened Docker Compose configuration, Traefik integration, and bootstrap script for token management and configuration. ## Motivation Coolify deployments are fragile without explicit Traefik routing and consistent bootstrap behavior. This PR makes the default Compose and bootstrap path production-ready. ## How It Works 1. Traefik routes HTTPS to the container's internal port 2. Bootstrap script validates bind/token settings and writes config 3. Gateway starts with consistent bind/port flags 4. Docker socket proxy enables sandboxing safely ## Architecture ```mermaid graph LR; User --> Traefik; Traefik --> OpenClaw[openclaw container]; OpenClaw --> Bootstrap[scripts/coolify-bootstrap.sh]; Bootstrap --> Config[/root/.openclaw/openclaw.json]; Bootstrap --> Gateway; OpenClaw --> DockerProxy[docker-socket-proxy]; ``` ## Key Code Changes 1. **New Files:** - `docker-compose.coolify.yml` - Production Compose for Coolify with Traefik labels - `scripts/coolify-bootstrap.sh` - Bootstrap script (token sync, config creation, startup) - `.env.coolify.example` - Environment variable template 2. **Docker Compose Hardening (`docker-compose.coolify.yml`):** - Security opts: `no-new-privileges:true` - Capabilities: `cap_drop: ALL` - File descriptor limits: `ulimits.nofile: 65535` (WebSocket connections) - Traefik labels for automatic HTTPS routing - Docker socket proxy integration for safe sandboxing 3. **Bootstrap Script Features (`scripts/coolify-bootstrap.sh`):** - Token sync: Writes `SERVICE_PASSWORD_GATEWAY` to `$TOKEN_FILE` - Config validation: Checks `OPENCLAW_GATEWAY_BIND` (defaults to `lan`) - CLI setup: Creates symlink `/root/bin/openclaw` → `/app/openclaw.mjs` - PATH fixes: Ensures `/root/bin` is in PATH - Docker proxy wait: Polls `$DOCKER_HOST/_ping` before gateway startup - Workspace alignment: Uses `/root/openclaw-workspace` 4. **Container Configuration:** - Environment: `GATEWAY_TRUSTED_PROXIES=10.0.1.7` (Coolify's Traefik) - Volumes: `openclaw-config`, `openclaw-workspace` - User: `0` (root for Coolify volume permissions) - Healthcheck: HTTP endpoint for Traefik routing 5. **Bug Fixes:** - `src/agents/skills-install.ts` - Changed from `-g` to `--prefix CONFIG_DIR` for Docker compatibility - `src/cron/isolated-agent/run.ts` - Removed unused import `formatXHighModelHint` - `src/docker-setup.test.ts` - Updated to support multiple compose file locations ## Dependencies - PR #9421 for `skipDevicePairingForTrustedProxy` support ## Testing - `pnpm build && pnpm test`