NixOS flake for hardened OpenClaw deployment
Two lines in your flake flip OpenClaw from alarmingly exposed to locked-down: gateway auth, localhost binding, Caddy auto-TLS, strict systemd directives, tool allowlists, and fail2ban are all wired in. It's a pragmatic, opinionated safety wrapper that saves you from the default footguns — just expect it to be useful only if you already live in the NixOS/OpenClaw world.
