fix: resolve OpenClaw iframe connection refused and Docker HTTP proxy conflict

dashboard/backend/main.py

@@ -28,7 +28,7 @@ async def monitor_containers():
                         msg = f"⚠️ *Container Alert* ⚠️\nContainer `{c.name}` just stopped unexpectedly (Status: {current_status})."
                         # Use httpx directly as system.send_notification expects a FastAPI request object usually
                         if TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID:
-                            proxy_url = os.environ.get("HTTP_PROXY") or os.environ.get("http_proxy")
+                            proxy_url = os.environ.get("TELEGRAM_PROXY")
                             async with httpx.AsyncClient(proxy=proxy_url) as hc:
                                 await hc.post(
                                     f"https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage",

dashboard/backend/routers/system.py

@@ -16,7 +16,7 @@ async def send_notification(body: dict):
     msg = body.get("message", "")
     if not msg or not TELEGRAM_BOT_TOKEN or not TELEGRAM_CHAT_ID:
         return {"ok": False, "error": "missing message or Telegram config"}
-    proxy_url = os.environ.get("HTTP_PROXY") or os.environ.get("http_proxy")
+    proxy_url = os.environ.get("TELEGRAM_PROXY")
     async with httpx.AsyncClient(proxy=proxy_url) as client:
         r = await client.post(
             f"https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage",

dashboard/docker-compose.yml

@@ -36,8 +36,7 @@ services:
       - VPS_SSH_USER=jimmyg
       - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
       - TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID:-}
-      - HTTP_PROXY=${HTTP_PROXY:-}
+      - TELEGRAM_PROXY=${TELEGRAM_PROXY:-}
-      - HTTPS_PROXY=${HTTPS_PROXY:-}
     volumes:
       - /volume1:/volume1
       - /volume1/docker/nas-dashboard/ssh/dashboard_terminal:/app/ssh/id_ed25519:ro

dashboard/frontend/src/routes/OpenClaw.svelte

@@ -1,13 +1,50 @@
+<script>
+  let isTailscale = location.hostname.startsWith("100.");
+  let isLocal = location.hostname === "localhost" || location.hostname === "127.0.0.1" || location.hostname.startsWith("192.168.");
+  let canAccess = isTailscale || isLocal;
+</script>
+
 <div class="space-y-4">
   <div>
     <h1 class="text-2xl font-bold text-surface-900 tracking-tight">OpenClaw</h1>
     <p class="text-sm text-surface-400 mt-1">AI Assistant</p>
   </div>
 
-  <iframe
+  {#if canAccess}
-    src="{location.protocol}//{location.hostname}:3100"
+    <div class="flex flex-col items-center justify-center p-12 text-center bg-surface-50 dark:bg-surface-800 rounded-xl border border-surface-200 dark:border-surface-700 h-[calc(100vh-10rem)]">
-    title="OpenClaw"
+      <div class="h-16 w-16 bg-primary-100 dark:bg-primary-900/30 text-primary-600 dark:text-primary-400 rounded-2xl flex items-center justify-center mb-6">
-    class="w-full h-[calc(100vh-10rem)] rounded-xl border border-surface-200 shadow-lg"
+        <svg xmlns="http://www.w3.org/2000/svg" class="h-8 w-8" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-    allow="clipboard-read; clipboard-write"
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 20l4-16m4 4l4 4-4 4M6 16l-4-4 4-4" />
-  ></iframe>
+        </svg>
+      </div>
+      <h2 class="text-xl font-semibold text-surface-900 dark:text-white mb-2">OpenClaw Ready</h2>
+      <p class="text-surface-600 dark:text-surface-400 max-w-md mb-8">
+        OpenClaw's security settings prevent it from being embedded inside the dashboard. Click below to launch the assistant securely in a new tab.
+      </p>
+      <a
+        href="{location.protocol}//{location.hostname}:3100"
+        target="_blank"
+        rel="noopener noreferrer"
+        class="inline-flex items-center justify-center px-6 py-3 border border-transparent text-base font-medium rounded-lg text-white bg-primary-600 hover:bg-primary-700 shadow-sm transition-colors"
+      >
+        Launch OpenClaw
+        <svg xmlns="http://www.w3.org/2000/svg" class="ml-2 -mr-1 h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 6H6a2 2 0 00-2 2v10a2 2 0 002 2h10a2 2 0 002-2v-4M14 4h6m0 0v6m0-6L10 14" />
+        </svg>
+      </a>
+    </div>
+  {:else}
+    <div class="flex flex-col items-center justify-center p-12 text-center bg-surface-50 dark:bg-surface-800 rounded-xl border border-surface-200 dark:border-surface-700 h-[calc(100vh-10rem)]">
+      <svg xmlns="http://www.w3.org/2000/svg" class="h-16 w-16 text-surface-400 mb-4" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z" />
+      </svg>
+      <h2 class="text-xl font-semibold text-surface-900 dark:text-white mb-2">Tailscale Network Required</h2>
+      <p class="text-surface-600 dark:text-surface-400 max-w-md">
+        For security reasons, OpenClaw is only accessible when connected directly to the NAS via the internal Tailscale network.
+      </p>
+      <p class="mt-4 text-sm text-surface-500">
+        Connect to Tailscale and visit <a href="http://100.78.131.124:4000" class="text-primary-500 hover:underline font-medium">http://100.78.131.124:4000</a> to use the AI Assistant.
+      </p>
+    </div>
+  {/if}
 </div>