Fix OpenClaw template: secrets, auto-detect origin, all AI providers

.saturn/templates-enterprise.json

@@ -109,9 +109,9 @@
       "recipe_path": "examples/wandb/.saturn/saturn.json"
     },
     {
-      "title": "OpenClaw (Deployment)",
+      "title": "OpenClaw Beta",
       "thumbnail_image_url": "https://saturn-public-assets.s3.us-east-2.amazonaws.com/example-thumbnails/openclaw.png",
-      "weight": 1950,
+      "weight": 10,
       "recipe_path": "examples/openclaw/.saturn/saturn.json"
     }
   ]

.saturn/templates-hosted.json

@@ -109,9 +109,9 @@
       "recipe_path": "examples/wandb/.saturn/saturn.json"
     },
     {
-      "title": "OpenClaw (Deployment)",
+      "title": "OpenClaw Beta",
       "thumbnail_image_url": "https://saturn-public-assets.s3.us-east-2.amazonaws.com/example-thumbnails/openclaw.png",
-      "weight": 1950,
+      "weight": 10,
       "recipe_path": "examples/openclaw/.saturn/saturn.json"
     }
   ]

examples/openclaw/.saturn/bootstrap-openclaw.sh

@@ -8,7 +8,62 @@ set -euo pipefail
 echo "[openclaw] starting setup..."
 
 : "${OPENCLAW_GATEWAY_TOKEN:?OPENCLAW_GATEWAY_TOKEN is required}"
-: "${OPENCLAW_PUBLIC_ORIGIN:?OPENCLAW_PUBLIC_ORIGIN is required}"
+
+# Auto-detect the public origin from the Saturn Cloud API.
+# SATURN_TOKEN (a JWT) contains the deployment ID in its payload.
+# We decode it, call the Saturn API to get the deployment's public URL,
+# and use that as the allowed origin for the OpenClaw Control UI.
+# If OPENCLAW_PUBLIC_ORIGIN is explicitly set to a real URL, that takes
+# precedence — useful when a custom domain is in front of the deployment.
+_PLACEHOLDER_ORIGIN="https://your-subdomain.community.saturnenterprise.io"
+if [ -z "${OPENCLAW_PUBLIC_ORIGIN:-}" ] || [ "${OPENCLAW_PUBLIC_ORIGIN}" = "${_PLACEHOLDER_ORIGIN}" ]; then
+  echo "[openclaw] auto-detecting public origin via Saturn API..."
+
+  if [ -n "${SATURN_TOKEN:-}" ] && [ -n "${SATURN_BASE_URL:-}" ]; then
+    # Decode JWT payload to extract the deployment ID
+    _RESOURCE_ID=$(python3 -c "
+import json, base64, sys
+try:
+    token = '$SATURN_TOKEN'
+    payload = token.split('.')[1]
+    payload += '=' * (4 - len(payload) % 4)
+    data = json.loads(base64.urlsafe_b64decode(payload))
+    resource = data.get('resource', '')
+    print(resource.split(':')[-1] if ':' in resource else '')
+except:
+    print('')
+" 2>/dev/null)
+
+    if [ -n "$_RESOURCE_ID" ]; then
+      _PUBLIC_URL=$(curl -sf \
+        -H "Authorization: token $SATURN_TOKEN" \
+        "$SATURN_BASE_URL/api/deployments/$_RESOURCE_ID" \
+        | python3 -c "
+import json, sys
+try:
+    data = json.load(sys.stdin)
+    url = (data.get('state', {}).get('url') or
+           data.get('url') or '')
+    print(url)
+except:
+    print('')
+" 2>/dev/null)
+
+      if [ -n "$_PUBLIC_URL" ]; then
+        OPENCLAW_PUBLIC_ORIGIN="$_PUBLIC_URL"
+        echo "[openclaw] auto-detected public origin: $OPENCLAW_PUBLIC_ORIGIN"
+      fi
+    fi
+  fi
+
+  if [ -z "${OPENCLAW_PUBLIC_ORIGIN:-}" ]; then
+    echo "[openclaw] ERROR: OPENCLAW_PUBLIC_ORIGIN is not set and could not be auto-detected."
+    echo "[openclaw] Set OPENCLAW_PUBLIC_ORIGIN to your deployment URL and restart."
+    exit 1
+  fi
+else
+  echo "[openclaw] using configured public origin: $OPENCLAW_PUBLIC_ORIGIN"
+fi
 
 ENABLE_WHATSAPP="${ENABLE_WHATSAPP:-false}"
 ENABLE_TELEGRAM="${ENABLE_TELEGRAM:-false}"

examples/openclaw/.saturn/saturn.json

@@ -1,28 +1,79 @@
 {
-  "name": "example-openclaw",
-  "image_uri": "public.ecr.aws/saturncloud/saturn-python:2025.05.01",
-  "description": "Deploy OpenClaw Beta on Saturn Cloud.",
-  "environment_variables": {
-    "ANTHROPIC_API_KEY": "",
-    "ENABLE_TELEGRAM": "false",
-    "ENABLE_WHATSAPP": "false",
-    "OPENCLAW_GATEWAY_TOKEN": "",
-    "OPENCLAW_MODEL": "anthropic/claude-sonnet-4-5",
-    "OPENCLAW_PUBLIC_ORIGIN": "https://your-subdomain.community.saturnenterprise.io",
-    "TELEGRAM_ALLOW_FROM": "[\"123456789\"]",
-    "TELEGRAM_BOT_TOKEN": "",
-    "WHATSAPP_ALLOW_FROM": "[\"+1234567890\"]"
-  },
-  "working_directory": "/home/jovyan/examples/examples/openclaw",
-  "git_repositories": [
-    {
-      "url": "https://github.com/saturncloud/examples",
-      "path": "/home/jovyan/examples"
-    }
-  ],
-  "deployment": {
+  "schema_version": "2024.04.01",
+  "type": "deployment",
+  "spec": {
+    "name": "example-openclaw",
+    "description": "Deploy OpenClaw Beta on Saturn Cloud.",
+    "tags": {
+      "type": "featured-tutorial"
+    },
+    "image": "saturncloud/saturn-python:2025.05.01",
     "instance_type": "large",
-    "command": "bash .saturn/bootstrap-openclaw.sh"
-  },
-  "version": "2022.01.06"
-}
+    "environment_variables": {
+      "ENABLE_TELEGRAM": "false",
+      "ENABLE_WHATSAPP": "false",
+      "OPENCLAW_MODEL": "",
+      "OPENCLAW_PUBLIC_ORIGIN": "",
+      "TELEGRAM_ALLOW_FROM": "[\"123456789\"]",
+      "WHATSAPP_ALLOW_FROM": "[\"+1234567890\"]"
+    },
+    "secrets": [
+      {
+        "location": "OPENCLAW_GATEWAY_TOKEN",
+        "attachment_type": "environment_variable",
+        "description": "Gateway authentication token — set this to a secure random string (e.g. openssl rand -hex 32). Required."
+      },
+      {
+        "location": "ANTHROPIC_API_KEY",
+        "attachment_type": "environment_variable",
+        "description": "Anthropic API key. Link this OR one of the other provider keys below — only one is needed."
+      },
+      {
+        "location": "OPENAI_API_KEY",
+        "attachment_type": "environment_variable",
+        "description": "OpenAI API key. Link this OR one of the other provider keys — only one is needed."
+      },
+      {
+        "location": "GEMINI_API_KEY",
+        "attachment_type": "environment_variable",
+        "description": "Google Gemini API key. Link this OR one of the other provider keys — only one is needed."
+      },
+      {
+        "location": "MISTRAL_API_KEY",
+        "attachment_type": "environment_variable",
+        "description": "Mistral API key. Link this OR one of the other provider keys — only one is needed."
+      },
+      {
+        "location": "OPENROUTER_API_KEY",
+        "attachment_type": "environment_variable",
+        "description": "OpenRouter API key. Link this OR one of the other provider keys — only one is needed."
+      },
+      {
+        "location": "TELEGRAM_BOT_TOKEN",
+        "attachment_type": "environment_variable",
+        "description": "Telegram bot token from BotFather. Only required if ENABLE_TELEGRAM is set to true."
+      }
+    ],
+    "working_directory": "/home/jovyan/examples/examples/openclaw",
+    "extra_packages": {},
+    "start_script": "",
+    "token_scope": null,
+    "git_repositories": [
+      {
+        "url": "https://github.com/saturncloud/examples",
+        "path": "/home/jovyan/examples",
+        "public": true,
+        "reference": "main",
+        "reference_type": "branch",
+        "on_restart": "preserve changes"
+      }
+    ],
+    "start_dind": false,
+    "command": "bash .saturn/bootstrap-openclaw.sh",
+    "scale": 1,
+    "start_ssh": false,
+    "use_spot_instance": false,
+    "routes": [],
+    "viewers": []
+  }
+}