OpenClaw入門
導入手順から社内Kubernetes
本番運用まで完全ガイド

┌─────────────────────────────────────────────────────────────┐
│  社内 LAN (192.168.11.0/24)                                  │
│                                                              │
│   ┌──────────────────┐    ┌──────────────────────────────┐   │
│   │ Synology NAS     │    │ Ubuntu Server                │   │
│   │ 192.168.11.241   │    │ 192.168.11.248               │   │
│   │ ├ Redmine :8080  │    │ ├ Lemonade LLM :8000         │   │
│   │ ├ Growi  :3000   │    │ │   (Qwen / Gemma local)     │   │
│   │ └ chatgpt-bridge │    │ └ docker registry            │   │
│   │   :18080         │    └──────────────────────────────┘   │
│   │   (gpt-image-2)  │                                       │
│   └──────────────────┘                                       │
│            ▲                                                 │
│            │ image-gen skill                                 │
│   ┌────────┴───────────────────────────────────┐             │
│   │ Raspberry Pi 5 (192.168.11.250)             │            │
│   │ ┌────────────────────────────────────────┐  │            │
│   │ │ k3s (single-node, Traefik, local-path)│  │            │
│   │ │  ┌──────────────────────────────────┐ │  │            │
│   │ │  │ Namespace: openclaw              │ │  │            │
│   │ │  │  ├ Deployment: openclaw           │ │  │           │
│   │ │  │  │   image: ghcr.io/openclaw      │ │  │           │
│   │ │  │  │   port:  18789                 │ │  │           │
│   │ │  │  ├ ConfigMap: openclaw-config     │ │  │           │
│   │ │  │  ├ Secret:    openclaw-secrets    │ │  │           │
│   │ │  │  └ PVC:       openclaw-data       │ │  │           │
│   │ │  └──────────────────────────────────┘ │  │            │
│   │ └────────────────────────────────────────┘  │            │
│   └─────────────────────────────────────────────┘            │
└─────────────────────────────────────────────────────────────┘

services:
  openclaw:
    image: ghcr.io/openclaw/openclaw:2026.5.7
    container_name: openclaw
    ports:
      - "18789:18789"
    environment:
      OPENCLAW_SKIP_ONBOARDING: "1"
      OPENCLAW_DISABLE_BONJOUR: "1"
    volumes:
      - ./data:/home/node/.openclaw
      - ./openclaw.json:/home/node/.openclaw/openclaw.json:ro
    restart: unless-stopped

{
  "gateway": {
    "bind": "custom",
    "customBindHost": "0.0.0.0",
    "auth": { "mode": "token", "token": "REPLACE_ME_RANDOM_32CHARS" }
  },
  "models": {
    "mode": "merge",
    "providers": {
      "lemonade-local": {
        "baseUrl": "http://192.168.11.248:8000/api/v1",
        "api": "openai-completions",
        "models": [
          {
            "id": "user.Qwen3.6-35B-A3B-Q4",
            "name": "Qwen 3.6 35B A3B Q4 (Local)",
            "reasoning": true,
            "input": ["text"],
            "cost": { "input": 0, "output": 0 },
            "contextWindow": 262144,
            "contextTokens": 240000,
            "maxTokens": 16384
          }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": { "primary": "lemonade-local/user.Qwen3.6-35B-A3B-Q4" }
    }
  }
}

docker compose up -d
curl http://127.0.0.1:18789/healthz
# → {"status":"ok"}

# ブラウザで http://localhost:18789/ にアクセス
# 起動時に gateway token を入れるとログイン完了

{
  "agents": {
    "defaults": {
      "model": {
        "primary": "openai-codex/gpt-5.5",
        "fallbacks": [
          "lemonade-local/user.Qwen3.6-35B-A3B-Q4"
        ]
      }
    }
  }
}

k3s/
├── kustomization.yaml
├── namespace.yaml         # openclaw namespace
├── configmap.yaml         # openclaw.json (Gemma/Qwen + Codex 設定)
├── pvc.yaml               # /home/node/.openclaw 永続化（local-path）
├── deployment.yaml        # ghcr image + Secret 注入
├── service.yaml           # ClusterIP / LoadBalancer
└── ingress.yaml           # openclaw.192.168.11.250.sslip.io

apiVersion: apps/v1
kind: Deployment
metadata: { name: openclaw, namespace: openclaw }
spec:
  replicas: 1
  strategy:
    type: Recreate              # PVC が RWO なので Recreate 必須
  template:
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch   # 起動高速化の必須設定
      initContainers:
        - name: seed-config
          image: busybox:1.36
          # PVC 上に openclaw.json が無いときだけ ConfigMap から seed
          # → runtime に書き換えた auth profile を保護
      containers:
        - name: openclaw
          image: ghcr.io/openclaw/openclaw:2026.5.7
          ports: [ { name: http, containerPort: 18789 } ]
          env:
            - { name: OPENCLAW_SKIP_ONBOARDING,   value: "1" }
            - { name: OPENCLAW_DISABLE_BONJOUR,   value: "1" }
            # ... Secret から各種 API トークンを注入
          volumeMounts:
            - { name: data,             mountPath: /home/node/.openclaw }
            - { name: obsidian-vault,   mountPath: /home/node/obsidian-vault }
          livenessProbe:  { httpGet: { path: /healthz, port: http } }
          readinessProbe: { httpGet: { path: /readyz,  port: http } }

# scripts/deploy.sh
sudo BRIDGE_API_TOKEN=<NAS発行のトークン> ./scripts/deploy.sh

# 内部処理:
# 1. namespace 作成 (openclaw)
# 2. init-secret.sh で GATEWAY_TOKEN 乱数生成 → Secret 作成
#    BRIDGE_API_TOKEN 等の追加トークンがあれば同 Secret に併合
# 3. kubectl apply -k k3s/
# 4. rollout status の完了待ち

# openclaw-secrets （Secret）
GATEWAY_TOKEN          # OpenClaw 自身のゲートウェイ認証
BRIDGE_API_TOKEN       # NAS の chatgpt-bridge → gpt-image-2
REDMINE_URL            # 社内 Redmine
REDMINE_API_KEY        # 〃
GSK_API_KEY            # Genspark CLI
X_API_KEY/X_API_SECRET # SNS自動投稿 (X)
IG_ACCESS_TOKEN        # Instagram Graph API
FB_PAGE_TOKEN          # Facebook Page

# openclaw-ga4 （別 Secret）
service-account.json   # GA4 Data API 用 Google サービスアカウント鍵

POD=$(sudo KUBECONFIG=/etc/rancher/k3s/k3s.yaml \
  kubectl get pod -n openclaw -l app=openclaw \
  -o jsonpath='{.items[0].metadata.name}')

sudo KUBECONFIG=/etc/rancher/k3s/k3s.yaml \
  kubectl exec -it -n openclaw $POD -c openclaw -- \
  openclaw models auth login --provider openai-codex