feat: add openclaw sandboxed user, sudo policy, fs restrictions, docker proxy, watchdog

modules/openclaw-watchdog.nix

@@ -0,0 +1,82 @@
+{ pkgs, ... }:
+{
+  systemd.services.openclaw-watchdog = {
+    description = "Post-rebuild health watchdog";
+    after = [ "network.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "/etc/openclaw/nixos-rollback.sh check";
+    };
+    onFailure = [ "nixos-rollback.service" ];
+  };
+
+  systemd.services.nixos-rollback = {
+    description = "Autonomous NixOS rollback";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "/etc/openclaw/nixos-rollback.sh rollback";
+    };
+  };
+
+  environment.etc."openclaw/nixos-rollback.sh" = {
+    mode = "0750";
+    text = ''
+      #!/usr/bin/env bash
+      set -euo pipefail
+
+      WEBHOOK="$(cat /run/secrets/discord-webhook 2>/dev/null || echo "")"
+      UNITS=("sshd" "docker" "bluesky-pds" "cloudflared")
+      HOSTNAME="$(hostname)"
+
+      notify() {
+        [ -z "$WEBHOOK" ] && return
+        curl -s -X POST "$WEBHOOK" \
+          -H "Content-Type: application/json" \
+          -d "{\"content\": \"$1\"}"
+      }
+
+      check_units() {
+        for unit in "''${UNITS[@]}"; do
+          if ! systemctl is-active --quiet "$unit"; then
+            return 1
+          fi
+        done
+        return 0
+      }
+
+      check_ssh() {
+        timeout 5 bash -c 'echo > /dev/tcp/127.0.0.1/22' 2>/dev/null
+      }
+
+      do_check() {
+        for i in $(seq 1 6); do
+          sleep 10
+          if check_units && check_ssh; then
+            notify "**[$HOSTNAME] NixOS switch healthy** — all units OK after rebuild."
+            exit 0
+          fi
+        done
+        exit 1
+      }
+
+      do_rollback() {
+        notify "**[$HOSTNAME] ROLLBACK TRIGGERED** — health check failed. Rolling back..."
+        if nixos-rebuild switch --rollback; then
+          sleep 15
+          if check_units && check_ssh; then
+            notify "**[$HOSTNAME] Rollback successful** — previous generation restored."
+          else
+            notify "**[$HOSTNAME] URGENT — rollback also failed.** Manual intervention needed."
+          fi
+        else
+          notify "**[$HOSTNAME] URGENT — rollback command failed.** Manual intervention needed."
+        fi
+      }
+
+      case "''${1:-check}" in
+        check) do_check ;;
+        rollback) do_rollback ;;
+      esac
+    '';
+  };
+}