docs: update Redpill provider with Phala Cloud deployment guide
- Add Phala Cloud CVM deployment instructions - Document auto-configuration of channels (Telegram, Discord) - Add gateway auth (password/token) documentation - Remove non-functional SETUP_PASSWORD references - Fix URL format for Phala Cloud dstack Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
HashWarlock
parent
b02fb9364d
commit
fb106d774b
@ -3,6 +3,7 @@ summary: "Use Redpill AI GPU TEE models in Clawdbot"
|
||||
read_when:
|
||||
- You want privacy-focused inference with hardware-verified security
|
||||
- You want GPU TEE model setup guidance
|
||||
- You want to deploy Clawdbot on Phala Cloud for full TEE privacy
|
||||
---
|
||||
# Redpill AI
|
||||
|
||||
@ -247,9 +248,194 @@ If you receive attestation errors:
|
||||
}
|
||||
```
|
||||
|
||||
## Deploy on Phala Cloud (Full TEE Stack)
|
||||
|
||||
For maximum privacy, deploy Clawdbot itself inside a Phala Cloud CVM (Confidential Virtual Machine). This creates an end-to-end TEE stack where both the application and the AI inference run in hardware-secured enclaves.
|
||||
|
||||
### Why Phala Cloud + Redpill
|
||||
|
||||
| Layer | TEE Protection |
|
||||
|-------|----------------|
|
||||
| **Application** | Clawdbot runs in Phala Cloud CVM with Intel TDX |
|
||||
| **AI Inference** | Redpill routes to GPU TEE models (Phala, Tinfoil, etc.) |
|
||||
| **Result** | Your prompts never leave secure enclaves from input to output |
|
||||
|
||||
### Prerequisites
|
||||
|
||||
1. [Phala Cloud](https://cloud.phala.network) account with API key
|
||||
2. [Redpill AI](https://redpill.ai) API key
|
||||
3. Docker installed locally
|
||||
4. Phala CLI: `npm install -g phala`
|
||||
|
||||
### Quick Deployment
|
||||
|
||||
**1. Authenticate with Phala Cloud**
|
||||
|
||||
```bash
|
||||
phala auth login <your-phala-cloud-api-key>
|
||||
```
|
||||
|
||||
**2. Create docker-compose.phala.yml**
|
||||
|
||||
The container auto-configures Redpill as the default provider when `REDPILL_API_KEY` is set on first boot.
|
||||
|
||||
```yaml
|
||||
# docker-compose.phala.yml for Phala Cloud CVM
|
||||
services:
|
||||
clawdbot:
|
||||
image: hashwarlock/clawdbot:redpill
|
||||
environment:
|
||||
HOME: /home/node
|
||||
TERM: xterm-256color
|
||||
# Auto-configures Redpill provider on first boot
|
||||
REDPILL_API_KEY: ${REDPILL_API_KEY}
|
||||
# Auto-configures messaging channels when tokens are provided
|
||||
TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
|
||||
DISCORD_BOT_TOKEN: ${DISCORD_BOT_TOKEN:-}
|
||||
# Gateway configuration
|
||||
GATEWAY_PORT: ${GATEWAY_PORT:-18789}
|
||||
GATEWAY_AUTH: ${GATEWAY_AUTH:-off}
|
||||
# Persistence paths
|
||||
CLAWDBOT_STATE_DIR: /data/.clawdbot
|
||||
CLAWDBOT_WORKSPACE_DIR: /data/workspace
|
||||
volumes:
|
||||
- clawdbot-data:/data
|
||||
network_mode: host
|
||||
restart: unless-stopped
|
||||
|
||||
volumes:
|
||||
clawdbot-data:
|
||||
```
|
||||
|
||||
**3. Create .env file**
|
||||
|
||||
```bash
|
||||
# .env - secrets are encrypted to the TEE
|
||||
REDPILL_API_KEY=rp_xxxxxxxxxxxx
|
||||
# Optional: messaging channels (auto-configure on boot)
|
||||
# TELEGRAM_BOT_TOKEN=your-telegram-bot-token
|
||||
# DISCORD_BOT_TOKEN=your-discord-bot-token
|
||||
# Optional: protect the web UI with password auth
|
||||
# GATEWAY_AUTH=password
|
||||
# GATEWAY_PASSWORD=your-secure-password
|
||||
```
|
||||
|
||||
**4. Deploy to Phala Cloud**
|
||||
|
||||
```bash
|
||||
phala deploy \
|
||||
--name clawdbot-tee \
|
||||
--compose ./docker-compose.phala.yml \
|
||||
--env-file ./.env \
|
||||
--vcpu 2 \
|
||||
--memory 4G \
|
||||
--disk-size 20G
|
||||
```
|
||||
|
||||
**5. Access the Gateway**
|
||||
|
||||
After deployment, get your CVM's public URL:
|
||||
|
||||
```bash
|
||||
phala cvms get clawdbot-tee
|
||||
```
|
||||
|
||||
The gateway URL follows the Phala Cloud dstack format: `https://<DSTACK_APP_ID>-18789.<DSTACK_GATEWAY_URL>`. If you enabled `GATEWAY_AUTH=password`, add `?password=your-password` to the URL.
|
||||
|
||||
### Managing Your Deployment
|
||||
|
||||
```bash
|
||||
# View logs
|
||||
phala cvms logs clawdbot-tee
|
||||
|
||||
# Check status
|
||||
phala cvms get clawdbot-tee
|
||||
|
||||
# SSH into CVM (if deployed with --dev-os)
|
||||
phala ssh clawdbot-tee
|
||||
|
||||
# Update deployment (use CVM ID from phala cvms get)
|
||||
phala deploy --cvm-id app_xxxxx --compose ./docker-compose.phala.yml
|
||||
|
||||
# Or if phala.toml exists from initial deploy, just run:
|
||||
phala deploy
|
||||
```
|
||||
|
||||
### Configuration via Web UI
|
||||
|
||||
Redpill is automatically configured as the default provider on first boot. If you provided `TELEGRAM_BOT_TOKEN` or `DISCORD_BOT_TOKEN`, those channels are also auto-configured and running.
|
||||
|
||||
Access your gateway URL to:
|
||||
|
||||
1. Configure additional channels (Slack, Signal, WhatsApp) via the Channels page
|
||||
2. Start chatting with full TEE privacy (Redpill is already set as default)
|
||||
3. View and switch models via the Config page (`/config`)
|
||||
|
||||
### Environment Variables
|
||||
|
||||
| Variable | Required | Description |
|
||||
|----------|----------|-------------|
|
||||
| `REDPILL_API_KEY` | Yes | Your Redpill API key (auto-configures all 18 GPU TEE models on first boot) |
|
||||
| `TELEGRAM_BOT_TOKEN` | No | Telegram bot token (auto-configures and starts Telegram channel on boot) |
|
||||
| `DISCORD_BOT_TOKEN` | No | Discord bot token (auto-configures and starts Discord channel on boot) |
|
||||
| `GATEWAY_PORT` | No | Gateway port (default: `18789`) |
|
||||
| `GATEWAY_AUTH` | No | Gateway auth mode: `off`, `token`, or `password` (default: `off`) |
|
||||
| `GATEWAY_TOKEN` | No | Gateway token (required when `GATEWAY_AUTH=token`) |
|
||||
| `GATEWAY_PASSWORD` | No | Gateway password (required when `GATEWAY_AUTH=password`) |
|
||||
| `CLAWDBOT_STATE_DIR` | No | Config/credentials path (default: `/data/.clawdbot`) |
|
||||
| `CLAWDBOT_WORKSPACE_DIR` | No | Workspace path (default: `/data/workspace`) |
|
||||
|
||||
### Securing Your Deployment
|
||||
|
||||
For production deployments, enable gateway authentication to protect the web UI:
|
||||
|
||||
```bash
|
||||
# .env - with password auth enabled
|
||||
REDPILL_API_KEY=rp_xxxxxxxxxxxx
|
||||
GATEWAY_AUTH=password
|
||||
GATEWAY_PASSWORD=your-secure-password
|
||||
```
|
||||
|
||||
Access the UI: `https://<DSTACK_APP_ID>-18789.<DSTACK_GATEWAY_URL>?password=your-secure-password`
|
||||
|
||||
For token-based auth (alternative):
|
||||
|
||||
```bash
|
||||
GATEWAY_AUTH=token
|
||||
GATEWAY_TOKEN=your-secret-gateway-token
|
||||
```
|
||||
|
||||
Access with: `https://<DSTACK_APP_ID>-18789.<DSTACK_GATEWAY_URL>?token=your-secret-gateway-token`
|
||||
|
||||
### Adding Messaging Channels
|
||||
|
||||
The following channels work in Docker/Linux environments (no Mac services required):
|
||||
|
||||
| Channel | Setup | Environment Variables |
|
||||
|---------|-------|----------------------|
|
||||
| **Telegram** | Easy | `TELEGRAM_BOT_TOKEN` |
|
||||
| **Discord** | Easy | `DISCORD_BOT_TOKEN` |
|
||||
| **Slack** | Medium | `SLACK_APP_TOKEN`, `SLACK_BOT_TOKEN` |
|
||||
| **WhatsApp** | Medium | QR code login via `/setup` wizard |
|
||||
| **Signal** | Hard | Requires `signal-cli` + Java |
|
||||
|
||||
Configure channels via the `/setup` wizard at `https://<cvm-url>:18789/setup`.
|
||||
|
||||
### Persistent Storage
|
||||
|
||||
The `clawdbot-data` volume stores:
|
||||
- Channel credentials and tokens
|
||||
- Agent configurations
|
||||
- Session history
|
||||
- Workspace files
|
||||
|
||||
Data persists across CVM restarts and upgrades.
|
||||
|
||||
## More Information
|
||||
|
||||
- [Redpill AI](https://redpill.ai)
|
||||
- [API Documentation](https://docs.redpill.ai)
|
||||
- [GPU TEE Technology](https://docs.redpill.ai/privacy/overview)
|
||||
- [Pricing](https://redpill.ai/pricing)
|
||||
- [Phala Cloud](https://cloud.phala.network)
|
||||
- [Phala Cloud CLI Docs](https://docs.phala.network/phala-cloud/references/phala-cloud-cli/phala/overview)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user