diff --git a/docs/providers/redpill.md b/docs/providers/redpill.md index 8adaae432..a90f81f02 100644 --- a/docs/providers/redpill.md +++ b/docs/providers/redpill.md @@ -3,6 +3,7 @@ summary: "Use Redpill AI GPU TEE models in Clawdbot" read_when: - You want privacy-focused inference with hardware-verified security - You want GPU TEE model setup guidance + - You want to deploy Clawdbot on Phala Cloud for full TEE privacy --- # Redpill AI @@ -247,9 +248,194 @@ If you receive attestation errors: } ``` +## Deploy on Phala Cloud (Full TEE Stack) + +For maximum privacy, deploy Clawdbot itself inside a Phala Cloud CVM (Confidential Virtual Machine). This creates an end-to-end TEE stack where both the application and the AI inference run in hardware-secured enclaves. + +### Why Phala Cloud + Redpill + +| Layer | TEE Protection | +|-------|----------------| +| **Application** | Clawdbot runs in Phala Cloud CVM with Intel TDX | +| **AI Inference** | Redpill routes to GPU TEE models (Phala, Tinfoil, etc.) | +| **Result** | Your prompts never leave secure enclaves from input to output | + +### Prerequisites + +1. [Phala Cloud](https://cloud.phala.network) account with API key +2. [Redpill AI](https://redpill.ai) API key +3. Docker installed locally +4. Phala CLI: `npm install -g phala` + +### Quick Deployment + +**1. Authenticate with Phala Cloud** + +```bash +phala auth login +``` + +**2. Create docker-compose.phala.yml** + +The container auto-configures Redpill as the default provider when `REDPILL_API_KEY` is set on first boot. + +```yaml +# docker-compose.phala.yml for Phala Cloud CVM +services: + clawdbot: + image: hashwarlock/clawdbot:redpill + environment: + HOME: /home/node + TERM: xterm-256color + # Auto-configures Redpill provider on first boot + REDPILL_API_KEY: ${REDPILL_API_KEY} + # Auto-configures messaging channels when tokens are provided + TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-} + DISCORD_BOT_TOKEN: ${DISCORD_BOT_TOKEN:-} + # Gateway configuration + GATEWAY_PORT: ${GATEWAY_PORT:-18789} + GATEWAY_AUTH: ${GATEWAY_AUTH:-off} + # Persistence paths + CLAWDBOT_STATE_DIR: /data/.clawdbot + CLAWDBOT_WORKSPACE_DIR: /data/workspace + volumes: + - clawdbot-data:/data + network_mode: host + restart: unless-stopped + +volumes: + clawdbot-data: +``` + +**3. Create .env file** + +```bash +# .env - secrets are encrypted to the TEE +REDPILL_API_KEY=rp_xxxxxxxxxxxx +# Optional: messaging channels (auto-configure on boot) +# TELEGRAM_BOT_TOKEN=your-telegram-bot-token +# DISCORD_BOT_TOKEN=your-discord-bot-token +# Optional: protect the web UI with password auth +# GATEWAY_AUTH=password +# GATEWAY_PASSWORD=your-secure-password +``` + +**4. Deploy to Phala Cloud** + +```bash +phala deploy \ + --name clawdbot-tee \ + --compose ./docker-compose.phala.yml \ + --env-file ./.env \ + --vcpu 2 \ + --memory 4G \ + --disk-size 20G +``` + +**5. Access the Gateway** + +After deployment, get your CVM's public URL: + +```bash +phala cvms get clawdbot-tee +``` + +The gateway URL follows the Phala Cloud dstack format: `https://-18789.`. If you enabled `GATEWAY_AUTH=password`, add `?password=your-password` to the URL. + +### Managing Your Deployment + +```bash +# View logs +phala cvms logs clawdbot-tee + +# Check status +phala cvms get clawdbot-tee + +# SSH into CVM (if deployed with --dev-os) +phala ssh clawdbot-tee + +# Update deployment (use CVM ID from phala cvms get) +phala deploy --cvm-id app_xxxxx --compose ./docker-compose.phala.yml + +# Or if phala.toml exists from initial deploy, just run: +phala deploy +``` + +### Configuration via Web UI + +Redpill is automatically configured as the default provider on first boot. If you provided `TELEGRAM_BOT_TOKEN` or `DISCORD_BOT_TOKEN`, those channels are also auto-configured and running. + +Access your gateway URL to: + +1. Configure additional channels (Slack, Signal, WhatsApp) via the Channels page +2. Start chatting with full TEE privacy (Redpill is already set as default) +3. View and switch models via the Config page (`/config`) + +### Environment Variables + +| Variable | Required | Description | +|----------|----------|-------------| +| `REDPILL_API_KEY` | Yes | Your Redpill API key (auto-configures all 18 GPU TEE models on first boot) | +| `TELEGRAM_BOT_TOKEN` | No | Telegram bot token (auto-configures and starts Telegram channel on boot) | +| `DISCORD_BOT_TOKEN` | No | Discord bot token (auto-configures and starts Discord channel on boot) | +| `GATEWAY_PORT` | No | Gateway port (default: `18789`) | +| `GATEWAY_AUTH` | No | Gateway auth mode: `off`, `token`, or `password` (default: `off`) | +| `GATEWAY_TOKEN` | No | Gateway token (required when `GATEWAY_AUTH=token`) | +| `GATEWAY_PASSWORD` | No | Gateway password (required when `GATEWAY_AUTH=password`) | +| `CLAWDBOT_STATE_DIR` | No | Config/credentials path (default: `/data/.clawdbot`) | +| `CLAWDBOT_WORKSPACE_DIR` | No | Workspace path (default: `/data/workspace`) | + +### Securing Your Deployment + +For production deployments, enable gateway authentication to protect the web UI: + +```bash +# .env - with password auth enabled +REDPILL_API_KEY=rp_xxxxxxxxxxxx +GATEWAY_AUTH=password +GATEWAY_PASSWORD=your-secure-password +``` + +Access the UI: `https://-18789.?password=your-secure-password` + +For token-based auth (alternative): + +```bash +GATEWAY_AUTH=token +GATEWAY_TOKEN=your-secret-gateway-token +``` + +Access with: `https://-18789.?token=your-secret-gateway-token` + +### Adding Messaging Channels + +The following channels work in Docker/Linux environments (no Mac services required): + +| Channel | Setup | Environment Variables | +|---------|-------|----------------------| +| **Telegram** | Easy | `TELEGRAM_BOT_TOKEN` | +| **Discord** | Easy | `DISCORD_BOT_TOKEN` | +| **Slack** | Medium | `SLACK_APP_TOKEN`, `SLACK_BOT_TOKEN` | +| **WhatsApp** | Medium | QR code login via `/setup` wizard | +| **Signal** | Hard | Requires `signal-cli` + Java | + +Configure channels via the `/setup` wizard at `https://:18789/setup`. + +### Persistent Storage + +The `clawdbot-data` volume stores: +- Channel credentials and tokens +- Agent configurations +- Session history +- Workspace files + +Data persists across CVM restarts and upgrades. + ## More Information - [Redpill AI](https://redpill.ai) - [API Documentation](https://docs.redpill.ai) - [GPU TEE Technology](https://docs.redpill.ai/privacy/overview) - [Pricing](https://redpill.ai/pricing) +- [Phala Cloud](https://cloud.phala.network) +- [Phala Cloud CLI Docs](https://docs.phala.network/phala-cloud/references/phala-cloud-cli/phala/overview)