docs: update Redpill provider with Phala Cloud deployment guide
- Add Phala Cloud CVM deployment instructions - Document auto-configuration of channels (Telegram, Discord) - Add gateway auth (password/token) documentation - Remove non-functional SETUP_PASSWORD references - Fix URL format for Phala Cloud dstack Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
HashWarlock
parent
b02fb9364d
commit
fb106d774b
@ -3,6 +3,7 @@ summary: "Use Redpill AI GPU TEE models in Clawdbot"
|
|||||||
read_when:
|
read_when:
|
||||||
- You want privacy-focused inference with hardware-verified security
|
- You want privacy-focused inference with hardware-verified security
|
||||||
- You want GPU TEE model setup guidance
|
- You want GPU TEE model setup guidance
|
||||||
|
- You want to deploy Clawdbot on Phala Cloud for full TEE privacy
|
||||||
---
|
---
|
||||||
# Redpill AI
|
# Redpill AI
|
||||||
|
|
||||||
@ -247,9 +248,194 @@ If you receive attestation errors:
|
|||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
|
## Deploy on Phala Cloud (Full TEE Stack)
|
||||||
|
|
||||||
|
For maximum privacy, deploy Clawdbot itself inside a Phala Cloud CVM (Confidential Virtual Machine). This creates an end-to-end TEE stack where both the application and the AI inference run in hardware-secured enclaves.
|
||||||
|
|
||||||
|
### Why Phala Cloud + Redpill
|
||||||
|
|
||||||
|
| Layer | TEE Protection |
|
||||||
|
|-------|----------------|
|
||||||
|
| **Application** | Clawdbot runs in Phala Cloud CVM with Intel TDX |
|
||||||
|
| **AI Inference** | Redpill routes to GPU TEE models (Phala, Tinfoil, etc.) |
|
||||||
|
| **Result** | Your prompts never leave secure enclaves from input to output |
|
||||||
|
|
||||||
|
### Prerequisites
|
||||||
|
|
||||||
|
1. [Phala Cloud](https://cloud.phala.network) account with API key
|
||||||
|
2. [Redpill AI](https://redpill.ai) API key
|
||||||
|
3. Docker installed locally
|
||||||
|
4. Phala CLI: `npm install -g phala`
|
||||||
|
|
||||||
|
### Quick Deployment
|
||||||
|
|
||||||
|
**1. Authenticate with Phala Cloud**
|
||||||
|
|
||||||
|
```bash
|
||||||
|
phala auth login <your-phala-cloud-api-key>
|
||||||
|
```
|
||||||
|
|
||||||
|
**2. Create docker-compose.phala.yml**
|
||||||
|
|
||||||
|
The container auto-configures Redpill as the default provider when `REDPILL_API_KEY` is set on first boot.
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
# docker-compose.phala.yml for Phala Cloud CVM
|
||||||
|
services:
|
||||||
|
clawdbot:
|
||||||
|
image: hashwarlock/clawdbot:redpill
|
||||||
|
environment:
|
||||||
|
HOME: /home/node
|
||||||
|
TERM: xterm-256color
|
||||||
|
# Auto-configures Redpill provider on first boot
|
||||||
|
REDPILL_API_KEY: ${REDPILL_API_KEY}
|
||||||
|
# Auto-configures messaging channels when tokens are provided
|
||||||
|
TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
|
||||||
|
DISCORD_BOT_TOKEN: ${DISCORD_BOT_TOKEN:-}
|
||||||
|
# Gateway configuration
|
||||||
|
GATEWAY_PORT: ${GATEWAY_PORT:-18789}
|
||||||
|
GATEWAY_AUTH: ${GATEWAY_AUTH:-off}
|
||||||
|
# Persistence paths
|
||||||
|
CLAWDBOT_STATE_DIR: /data/.clawdbot
|
||||||
|
CLAWDBOT_WORKSPACE_DIR: /data/workspace
|
||||||
|
volumes:
|
||||||
|
- clawdbot-data:/data
|
||||||
|
network_mode: host
|
||||||
|
restart: unless-stopped
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
clawdbot-data:
|
||||||
|
```
|
||||||
|
|
||||||
|
**3. Create .env file**
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# .env - secrets are encrypted to the TEE
|
||||||
|
REDPILL_API_KEY=rp_xxxxxxxxxxxx
|
||||||
|
# Optional: messaging channels (auto-configure on boot)
|
||||||
|
# TELEGRAM_BOT_TOKEN=your-telegram-bot-token
|
||||||
|
# DISCORD_BOT_TOKEN=your-discord-bot-token
|
||||||
|
# Optional: protect the web UI with password auth
|
||||||
|
# GATEWAY_AUTH=password
|
||||||
|
# GATEWAY_PASSWORD=your-secure-password
|
||||||
|
```
|
||||||
|
|
||||||
|
**4. Deploy to Phala Cloud**
|
||||||
|
|
||||||
|
```bash
|
||||||
|
phala deploy \
|
||||||
|
--name clawdbot-tee \
|
||||||
|
--compose ./docker-compose.phala.yml \
|
||||||
|
--env-file ./.env \
|
||||||
|
--vcpu 2 \
|
||||||
|
--memory 4G \
|
||||||
|
--disk-size 20G
|
||||||
|
```
|
||||||
|
|
||||||
|
**5. Access the Gateway**
|
||||||
|
|
||||||
|
After deployment, get your CVM's public URL:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
phala cvms get clawdbot-tee
|
||||||
|
```
|
||||||
|
|
||||||
|
The gateway URL follows the Phala Cloud dstack format: `https://<DSTACK_APP_ID>-18789.<DSTACK_GATEWAY_URL>`. If you enabled `GATEWAY_AUTH=password`, add `?password=your-password` to the URL.
|
||||||
|
|
||||||
|
### Managing Your Deployment
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# View logs
|
||||||
|
phala cvms logs clawdbot-tee
|
||||||
|
|
||||||
|
# Check status
|
||||||
|
phala cvms get clawdbot-tee
|
||||||
|
|
||||||
|
# SSH into CVM (if deployed with --dev-os)
|
||||||
|
phala ssh clawdbot-tee
|
||||||
|
|
||||||
|
# Update deployment (use CVM ID from phala cvms get)
|
||||||
|
phala deploy --cvm-id app_xxxxx --compose ./docker-compose.phala.yml
|
||||||
|
|
||||||
|
# Or if phala.toml exists from initial deploy, just run:
|
||||||
|
phala deploy
|
||||||
|
```
|
||||||
|
|
||||||
|
### Configuration via Web UI
|
||||||
|
|
||||||
|
Redpill is automatically configured as the default provider on first boot. If you provided `TELEGRAM_BOT_TOKEN` or `DISCORD_BOT_TOKEN`, those channels are also auto-configured and running.
|
||||||
|
|
||||||
|
Access your gateway URL to:
|
||||||
|
|
||||||
|
1. Configure additional channels (Slack, Signal, WhatsApp) via the Channels page
|
||||||
|
2. Start chatting with full TEE privacy (Redpill is already set as default)
|
||||||
|
3. View and switch models via the Config page (`/config`)
|
||||||
|
|
||||||
|
### Environment Variables
|
||||||
|
|
||||||
|
| Variable | Required | Description |
|
||||||
|
|----------|----------|-------------|
|
||||||
|
| `REDPILL_API_KEY` | Yes | Your Redpill API key (auto-configures all 18 GPU TEE models on first boot) |
|
||||||
|
| `TELEGRAM_BOT_TOKEN` | No | Telegram bot token (auto-configures and starts Telegram channel on boot) |
|
||||||
|
| `DISCORD_BOT_TOKEN` | No | Discord bot token (auto-configures and starts Discord channel on boot) |
|
||||||
|
| `GATEWAY_PORT` | No | Gateway port (default: `18789`) |
|
||||||
|
| `GATEWAY_AUTH` | No | Gateway auth mode: `off`, `token`, or `password` (default: `off`) |
|
||||||
|
| `GATEWAY_TOKEN` | No | Gateway token (required when `GATEWAY_AUTH=token`) |
|
||||||
|
| `GATEWAY_PASSWORD` | No | Gateway password (required when `GATEWAY_AUTH=password`) |
|
||||||
|
| `CLAWDBOT_STATE_DIR` | No | Config/credentials path (default: `/data/.clawdbot`) |
|
||||||
|
| `CLAWDBOT_WORKSPACE_DIR` | No | Workspace path (default: `/data/workspace`) |
|
||||||
|
|
||||||
|
### Securing Your Deployment
|
||||||
|
|
||||||
|
For production deployments, enable gateway authentication to protect the web UI:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# .env - with password auth enabled
|
||||||
|
REDPILL_API_KEY=rp_xxxxxxxxxxxx
|
||||||
|
GATEWAY_AUTH=password
|
||||||
|
GATEWAY_PASSWORD=your-secure-password
|
||||||
|
```
|
||||||
|
|
||||||
|
Access the UI: `https://<DSTACK_APP_ID>-18789.<DSTACK_GATEWAY_URL>?password=your-secure-password`
|
||||||
|
|
||||||
|
For token-based auth (alternative):
|
||||||
|
|
||||||
|
```bash
|
||||||
|
GATEWAY_AUTH=token
|
||||||
|
GATEWAY_TOKEN=your-secret-gateway-token
|
||||||
|
```
|
||||||
|
|
||||||
|
Access with: `https://<DSTACK_APP_ID>-18789.<DSTACK_GATEWAY_URL>?token=your-secret-gateway-token`
|
||||||
|
|
||||||
|
### Adding Messaging Channels
|
||||||
|
|
||||||
|
The following channels work in Docker/Linux environments (no Mac services required):
|
||||||
|
|
||||||
|
| Channel | Setup | Environment Variables |
|
||||||
|
|---------|-------|----------------------|
|
||||||
|
| **Telegram** | Easy | `TELEGRAM_BOT_TOKEN` |
|
||||||
|
| **Discord** | Easy | `DISCORD_BOT_TOKEN` |
|
||||||
|
| **Slack** | Medium | `SLACK_APP_TOKEN`, `SLACK_BOT_TOKEN` |
|
||||||
|
| **WhatsApp** | Medium | QR code login via `/setup` wizard |
|
||||||
|
| **Signal** | Hard | Requires `signal-cli` + Java |
|
||||||
|
|
||||||
|
Configure channels via the `/setup` wizard at `https://<cvm-url>:18789/setup`.
|
||||||
|
|
||||||
|
### Persistent Storage
|
||||||
|
|
||||||
|
The `clawdbot-data` volume stores:
|
||||||
|
- Channel credentials and tokens
|
||||||
|
- Agent configurations
|
||||||
|
- Session history
|
||||||
|
- Workspace files
|
||||||
|
|
||||||
|
Data persists across CVM restarts and upgrades.
|
||||||
|
|
||||||
## More Information
|
## More Information
|
||||||
|
|
||||||
- [Redpill AI](https://redpill.ai)
|
- [Redpill AI](https://redpill.ai)
|
||||||
- [API Documentation](https://docs.redpill.ai)
|
- [API Documentation](https://docs.redpill.ai)
|
||||||
- [GPU TEE Technology](https://docs.redpill.ai/privacy/overview)
|
- [GPU TEE Technology](https://docs.redpill.ai/privacy/overview)
|
||||||
- [Pricing](https://redpill.ai/pricing)
|
- [Pricing](https://redpill.ai/pricing)
|
||||||
|
- [Phala Cloud](https://cloud.phala.network)
|
||||||
|
- [Phala Cloud CLI Docs](https://docs.phala.network/phala-cloud/references/phala-cloud-cli/phala/overview)
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user