meshcentral-openclaw-bridge/DEPLOYMENT.md

Deployment facts and live-test plan

MeshCentral deployment

• Hostname: mesh.ledrew.me
• Internal address: 10.10.10.177:80
• Reported version: 1.2.5
• Location: LXC on PVE2
• Installation method: Proxmox Community Scripts MeshCentral installer
• Test endpoint: PVE3
• Integration account: sa_clawdia

Secret handling

The integration password was provided out-of-band in the project conversation and is intentionally not stored in this repository, project files, logs, command lines, or agent prompts. The real adapter must receive it through a protected runtime secret mechanism, such as a root-readable 0600 environment file or equivalent secret store.

If the credential is ever committed, logged, pasted into a command, or exposed to an unintended audience, rotate it immediately in MeshCentral.

Live-test prerequisites

Before connecting:

• Confirm that mesh.ledrew.me is intended to resolve/reach the internal MeshCentral service from the proposed bridge host.
• Determine whether the reported port 80 is plain HTTP behind a reverse proxy and whether the MeshCentral control channel is available at the corresponding /control.ashx WebSocket endpoint.
• Verify the certificate/trust path if the control channel uses TLS; never disable certificate validation.
• Confirm sa_clawdia has only the required read-only permissions for the first test.
• Confirm PVE3 is the sole target allowlisted for the first live test.
• Use only read-only operations: authentication/health check, server version, device groups, device inventory, and selected device metadata.
• Capture no password or session token in logs.

Security Hardening Status

• Concurrency & Rate Limits: 5 concurrent requests max; token-bucket rate limiter applied to all outbound requests.
• Audit Redaction: Structured audit logs automatically redact secrets (base64, hex, known key patterns) and never capture credentials.
• Verification: 90/90 tests pass; TypeScript build passes with no errors; ESLint passes with no warnings.
• Remaining Live-Test Gates: See TODO.md for the operational checklist. Rob authorized read-only project access on 2026-08-26; no additional per-test approval is required, but all scope and stop conditions remain mandatory.
• Rollback Rules: If rollback is required: stop service immediately, rotate integration credential in MeshCentral, review audit logs, and document incident.

Authorization checkpoint

A live connectivity test is authorized under Rob's project-level read-only access decision on 2026-08-26. The authorization covers only the documented read-only operations and PVE3 target; it does not cover commands, diagnostics, or state changes.