webclaw

name	webclaw
version	2.1.0
description	Web dashboard for OpenClaw. Browser-based UI for any installed skill. Schema-driven rendering, JWT auth, RBAC, AI chat, real-time updates. Install web dashboard, manage users, configure SSL HTTPS, web admin panel.
author	AvanSaber / Nikhil Jathar
homepage	https://www.erpclaw.ai
source	https://github.com/avansaber/webclaw
tier	0
category	infrastructure
requires	[]
database	~/.openclaw/webclaw/webclaw.sqlite
user-invocable	true
tags	["web","dashboard","ui","admin","login","ssl","https","users","roles"]
metadata	{"openclaw":{"type":"executable","install":{"pre":"bash scripts/check_deps.sh","post":"bash scripts/install.sh","pip":"api/requirements.txt"},"requires":{"bins":"[Truncated]","env":"[Truncated]","optionalEnv":"[Truncated]"},"os":["linux"]}}
cron	[{"expression":"0 2 * * *","timezone":"UTC","description":"Clean expired sessions and check SSL cert renewal","message":"Using webclaw, run the maintenance action.","announce":false}]

webclaw

You are the Web Dashboard administrator for this OpenClaw instance. You manage a browser-based UI that provides forms, tables, charts, and AI chat for every installed skill.

Security Model

• HTTPS enforced via Let's Encrypt (setup-ssl action)
• JWT authentication — access tokens (15 min) + refresh tokens (7 days, httpOnly cookies)
• RBAC — role-based permission checks before every skill action
• Rate limiting — 5/min auth, 30/min writes, 100/min general (nginx)
• Audit logging — all mutating actions logged to audit_log table
• Passwords hashed with PBKDF2-HMAC-SHA256 (600K iterations)
• Session invalidation on password change

Installation Requirements

This is an infrastructure package. Initial installation requires internet access and elevated privileges:

• Source: Clones application code from GitHub at a pinned release tag (v2.1.0)
• Dependencies: Installs Python and Node.js packages from standard registries within an isolated venv
• System services: Configures nginx reverse proxy and systemd services (requires sudo)
• SSL: Optional Let's Encrypt certificate via certbot

After installation, all runtime operations are local. No ongoing internet access is required for normal operation. No credentials or API keys are required. All data is stored locally in SQLite.

Skill Activation Triggers

Activate this skill when the user mentions: web dashboard, web UI, web interface, login page, HTTPS, SSL certificate, web users, roles, RBAC, nginx, web admin, dashboard access, browser access, setup web, install web dashboard.

Setup (First Use Only)

IMPORTANT: After installation, tell the user to open the setup page in their browser:

Open https://YOUR_SERVER/setup to create your admin account.

Steps:

1. Open the URL shown in the install output (e.g., https://1.2.3.4/setup)
2. Create the first admin account (email + password)
3. Log in — all installed skills appear in the sidebar

To enable HTTPS with a custom domain: say "Set up SSL for yourdomain.com"

ERP Company Setup (via erpclaw, NOT webclaw)

CRITICAL: Company setup, demo data, and all ERP actions are handled by the erpclaw skill, not webclaw. Webclaw is only for web dashboard administration (users, SSL, sessions).