build: Makefile with cross-builds (linux/termux arm64, armv7), non-root distroless Dockerfile, example config

config.example.yaml

@@ -0,0 +1,29 @@
+# OpenClaw configuration. Secrets can come from env instead:
+#   OPENCLAW_AUTH_TOKEN, OPENCLAW_LLM_API_KEY, OPENCLAW_LLM_BASE_URL, OPENCLAW_LLM_MODEL,
+#   OPENCLAW_LISTEN, OPENCLAW_DATA_DIR, OPENCLAW_WORKSPACE, OPENCLAW_ALLOWED_ORIGINS (comma separated)
+listen: 127.0.0.1:8787          # bind to 0.0.0.0 only behind TLS (reverse proxy) or in a trusted LAN
+auth_token: ""                  # required, >= 16 chars. Generate: openssl rand -hex 32
+allowed_origins: []             # browser origins allowed besides same host; "*" only if you really mean it
+data_dir: ./data
+workspace: ""                   # default: <data_dir>/workspace; file tools cannot leave it
+
+llm:
+  base_url: https://api.openai.com/v1   # OpenRouter: https://openrouter.ai/api/v1 · Ollama: http://localhost:11434/v1
+  api_key: ""
+  model: gpt-4o-mini
+  timeout_sec: 120
+  temperature: 0.7
+
+agent:
+  system_prompt: "You are OpenClaw, a concise and helpful self-hosted assistant. Use tools when they help."
+  max_iterations: 8
+  history_limit: 50
+
+tools:
+  web_fetch:
+    enabled: true
+    max_bytes: 524288
+    timeout_sec: 15
+    allow_private: false        # true allows localhost/LAN targets (SSRF risk)
+  files_enabled: true
+  file_max_bytes: 1048576