# NemoClaw policy preset that lets the AgenticROS plugin call a vision
# model on the host for describing camera snapshots. Without this preset
# the OPA proxy denies the plugin's outbound HTTP request to Ollama with
# a 403, and ros2_camera_snapshot returns no "Vision description:" line.
#
# Apply with::
#
#   nemoclaw nemo policy-add --from-file scripts/agenticros-describer.policy.yaml --yes
#
# Wire-level note:
#   The plugin's describer makes an HTTP/1.1 POST to
#   ``http://host.docker.internal:11434/v1/chat/completions`` (default).
#   That is a *regular HTTP REST* request — NOT a CONNECT tunnel like the
#   rosbridge WebSocket. Two consequences:
#
#     * We use ``protocol: rest`` with explicit ``rules`` (same shape as
#       the built-in ``managed_inference`` and ``local_inference`` policies
#       and our ``openai`` preset). The raw L4 ``access: full`` shape used
#       for the rosbridge preset does NOT match HTTP method/path REST
#       traffic — you'll see a 403 "FORWARD denied POST ..." in
#       /var/log/openshell.*.log if you try it.
#
#     * ``host.docker.internal`` resolves to the Docker bridge gateway
#       (an RFC1918 address, typically 172.19.0.1). The OpenShell SSRF
#       guard default-denies private destinations, so we still need the
#       ``allowed_ips`` block listing the three private CIDRs — same as
#       the rosbridge preset.

preset:
  name: agenticros-describer
  description: "AgenticROS plugin -> host Ollama (vision) on :11434 for camera snapshot descriptions"

network_policies:
  agenticros_describer:
    name: agenticros_describer
    endpoints:
      - host: host.docker.internal
        port: 11434
        protocol: rest
        enforcement: enforce
        allowed_ips:
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.0.0/16
        rules:
          - allow:
              method: POST
              path: /**
          - allow:
              method: GET
              path: /**
      - host: host.openshell.internal
        port: 11434
        protocol: rest
        enforcement: enforce
        allowed_ips:
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.0.0/16
        rules:
          - allow:
              method: POST
              path: /**
          - allow:
              method: GET
              path: /**
      # NemoClaw's Ollama auth proxy. Useful if you ever point the
      # describer URL at the auth-proxied endpoint instead of raw Ollama.
      - host: host.openshell.internal
        port: 11435
        protocol: rest
        enforcement: enforce
        allowed_ips:
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.0.0/16
        rules:
          - allow:
              method: POST
              path: /**
          - allow:
              method: GET
              path: /**
    # The OPA proxy denies requests whose calling binary is not in the
    # allowed list (the OCSF log shows "DENIED -(0) -> ..." when this
    # check fails — "-(0)" means binary attribution failed). Mirroring the
    # built-in ``local_inference`` allowlist covers the AgenticROS plugin
    # (which runs in-process inside the openclaw-gateway node process),
    # the gateway's own outbound HTTP, and shell-based test calls
    # (``curl`` from inside the sandbox).
    binaries:
      - path: /usr/local/bin/openclaw
      - path: /usr/local/bin/node
      - path: /usr/bin/node
      - path: /usr/bin/curl
      - path: /usr/bin/python3