Safety & Cost Control

ports:
  - "127.0.0.1:8080:8080"  # Safe: localhost only
  # NOT: "8080:8080"       # Dangerous: exposed to all interfaces

# Block external access to port 8080
sudo ufw deny from any to any port 8080

# Or with iptables
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP
sudo iptables -A INPUT -p tcp -s 127.0.0.1 --dport 8080 -j ACCEPT

# Check for common misconfigurations
moltbot security audit

# Auto-fix safe issues
moltbot security audit --fix

# .env file (add to .gitignore!)
ANTHROPIC_API_KEY=sk-ant-xxx
OPENAI_API_KEY=sk-xxx
TELEGRAM_BOT_TOKEN=123456:ABC...

# Reference in config or pass to Docker

# macOS: Enable FileVault (System Preferences > Security & Privacy)

# Linux: Use encrypted home directory or LUKS
# Or encrypt just the credentials directory:
encfs ~/.clawdbot-encrypted ~/.clawdbot

// In your moltbot config or agent settings:
{
  "model": {
    "max_tokens": 4096,          // Limit output tokens
    "max_context_tokens": 32000  // Limit context window
  }
}

// Enable cache-TTL pruning to reduce cache write costs
{
  "cache": {
    "enabled": true,
    "ttl": "5m",           // Cache TTL
    "prune_on_expire": true // Prune context when cache expires
  }
}

// If cache TTL is 1 hour, use 55-minute heartbeat
{
  "heartbeat": {
    "enabled": true,
    "interval": "55m"
  }
}

// Route simple tasks to cheaper models
{
  "routing": {
    "default": "claude-3-5-haiku",      // Default to cheapest
    "complex": "claude-3-5-sonnet",     // Upgrade for complex tasks
    "reasoning": "claude-3-5-opus"      // Only when needed
  }
}

// Enable batch processing for background tasks
{
  "batch": {
    "enabled": true,
    "queue_threshold": 10,  // Batch when 10+ messages queued
    "max_wait": "30s"       // Or after 30 seconds
  }
}