Additional Configuration#

Reference for configurable values in deploy_nemoclaw_vss.ipynb and the optional notebook cells that go beyond the minimum Setup VSS and Skills path.

Brev hardware and CSP selection#

The default Brev launchable is available for the notebook path. Before launching the instance, you can also edit the launchable to choose a different hardware profile, such as GPU or CPU shape, and cloud service provider (CSP).

Brev launchable Edit action

Click Edit in the upper right corner of the Brev launchable before creating the instance.#

In the Brev launchable editor, select the hardware profile and CSP that match your deployment target and available capacity, then launch the instance. Review Hardware Requirements and Development Profile GPU Requirements before selecting the hardware profile.

Brev hardware profile and CSP selection

Select the instance hardware profile and cloud service provider in Brev.#

After the instance starts, keep the notebook’s HARDWARE_PROFILE value aligned with the selected machine. Brev controls the cloud VM shape, while HARDWARE_PROFILE controls the VSS deployment assumptions used by the notebook and orchestrator.

Agent model versus VSS models#

The notebook configures two different model surfaces:

  • NEMOCLAW_* variables configure the OpenClaw chat agent that operates VSS.

  • VSS_LLM_* and VSS_VLM_* variables configure the LLM/VLM endpoints used by the deployed VSS services when docker_generate creates profile artifacts.

Notebook variables#

Required and provider selection values are set in Section 1.1 and Section 1.2.

Variable

Default

Description

NGC_CLI_API_KEY

(blank)

NVIDIA legacy API key. Required for docker login nvcr.io, host NGC CLI configuration, sandbox-side NGC credentials, and model artifact downloads.

HARDWARE_PROFILE

RTXPRO6000BW

Hardware profile applied by the orchestrator. Supported values are H100, L40S, RTXPRO6000BW, DGX-SPARK, IGX-THOR, AGX-THOR, and OTHER. Edge profiles (DGX-SPARK, IGX-THOR, AGX-THOR) are valid only for base and alerts.

NVIDIA_API_KEY

(blank)

Required for the build.nvidia.com OpenClaw provider and propagated to generated VSS env when NVIDIA-hosted endpoints are used.

NEMOCLAW_ENDPOINT_URL

(blank)

OpenAI-compatible base URL for a cloud or local custom OpenClaw provider. When non-empty, the notebook selects NEMOCLAW_PROVIDER=custom. Do not set this when using the NVIDIA-hosted NemoClaw LLM endpoint; leave it blank so the notebook selects NEMOCLAW_PROVIDER=build.

NEMOCLAW_MODEL

(blank)

Model ID for the OpenClaw chat agent. If blank on the build.nvidia.com path, the installer defaults to nvidia/nemotron-3-super-120b-a12b.

COMPATIBLE_API_KEY

(blank)

Bearer token for the custom OpenAI-compatible provider. Must be non-empty for custom provider mode, even when a local server ignores it.

Advanced values are set in Section 1.3 or derived from the environment.

Variable

Default

Description

NEMOCLAW_INSTALL_REF

v0.0.48

NemoClaw installer pin. Section 3 reinstalls if the installed nemoclaw version does not match this semver tag.

OPENCLAW_HOOKS_ENABLED

True

Enables OpenClaw webhooks and generates a random OPENCLAW_HOOKS_TOKEN.

OPENCLAW_HOOKS_PATH

/hooks

Webhook path under the OpenClaw dashboard forward.

VSS_LLM_NAME, VSS_LLM_ENDPOINT_URL, VSS_LLM_MODEL_TYPE

(blank)

Remote LLM settings for the deployed VSS stack. Setting VSS_LLM_ENDPOINT_URL forces generated VSS env to remote LLM mode.

VSS_LLM_ENABLE_THINKING

(blank)

Optional deployed-VSS LLM thinking/behavior override.

VSS_OPENAI_API_KEY

(blank)

Key for deployed VSS remote LLM/VLM endpoints. Blank falls back to NVIDIA_API_KEY.

VSS_VLM_NAME, VSS_VLM_ENDPOINT_URL, VSS_VLM_MODEL_TYPE

(blank)

Remote VLM settings for the deployed VSS stack. Setting VSS_VLM_ENDPOINT_URL forces generated VSS env to remote VLM mode.

LLM_DEVICE_ID

"0"

GPU index for the local LLM NIM on non-edge hardware profiles.

VLM_DEVICE_ID

"1"

GPU index for the local VLM NIM on non-edge hardware profiles.

EXTERNAL_IP

(blank)

External host IP used by generated VSS URLs. Blank resolves from hostname -I.

VSS_REPO_DIR

~/video-search-and-summarization

VSS checkout used by the notebook.

NEMOCLAW_REPO_DIR

~/NemoClaw

Fallback NemoClaw source checkout used by init_nemoclaw.sh only when the nemoclaw CLI is not already available. The current curl installer normally clones the installed source under ~/.nemoclaw/source.

NEMOCLAW_SANDBOX_NAME

demo

Sandbox name to create or reuse.

OPENCLAW_PLUGIN_VARIANT

nemoclaw

Variant overlay applied by the VSS OpenClaw plugin. The nemoclaw overlay copies .openclaw/workspace/_nemoclaw/*.md into the sandbox workspace.

PLUGIN_WORKSPACE_DIR

<VSS_REPO_DIR>/.openclaw/workspace

Source workspace template directory used by Section 4 verification.

VSS_ORCHESTRATOR_MCP_HOST

0.0.0.0

Bind host used when Section 6.1 starts the MCP server.

VSS_ORCHESTRATOR_MCP_PORT

9988

Bind port used when Section 6.1 starts the MCP server.

NEMOCLAW_DASHBOARD_PORT

18789

OpenClaw dashboard forward port used by the UI and webhook checks.

MCP server environment#

The orchestrator MCP server reads credentials, hardware profile, remote VSS model endpoints, and device IDs at startup. In the notebook flow, Section 6.1 maps the notebook-facing VSS_* variables into the unprefixed MCP server environment variables before launching uv run nat mcp serve:

docker_generate then merges those values with the selected profile .env and any per-call env_overrides. For the full resolution order and tool payloads, see VSS Orchestrator MCP server.

Optional notebook cells#

Section 2.1 - pin Docker version#

Pins the tested Docker stack before Section 3 creates the sandbox:

  • Docker CE 29.4.3

  • buildx 0.33.0

  • Docker Compose 5.1.3

  • containerd 2.2.3

Run this before Section 3 creates the OpenClaw sandbox. A Docker downgrade restarts dockerd and would disrupt live sandbox containers if it ran later in the notebook. The cell runs apt-mark hold so later package operations do not drift the instance back to a newer Docker stack before Section 6 runs.

Section 4 - verify sandbox, policy, skills, and webhooks#

Runs additional checks against the live sandbox after Section 3:

  • Sandbox phase, namespace, and id.

  • Active policy metadata (status, version, hash).

  • OpenClaw webhooks reachability when enabled.

  • openclaw plugins doctor output.

  • Installed non-bundled skills from openclaw skills list --json.

  • Workspace .md files copied by the plugin install.

Section 7 - verify host reachability from the sandbox#

Run only after VSS is deployed. The probe uses nemoclaw <sandbox> connect and validates host port reachability through host.openshell.internal. Do not replace this with docker exec because that can use a different path and produce misleading results.

The notebook reports one of the following results for each checked port:

  • REACHABLE - an HTTP service answered. 404 and non-policy 403 responses still count because they prove a service is listening, even if GET / is not a valid or authorized route.

  • NOT_REACHABLE - the port is blocked by policy, no service is listening, DNS failed, the connection failed, or the request timed out. Check the NOTE column for the reason.

OpenClaw webhooks#

When OPENCLAW_HOOKS_ENABLED is true, the notebook generates a random OPENCLAW_HOOKS_TOKEN and configures OpenClaw webhooks at OPENCLAW_HOOKS_PATH. Section 4 sends a local authenticated POST to http://127.0.0.1:18789/hooks/agent to confirm acceptance.

Disable webhooks by setting:

OPENCLAW_HOOKS_ENABLED = False

Artifacts and logs#

  • MCP server log: <VSS_REPO_DIR>/.orchestrator-artifacts/vss_orchestrator_mcp.log.

  • Generated env artifacts: <output_dir>/generated.<docker_compose_id>.dry-run.env.

  • Generated compose artifacts: <output_dir>/compose.resolved.<docker_compose_id>.dry-run.yml.

  • MCP config: deploy/docker/scripts/vss_orchestrator_mcp_config.yml.

  • The recorded MCP PID is kept in the notebook’s Python state as VSS_ORCHESTRATOR_MCP_PID and reused by Section 6.1 to stop a stale server before relaunching.