sempre

Sempre — Italian for “always”. Your AI team is always on, always working, always learning.

Fork it. Fill in config.json. Run make up. Your AI company is live.

---

How It Works

sempre is a Docker-based multi-agent AI system built on OpenClaw + Ollama. You define a team of agents, each with a role and tool access. They collaborate, remember things, and get work done.

The Big Picture

You (Discord / Web UI / SSH)
         │
         ▼
┌────────────────────────────────────────────────────────┐
│  nginx  — single SSL entry point (Tailscale cert)      │
│                                                        │
│  :NGINX_OPENCLAW_PORT  ───▶  OpenClaw Web UI           │
│  :NGINX_OLLAMA_PORT    ───▶  Ollama API                │
│  :NGINX_N8N_PORT       ───▶  n8n workflows             │
│  :NGINX_HTTP_PORT      ───▶  444 (rejected — SSL only) │
└──────────────────────┬─────────────────────────────────┘
                       │ HTTPS → HTTP (internal)
                       ▼
┌────────────────────────────────────────────────────────┐
│  openclaw-gateway  :18789                              │
│                                                        │
│  ┌─────────┐  ┌─────────┐  ┌─────────┐               │
│  │  GM     │  │ Agent 1 │  │Agent N… │  ← config.json │
│  └────┬────┘  └────┬────┘  └────┬────┘               │
│       └────────────┼────────────┘                      │
│                    ▼                                    │
│              ollama  (LLM)                              │
│                    │                                    │
│                    ▼  ollama.com Cloud                  │
│         minimax · qwen · gemini · nemotron              │
└────────────────────────────────────────────────────────┘
                       │
          ┌────────────┼────────────┐
          ▼            ▼            ▼
    Per-agent tools (×N agents):
    gh-proxy       crawl4ai     browser-use
    (GitHub API)   (scraper)    (AI browser)

    Shared across all agents:
    /root/.km  (Obsidian KM vault — knowledge base)
    n8n        (workflow automation)
    gws CLI    (Google Workspace)

How Agents Work Together

GM (General Manager) receives tasks from users via Discord or Web UI. It triages complexity, delegates to Worker agents in parallel, synthesizes results, and responds.

Worker agents run research, code, data extraction, and web tasks concurrently. Each worker has its own isolated tool stack so they never interfere with each other.

Knowledge compounds over time — every research result gets written to the shared Obsidian KM vault (disks/km/). On the next task, agents search this vault before going to the web. The team gets smarter with every session.

n8n handles the boring parts — scheduled reports, data sync, webhook triggers. Agents offload recurring work to n8n so they stay free for actual thinking.

Tool Routing (enforced)

Agents follow strict platform service routing — they cannot use raw HTTP or native tools for tasks that have a dedicated service.

GitHub tokens are injected server-side by gh-proxy — agents never see the actual token.

---

Installation

1. Prerequisites

---

2. Clone

git clone https://github.com/YOUR_ORG/sempre.git
cd sempre

---

3. Create config.json

make config

This copies config.json.example → config.json. Open config.json and fill in each section.

config.json is gitignored — it contains your secrets. config.json.example is what’s committed.

---

4. Configure config.json

Team + Agents

"team": "sempre",
"agents": [
    {
        "id": "mone", "name": "Mone", "role": "gm",
        "discord_token": "", "github_token": "ghp_xxxx",
        "persona": "Direct and decisive team lead. Sets priorities clearly, delegates without hesitation."
    },
    {
        "id": "sam", "name": "Sam", "role": "worker",
        "discord_token": "", "github_token": "ghp_xxxx",
        "persona": "Methodical and detail-oriented. Takes quiet pride in getting things exactly right."
    }
]

• "team" — names all containers and the Docker network
• One "gm" agent required — this is the orchestrator
• Add as many "worker" agents as you want
• "persona" — unique personality injected into each agent’s SOUL.md (they sound different)

OpenClaw secrets

openssl rand -hex 32   # use this for gateway_token

"openclaw": {
    "gateway_token":  "paste_output_here",
    "root_password":  "your_ssh_password",
    "gateway_origin": "https://openclaw.sempre.orb.local"
}

Tailscale hostname + nginx ports

tailscale status   # find your machine hostname

"tailscale_hostname": "your-machine.tailnet.ts.net",
"nginx": {
    "openclaw_port": 20443,
    "ollama_port":   11434,
    "n8n_port":      20678,
    "http_port":     20080
}

GATEWAY_ORIGIN_EXTRA (Tailscale CORS origin) is derived automatically from these two fields — no need to set it separately.

n8n secrets

openssl rand -hex 32   # encryption_key — never change after first boot

"n8n": {
    "encryption_key": "paste_output_here",
    "password":       "your_n8n_password",
    "webhook_secret": "any_random_string"
}

LLM models

"llm": {
    "model":         "minimax-m2.7:cloud",
    "models":        "minimax-m2.7:cloud,nemotron-3-super:cloud,nomic-embed-text",
    "browser_model": "nemotron-3-super:cloud"
}

nomic-embed-text must be in models — it powers semantic search for the KM vault.

Brave Search — optional

Get a free key at brave.com/search/api:

"brave_api_key": "BSA_xxxx"

Google Workspace — optional

1. Google Cloud Console → IAM & Admin → Service Accounts → Create → JSON key → download
2. Enable: Sheets, Drive, Gmail
3. Encode locally — never paste into a website:

# macOS
base64 -i /path/to/service-account.json | tr -d '\n'

# Linux
base64 -w0 /path/to/service-account.json

"google_service_account_b64": "eyJxxxxxxxx..."

---

5. Discord bots — optional

1. Go to discord.com/developers/applications
2. Create one application per agent
3. Bot tab → enable Message Content Intent + Server Members Intent → copy Token
4. Paste each token into config.json as agents[].discord_token
5. make invite-bots → get invite URLs → add bots to your server

---

6. Start

make up

What happens:

1. Validates config.json — exits with a clear error if required fields are missing
2. Auto-generates SSL cert via tailscale cert if not present
3. Validates docker-compose config
4. Builds custom images
5. Starts all containers

On success:

╔══════════════════════════════════════════════════════════════╗
║  ✅  sempre · sempre is running
╠══════════════════════════════════════════════════════════════╣
║
║  🤖  OpenClaw    https://your-machine.ts.net:20443
║  🤖  OpenClaw    https://openclaw.sempre.orb.local  (OrbStack)
║  🔮  Ollama API  https://your-machine.ts.net:11434
║  🔄  n8n         https://your-machine.ts.net:20678
║  🔐  SSH         ssh root@localhost -p 2222
║
║  Agents: mone sam nina
╚══════════════════════════════════════════════════════════════╝

---

7. First boot: Register Ollama Cloud key

Ollama generates an ed25519 keypair on first start. Cloud models won’t work until you register the public key.

docker logs sempre-ollama 2>&1 | grep ssh-ed25519

Copy the ssh-ed25519 AAAA... line → ollama.com/settings/keys → Add key.

docker restart sempre-ollama

Without this step, all cloud models fail with 401.

---

8. First boot: Get n8n API key

1. Open https://your-machine.ts.net:{NGINX_N8N_PORT}
2. Log in: admin@local / your n8n.password
3. Settings → API Keys → Add API Key → copy
4. Add to config.json:

"n8n": {
    ...
    "api_key": "your_key_here"
}

5. Apply: make restart

---

Access

---

Makefile Reference

Setup & Config

make config       # Copy config.json.example → config.json (first time only)
make cert         # Force-regenerate Tailscale SSL cert (auto-runs on make up)

Running

make up           # Validate → cert (if missing) → build → start everything
make down         # Stop all containers
make restart      # Stop + start (picks up config.json changes)
make generate     # Regenerate .env.generated + compose override from config.json

Logs

make logs              # Tail all logs
make logs-openclaw     # OpenClaw gateway only
make logs-gh-proxy     # All GitHub proxy instances
make logs-crawl4ai     # All Crawl4AI instances
make logs-browser-use  # All Browser-use instances

Rebuild

make restart-openclaw   # Rebuild + restart openclaw only
make rebuild-openclaw   # Full down → rebuild image → up
make build              # Rebuild all custom images (no-cache)

Other

make ssh           # SSH into openclaw container
make shell         # docker exec bash into openclaw
make status        # Container status
make invite-bots   # Discord bot invite URLs
make validate      # Validate docker-compose.yml
make clean         # Remove containers, volumes, and images

When to use what

---

Multiple Teams on One Machine

Each team is a separate clone with its own config.json. Differentiate by port.

git clone ... sempre-team-a
# config.json: "team": "team-a", nginx.openclaw_port: 20443, nginx.n8n_port: 20678

git clone ... sempre-team-b
# config.json: "team": "team-b", nginx.openclaw_port: 20444, nginx.n8n_port: 20679

The SSL cert is shared — set disks.ssl in both teams to the same path.

---

config.json Reference

---

Disk Layout

disks/                        ← host-mounted volumes (gitignored)
├── openclaw/
│   ├── openclaw.json         ← generated on first run — edit freely after
│   └── agents/
│       ├── {gm}/workspace/   ← SOUL.md · AGENTS.md · TOOLS.md · IDENTITY.md
│       └── {worker}/workspace/
├── km/                       ← Obsidian KM vault — shared across all agents
│   ├── MOC/                  ← Maps of Content (index)
│   ├── Projects/
│   ├── Research/
│   ├── Tech/
│   └── Daily/
├── ollama/                   ← model weights + ed25519 keypair
├── crawl4ai/                 ← per-agent browser state
└── ssl/                      ← Tailscale SSL certs (auto-generated by make up)
    ├── cert.pem
    └── key.pem

Open disks/km/ in Obsidian to browse the knowledge graph visually.

---

Customizing

---

Troubleshooting

---

Built on OpenClaw · Powered by Ollama · MIT License