fix gateway ssh and tailscale serve config

docker/bin/start-gateway.sh

@@ -4,9 +4,17 @@ set -eu
 CONFIG_DIR="${HOME:-/home/node}/.openclaw"
 CONFIG_FILE="${CONFIG_DIR}/openclaw.json"
 DEFAULT_CONFIG="/opt/openclaw/defaults/openclaw.json"
-BIND="${OPENCLAW_GATEWAY_BIND:-lan}"
 TAILSCALE_MODE="${OPENCLAW_TAILSCALE_MODE:-off}"
 PORT="${OPENCLAW_GATEWAY_PORT:-18789}"
+RAW_BIND="${OPENCLAW_GATEWAY_BIND:-}"
+
+if [ -n "${RAW_BIND}" ]; then
+  BIND="${RAW_BIND}"
+elif [ "${TAILSCALE_MODE}" = "serve" ]; then
+  BIND="loopback"
+else
+  BIND="lan"
+fi
 
 mkdir -p "${CONFIG_DIR}"
 
@@ -29,7 +37,9 @@ jq \
   .gateway.bind = $bind |
   .gateway.tailscale.mode = $tailscale_mode |
   .gateway.auth.mode = "token" |
+  .gateway.auth.allowTailscale = ($tailscale_mode == "serve") |
   .gateway.auth.token = (if $token == "" then (.gateway.auth.token // "${OPENCLAW_GATEWAY_TOKEN}") else $token end) |
+  .gateway.trustedProxies = (((.gateway.trustedProxies // []) + (if $tailscale_mode == "serve" then ["127.0.0.1", "::1"] else [] end)) | unique) |
   .gateway.controlUi.allowInsecureAuth = true |
   .models.providers.openai = {
     baseUrl: "https://api.openai.com/v1",