feat(tom): add openclaw-gateway as a system service

Adds the nix-openclaw flake input and enables the openclaw-gateway
NixOS module on TOM. This runs the OpenClaw gateway under a dedicated
'openclaw' system user with persistent state at /var/lib/openclaw.

Changes:
- Add nix-openclaw flake input (follows nixpkgs)
- Import openclaw-gateway NixOS module in tom configuration
- Create machines/tom/services/openclaw-gateway/default.nix
- Persist /var/lib/openclaw across reboots (impermanence)

Author: theorderingmachine

flake.nix

@@ -24,6 +24,10 @@
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nix-openclaw = {
+      url = "github:openclaw/nix-openclaw";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixpkgs = {
       url = "github:NixOS/nixpkgs/nixos-unstable";
     };
@@ -166,6 +170,7 @@
             ./machines/tom/configuration.nix
             inputs.home-manager.nixosModules.home-manager
             inputs.impermanence.nixosModules.impermanence
+            inputs.nix-openclaw.nixosModules.openclaw-gateway
             inputs.sops-nix.nixosModules.sops
             {
               home-manager = {

machines/tom/configuration.nix

@@ -60,6 +60,7 @@
     ./services/interception-tools
     ./services/minecraft-server
     ./services/ollama
+    ./services/openclaw-gateway
     ./services/openssh
     ./services/pipewire
     ./services/plasma6
@@ -93,6 +94,7 @@
       "/etc/ollama/models"
       "/srv/minecraft/world"
       "/var/lib/nixos"
+      "/var/lib/openclaw"
       "/var/lib/slack"
       "/var/lib/soft-serve"
       "/var/lib/systemd/coredump"

machines/tom/services/openclaw-gateway/default.nix

@@ -0,0 +1,14 @@
+# https://github.com/openclaw/openclaw
+{ ... }:
+{
+  services.openclaw-gateway = {
+    enable = true;
+    port = 18789;
+    user = "openclaw";
+    group = "openclaw";
+    stateDir = "/var/lib/openclaw";
+    environment = {
+      NODE_ENV = "production";
+    };
+  };
+}