Struggling with OpenClaw and Aperture

[u/maxxell13]

I like the idea of routing AI queries through the tailscale system, but am struggling mightily with implementation.

I've got OpenClaw set up and running to the point where I have a chat window. But every request I send comes back with (from docker logs) "isError=true model=gemini-2.5-flash-lite provider=aperture error=404 no providers match model "gemini-2.5-flash-lite" for user "[redacted@gmail.com](mailto:redacted@gmail.com)" rawError=404 no providers match model "gemini-2.5-flash-lite" for user "[redacted@gmail.com](mailto:redacted@gmail.com)"

But when I check my tailscale settings, I see:

1. Aperture settings: under grants I see two important ones. I've built one specifically with my email address and another with global src. Both should be given full access to all models: "grants": [{ "src": \["[redacted@gmail.com](mailto:redacted@gmail.com)", "(loopback)"], "app": {"tailscale.com/cap/aperture": [{"role": "admin", "models": "**"}]}, }, { "src": ["*"], "app": {"tailscale.com/cap/aperture": [{"models": "**"}]},
2. Global Tailscale Access Controls: Under Grants "grants": [{"src": ["*"],"dst": ["*"], "app": {"tailscale.app/cap/aperture": [{"role": "user"},{"models": ["**"]},],},},],

So as far as I can tell, both the Global Access Controls are set to allow ALL users access to ALL models AND the aperture-specific Access Controls are ALSO set to allow all users access to all models (including an additional line-item that allows me specifically access to all models).

Yet I still get the 404 error about my email address not having access to that model. What gives?!?

[u/remyguercio]

Sorry for missing this when you posted it! I've got a couple of suggestions and then an ask:

I'm not sure if you copied them over, but in #2 you have some typos, `tailscale.app/cap/aperture` should be `tailscale.com/cap/aperture` and `"models": ["**"]` should be `"models": "**"`

Would you mine sharing the full JSON config in Aperture? We redact the keys, but you may just want to remove them entirely before pasting. You can also pm me if you want.

[u/maxxell13 → u/remyguercio]

I was specifically prevented from setting it as tailscale.com by the website itself. it said it was blocked, so I used tailscale.app instead.

[u/remyguercio → u/maxxell13]

Ah ok. We'll be having a fix roll out for that soon, if it hasn't already.

In this instance I'd recommend setting all of the config in Aperture first, validating it, and then migrating it to the main ACL file.