OpenClaw Server Deployment Overview¶

Prerequisites¶

The following conditions are required for a successful application deployment:

• Operating System: Debian 11+ or Ubuntu 20.04+.

• Access Rights: Superuser (root) privileges or sudo access.

• Ports:

  • 80/tcp (HTTP) — for health checks and redirection.

  • 443/tcp (HTTPS) — primary web interface port.

  • 22/tcp (SSH) — remote management.

  • 41641/udp (Tailscale) — if VPN support is enabled.

FQDN of the final panel on hostkey.in domain¶

The domain template for accessing the web interface is formed as follows:

File and Directory Structure¶

Main directories in the system:

• /opt/openclaw-ansible — installer working directory.

• /home/openclaw — home directory of the openclaw user.

• /home/openclaw/.openclaw — application configuration files.

• /data/nginx — Nginx configurations and certificates.

• /root/nginx — Docker Compose files for the proxy server.

Application Installation Process¶

Deployment is performed using the install.sh script, which prepares the environment and initiates the installation process via Ansible.

1. System Preparation: Installation of necessary system utilities (git, curl, sudo, vim, etc.).

2. Docker Installation: Repository setup and Docker CE installation.

3. User Creation: Creation of the openclaw system user with limited sudo privileges.

4. OpenClaw Installation:

   • In release mode: Installation via global package pnpm install -g openclaw@latest.

   • In development mode: Cloning the repository from GitHub, building from source, and creating symbolic links.

5. Proxy Configuration: Deployment of Nginx with automatic SSL certificate acquisition via Certbot.

Access Rights and Security¶

System security is ensured by the following mechanisms:

• Firewall (UFW): Installed by default; only necessary ports are allowed (22, 80, 443). Docker isolation is configured via after.rules.

• Fail2Ban: SSH protection against brute-force attacks.

• User Privilege Restriction: The openclaw user is permitted to execute only a limited set of systemctl commands and tailscale diagnostics without password entry.

• Automatic Updates: The unattended-upgrades package is enabled for automatic installation of security updates.

Databases¶

In the current configuration, the database is not isolated in a separate container; the application uses local storage and the file system to manage sessions and data.

Docker Containers and Execution¶

To ensure web interface operation via HTTPS, one primary container is used:

Application Update Instructions¶

Updates are performed by re-running the installation process or updating packages:

• For Nginx Docker containers: Navigate to the /root/nginx directory and execute image update commands.

• For OpenClaw itself: Use the command pnpm install -g openclaw@latest (in release mode) or re-run the build process (in development mode).

Permissions Settings¶

Access rights to critical directories are configured as follows:

Configuration Files and Data Location¶

• OpenClaw Configuration: ~/.openclaw/config.yml (created after executing the onboard command).

• Application Logs: ~/.openclaw/logs/.

• Nginx Configuration: /data/nginx/user_conf.d/{domain}.conf.

Available Connection Ports¶

Starting and Stopping the Application¶

The Gateway service is managed via systemctl:

• Start: sudo systemctl start openclaw

• Stop: sudo systemctl stop openclaw

• Restart: sudo systemctl restart openclaw

• View Status: openclaw status or journalctl -u openclaw -f

Proxy Servers¶

Nginx in combination with Certbot is used as the proxy server.

• Nginx operates in network_mode: host mode.

• Automatic HTTP to HTTPS redirect is configured.

• WebSocket support is implemented for correct interface operation (Upgrade and Connection headers).

• SSL certificates are managed via the nginx-certbot container and stored in the Docker named volume nginx_secrets.