OpenClaw Server Deployment Overview¶

Prerequisites¶

To ensure a successful application deployment, the following requirements must be met:

• Operating System: Debian 11+ or Ubuntu 20.04+.

• Access Rights: Superuser (root) privileges or sudo access are required.

• Ports:

• 22/tcp — SSH (default access).

• 80/tcp and 443/tcp — HTTP and HTTPS for the web interface.

• 18789/tcp — OpenClaw gateway port (default).

• 41641/udp — If Tailscale is used.

FQDN of the final panel on hostkey.in domain¶

File and Directory Structure¶

After installation, the data and configuration structure will be as follows:

• /home/openclaw/.openclaw/ — Main application directory (configurations, logs, sessions).

• /data/nginx/ — Custom Nginx configurations.

• /root/nginx/ — Docker Compose files for the reverse proxy.

• /etc/docker/daemon.json — Docker daemon settings.

Application Installation Process¶

Deployment is performed using the install.sh installation script, which prepares the environment and initiates the automatic configuration process.

Main Installation Stages:¶

1. System Preparation: Installation of necessary system utilities (curl, git, sudo, vim, jq, etc.) and updating the package cache.

2. Node.js Environment Setup: Installation of Node.js (version 22.x) and the pnpm package manager.

3. User Creation: Creation of the openclaw system user with restricted access rights via sudoers.

4. Application Installation:

5. In release mode (default): Global installation via pnpm install -g openclaw@latest.

6. In development mode: Cloning the repository from GitHub, building from source (pnpm build), and creating symbolic links in system paths.

7. Security Configuration: Configuring the UFW firewall (allowing SSH and HTTP/HTTPS) and installing fail2ban to protect against SSH brute-force attacks.

Access Rights and Security¶

System security is ensured by the following mechanisms:

• User: All application processes run under the openclaw user.

• Firewall (UFW):

• A default deny policy for incoming connections is implemented.

• Docker isolation is configured via rules in /etc/ufw/after.rules to prevent unauthorized external access to containers.

• SSH Protection: fail2ban is configured to block IP addresses after several failed login attempts.

• Automatic Updates: The unattended-upgrades service is enabled for automatic installation of security updates.

Databases¶

The application uses local session and data storage located in the user's home directory: /home/openclaw/.openclaw/. Specific connection settings for external DBs (if required) are configured via the config.yml configuration file.

Docker Containers and Execution¶

A containerized reverse proxy is used to ensure web interface operation over the secure HTTPS protocol.

Custom Scripts and Additional Settings¶

The following actions are performed during the deployment process:

• User Environment Setup: Paths to pnpm binaries are added to the openclaw user's .bashrc.

• OpenClaw Initialization: After installation, it is necessary to run the command openclaw onboard --install-daemon, which creates the main configuration file ~/.openclaw/config.json.

• System Service Setup: A systemd service named openclaw-gateway.service is created and enabled to ensure the application starts automatically upon system boot.

Application Update Instructions¶

To update the core application, use the following commands depending on the installation mode:

• If the npm version (release) is installed:

  sudo su - openclaw
  pnpm install -g openclaw@latest
  

• If using development mode:

  cd /home/openclaw/code/openclaw
  git pull
  pnpm install
  pnpm build
  

Configuration Files and Data Locations¶

Available Connection Ports¶

• 80 (HTTP) — Redirects to HTTPS.

• 443 (HTTPS) — Main port for the management web interface.

• 18789 (TCP) — OpenClaw gateway port.

Starting and Stopping the Application¶

Application management is performed via the system service manager:

• Start: sudo systemctl start openclaw

• Stop: sudo systemctl stop openclaw

• Restart: sudo systemctl restart openclaw

• View Status: openclaw status or sudo systemctl status openclaw

• View Logs: openclaw logs or sudo journalctl -u openclaw -f