OpenClaw VPS Setup

gistfile1.txt

Phase 1: VPS Provisioning

  - Generate SSH key pair — creates an ED25519 key pair locally (~/.clawcontrol/deployments/<name>/ssh/id_ed25519)
  - Upload SSH key to cloud provider — registers the public key with Hetzner/DigitalOcean as clawcontrol-<deployment-name>
  - Create VPS server — provisions a server via the cloud provider API (default: Hetzner cpx11 — 2 vCPU AMD, 2GB RAM, 40GB
  SSD, Ubuntu 24.04, Ashburn VA)
  - Wait for server to be running — polls the provider API every 3 seconds until the server status is running (timeout:
  120s)
  - Establish SSH connection — polls SSH on port 22 every 5 seconds until the server accepts connections (timeout: 180s),
  connects as root using the generated key

  Phase 2: System Setup

  - Configure 4GB swap — creates /swapfile (4GB), sets permissions to 600, runs mkswap and swapon, appends to /etc/fstab,
  sets vm.swappiness=100 in /etc/sysctl.conf
  - Update system packages — runs apt-get update && apt-get upgrade -y
  - Install base dependencies — installs curl, wget, git, build-essential via apt

  Phase 3: Runtime Installation

  - Install NVM v0.40.1 — downloads and runs the NVM install script, adds sourcing lines to ~/.bashrc
  - Install Node.js LTS — runs nvm install --lts and sets it as the default
  - Install pnpm — runs npm install -g pnpm
  - Install Google Chrome Stable — downloads the .deb package from dl.google.com, installs it via apt-get install -y
  /tmp/chrome.deb (which auto-resolves all Chrome dependencies: libX11, libXss, libgbm, fonts, etc.)
  - Install OpenClaw — runs the OpenClaw install script from https://openclaw.ai/install.sh

  Phase 4: Configuration

  - Generate gateway auth token — creates a 32-byte random hex token for API authentication
  - Write OpenClaw config (~/.openclaw/openclaw.json) — configures:
    - Browser: headless Chrome with --no-sandbox, CDP on port 18800, executable at /usr/bin/google-chrome
    - Gateway: port 18789, bound to loopback only (not publicly accessible), with the generated auth token
    - AI agent: the selected AI provider and model (e.g., openrouter/moonshotai/kimi-k2.5), max 4 concurrent agents, 8
  concurrent subagents, workspace at /root/.openclaw/workspace
    - Channels: Telegram bot token and allowed user IDs
    - Plugins: Telegram plugin enabled
  - Write environment file (~/.openclaw/.env, mode 0600) — sets the AI provider API key (e.g., OPENROUTER_API_KEY=...,
  ANTHROPIC_API_KEY=..., etc.)

  Phase 5: Tailscale (optional, skipped if user chose to skip)

  - Install Tailscale — runs the Tailscale install script, enables and starts tailscaled systemd service
  - Authenticate Tailscale — runs tailscale up, extracts the auth URL, opens the user's browser to complete authentication,
   polls until authenticated (timeout: 5 minutes)
  - Configure Tailscale Serve — runs tailscale serve --bg 18789 to proxy the OpenClaw gateway over the Tailscale network