OpenClaw Cloud Deployment: Cloud vs Local

When Cloud Makes Sense

Cloud deployment is not always the right choice. Use it when:

• 24/7 uptime — Feishu, Slack, or email bots must respond even when your laptop is off
• Team collaboration — Multiple people need to manage and monitor the same OpenClaw instance
• Multiple channels — Several integrations (Feishu, Slack, webhooks) need a stable endpoint
• Scheduled tasks — Cron-like jobs must run reliably at fixed times

Stay local when you are experimenting, validating workflows, or only need ad-hoc runs.

VPS Deployment Overview

A typical cloud setup includes:

1. A VPS (Ubuntu 22.04 LTS or similar)
2. Docker or direct Node.js install
3. systemd for process management
4. Nginx as reverse proxy with HTTPS
5. Gateway auth and security hardening

Step 1: Prepare the VPS

# Update system
sudo apt update && sudo apt upgrade -y

# Install Node.js 22+ (via NodeSource)
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt install -y nodejs

# Verify
node -v   # Should be v22.x or higher

Step 2: Install OpenClaw

npm install -g openclaw@latest
openclaw onboard --install-daemon

Configure your API keys, channels, and model provider during onboarding.

Step 3: Run as a systemd Daemon

Create a systemd unit so OpenClaw survives reboots:

# /etc/systemd/system/openclaw.service
[Unit]
Description=OpenClaw Agent Runtime
After=network.target

[Service]
Type=simple
User=openclaw
ExecStart=/usr/bin/openclaw gateway start
Restart=always
RestartSec=10
Environment=NODE_ENV=production

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable openclaw
sudo systemctl start openclaw
sudo systemctl status openclaw

Step 4: Nginx Reverse Proxy with HTTPS

Use Nginx to expose OpenClaw safely with TLS:

# /etc/nginx/sites-available/openclaw
server {
    listen 443 ssl http2;
    server_name openclaw.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/openclaw.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/openclaw.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:18789;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Obtain certificates with Certbot:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d openclaw.yourdomain.com

Step 5: Gateway Auth

Never expose the gateway without authentication. Enable token auth:

openclaw config set gateway.auth.mode token
openclaw config set gateway.auth.token "your-secure-random-token"

Restart the gateway after changing auth settings.

Step 6: Disable Control UI in Production

The Control UI is convenient for debugging but increases attack surface. Disable it in production:

openclaw config set gateway.controlUi false

Use the CLI or a separate admin tool for management instead.

Step 7: Security Audit

Run a deep security audit before going live:

openclaw security audit --deep

Address any findings: permission over-granting, exposed secrets, missing auth.

Step 8: Logging

Configure centralized logging for production:

openclaw config set logging.level info
openclaw config set logging.destination /var/log/openclaw/openclaw.log

Rotate logs and monitor for anomalies.

Docker Deployment (Alternative)

For containerized deployment:

# Pull or build
docker pull openclaw/openclaw:latest

# Run with config mounted
docker run -d \
  --name openclaw \
  -v /path/to/config:/root/.openclaw \
  -p 18789:18789 \
  --restart unless-stopped \
  openclaw/openclaw:latest

Bind config and logs to host volumes so they persist across container restarts.

Summary Checklist

• VPS with Node.js 22+
• systemd daemon for process management
• Nginx reverse proxy with HTTPS
• Gateway token auth enabled
• Control UI disabled in production
• openclaw security audit --deep passed
• Logging configured and rotated