How to Deploy OpenClaw on a Server: Complete Production Setup Guide

Deploying OpenClaw on a dedicated production server transforms your autonomous AI agents from local desktop experiments into high-availability, 24/7 cloud services. While running OpenClaw locally is ideal for prototyping workflows and tweaking prompts, production workloads require persistent process execution, rock-solid network availability, automated error recovery, isolated execution environments, and encrypted communication channels.

Whether you are building autonomous research pipelines, multi-channel customer service bots on Telegram and Slack, automated content generators, or scheduled data crawlers, this guide walks you through every phase of deploying OpenClaw on a Linux server.

By the end of this tutorial, you will have a hardened, production-ready OpenClaw deployment featuring:

• A dedicated non-root execution user and strict Linux file permissions
• Firewall rules with Uncomplicated Firewall (UFW)
• A managed systemd service providing automatic restart, resource throttling, and system-level logging
• An Nginx reverse proxy configured for full duplex WebSocket streaming, HTTP/2, and strict HTTP security headers
• Automated SSL/TLS certificates via Let's Encrypt Certbot
• Automated log rotation, state backups, and health check monitoring

---

Production Architecture Overview

Before provisioning hardware, it is helpful to understand how traffic and internal states flow through a production OpenClaw stack.

[ Incoming Client Request / Webhook / WebSocket ]
                     │
                     ▼
       ┌───────────────────────────┐
       │   Firewall (UFW / Cloud)  │ (Ports 80, 443, SSH)
       └─────────────┬─────────────┘
                     │
                     ▼
       ┌───────────────────────────┐
       │     Nginx Reverse Proxy   │ (SSL Termination, WebSockets,
       │   (agent.yourdomain.com)  │  Security Headers, Gzip)
       └─────────────┬─────────────┘
                     │ Proxy Pass: http://127.0.0.1:3000
                     ▼
       ┌───────────────────────────┐
       │   OpenClaw Application    │ (Runs under non-root 'openclaw' user,
       │    (Node.js / systemd)    │  managed by /etc/systemd/system)
       └──────┬──────────────┬─────┘
              │              │
              ▼              ▼
   ┌──────────────────┐  ┌───────────────────────────────────┐
   │ SQLite / Vector  │  │ Outbound LLM API Gateway          │
   │ State & Memory   │  │ (OpenAI, Anthropic, DeepSeek,     │
   │ (/var/lib/...)   │  │  or Local Ollama Server)          │
   └──────────────────┘  └───────────────────────────────────┘

Key Architectural Layers

1. Edge & Firewall Layer: The perimeter allows only inbound HTTP (80), HTTPS (443), and custom SSH traffic. Direct access to OpenClaw's internal Node.js port (default 3000) is strictly blocked from public interfaces.
2. Reverse Proxy Layer (Nginx): Terminates TLS/SSL, upgrades HTTP connections to persistent WebSockets (critical for real-time agent output streaming and Server-Sent Events), applies HTTP security headers, and buffers large payloads.
3. Application & Supervisor Layer (systemd): Runs the OpenClaw process under an unprivileged system user (openclaw), manages environment variables via a protected .env.production file, enforces memory limits, and handles auto-restarts upon uncaught exceptions or kernel reboots.
4. Data & Persistence Layer: Manages persistent SQLite database files, vector stores, session histories, and local workspace artifacts in isolated system directories.
5. Outbound API Gateway: Safely manages outbound HTTPS connections to foundation model endpoints (OpenAI, Anthropic, DeepSeek) or local inference backends (Ollama, vLLM).

---

Server Provisioning & Hardware Specifications

Choosing the right virtual private server (VPS) ensures that your AI agents execute tasks reliably without crashing due to Out-Of-Memory (OOM) errors.

Hardware Sizing Guidelines

Deployment Tier	Workload Profile	Minimum vCPU	Minimum RAM	Storage (NVMe)	Recommended Bandwidth
Starter / Hobby	1 Single-purpose agent, low concurrency, remote cloud LLM APIs	1 vCPU	1 GB – 2 GB	25 GB SSD	1 TB / month
Standard Production	2–5 Multi-agent workflows, tool execution, browser automation	2 vCPU	4 GB	50 GB NVMe	2–3 TB / month
Enterprise / Heavy	High concurrency, local vector embeddings, heavy file scraping	4 vCPU	8 GB – 16 GB	100 GB NVMe	5+ TB / month

Recommended Cloud Provider

For reliable global performance and instant deployment, we recommend Vultr High Performance Cloud Compute. Vultr provides high-frequency AMD EPYC and Intel Xeon processors paired with NVMe storage across 32+ datacenter locations worldwide. Selecting a server location geographically close to your LLM API endpoints (such as US-East for OpenAI and Anthropic) significantly reduces round-trip request latency during multi-turn agent reasoning.

You can launch a high-performance instance via Vultr Cloud Compute starting at low hourly rates. For a complete comparison of hosting options, read our detailed breakdown of the Best VPS for OpenClaw Self-Hosting.

Operating System Recommendation

We recommend Ubuntu 24.04 LTS or Ubuntu 22.04 LTS. These distributions provide modern systemd toolsets, up-to-date security packages, and straightforward Node.js LTS compatibility.

---

Operating System & Environment Preparation

Once your server is provisioned and you have logged in via SSH as root, follow these steps to secure the OS and install runtime dependencies.

Step 1: Update System Packages

Start by refreshing the package repositories and upgrading installed packages to their latest security patches:

sudo apt update && sudo apt upgrade -y
sudo apt install -y curl wget git build-essential ufw unattended-upgrades htop jq software-properties-common

Step 2: Create an Unprivileged Service User

Running OpenClaw as the root user poses significant security risks. If a skill or external script is compromised, the attacker would gain full administrative control over your server. Create a dedicated system user named openclaw:

# Create openclaw system user with a home directory
sudo useradd -m -s /bin/bash openclaw

# Add openclaw to the sudo group if administrative tasks are needed
sudo usermod -aG sudo openclaw

Step 3: Configure UFW Firewall

Lock down your server by allowing only essential ports:

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (Port 22 or your custom SSH port)
sudo ufw allow 22/tcp comment 'OpenSSH'

# Allow HTTP and HTTPS for Nginx
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

# Enable UFW
sudo ufw --force enable

# Verify firewall status
sudo ufw status verbose

Step 4: Install Node.js LTS (v20 or v22)

OpenClaw requires Node.js version 18.x or higher (Node.js 20 LTS or 22 LTS recommended). Install Node.js via the official NodeSource repository:

# Download and setup NodeSource repository for Node.js 20 LTS
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -

# Install Node.js and npm
sudo apt install -y nodejs

# Verify installation versions
node --version
npm --version

# Optional: Install pnpm for faster package management
sudo npm install -g pnpm

---

Application Installation & Environment Configuration

With your environment ready, install OpenClaw into a dedicated directory under /opt/openclaw.

Step 1: Create Application Directory and Permissions

# Create application and data directories
sudo mkdir -p /opt/openclaw
sudo mkdir -p /var/lib/openclaw
sudo mkdir -p /var/log/openclaw

# Grant ownership to the openclaw user
sudo chown -R openclaw:openclaw /opt/openclaw
sudo chown -R openclaw:openclaw /var/lib/openclaw
sudo chown -R openclaw:openclaw /var/log/openclaw

Step 2: Install OpenClaw

You can install OpenClaw either globally via npm or by cloning the release repository. To install globally:

sudo npm install -g openclaw

Or switch to the openclaw user and set up a custom workspace directory:

sudo su - openclaw
cd /opt/openclaw

# Initialize the OpenClaw configuration workspace
openclaw init --yes

For advanced command options and execution flags, consult our OpenClaw CLI Guide.

Step 3: Configure .env.production

Create a strictly protected .env.production file inside /opt/openclaw/:

cat << 'EOF' > /opt/openclaw/.env.production
# ==============================================================================
# OpenClaw Production Environment Configuration
# ==============================================================================

# Server Network Binding
NODE_ENV=production
PORT=3000
HOST=127.0.0.1
BASE_URL=https://agent.yourdomain.com

# Security & Authentication Secrets (Generate with: openssl rand -hex 32)
SESSION_SECRET=c4f8d2b638971f49635b7194602a819ecbfd8a439281a74281729b4e7281938a
API_AUTH_KEY=9a3c74e8912d094b82f6e5c7a10238491c834019283746192837465918237465

# Primary LLM API Keys
OPENAI_API_KEY=sk-proj-yourActualOpenAIKeyHere
ANTHROPIC_API_KEY=sk-ant-yourActualAnthropicKeyHere
DEEPSEEK_API_KEY=sk-yourActualDeepSeekKeyHere

# Local Inference (Optional: if routing models through Ollama)
# OLLAMA_BASE_URL=http://127.0.0.1:11434

# Memory & Persistence Storage
DATABASE_DRIVER=sqlite
DATABASE_PATH=/var/lib/openclaw/openclaw_production.db
VECTOR_STORE_PATH=/var/lib/openclaw/vector_store

# Logging and Verbosity
LOG_LEVEL=info
LOG_PATH=/var/log/openclaw/app.log

# Concurrency and Execution Limits
MAX_CONCURRENT_AGENTS=5
AGENT_TIMEOUT_SECONDS=300
MAX_SUBAGENT_DEPTH=3
EOF

Protect the configuration file so that only the openclaw user can read it:

chmod 600 /opt/openclaw/.env.production

For a comprehensive breakdown of all available configuration parameters, memory engines, and model adapters, review the OpenClaw Configuration Guide.

---

Process Management with systemd

In production environments, running OpenClaw in a temporary terminal or background nohup process is fragile. Linux systemd provides battle-tested process supervision, automatic reboot persistence, resource quotas, and unified logging.

Step 1: Create the systemd Service File

Create /etc/systemd/system/openclaw.service:

[Unit]
Description=OpenClaw Autonomous AI Agent Service
Documentation=https://openclawwiki.com
After=network.target network-online.target
Wants=network-online.target

[Service]
Type=simple
User=openclaw
Group=openclaw
WorkingDirectory=/opt/openclaw

# Load production environment variables
EnvironmentFile=/opt/openclaw/.env.production

# Node.js binary path and execution command
ExecStart=/usr/bin/openclaw start --env /opt/openclaw/.env.production
ExecReload=/bin/kill -HUP $MAINPID

# Auto-Restart Configuration
Restart=always
RestartSec=10s
RestartPreventExitStatus=0

# Security & Isolation Sandbox
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=full
ProtectHome=read-only
ReadWritePaths=/opt/openclaw /var/lib/openclaw /var/log/openclaw

# Resource Limits & File Descriptors
LimitNOFILE=65536
LimitNPROC=4096
MemoryHigh=2G
MemoryMax=3.5G

# Standard Logging via journald
StandardOutput=journal
StandardError=journal
SyslogIdentifier=openclaw

[Install]
WantedBy=multi-user.target

Explanation of Key Directives:

• User=openclaw / Group=openclaw: Ensures the application executes without root privileges.
• EnvironmentFile: Automatically injects all variables from .env.production into the execution process.
• Restart=always and RestartSec=10s: Automatically restarts OpenClaw if an unhandled promise rejection or memory error causes a crash.
• ProtectSystem=full and ReadWritePaths: Restricts filesystem modifications solely to designated application and storage directories.
• LimitNOFILE=65536: Increases the maximum open file descriptor limit to handle high numbers of concurrent HTTP and WebSocket connections.
• MemoryHigh=2G and MemoryMax=3.5G: Warns and prevents runaway memory leaks from consuming all host RAM and freezing the VPS.

Step 2: Enable and Start the Service

# Reload systemd daemon to pick up the new unit file
sudo systemctl daemon-reload

# Enable OpenClaw to start automatically on system boot
sudo systemctl enable openclaw.service

# Start the OpenClaw service
sudo systemctl start openclaw.service

# Check real-time service status
sudo systemctl status openclaw.service

Step 3: Monitor Live Application Logs

To inspect live streaming logs generated by OpenClaw:

# Tail live logs with journalctl
sudo journalctl -u openclaw.service -f -n 50

Note on Containerized Deployments: If you prefer containerized workflows with Docker and Docker Compose instead of native systemd, check our companion tutorial on OpenClaw Docker Setup.

---

Reverse Proxy Setup with Nginx

Exposing Node.js directly to the internet is not recommended. Nginx acts as a reverse proxy, providing SSL/TLS encryption, request filtering, static asset caching, and WebSocket connection handling.

Step 1: Install Nginx

sudo apt install -y nginx
sudo systemctl enable nginx
sudo systemctl start nginx

Step 2: Create the Nginx Configuration Block

Create a dedicated server configuration file /etc/nginx/sites-available/openclaw:

# Upstream definition for OpenClaw local server
upstream openclaw_backend {
    server 127.0.0.1:3000 max_fails=3 fail_timeout=10s;
    keepalive 32;
}

server {
    listen 80;
    listen [::]:80;
    server_name agent.yourdomain.com;

    # Allow ACME HTTP-01 challenge for Let's Encrypt Certbot
    location /.well-known/acme-challenge/ {
        root /var/www/html;
        allow all;
    }

    # Redirect all other HTTP traffic to HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name agent.yourdomain.com;

    # SSL Certificates (managed by Certbot after initial setup)
    # ssl_certificate /etc/letsencrypt/live/agent.yourdomain.com/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/agent.yourdomain.com/privkey.pem;

    # Modern SSL Protocols & Cipher Suites
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # Request Body Sizing (useful for document uploads to agent skills)
    client_max_body_size 50M;

    # Gzip Compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    # Main Reverse Proxy Location
    location / {
        proxy_pass http://openclaw_backend;
        proxy_redirect off;

        # Standard Proxy Headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;

        # Full-Duplex WebSocket & Streaming Support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Timeouts for Long-Running LLM Generation Streams
        proxy_connect_timeout 60s;
        proxy_send_timeout 300s;
        proxy_read_timeout 300s;
        send_timeout 300s;

        # Disable proxy buffering for instant token streaming
        proxy_buffering off;
        proxy_cache_bypass $http_upgrade;
    }

    # Dedicated Health Check Endpoint
    location /healthz {
        proxy_pass http://openclaw_backend/healthz;
        proxy_http_version 1.1;
        access_log off;
    }
}

Step 3: Enable the Configuration and Test Syntax

# Enable the site configuration
sudo ln -sf /etc/nginx/sites-available/openclaw /etc/nginx/sites-enabled/

# Remove default site if present
sudo rm -f /etc/nginx/sites-enabled/default

# Test Nginx configuration for syntax errors
sudo nginx -t

# Reload Nginx
sudo systemctl reload nginx

---

Free SSL with Let's Encrypt Certbot

Secure your connection with an automated, free SSL/TLS certificate from Let's Encrypt.

Step 1: Install Certbot and the Nginx Plugin

sudo apt install -y certbot python3-certbot-nginx

Step 2: Request and Install the Certificate

Run Certbot to automatically configure SSL certificates in your Nginx configuration:

sudo certbot --nginx -d agent.yourdomain.com

Certbot will verify your domain ownership, generate the cryptographic keys, update /etc/nginx/sites-available/openclaw with the certificate paths, and reload Nginx.

Step 3: Verify Automated Certificate Renewal

Certbot sets up a background systemd timer to renew certificates before expiration. Verify the renewal dry-run:

# Test certificate renewal
sudo certbot renew --dry-run

# Inspect active renewal timers
sudo systemctl list-timers | grep certbot

---

Production Maintenance, Log Rotation & Automated Backups

Maintaining a server-hosted OpenClaw deployment requires routine maintenance workflows: log management, state backups, and zero-downtime updates.

1. Configure Logrotate

To prevent log files from growing indefinitely and filling up server storage, configure /etc/logrotate.d/openclaw:

sudo cat << 'EOF' > /etc/logrotate.d/openclaw
/var/log/openclaw/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 0640 openclaw openclaw
    sharedscripts
    postrotate
        /bin/systemctl reload openclaw.service > /dev/null 2>&1 || true
    endscript
}
EOF

2. Automated Daily State and Memory Backup Script

Create an automated backup script /usr/local/bin/backup-openclaw.sh to preserve your SQLite databases, vector embeddings, and .env configs:

#!/bin/bash
set -euo pipefail

BACKUP_DIR="/var/backups/openclaw"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
DEST_FILE="${BACKUP_DIR}/openclaw_backup_${TIMESTAMP}.tar.gz"

mkdir -p "${BACKUP_DIR}"

echo "[$(date)] Starting OpenClaw production backup..."

# Archive database, vector store, and configuration
tar -czf "${DEST_FILE}" \
    -C / \
    opt/openclaw/.env.production \
    var/lib/openclaw

# Set strict permissions
chmod 600 "${DEST_FILE}"

# Retain only the last 7 days of backups
find "${BACKUP_DIR}" -type f -name "openclaw_backup_*.tar.gz" -mtime +7 -delete

echo "[$(date)] Backup completed successfully: ${DEST_FILE}"

Make the script executable and add it to root's crontab:

sudo chmod +x /usr/local/bin/backup-openclaw.sh

# Open crontab editor
sudo crontab -e

Add the daily 02:00 AM backup schedule:

0 2 * * * /usr/local/bin/backup-openclaw.sh >> /var/log/openclaw/backup.log 2>&1

3. Zero-Downtime Application Update Procedure

When a new version of OpenClaw is released, apply updates smoothly with this standard procedure:

# 1. Update the OpenClaw package
sudo npm install -g openclaw@latest

# 2. Verify configuration integrity
sudo su - openclaw -c "openclaw config validate --env /opt/openclaw/.env.production"

# 3. Gracefully restart the service
sudo systemctl restart openclaw.service

# 4. Check logs and health status
sudo journalctl -u openclaw.service -n 20 --no-pager
curl -f http://127.0.0.1:3000/healthz || echo "Health check failed!"

---

Frequently Asked Questions (FAQ)

1. How much RAM does OpenClaw need in production?

For a single active agent communicating with external cloud LLMs (such as OpenAI GPT-4o or Anthropic Claude 3.5 Sonnet), 1 GB to 2 GB of RAM is sufficient. However, if your agents run local embeddings, execute complex custom Python/Node skills, or process heavy browser automation tasks with Puppeteer/Playwright, we recommend at least 4 GB of RAM along with 2 vCPUs on a high-performance VPS like Vultr Cloud Compute.

2. Can I run multiple OpenClaw agent instances on a single VPS?

Yes. You can run multiple instances by creating distinct systemd service files (e.g., /etc/systemd/system/openclaw-agent1.service and /etc/systemd/system/openclaw-agent2.service), configuring each to bind to unique internal ports (such as 3000 and 3001), and routing them through different Nginx subdomains (agent1.yourdomain.com and agent2.yourdomain.com).

3. How do I prevent WebSocket connection drops during streaming LLM responses?

LLM token streaming can keep HTTP/WebSocket connections open for several minutes. To prevent timeouts:

• Set proxy_read_timeout 300s; and proxy_send_timeout 300s; in your Nginx configuration.
• Set proxy_buffering off; so tokens stream directly without Nginx waiting for the complete response buffer.
• Ensure your client or reverse proxy sends WebSocket ping/pong heartbeats every 30 seconds.

4. Should I deploy OpenClaw via bare-metal systemd or Docker in production?

Both approaches are production-ready:

• systemd (Bare-metal / VM): Ideal for minimal overhead, direct hardware access, simplicity, and low memory usage on entry-level VPS instances.
• Docker / Docker Compose: Ideal if your deployment is part of a larger microservice cluster (e.g., PostgreSQL, Redis, Ollama), or if you require strict environment isolation across staging and production fleets. Refer to our OpenClaw Docker Setup guide for containerized setups.

5. How do I safely update OpenClaw without losing agent memory or state?

OpenClaw keeps persistent memory, conversation history, and vector embeddings in the directory specified by DATABASE_PATH and VECTOR_STORE_PATH (e.g., /var/lib/openclaw). As long as these paths reside outside the ephemeral package directory and you maintain regular backups via /usr/local/bin/backup-openclaw.sh, updating the core binary via npm install -g openclaw@latest will preserve all agent state and memory.

---

Conclusion & Next Steps

Deploying OpenClaw on a Linux server with systemd, Nginx, and Let's Encrypt SSL provides a resilient, secure foundation for hosting autonomous AI agents in production. Your agents can now run continuously, ingest incoming webhooks, interact with user queries in real-time, and execute scheduled tasks around the clock.

To deepen your OpenClaw infrastructure and management capabilities, explore these guides:

• Best VPS for OpenClaw Self-Hosting: Benchmark comparisons of cloud hosting providers for cost and latency.
• OpenClaw CLI Guide: Master all CLI flags, execution modes, and debugging utilities.
• OpenClaw Configuration Guide: Fine-tune model temperature, vector chunking, and memory retention policies.
• OpenClaw Docker Setup: Learn how to deploy OpenClaw with Docker Compose and multi-container stacks.