OpenClaw VPS Self-Hosting Guide: Run Your AI Agent 24/7

OpenClaw is an open-source AI agent that you can run on your own server instead of relying on third-party infrastructure. While self-hosting offers complete ownership over your setup, most guides assume prior expertise with Linux, Docker, and networking. This guide provides a straightforward, beginner-friendly walkthrough to get OpenClaw up and running on a Virtual Private Server (VPS) from scratch.

This guide covers picking a VPS provider, configuring OpenClaw on Ubuntu 22.04, and securing your server.

Why Self-Host OpenClaw?

Hosting OpenClaw yourself offers three primary advantages:

Privacy: Your data remains on your own infrastructure. No third-party platform accesses your prompts, API keys, or connected integrations.
Cost Control: A basic VPS ranges from $4 to $12 per month, whereas managed hosting solutions often cost more while offering less environment control.
Customization: You can modify OpenClaw's source code, add custom integrations, and configure models without restrictive platform API limits.

The main tradeoff is that you are responsible for maintaining server uptime, updates, and overall security.

Picking a VPS Provider

To run OpenClaw smoothly, you will need a Linux server with at least 2 vCPU, 4 GB RAM, and 40 GB SSD. Here is how the top providers compare for this setup:

Hetzner (Best Value)

Hetzner's CX series starts at approximately $4.09/month (CX23: 2 vCPU, 4 GB RAM) and goes up to $7.40/month (CX32: 4 vCPU, 8 GB RAM) for more complex, multi-channel configurations. They offer data centers in Germany, Finland, and the US. It provides excellent network performance at some of the lowest prices among reputable hosting companies.

Oracle Cloud (Free Tier)

Oracle offers an always-free tier featuring up to 4 ARM CPUs and 24 GB RAM on Ampere instances. This is a highly generous resource allotment, but provisioning capacity can be limited; you may need to retry instance creation multiple times before resources become available in your chosen region.

DigitalOcean

Basic Droplets run $6 to $12 per month. DigitalOcean is known for its beginner-friendly dashboard and extensive documentation. While slightly more expensive than Hetzner for equivalent compute, they provide an easy learning curve.

Linode (Akamai)

Linode's Nanode plan runs $5/month for 1 vCPU, 1 GB RAM, and 25 GB storage. It offers a solid alternative with strong network performance, particularly if you already manage services under Akamai.

Provider Comparison Summary

Provider	Starting Price/mo	vCPU	RAM	Storage	Free Tier
Hetzner CX23	$4.09	2	4 GB	40 GB NVMe	No
Oracle Cloud	$0	4 (ARM)	24 GB	200 GB	Yes
DigitalOcean	$6–$12	1–2	1–4 GB	25–80 GB SSD	No
Linode	$5–$10	1–2	1–4 GB	25–80 GB	No

Server Setup: Ubuntu 22.04

Once your VPS is provisioned, log in to your server via SSH using the IP address and credentials provided by your hosting provider:

ssh root@YOUR_SERVER_IP

Step 1: Create a Non-Root User

Running applications directly as root poses a security risk. Create a dedicated system user:

adduser openclaw
usermod -aG sudo openclaw

Set a strong password when prompted, then switch to the new user:

su - openclaw

Execute all subsequent commands from this openclaw user account. Use sudo only when root privileges are required.

Step 2: Update the System

Ensure your package lists and installed software are fully up to date:

sudo apt update && sudo apt upgrade -y

Step 3: Install Dependencies

OpenClaw requires Node.js (v18 or higher), Git, and a process manager to keep the backend running:

# Install Node.js 20 LTS
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs git

# Install PM2 globally to manage the application process
sudo npm install -g pm2

Verify your installations:

node --version   # Should print v20.x.x
npm --version    # Should print 10.x.x
git --version    # Should print 2.x.x

Step 4: Clone and Install OpenClaw

Clone the official repository and install the required dependencies:

cd ~
git clone https://github.com/openclaw/openclaw.git
cd openclaw
npm install

Step 5: Configure Environment Variables

Copy the example configuration file and enter your API keys:

cp .env.example .env
nano .env

At a minimum, configure your primary AI provider API key. For example, if you are using Anthropic:

ANTHROPIC_API_KEY=sk-ant-your-key-here

Save and exit the nano editor (Ctrl+X, then press Y, and confirm with Enter).

Step 6: Start OpenClaw with PM2

Launch the application backend and set up auto-start configurations:

pm2 start npm --name "openclaw" -- start
pm2 save
pm2 startup

The pm2 startup command will output a specific command that you must copy and execute with sudo. This guarantees that OpenClaw will automatically restart if your VPS undergoes a reboot.

Verify that the process is running successfully:

pm2 status

Security Hardening

An exposed, unhardened server running an AI agent with API access is a high-value target. Follow these steps to secure your deployment.

Enable the Firewall

Configure Ubuntu’s Uncomplicated Firewall (UFW) to block all unauthorized ports, leaving only SSH, HTTP, and HTTPS open:

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Confirm the active firewall status:

sudo ufw status

Disable Root SSH Login

To prevent brute-force attacks on the default administrative account, disable root SSH access.

[!IMPORTANT] Ensure you have configured SSH key authentication for your openclaw user and verified it works before disabling password login.

Open the SSH daemon configuration file:

sudo nano /etc/ssh/sshd_config

Locate and update the following settings:

PermitRootLogin no
PasswordAuthentication no

Apply the changes by restarting the SSH service:

sudo systemctl restart sshd

Set Up a Reverse Proxy with Nginx

Avoid exposing the raw application port (usually 3000) directly to the web. Instead, place Nginx in front of it to handle web requests:

sudo apt install -y nginx

Create a new site configuration file:

sudo nano /etc/nginx/sites-available/openclaw

Paste the configuration below, replacing your-domain.com with your actual domain name:

server {
    listen 80;
    server_name your-domain.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

Enable the configuration and reload Nginx:

sudo ln -s /etc/nginx/sites-available/openclaw /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx

Enable HTTPS with Let's Encrypt

Protect your traffic and credentials with free SSL/TLS certificates via Certbot:

sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.com

Follow the interactive prompts. Certbot automatically adjusts your Nginx configuration to route traffic over HTTPS and establishes a cron job for automated renewal.

Configure Automatic Security Updates

Ensure your system stays patched against OS-level vulnerabilities automatically:

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Select Yes when prompted to enable automatic updates.

Post-Setup Checklist

Ensure your setup is complete and secure by verifying the following:

OpenClaw is accessible and loading correctly over https://your-domain.com.
Running pm2 status shows the application is online.
Running sudo ufw status shows only SSH (22), HTTP (80), and HTTPS (443) ports are active.
Root SSH login and standard password authentications are disabled.
The SSL certificate is active (validate using sudo certbot certificates).
Unattended operating system upgrades are active.

Updating OpenClaw

When updates are released, pull the latest changes, update project dependencies, and restart the process:

cd ~/openclaw
git pull origin main
npm install
pm2 restart openclaw

Check the repository release notes before performing updates to prepare for any configuration changes or migrations.

Backups

Backing up configuration and environmental details is vital to recover from server failures. Back up your environment setup locally:

# Create a timestamped local backup of the config file
cp ~/openclaw/.env ~/openclaw-env-backup-$(date +%Y%m%d)

Alternatively, push the backup to a remote server using a tool like rsync:

rsync -az ~/openclaw/.env user@backup-server:~/backups/

If your configuration utilizes a database backend, schedule automated database dumps (such as weekly cron tasks) alongside file backups.

When Self-Hosting Is Not the Right Choice

While self-hosting offers customizability, it might not suit every scenario. Avoid self-hosting if:

You prefer not to handle command-line maintenance, package upgrades, or OS patching.
High availability is critical, and you do not have server health monitoring or alerting set up.
You are deploying OpenClaw for a corporate team that requires single sign-on (SSO), SAML, or centralized access logs out of the box.

In these circumstances, a managed hosting provider or an enterprise AI agent platform may be a more appropriate fit.