AI and LLMsWritten by GLWS15 min readUbuntu 24.04 LTS / AlmaLinux 9
Commands run on your server unless a section says otherwise. Replace example usernames, addresses and paths with your own values. Keep a working session open when changing remote access.

What you are setting up

OpenClaw is a self-hosted assistant that connects a language model to tools and messaging channels. A gateway process runs on your server, listens locally for its control interface and talks to the chat apps and model providers you configure. Because the assistant can act through its integrations, treat it like a user account with real permissions, not like a website.

The model usually runs at a provider, so the server needs memory for the gateway and its tools, not for the model. Our application page suggests planning for about 8 GB if you use browser or command tools, and a small test can run on less. Check the project's current requirements before you choose a plan.

On the VPS: check memory and free disk first
free -h
nproc
df -h /

Create a dedicated user

Run the assistant as its own account, not as root and not as your main administrator. If the assistant is ever tricked into running something, it can then damage only what that account owns. Give the account no sudo rights.

Ubuntu only
sudo adduser --disabled-password --gecos "" openclaw
sudo loginctl enable-linger openclaw
sudo -iu openclaw
AlmaLinux only
sudo useradd -m openclaw
sudo loginctl enable-linger openclaw
sudo -iu openclaw
On AlmaLinux use sudo useradd -m openclaw, then sudo passwd -l openclaw. Enabling linger lets the user's services keep running after you log out.

Install it

The project's installer detects your system, installs a supported Node.js release if one is missing, installs OpenClaw and starts onboarding. Download the script and read it before running it, rather than piping it straight into a shell. Run it as the openclaw user.

The current documentation asks for Node 26 (recommended) or a recent Node 24 release. The installer handles this for you.

As the openclaw user
curl -fsSL https://openclaw.ai/install.sh -o openclaw-install.sh
less openclaw-install.sh
bash openclaw-install.sh

Complete onboarding

Onboarding asks which model provider to use and stores the credentials, then helps you connect a channel. Use a provider key created just for this assistant, with a spending limit if your provider offers one, so you can revoke it without affecting anything else. If the guided screen is awkward over SSH, the classic step-by-step flow is available.

As the openclaw user
openclaw onboard

Run the gateway as a service

Install the gateway as a background service so it starts at boot and restarts after a failure. It is installed as a systemd user service, which is why linger was enabled earlier. Check the status, then confirm that it listens only on the loopback address.

As the openclaw user
openclaw gateway install
openclaw gateway status
openclaw doctor
Check the listener (the address should be 127.0.0.1)
ss -lntp | grep 18789

Keep the control interface private

The control interface is served on 127.0.0.1 port 18789 by default, which keeps it off the internet. Leave it that way. The gateway also requires authentication by default, using a token or password that you set in its configuration or environment. From your own computer, reach it through an SSH tunnel, then open the address in your browser. A tunnel does not replace the gateway's own login.

On your computer
ssh -N -L 18789:127.0.0.1:18789 deploy@YOUR_SERVER
# then open http://127.0.0.1:18789/ in your browser
On the VPS: confirm nothing is exposed
sudo ss -lntp | grep -v 127.0.0.1
Do not open port 18789 in the firewall. If you need access from many places, put it behind a VPN such as WireGuard, as the project's documentation recommends.

Limit who can talk to it and what it can do

The configuration file is ~/.openclaw/openclaw.json. For each messaging channel, list the exact accounts allowed to message the assistant, and require a mention in group chats so it does not react to everything. Start with one narrow job and add tools one at a time, checking each integration before you give it credentials. Keep model-provider keys separate from keys that change your own systems, and write down how to revoke each.

Example: restrict a channel to one phone number and require mentions in groups (edit the file)
{
  channels: {
    whatsapp: {
      allowFrom: ["+15555550123"],
      groups: { "*": { requireMention: true } },
    },
  },
}

Operate it

Use the status and log commands to watch it, and restart after configuration changes. Review the logs from time to time for unexpected activity, and check your provider's usage page for spending you did not expect. Keep OpenClaw updated, because assistants that talk to the internet receive security fixes often, and read the release notes before you update.

As the openclaw user
openclaw gateway status
openclaw logs --follow
openclaw gateway restart
Update (read the release notes first)
openclaw --version
curl -fsSL https://openclaw.ai/install.sh -o openclaw-install.sh && less openclaw-install.sh

Official documentation

These upstream references provide more detail on the commands and workflows in this guide.

KEEP LEARNING

Related GLWS guides

Browse all guides