Run OpenClaw on a VPS the right way.

A laptop is a fine place to start with OpenClaw. The moment you want it always-on — to receive Telegram messages, run cron jobs, react to events while you sleep — it has to live somewhere with reliable power and network. That's a VPS.

The break-even point is about a week of consistent use. By then, the friction of "ugh, my laptop closed and the agent missed three messages" outweighs the 30-minute VPS setup.

Don't over-provision. Most personal setups are happy on 4 GB of RAM forever; the moment you add browser automation that jumps to 8 GB. Match the size to your real workload.

We'll use Hetzner Ubuntu 24.04 as the example. The flow is identical on other providers; only the dashboard UI changes.

• Create the server with Ubuntu 24.04 LTS
• Add your SSH public key during provisioning (don't accept the password option)
• Note the server's IP address
• Set a meaningful hostname like 'openclaw-prod'
• Add a firewall rule allowing only SSH (port 22) from your IP if possible

# From your laptop
ssh root@<server-ip>

Before anything else, lock down the server. Five steps, ten minutes, dramatically reduces your attack surface.

# 1. Update everything
apt update && apt upgrade -y

# 2. Create a non-root user
adduser openclaw
usermod -aG sudo openclaw
mkdir -p /home/openclaw/.ssh
cp ~/.ssh/authorized_keys /home/openclaw/.ssh/
chown -R openclaw:openclaw /home/openclaw/.ssh
chmod 700 /home/openclaw/.ssh
chmod 600 /home/openclaw/.ssh/authorized_keys

# 3. Disable root SSH and password auth
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart ssh

# 4. Enable a firewall (UFW)
apt install -y ufw
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw enable

# 5. Test the new user works BEFORE closing your root session
# In a new terminal:
ssh openclaw@<server-ip>

As your new openclaw user:

# Install Node 22+
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs

# Install OpenClaw
curl -fsSL https://openclaw.ai/install-cli.sh | bash

# Onboard
openclaw onboard

In the onboarding wizard, choose:

• QuickStart install option
• Anthropic, OpenAI, or OpenRouter as your provider
• Bind to 127.0.0.1 (the default — don't change this)
• Skip channel setup for now; we'll do that after the gateway is stable

The gateway needs to survive reboots and crashes. systemd is the answer.

openclaw service install
sudo systemctl start openclaw-gateway
sudo systemctl enable openclaw-gateway
sudo systemctl status openclaw-gateway

The installed service file restarts on failure with exponential backoff and writes logs to journald, where journalctl -u openclaw-gateway -f streams them.

You don't need a Datadog account. The minimum viable monitoring for a single-VPS OpenClaw setup is:

• journalctl for live logs: journalctl -u openclaw-gateway -f
• A weekly email digest of "is the gateway up, what was the LLM bill" — the agent itself can run this as a cron job.
• Healthcheck.io ping: have the gateway ping a free Healthcheck endpoint every 5 min so you get paged if it goes silent.
• API spend alerts at the LLM provider — Anthropic and OpenAI both let you set them at 50%, 80%, 100% of your monthly cap.

Anything beyond that is overkill for a single-VPS setup. Once you have multiple agents on multiple boxes, that's when actual monitoring tooling earns its keep.