Noah writes practical guides for Next.js deploys, AI self-hosting (Ollama, n8n), and PaaS panels like Coolify and Dokploy. His focus is getting apps from git clone to HTTPS with the fewest moving parts.
What OpenClaw is
OpenClaw is an open-source AI agent gateway: it keeps an always-on assistant on your infrastructure, wired to LLM providers (and optionally local models) plus chat channels.
A Frankfurt or Amsterdam OrbitHost KVM VPS gives you 24/7 uptime without leaving EU networking. Use `/vps-for-openclaw` as the product entry point, then follow this install path.
VPS prerequisites
Ubuntu 24.04, 2+ vCPU, 4 GB RAM, NVMe storage, and Docker Engine with the Compose plugin. KVM only — OpenVZ guests fight Docker.
sudo apt update && sudo apt upgrade -y
sudo apt install -y git curl ca-certificates
# Install Docker Engine (see OrbitHost Docker guide), then:
docker version
docker compose version
sudo ufw allow OpenSSH
sudo ufw enableClone and run Docker setup
Clone the official OpenClaw repository and run its Docker setup helper. Always verify you are on the upstream org/repo you trust before piping scripts.
cd /opt
sudo git clone https://github.com/openclaw/openclaw.git
sudo chown -R $USER:$USER /opt/openclaw
cd /opt/openclaw
./docker-setup.shConfigure environment secrets
Create or edit `.env` with your LLM provider API key, gateway token, and any channel secrets. Rotate tokens if they ever appear in screenshots or tickets.
Keep `.env` mode 600 and out of public git remotes.
cd /opt/openclaw
cp .env.example .env # if provided by the repo
chmod 600 .env
nano .env
# set provider keys, gateway auth, and timezone (e.g. Europe/Berlin)Start the stack and verify locally
Bring containers up and confirm the gateway listens on localhost. Prefer SSH local forwarding from your laptop over opening the raw port on the public IP.
cd /opt/openclaw
docker compose up -d
docker compose ps
docker compose logs -f
# from your laptop (example):
# ssh -L 18789:127.0.0.1:18789 user@VPS_IP
# then open http://127.0.0.1:18789Optional: pair with Ollama
For local inference, install Ollama on the same host or another private VPS and point OpenClaw at `http://127.0.0.1:11434` or the Docker service name on a shared network.
RAM math becomes real here — see the Ollama and best-VPS-for-AI guides before pulling 13B+ models beside the gateway.
# sketch: attach OpenClaw and Ollama on one compose network
services:
openclaw:
# ... image/build from upstream compose
networks: [ai]
ollama:
image: ollama/ollama:latest
volumes: [ollama:/root/.ollama]
networks: [ai]
networks:
ai:
volumes:
ollama:Hardening checklist
SSH keys only, unattended upgrades or a patch calendar, backups of OpenClaw volumes, and no public 18789. If you need HTTPS, put Caddy/Nginx with auth in front — never naked gateway on 0.0.0.0.
- Bind gateway to 127.0.0.1
- Use WireGuard for admin access
- Pin compose image tags when possible
- Monitor disk + docker logs
Ops and upgrades
Upgrade by pulling the repo, reading the changelog, then recreating containers during a quiet window. Keep a note of provider model names you depend on — upstream defaults move.
Combine with n8n when you want deterministic workflows beside the agent. OrbitHost’s Docker VPS class covers this whole AI side-project pattern without jumping to dedicated metal on day one.
Related products
FAQ
How much RAM for OpenClaw?
4 GB is a solid baseline when using cloud LLM APIs. Add RAM if you co-host Ollama with larger local models on the same VPS.
Should port 18789 be public?
No. Bind to localhost and use SSH tunnels, WireGuard, or an authenticated reverse proxy. Treat the gateway like an admin console.
Docker or npm global install?
Docker Compose is the most common production path for isolation and upgrades. npm + systemd works if you prefer bare Node on the host.
Can I use Telegram?
Yes — many operators connect messaging channels so the agent stays reachable without exposing a public web UI. Follow OpenClaw’s channel docs for tokens.