Self-Hosted Server Installation

sudo apt update && sudo apt upgrade -y
sudo apt install python3.11 python3.11-venv python3-pip nginx certbot python3-certbot-nginx ufw -y

sudo useradd -r -s /bin/bash -d /opt/openclaw -m openclaw
sudo passwd openclaw
sudo su - openclaw

# As user 'openclaw'
python3 -m venv /opt/openclaw/venv
source /opt/openclaw/venv/bin/activate
pip install openclaw

# Create config directory and .env file
mkdir -p /opt/openclaw/.openclaw
cat > /opt/openclaw/.openclaw/.env <<'EOF'
OPENAI_API_KEY=sk-proj-YOUR_KEY_HERE
OPENCLAW_PROVIDER=openai
OPENCLAW_LOG_LEVEL=info
OPENCLAW_LOG_FILE=/opt/openclaw/logs/openclaw.log
EOF
mkdir -p /opt/openclaw/logs

openclaw --version

sudo tee /etc/systemd/system/openclaw.service <<'EOF'
[Unit]
Description=OpenClaw AI Agent Service
Documentation=https://openclaw-wiki.top
After=network.target
Wants=network.target

[Service]
Type=simple
User=openclaw
Group=openclaw
WorkingDirectory=/opt/openclaw
ExecStart=/opt/openclaw/venv/bin/openclaw start --port 8080 --host 127.0.0.1
ExecStop=/opt/openclaw/venv/bin/openclaw stop
Restart=on-failure
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=openclaw
EnvironmentFile=/opt/openclaw/.openclaw/.env
CapabilityBoundingSet=
PrivateTmp=true
ProtectSystem=strict
ReadWritePaths=/opt/openclaw/logs

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable openclaw
sudo systemctl start openclaw
sudo systemctl status openclaw

server {
  listen 80;
  server_name api.your-domain.com;

  location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_cache_bypass $http_upgrade;
    proxy_read_timeout 300s;
    proxy_connect_timeout 15s;
  }
}

sudo cp openclaw.conf /etc/nginx/sites-available/openclaw
sudo ln -s /etc/nginx/sites-available/openclaw /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

sudo certbot --nginx -d api.your-domain.com
# Follow prompts, certificates auto-renew via cron

sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw deny 8080/tcp    # Block direct access to OpenClaw port
sudo ufw enable
sudo ufw status

# Check service
sudo systemctl status openclaw
journalctl -u openclaw -f

# Test API
curl https://api.your-domain.com/health

# Check version as the service user
sudo -u openclaw openclaw --version

# Check service status (if using systemd)
sudo systemctl status openclaw

# Test a command
sudo -u openclaw openclaw run "Say 'server installation successful'"

# If API mode is enabled, test the endpoint
curl -s http://localhost:8080/health
# {"status": "ok", "version": "1.x.x"}

# Test a task via REST API
curl -X POST http://localhost:8080/api/run \
  -H "Authorization: Bearer $OPENCLAW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"task": "Hello from the server"}'

# Stop service first
sudo systemctl stop openclaw

# Upgrade
sudo -u openclaw pip install --upgrade openclaw

# Restart service
sudo systemctl start openclaw
sudo systemctl status openclaw

# systemd logs
sudo journalctl -u openclaw -f --since "1 hour ago"

# Application logs
tail -f /var/log/openclaw/openclaw.log

# /etc/logrotate.d/openclaw
/var/log/openclaw/*.log {
    daily
    rotate 14
    compress
    missingok
    notifempty
    postrotate
        systemctl kill --kill-who=main --signal=USR1 openclaw.service
    endscript
}

#!/usr/bin/env bash
# healthcheck.sh — run every 5 min via cron
HEALTH=$(curl -sf http://localhost:8080/health 2>/dev/null)
if [ $? -ne 0 ] || [ "$HEALTH" != '{"status":"ok"}' ]; then
    # Restart service
    systemctl restart openclaw
    # Alert (requires mail or curl to your alerting endpoint)
    echo "OpenClaw restarted at $(date)" | mail -s "OpenClaw Alert" ops@company.com
fi

# Add to crontab (every 5 minutes)
echo "*/5 * * * * /home/openclaw/healthcheck.sh >> /var/log/openclaw-healthcheck.log 2>&1" \
  | sudo tee -a /etc/cron.d/openclaw

# /etc/logrotate.d/openclaw
/var/log/openclaw/*.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    sharedscripts
    postrotate
        systemctl kill -s HUP openclaw
    endscript
}