How to Run OpenClaw on a VPS (Complete Guide)

Step 1 — Update the system

apt update && apt upgrade -y

Step 2 — Install Node.js 22 via NodeSource

curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
apt install -y nodejs

Step 3 — Verify Node version

node --version
# Should print v22.x.x or higher

Step 4 — Install OpenClaw globally

npm install -g openclaw

Step 5 — Verify installation

openclaw --version
# openclaw/x.x.x linux-arm64 node-v22.x.x

Minimal config — Claude Sonnet via Anthropic

{
  "model": "anthropic/claude-sonnet-4-6",
  "providers": {
    "anthropic": {
      "apiKey": "sk-ant-YOUR_KEY_HERE"
    }
  },
  "gateway": {
    "bind": "127.0.0.1:3000"
  }
}

Budget config — Gemini Flash (cheapest option)

{
  "model": "google/gemini-flash-2.5",
  "providers": {
    "google": {
      "apiKey": "YOUR_GOOGLE_AI_KEY"
    }
  },
  "gateway": {
    "bind": "127.0.0.1:3000"
  }
}

Add Telegram to your config

{
  "model": "anthropic/claude-sonnet-4-6",
  "providers": {
    "anthropic": {
      "apiKey": "sk-ant-YOUR_KEY_HERE"
    }
  },
  "gateway": {
    "bind": "127.0.0.1:3000"
  },
  "plugins": {
    "entries": {
      "telegram": {
        "enabled": true,
        "config": {
          "token": "YOUR_BOT_TOKEN",
          "allowedUsers": [YOUR_TELEGRAM_USER_ID]
        }
      }
    }
  }
}

Start the gateway and test

openclaw gateway start

# Check it's running
openclaw gateway status

Option A — systemd service (recommended)

# Create the service file
cat > /etc/systemd/system/openclaw.service << 'EOF'
[Unit]
Description=OpenClaw Gateway
After=network.target

[Service]
Type=simple
User=root
WorkingDirectory=/root
ExecStart=/usr/bin/openclaw gateway start
Restart=always
RestartSec=10
Environment=NODE_ENV=production

[Install]
WantedBy=multi-user.target
EOF

# Enable and start
systemctl daemon-reload
systemctl enable openclaw
systemctl start openclaw

# Check status
systemctl status openclaw

Option B — PM2 (simpler, more flexible)

npm install -g pm2

pm2 start "openclaw gateway start" --name openclaw
pm2 startup   # generates the command to auto-start on boot
pm2 save      # saves process list

# Check logs anytime
pm2 logs openclaw

1. Set up UFW firewall

# Allow SSH and close everything else
ufw allow OpenSSH
ufw enable

# Verify — should show SSH allowed, port 3000 NOT exposed
ufw status

2. Disable password SSH login (if using SSH keys)

# Edit SSH config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd

3. Enable automatic security updates

apt install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades
# Select "Yes" when prompted