> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arct.cloud/llms.txt
> Use this file to discover all available pages before exploring further.
# Self-host OpenClaw
> Run an always-on OpenClaw personal AI assistant on an Ubuntu VPS with private dashboard access, messaging, backups, and safe updates.
Arct Cloud provides the unmanaged Linux VPS. OpenClaw is not preinstalled or managed by Arct Cloud. Model-provider accounts, API usage, and any channel charges are separate from the VPS price and are billed by their respective providers.
OpenClaw is a privileged agent, not an ordinary chatbot. Depending on the tools you enable, it can read files, use credentials, browse the web, and run commands. Use a dedicated VPS, grant the minimum tools needed, and allow only trusted people to message it.
## Choose a Plan
OpenClaw's [official VPS guidance](https://docs.openclaw.ai/help/faq-first-run) lists an absolute minimum of 1 vCPU, 1 GB RAM, and about 500 MB of free disk. It recommends 1–2 vCPU and 2 GB or more of RAM for logs, media, and multiple channels.
| Plan | vCPU | RAM | NVMe storage | Guidance |
| ------------- | ---: | ---: | -----------: | ------------------------------------------------------------------- |
| **cvm.pico** | 1 | 1 GB | 15 GB | Meets the official minimum for a basic Gateway and light use |
| **cvm.nano** | 1 | 2 GB | 25 GB | Recommended starting point with memory headroom |
| **cvm.micro** | 2 | 4 GB | 40 GB | Better headroom for browser automation, media, or multiple channels |
Choose an Ubuntu LTS image. Browser data, sessions, media, logs, skills, and backups require more than the base installation size, so monitor memory and disk usage as the workload grows. Review current availability and pricing on the [Arct Cloud pricing page](https://www.arct.cloud/pricing).
## Before You Begin
Prepare the following:
* An SSH key and the public IP address from which you administer the VPS
* Credentials for the model provider selected during onboarding
* A model-usage budget and provider-side spending alerts
* Protected off-server storage for OpenClaw backups
* Optionally, a Telegram bot token from BotFather
## Install OpenClaw
[Deploy an Ubuntu LTS server](/compute/virtual-machines/deploy), then [connect over SSH](/compute/virtual-machines/connect-ssh).
A baseline OpenClaw deployment needs only SSH inbound. Configure the firewall protecting the VPS before installation:
| Protocol and port | Source |
| ----------------- | --------------------------------- |
| `TCP 22` | Your current public admin IP only |
Attach and verify a network-level firewall or ACL before installation. Keep the current session open and test SSH from a second terminal before disconnecting. Do not add inbound rules for `18789`, `80`, or `443`; the Gateway, model providers, and messaging channels use outbound connections for this setup.
Install OpenClaw with its official Linux installer:
```bash theme={null}
curl -fsSL --proto '=https' --tlsv1.2 \
https://openclaw.ai/install.sh | bash -s -- --no-onboard
```
The installer also provisions a supported Node.js runtime when required. After installation, run the canonical onboarding flow and install the managed service:
```bash theme={null}
openclaw onboard --flow quickstart --install-daemon
```
Select your model provider and enter its credentials. Onboarding generates Gateway token authentication by default. Model usage is not included with the VPS.
On Linux, this installs a user-level systemd service. Onboarding attempts to enable lingering so it survives logout; verify it after setup:
```bash theme={null}
loginctl show-user "$USER" -p Linger
```
If the result is `Linger=no`, run `sudo loginctl enable-linger "$USER"`, then restart and recheck the Gateway.
Retain the default loopback bind, token authentication, and port `18789`. These settings make the Gateway reachable only from the VPS itself:
```bash theme={null}
openclaw config set gateway.bind loopback
openclaw config set gateway.auth.mode token
openclaw config set gateway.port 18789
openclaw gateway restart
```
Never expose port `18789` directly to the public internet. Do not change the bind to `lan`, `auto`, or a public custom address for this deployment.
On your local computer, create a tunnel to the loopback-only Gateway:
```bash theme={null}
ssh -N -L 18789:127.0.0.1:18789 ubuntu@YOUR_SERVER_IP
```
Keep that terminal open, then visit `http://127.0.0.1:18789/` in your local browser and authenticate with the token created during onboarding. Close the tunnel with `Ctrl+C` when finished.
Add the bot from a trusted SSH session:
```bash theme={null}
openclaw channels add --channel telegram --token
openclaw channels status --probe
```
Keep the default DM pairing policy and group allowlist. Do not switch DMs to public access or add a wildcard sender. When your account receives a pairing code, approve only the expected identity:
```bash theme={null}
openclaw pairing list telegram
openclaw pairing approve telegram
```
Treat the bot token as a secret and rotate it if it is exposed.
Confirm that the service answers authenticated RPC calls, then run health and security checks:
```bash theme={null}
openclaw gateway status --require-rpc
openclaw health
openclaw security audit --deep
```
Resolve security-audit findings before granting additional tools, installing third-party skills, or connecting more users.
## Security Model
OpenClaw's supported posture is one user or trust boundary per Gateway. Anyone allowed to message a tool-enabled agent may be able to steer the same permissions, files, browser sessions, and credentials. Separate unrelated users or teams onto separate gateways and VPS instances.
Pairing and allowlists control who can trigger the agent, but they do not eliminate prompt injection. Web pages, messages, documents, attachments, and tool output can all contain hostile instructions. Keep sensitive files outside the agent workspace, disable browser, network, filesystem, and command tools unless required, use sandboxing and approval rules, and review third-party skills and plugins as executable code. See the official [OpenClaw security guidance](https://docs.openclaw.ai/gateway/security).
## Back Up State
OpenClaw state can include provider credentials, channel tokens, sessions, and workspaces. Create a verified archive, protect it like the live VPS, and copy it to encrypted off-server storage:
```bash theme={null}
install -d -m 700 ~/Backups/openclaw
openclaw backup create --output ~/Backups/openclaw --verify
```
Periodically test `openclaw backup verify ARCHIVE` and rehearse recovery on an isolated host. A backup left only on the VPS does not protect against server loss.
## Update Safely
Create a verified backup before a significant update, then update and recheck the service:
```bash theme={null}
openclaw backup create --output ~/Backups/openclaw --verify
openclaw update --dry-run
openclaw update
openclaw doctor
openclaw health
openclaw gateway status --require-rpc
```
The updater's automatic configuration copy is not a full recovery point. For rollback, follow the official [update and rollback procedure](https://docs.openclaw.ai/install/updating): try a code-only rollback first, and restore older state only when the prior version cannot read the migrated state. Preserve the current state before restoring because rollback can discard changes made after the backup.
## Troubleshooting
| Problem | What to check | |
| ------------------------------- | ----------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
| Control UI does not load | Confirm the SSH tunnel is still running, then run `openclaw gateway status --require-rpc` on the VPS | |
| Control UI reports unauthorized | Use the token created by onboarding; do not solve auth errors by exposing the Gateway or disabling authentication | |
| Gateway fails after a change | Run `openclaw doctor`, then inspect `openclaw logs --follow` | |
| Telegram does not respond | Run `openclaw channels status --probe` and check `openclaw pairing list telegram` | |
| Server runs out of memory | Check `free -h`, reduce browser/media work, or resize from `cvm.pico` to `cvm.nano` or `cvm.micro` | |
| Port `18789` is busy | Find the existing process with \`sudo ss -ltnp | grep 18789\` before changing any port or bind setting |
## Official Resources
Current installation, Gateway, channel, security, backup, and update guidance.
Source code, releases, security policy, and issue tracker.
OpenClaw is developed by the OpenClaw project. Arct Cloud is an independent hosting provider and is not affiliated with, sponsored by, or endorsed by OpenClaw.