Ubuntu VPS setup

OpenClaw VPS Launcher

Set up a private sandbox in 15 minutes

When you are done, OpenClaw runs under a dedicated Linux user, the gateway stays on loopback, and the dashboard opens privately through Tailscale Serve.

Pinned install command

Review script first

curl -fsSL https://raw.githubusercontent.com/LineZero-Studio/openclaw-diy/v0.1.2/install.sh | bash

This command is pinned to v0.1.2. For a first install, use this release instead of instructions from main.

1 Fresh VPS Ubuntu 24.04

2 Installer OpenClaw user + daemon

3 Private dashboard Tailscale Serve

Before you start

Requirements

Fresh VPS

Use Ubuntu 24.04 on a new VPS with no unrelated data. The installer intentionally stops on other operating systems.

Tailscale Account

You will complete browser login during live validation. The guide does not ask for a Tailscale auth key.

Model Choice

MiniMax is the recommended API-key path. Gemini API is the free-tier fallback. Skip-model mode is for testing only.

VPS checklist

Recommended VPS Path

Create a new Linode using Ubuntu 24.04 LTS.
Choose a 2 GB Shared CPU size unless you know you need more.
Pick a region close to you or your expected users.
Add SSH access, boot the VPS, and connect as the admin user.
Run the tagged installer command from this page.

Cost checkpoints

Check Costs Before You Create Anything

VPS runtime

Cloud providers usually start charging while the VPS exists, even when OpenClaw is idle. Check the current plan page before you create it.

Backups and snapshots

Provider backups, snapshots, reserved IPs, and extra storage can add charges. Leave paid extras off unless you intentionally choose them.

Model API use

MiniMax or Gemini usage depends on the provider account, limits, and terms. Do not assume a free tier will stay unchanged.

Model setup

Choose A Model Path

Normal install

The installer prompts for a provider. Press Enter for MiniMax, or choose Gemini API as the fallback. Keys are stored in /home/openclaw/.openclaw/.env with mode 0600.

Gemini API free tiers have rate limits, terms may change, and you should review Google AI Studio data and privacy terms before relying on it.

No-model smoke mode

curl -fsSL https://raw.githubusercontent.com/LineZero-Studio/openclaw-diy/v0.1.2/install.sh | bash -s -- --skip-model

This mode runs onboarding with --auth-choice skip and prints Model check: skipped - no API key provided.

Private dashboard

Open The Dashboard Privately

How private access works

OpenClaw stays private. The gateway listens on loopback, meaning port 18789 is reachable only from the VPS itself. Tailscale Serve gives devices in your tailnet a private HTTPS URL after browser login.

After install, from your computer, SSH into the VPS once. Then run OpenClaw operational commands from that VPS shell as the dedicated openclaw user while loading the installer-managed .env. Running openclaw directly as root can use the wrong config and fail with gateway token missing.

ssh root@<your-vps-ip>

Only if prompted: if the dashboard asks for auth, print the gateway token from that VPS shell, paste it into the Gateway Token field, and do not share it.

sudo -u openclaw -H bash -lc "sed -n 's/^OPENCLAW_GATEWAY_TOKEN=//p' /home/openclaw/.openclaw/.env"

Only if prompted: if it then shows Device pairing required, approve only the request ID shown by your browser, then connect again.

sudo -u openclaw -H bash -lc 'set -a; source /home/openclaw/.openclaw/.env; set +a; openclaw devices approve <request-id>'

Keep this private

Do not open public OpenClaw ports. Do not use Tailscale Funnel for v1. The intended path is a Tailscale Serve URL inside your tailnet.

Private access means the dashboard is not exposed through public OpenClaw ports. It does not replace normal VPS security basics: keep the server updated, protect SSH access, and never share tokens or API keys.

Success looks like

You open an HTTPS Tailscale Serve URL from a device logged into your tailnet, without opening public VPS ports.

Access checklist

Installer installs Tailscale and configures local gateway defaults.
User completes tailscale up browser login during live validation.
Tailscale Serve publishes the private dashboard URL.
Gateway token copy command is shown only as a command, not printed into installer logs.
Browser device pairing is approved with the request ID shown by the dashboard.
Gateway status and dashboard access are checked before release.

The gateway token and device approval commands are only for dashboard prompts, not first steps.

Optional add-on

Add Telegram Later

Run Telegram setup only after the installer completes, the private dashboard opens through Tailscale Serve, and gateway health checks are clean. Telegram is not part of first-run success.

Create a bot token in Telegram with @BotFather and /newbot. The add-on stores the token in /home/openclaw/.openclaw/.env and configures the default Telegram account with DM pairing enabled and groups disabled for v1.

OpenClaw's Telegram docs describe BotFather setup, default DM pairing, and the TELEGRAM_BOT_TOKEN env fallback: docs.openclaw.ai/channels/telegram.

Run the add-on

curl -fsSL https://raw.githubusercontent.com/LineZero-Studio/openclaw-diy/v0.1.2/scripts/add-telegram.sh | bash

Do not paste the token into support requests, screenshots, or shared logs.

Telegram Checks

Status probe

After setup, run sudo -u openclaw -H bash -lc 'set -a; source /home/openclaw/.openclaw/.env; set +a; openclaw channels status --channel telegram --probe --json'.

First DM

If the bot does not reply, start a direct message to the bot and approve the first pairing request from OpenClaw before relying on it.

Common failures

Rerun after a successful core install, confirm the BotFather token is current, keep groups out of v1, and share only sanitized status output.

Recovery

Troubleshooting And Rebuild Rules

Logs

Installer logs are written under /var/log/openclaw-vps-guide/. Failure output prints the active log path.

Resume behavior

Marker-owned partial installs can be rerun. Unknown existing /home/openclaw/.openclaw state stops the installer instead of overwriting it.

Secret safety

Do not share .env, API keys, bot tokens, gateway tokens, or screenshots that show secrets. Share sanitized command output only.

Support boundary

Keep Diagnostics Local

This guide does not upload diagnostics and does not provide managed hosting. Use local logs and sanitized OpenClaw command output when asking for best-effort setup help.

Never send /home/openclaw/.openclaw/.env, API keys, bot tokens, gateway tokens, or screenshots with visible secrets.

Help link: https://linezerostudio.com