OpenClaw is a self-hosted Gateway that connects chat applications to AI coding agents. Running that Gateway on a virtual private server (VPS) keeps it online when your laptop is closed, while the server retains the sessions, routing configuration, channel connections, and working files. The practical setup is: provision a Linux VPS, secure SSH access, install a supported Node.js release and OpenClaw, complete onboarding, install the managed Gateway service, and access the dashboard through an SSH tunnel or a private mesh network rather than exposing it directly to the internet.
Antihost offers VPS plans with one-click OpenClaw, NVMe storage and a 14-day free trial.
What OpenClaw is
OpenClaw is an open-source, MIT-licensed Gateway for connecting chat channels with AI coding agents. A single Gateway process coordinates channel connections, sessions, routing, the command-line interface, the web Control UI, and optional local nodes. That design gives you one place to manage conversations and agent work instead of running a separate integration for every messaging application.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
The project is aimed at developers, power users, and teams that want an assistant available at all times while keeping infrastructure and data under their own control. Telegram, Discord, Slack, and WhatsApp are among the channel integrations available through the documented setup flow.
“The Gateway is the single source of truth for sessions, routing, and channel connections.”
#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
On a VPS, the Gateway is the long-running service. Your workstation or phone becomes a client that reaches the Control UI through a protected connection, while the server keeps the durable state and workspace. This distinction matters: if the VPS is lost and you have no backup, reinstalling the software alone will not restore your sessions or work files.
Why run OpenClaw on a VPS?
Continuous availability
A VPS normally runs continuously in a datacenter, so the Gateway can receive messages and perform scheduled or long-running work while your personal computer is offline. You can reconnect from another device without moving the service or its configuration.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteOne authoritative workspace
The VPS should be treated as the source of truth for Gateway state and workspace data. Keep project files, channel configuration, session data, and operational backups there rather than relying on a laptop copy that may be stale.
Remote administration
SSH provides administrative access, and the web Control UI provides a convenient way to monitor and use the Gateway. Remote access is a security decision, not merely a convenience feature: decide whether administration will be SSH-only, tailnet-only, or reachable through another authenticated network path before you expose any service.
Trade-offs
- You are responsible for SSH security, operating-system updates, account separation, backups, and recovery.
- A VPS introduces recurring infrastructure charges and possible network latency between the server, you, and connected channels.
- Small instances can experience memory pressure during concurrent agent work, dependency installation, or channel processing.
- Provider storage and snapshot behavior determine how quickly you can recover after a failed upgrade or deleted server.
What you need before installation
- A Linux VPS or cloud VM with SSH access. Choose a persistent disk and a region that gives acceptable latency to you and the channels you use.
- Node.js 24.16 or newer, or Node.js 26.1 or newer. The installation documentation recommends Node 26 when available.
- An API key from your chosen AI provider. You will supply or authorize this during onboarding.
- An access plan. Decide whether the Gateway remains on loopback and is reached through an SSH tunnel or Tailscale Serve, or whether it will bind to a private LAN or tailnet address with authentication.
- A backup plan. Back up both Gateway state and the workspace, and confirm how you would restore them to a replacement VM.
There is no universal official minimum for CPU cores, RAM, disk capacity, or monthly VPS cost. Actual requirements depend on the number of channels, simultaneous sessions, agent workloads, dependency builds, and the size of the workspace. Treat any sizing number published by a hosting company or community post as a workload-specific suggestion, not an OpenClaw requirement.
Choosing a VPS or cloud platform
The official provider picker lists several deployment paths. No single provider is automatically best; compare the operational details that affect an always-on Gateway.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Option | What to examine before choosing |
|---|---|
| Azure | SSH and firewall controls, region availability, persistent-disk and snapshot recovery, and the cost structure of small virtual machines. |
| DigitalOcean | Simple VM provisioning, SSH key management, regional latency, backups or snapshots, and how storage persists when a VM is rebuilt. |
| Fly.io | Private networking, persistent-volume behavior, region placement, and the amount of hands-on administration required for a long-running process. |
| Google Cloud (GCP) | Firewall rules, IAM and SSH options, disk snapshots, region choice, and billing for always-on compute and storage. |
| Hetzner | Available regions, ARM versus x86 choices, snapshot and backup features, and performance consistency on the smallest plans. |
| Northflank | Managed deployment controls, persistent storage, shell access, private networking, and the recovery procedure if a workload is recreated. |
| Oracle Cloud | Availability of the chosen VM shape, persistent storage, firewall configuration, regional capacity, and the terms of any free allocation. |
| Railway | Persistent volume support, service restart behavior, outbound network access, and how you would obtain an administrative shell for diagnostics. |
| Render | Whether the selected service type is continuously running, how disks persist, private networking options, and the backup workflow. |
| Raspberry Pi | Physical power and network reliability, ARM compatibility, local backup media, and whether you can maintain the device and its operating system. |
| Upstash Box | Persistent storage, SSH or equivalent administration, region and latency, and the provider’s recovery and billing terms. |
| AWS EC2, Lightsail, or free tier | Security groups, static addressing, EBS or attached-disk persistence, snapshots, regional pricing, and the limits or expiration conditions of free-tier offers. |
Compare current prices and billing terms directly with the provider at the time you deploy; those values change by region, machine size, storage, bandwidth, taxes, and promotional status. Also check whether the platform offers x86 or ARM. ARM can be cost-effective, but a dependency or binary that assumes x86 may require an alternative package or build step.
Secure the VPS before exposing OpenClaw
Harden SSH administration
Create a dedicated administrative account, use key-based authentication, apply the host’s security updates, and restrict inbound traffic with the provider firewall and the operating-system firewall. Do not make the Gateway’s web interface a substitute for SSH hardening.
If you want tailnet-only administration, the VPS guide recommends installing Tailscale first, connecting the server to your tailnet, and verifying a second SSH session through its Tailscale address. Only after that verification should you restrict or remove public SSH access. Keep the first SSH session open until the second path has been tested successfully.
Use separate identities for shared environments
Run team deployments in a dedicated runtime and with dedicated operating-system accounts. Do not sign that shared runtime into a personal Apple, Google, browser, or password-manager account. When team members may be adversarial toward one another, use separate Gateways, hosts, or OS users rather than assuming channel permissions provide isolation.
Recommended Free Tools
Plan backups before the first message
Back up the Gateway state and workspace to storage independent of the VM. A snapshot is useful for whole-disk recovery, while a file-level backup can restore selected projects or configuration. Test that the backup can be read and that you know the order for restoring the files, reinstalling the service, and reconnecting channels.
Install OpenClaw on the VPS
1. Provision and connect to the server
- Create a Linux VPS with persistent storage and a region suitable for your users and channels.
- Install your SSH key and complete the host and firewall hardening described above.
- Connect over SSH using the dedicated administrative account. If you are using a tailnet, verify the private SSH path before restricting public access.
2. Run the official installer
From the SSH session, run:
curl -fsSL https://openclaw.ai/install.sh | bashThe installer detects the operating system, installs Node when necessary, installs OpenClaw, and starts onboarding. If your organization’s policy does not permit piping a remote script directly to a shell, download and review the script through your approved process, then run the resulting installer according to that policy.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
3. Complete onboarding
Onboarding offers a quick path and a custom path. Quick start can reuse detected AI access, verify it with a real completion, and open the web dashboard. Custom setup walks through the complete configuration when you need to choose settings explicitly or are deploying for a team.
Provide the API key from your selected AI provider when prompted. Keep the key in the Gateway’s protected server environment and do not paste it into a public channel or commit it to a project repository.
4. Install the managed Gateway service
Install the service with either command:
openclaw gateway installopenclaw onboard --install-daemonOn Linux and WSL2, this creates a systemd user service. A managed service lets the Gateway run independently of an interactive shell and gives you a standard status and restart path.
5. Verify the installation
Run each check from the server:
openclaw --version
openclaw doctor
openclaw gateway statusThe version command confirms what was installed. The doctor command checks for common configuration or environment problems. Gateway status confirms whether the managed service is running and exposes the information you need for the next access step.
6. Open the dashboard and connect a channel
Start the dashboard locally with:
openclaw dashboardUse the documented channel setup to connect Telegram, Discord, Slack, WhatsApp, or another supported application. Send a controlled test message, confirm that the expected agent responds, and check the service status again before inviting other users.
Access the dashboard remotely without opening it to the internet
Option A: keep the Gateway on loopback and use an SSH tunnel
This is the secure default recommended for a single operator. The Gateway listens only on the VPS itself, and SSH forwards a local browser port to the Gateway port. Obtain the actual Gateway port from the dashboard or status output, then create the tunnel from your computer:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
ssh -N -L 127.0.0.1:LOCAL_PORT:127.0.0.1:GATEWAY_PORT USER@VPS_ADDRESSKeep that SSH process running while you use the Control UI, and open the local address and port shown by OpenClaw. Replace the capitalized values with your local port, the Gateway’s listening port, your SSH account, and the server address. Because the listener remains on your own computer, no public web port is required.
Option B: use Tailscale Serve
Tailscale Serve can publish the loopback service inside your tailnet without making it publicly reachable. Use this when your laptop and phone are already members of the same trusted tailnet. Keep the Gateway’s listener private, restrict tailnet membership, and remove devices or users that no longer need access.
Option C: bind to a private network address
If you bind the Gateway to lan or tailnet, configure gateway.auth.token or gateway.auth.password, unless authentication is delegated to a trusted proxy. A network bind without authentication is not an acceptable shortcut. Limit firewall rules to the private network and verify that the dashboard is not reachable from the public internet.
Operate, back up, and recover the Gateway
Back up both state and workspace
The Gateway owns two categories of data that matter: its operational state and the workspace used by agents. Schedule backups for both, retain more than one recovery point, and store at least one copy outside the VPS. A backup that contains only source files but not Gateway state may leave you without sessions and routing configuration; a state-only backup may omit the projects agents need.
Use snapshots deliberately
Take a provider snapshot before major operating-system, Node, or OpenClaw changes when your platform supports it. Snapshots are not a complete backup strategy: they can share the same account, region, or storage failure as the original VM. Combine them with an independent file-level copy.
Keep an outage runbook
- Record the VPS provider, region, server address, SSH account, and the private access method.
- Record where Gateway state and workspace backups live and how to decrypt or retrieve them.
- Document the channel credentials and the order in which channels should be reconnected.
- Keep the verification commands
openclaw doctorandopenclaw gateway statusin the runbook.
Tune OpenClaw on small VMs and ARM hosts
The official VPS guidance includes two environment variables for constrained systems:
NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cachestores Node compilation artifacts so repeated command and worker starts can avoid rebuilding the same code.OPENCLAW_NO_RESPAWN=1keeps routine Gateway restarts in-process instead of respawning, which can reduce overhead on low-power hosts.
Apply these variables in the environment used by the managed service, not only in an interactive shell; otherwise systemd may not receive them. On systemd hosts, the guide also suggests a longer TimeoutStartSec when startup is slow and SSD-backed locations for state and caches. Monitor memory and disk usage after enabling any optimization, because a cache still consumes storage and a longer startup timeout can hide a genuinely failed service.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Troubleshoot common failures
The installer reports an unsupported Node version
Check the installed version and upgrade to Node 24.16 or newer, or Node 26.1 or newer; Node 26 is the documented recommendation. Run onboarding again after the upgrade, then repeat openclaw doctor.
The Gateway is installed but not running
Run openclaw gateway status and openclaw doctor. Check the systemd user-service logs for the first configuration or permission error. Confirm that the service environment contains the API credentials and any tuning variables; variables set only in your SSH shell are not automatically inherited by a user service.
The dashboard works on the VPS but not from your laptop
Confirm that the Gateway is listening on loopback and that your SSH tunnel forwards the same port reported by OpenClaw. Keep the tunnel process open, test the local address shown by the dashboard command, and do not solve a forwarding error by binding the service publicly. For a tailnet setup, verify that both devices are connected to the same tailnet and that the private route is allowed.
A private-network bind is reachable but authentication fails
Check that gateway.auth.token or gateway.auth.password is configured in the Gateway’s actual service environment. If a trusted proxy handles authentication, verify that the proxy is the only permitted network path and that direct access to the Gateway port is blocked.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The VPS becomes slow or runs out of memory
Inspect concurrent sessions, agent workloads, dependency builds, and cache growth. Reduce simultaneous work, move caches and state to SSD-backed storage, and choose a larger VM if the workload consistently exceeds available memory. There is no official universal RAM threshold; measure your own workload rather than relying on a generic plan label.
Sessions or projects disappear after rebuilding the VM
The replacement server was likely created without restoring Gateway state and workspace. Stop new activity, retrieve the latest independent backup, restore both data sets, reinstall the managed service, and verify with openclaw doctor and openclaw gateway status before reconnecting channels.
A practical security checklist
- Use SSH keys and a dedicated server account; keep public SSH restricted or remove it after a tested tailnet path is available.
- Keep the Gateway on loopback unless a private-network bind is necessary.
- Use an SSH tunnel or Tailscale Serve for remote dashboard access.
- When binding to
lanortailnet, requiregateway.auth.tokenorgateway.auth.password, or a genuinely trusted authenticating proxy. - Run shared team deployments with dedicated OS accounts and runtimes; separate hosts or Gateways when users cannot be trusted with one another’s data.
- Never place AI-provider keys in chat messages, repositories, or shared personal accounts.
- Back up Gateway state and workspace independently of the VPS and periodically test restoration.
- Review firewall rules after every networking change and verify the dashboard is not publicly exposed.
What a good first deployment looks like
For a single operator, the least surprising design is a Linux VPS with persistent SSD storage, a supported Node release, key-based SSH, and the Gateway bound to loopback. Install through the official script, complete onboarding, install the systemd-managed service, verify it with the three OpenClaw commands, and use an SSH tunnel for the dashboard. Add Tailscale when you need convenient access from several trusted devices. Move to a private-network bind only when the operational need is clear and authentication and firewall rules are already defined.
For a team, start with a dedicated runtime and OS account, document who can administer the host, and decide whether members require separate Gateways or hosts. Treat backups and recovery as part of deployment rather than an emergency task. The result is an always-on assistant whose sessions, routing, channels, and workspace remain under your control without turning the Gateway’s web interface into a public target.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
