Neura Market Logo

Automated OpenClaw Installation with Ansible, Tailscale VPN, and Firewall Isolation

Learn how to deploy OpenClaw to production servers using openclaw-ansible, a security-first automated installer. This guide covers prerequisites, firewall isolation, Tailscale VPN, and Docker setup.

Read this when

  • You want automated server deployment with security hardening
  • You need firewall-isolated setup with VPN access
  • You're deploying to remote Debian/Ubuntu servers

Deploy OpenClaw to production servers with openclaw-ansible, an automated installer built around a security-first design.

Info

The openclaw-ansible repository is the authoritative source for Ansible deployment. This page provides a quick overview.

Prerequisites

RequirementDetails
OSDebian 11+ or Ubuntu 20.04+
AccessRoot or sudo privileges
NetworkInternet connection for package installation
Ansible2.14+ (installed automatically by the quick-start script)

What you get

  • Firewall-first security: UFW plus Docker isolation (only SSH and Tailscale are reachable)
  • Tailscale VPN for remote access without public service exposure
  • Docker for isolated sandbox containers with localhost-only bindings
  • Systemd integration with hardening and automatic startup on boot
  • Single command setup

Quick start

curl -fsSL https://raw.githubusercontent.com/openclaw/openclaw-ansible/main/install.sh | bash

What gets installed

  1. Tailscale (mesh VPN for secure remote access)
  2. UFW firewall (only SSH and Tailscale ports open)
  3. Docker CE plus Compose V2 (default agent sandbox backend)
  4. Node.js and pnpm (OpenClaw requires Node 22.22.3+, 24.15+, or 25.9+; Node 24 is recommended)
  5. OpenClaw, installed on the host, not containerized
  6. A systemd service with security hardening

Note

The gateway runs directly on the host, not inside Docker. Agent sandboxing is optional; this playbook installs Docker because it is the default sandbox backend. See Sandboxing for alternative backends.

Post-install setup

Switch to the openclaw user

sudo -i -u openclaw

Run the onboarding wizard

The post-install script walks you through configuring OpenClaw.

Connect messaging channels

Log in to WhatsApp, Telegram, Discord, or Signal:

openclaw channels login --channel <name>

Verify the installation

sudo systemctl status openclaw
sudo journalctl -u openclaw -f

Connect to Tailscale

Connect to your VPN mesh for secure remote access.

Quick commands

# Check service status
sudo systemctl status openclaw

# View live logs
sudo journalctl -u openclaw -f

# Restart gateway
sudo systemctl restart openclaw

# Channel login (run as openclaw user)
sudo -i -u openclaw
openclaw channels login --channel <name>

Security architecture

Four-layer defense model:

  1. Firewall (UFW): only SSH (22) and Tailscale (41641/udp) are exposed publicly
  2. VPN (Tailscale): the gateway is reachable only through the VPN mesh
  3. Docker isolation: the DOCKER-USER iptables chain prevents external port exposure
  4. Systemd hardening: NoNewPrivileges, PrivateTmp, unprivileged user

Check your external attack surface:

nmap -p- YOUR_SERVER_IP

Only port 22 (SSH) should be open. The gateway and Docker remain locked down.

Docker is installed for agent sandboxes (isolated tool execution), not for running the gateway. See Multi-Agent Sandbox and Tools for sandbox configuration.

Manual installation

Install prerequisites

sudo apt update && sudo apt install -y ansible git

Clone the repository

git clone https://github.com/openclaw/openclaw-ansible.git
cd openclaw-ansible

Install Ansible collections

ansible-galaxy collection install -r requirements.yml

Run the playbook

./run-playbook.sh

Or run the playbook directly and then run the setup script manually:

ansible-playbook playbook.yml --ask-become-pass
# Then run: /tmp/openclaw-setup.sh

Updating

The Ansible installer sets up OpenClaw for manual updates; see Updating for the standard procedure.

To re-run the playbook (for example, after configuration changes):

cd openclaw-ansible
./run-playbook.sh

This is idempotent and safe to run multiple times.

Troubleshooting

Firewall blocks my connection

  • Connect through Tailscale VPN first; the gateway is only reachable that way by design.
  • SSH (port 22) is always permitted.

Service will not start

# Check logs
sudo journalctl -u openclaw -n 100

# Verify permissions
sudo ls -la /opt/openclaw

# Test manual start
sudo -i -u openclaw
cd ~/openclaw
openclaw gateway run

Docker sandbox issues

# Verify Docker is running
sudo systemctl status docker

# Check sandbox image
sudo docker images | grep openclaw-sandbox

# Build the sandbox image if missing (requires a source checkout)
cd /opt/openclaw/openclaw
sudo -u openclaw ./scripts/sandbox-setup.sh
# For npm installs without a source checkout, see
# https://docs.openclaw.ai/gateway/sandboxing#images-and-setup

Channel login fails

Ensure you are running as the openclaw user:

sudo -i -u openclaw
openclaw channels login --channel <name>

Advanced configuration

For detailed security architecture and troubleshooting, refer to the openclaw-ansible repository: