OpenClaw is one of the fastest-growing open-source projects of 2026 — over 380,000 GitHub stars as of September 2026, MIT-licensed, and stewarded by the OpenClaw Foundation, an independent 501(c)(3) with no paid tier and no hosted service. It acts as a self-hosted gateway between the messaging apps you already use (WhatsApp, Telegram, Discord, Slack) and AI models like Claude or GPT. Instead of paying for yet another SaaS AI assistant, you run it on your own VPS, keep your data private, and pay only for the API calls you actually make.
This guide walks you through setting up OpenClaw on an Ubuntu VPS from scratch: choosing the right server, security hardening, installing the correct Node.js runtime, putting Nginx and SSL in front of the gateway, locking the gateway down with authentication, running it as a managed service, and automating configuration deployments with DeployHQ.
How this guide differs from the official docs
The official OpenClaw VPS documentation recommends a Docker-based install reached over an SSH tunnel or Tailscale, with the gateway never exposed to the public internet. That is the safest pattern and you should prefer it if it fits your workflow.
This guide covers the other common path: a bare-metal Node install with a public HTTPS domain in front of it, which is what most people actually want when they need the Control UI from any browser without a tunnel running. That path is legitimate, but it carries an obligation the tunnel path doesn't: you must turn on gateway authentication. Most third-party OpenClaw tutorials skip that step and leave an unauthenticated AI agent — with your provider API keys attached — reachable from the open internet. Step 6 fixes that.
What You'll Need
- A VPS running Ubuntu 24.04 LTS (or 26.04 LTS) — minimum 2 vCPU, 4 GB RAM, 20 GB SSD (DigitalOcean, Hetzner, or Contabo all work). 24.04 LTS is the safer default because nearly every provider offers a current image for it
- A domain name pointed at your VPS IP
- An API key from an AI provider (Anthropic, OpenAI, or Google Gemini) — or an existing Claude Code / Codex CLI login, which onboarding can reuse
- An account on your preferred messaging platform (Telegram is the easiest to start with)
- A DeployHQ account for automating updates (free tier covers this)
Choosing a VPS for OpenClaw
OpenClaw is a single long-running Node.js process, so the deciding factor is steady RAM rather than burst CPU. A few practical notes on the providers people ask about most:
- Sizing: 2 vCPU / 4 GB RAM is the comfortable floor. The gateway itself is light, but the Node runtime plus a couple of active skills (each of which may spawn its own tooling) will eat into 2 GB fast. If you plan to run local models via Ollama on the same box, budget 16 GB+ and a GPU — that's a different class of server, covered in our guide to self-hosting AI models.
- Hetzner gives the best price-to-performance in the EU and is the most common pick for a
run it and forget it
gateway. It also has an official OpenClaw install page. - DigitalOcean costs a little more but has the most predictable networking and the simplest firewall/DNS story if you're new to VPS administration.
- Contabo is the cheapest per GB of RAM and shows up constantly in OpenClaw searches for that reason; it's fine for a personal assistant, but their I/O is slower, so keep expectations realistic.
- Build from source needs headroom. OpenClaw's own Hetzner guide asks for at least 6 GB RAM for a source-image build and notes that a build ending in
Killedor exit code 137 means you ran out of memory and should resize the server. If you're on a smaller box, use a pre-built image or the plain npm install below. - On
free
tiers: throttled or sleeping instances are the wrong fit for an assistant that has to be online 24/7, so avoid the disposable free trials. The exception worth knowing about is Oracle Cloud's Always Free ARM tier, which OpenClaw lists as a supported install target — it's a genuinely always-on box rather than a trial. Otherwise a $5–$10/month VPS is the real floor.
If you'd rather not hand-roll firewall rules, DNS, and SSH hardening yourself, DeployHQ Managed VPS provisions a real Linux server with deployments already wired in — you still get root, but the initial hardening is done for you.
Step 1 — Initial Server Setup
Connect as root, then immediately create a non-root user with sudo access:
ssh root@<your-vps-ip>
adduser openclawops
usermod -aG sudo openclawops
Copy your SSH key to the new user so you can log back in without a password:
rsync --archive --chown=openclawops:openclawops ~/.ssh /home/openclawops
Switch to the new user for all remaining steps:
su - openclawops
Tighten SSH configuration to disable password auth and root login:
sudo nano /etc/ssh/sshd_config
Set these values:
PasswordAuthentication no
PermitRootLogin no
If you plan to reach the Control UI over an SSH tunnel (see the FAQ), also make sure local forwarding is permitted — OpenClaw's Hetzner guide recommends the narrow form, which allows ssh -L from your laptop while blocking remote forwards originating on the server:
AllowTcpForwarding local
Validate the config, then restart SSH (keep your current session open in case something goes wrong):
sudo sshd -t
sudo systemctl restart ssh
Update the system before doing anything else:
sudo apt update && sudo apt dist-upgrade -y
The steps above — non-root user, key-only SSH, patched packages — are the minimum for any internet-facing box. If OpenClaw is your first self-hosted service, it's worth working through a full Linux server hardening checklist before you expose anything to the public internet, because an AI gateway with API keys attached is a more attractive target than a static site.
Step 2 — Configure the Firewall
Lock down ingress traffic with UFW. Allow only SSH, HTTP, and HTTPS:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw limit 22/tcp # rate-limit to slow brute-force attempts
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
Verify the rules are active:
sudo ufw status verbose
Do not open port 18789 (OpenClaw's gateway port) to the public internet. The official guidance is explicit about this: a cloud firewall only needs to admit SSH, and never needs an inbound rule for TCP 18789. We'll put Nginx in front of the gateway instead.
Step 3 — Install a Supported Node.js Runtime
This is the step that trips up most OpenClaw VPS installs, and it changed in 2026. OpenClaw requires Node 24.16+ or Node 26.1+. Per the official Node.js requirements, Node 22, 23 and 25 are unsupported — so older tutorials telling you to install Node 22 will leave you with a broken install.
The reason is specific and worth understanding, because the failure is silent rather than loud. OpenClaw stores state in SQLite via node:sqlite. Node 22.23.x, 24.15.0, 25.9.0 and 26.0.0 shipped a broken TEXT decoder that truncates values at embedded NUL characters when reading TEXT columns. Node 24.16.0 and 26.1.0 are the first fixed releases on their respective lines. A gateway on a bad runtime appears to work and then quietly loses parts of stored values. The docs also warn to upgrade Node before updating OpenClaw, not after.
Install Node 24 from the NodeSource repository (this tracks the latest 24.x, which is comfortably past the 24.16 floor):
curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
sudo apt-get install -y nodejs
node -v # must be v24.16.0+ (or v26.1.0+)
Node 26 is the runtime OpenClaw recommends — the docs note it starts the gateway faster and uses less memory than Node 24 — while Node 24 is the LTS line their CI pins. Either is fine; if you want 26, use setup_26.x instead.
Note on the npm metadata: the published
openclawpackage'senginesfield is currently looser than the documented policy and still lists some Node 22 and 25 ranges. Follow the documentation floor (24.16+/26.1+), not theenginesfield — installing on Node 22 may not error, which is exactly what makes this failure mode dangerous.
Step 4 — Install OpenClaw
Run the official installer. It provisions a supported Node runtime itself if one isn't already present, and starts onboarding automatically:
curl -fsSL https://openclaw.ai/install.sh | bash
If you installed the package directly with npm, pnpm or Bun instead, start onboarding by hand:
openclaw onboard
During onboarding you'll be pointed at the security guide and then offered Quick start (which reuses a detected Claude Code or Codex CLI login or API key, verifies it with a real completion, and saves the config) or Custom setup (which walks through every guided option). Pick Custom setup if you want to choose your provider and channel explicitly.
Once installed, verify the gateway:
openclaw gateway status
Step 5 — Confirm the Gateway Is on Loopback
The gateway binds to loopback by default, on port 18789 (gateway.port). That's the behaviour you want: the gateway itself should never listen on a public interface, and all external access should arrive through Nginx.
Confirm it, and change it interactively if it has been altered:
openclaw configure --section gateway
The corresponding configuration in ~/.openclaw/openclaw.json is:
{
gateway: {
bind: "loopback",
},
}
If openclaw gateway status ever shows the gateway bound to anything other than 127.0.0.1, fix that before going any further. Per OpenClaw's own exposure runbook, any non-loopback bind must have gateway auth, a firewall allowlist, and no public port-forward.
Ready to automate updates once this is running? A free DeployHQ account is all you need for the Git-based config workflow in Step 10 — you can create it now and connect the server later.
Step 6 — Turn On Gateway Authentication
Do not skip this step. Loopback binding protects you from someone hitting port 18789 directly. It does not protect you once Nginx is proxying that port to a public domain — at that point the internet can reach your gateway through the proxy, and without auth anyone who finds the hostname can drive your agent and spend your AI provider credits.
OpenClaw's exposure runbook publishes a minimum safe baseline for exposed deployments. The auth portion looks like this in ~/.openclaw/openclaw.json:
{
gateway: {
bind: "loopback",
auth: {
mode: "token",
token: "replace-with-a-long-random-token",
},
},
}
Generate a real token rather than typing one:
openssl rand -hex 32
The same runbook recommends tightening the agent itself before you allow remote senders — session.dmScope: "per-channel-peer" so DM sessions don't share context, agents.defaults.sandbox.mode: "non-main", tools.profile: "messaging", tools.exec.security: "deny" with ask: "always", and tools.elevated.enabled: false. Widen one control at a time. Be aware that tools.exec.security: "deny" blocks all exec calls including benign diagnostics, so relax it deliberately rather than by default.
Then run OpenClaw's own pre-flight checks and resolve anything critical before you open the door:
openclaw doctor
openclaw security audit
openclaw security audit --deep
openclaw health
A word on what not to do here: OpenClaw has a trusted-proxy auth mode, and it looks like the obvious choice for an Nginx setup. It isn't. The docs are explicit that trusted-proxy mode is for identity-aware proxies (Pomerium, Caddy + OAuth, nginx + oauth2-proxy) and should not be used when your proxy is just a TLS terminator or load balancer
— which is exactly what the Nginx config in the next step is. Use token auth here.
Step 7 — Set Up Nginx as a Reverse Proxy
Install Nginx and Certbot:
sudo apt install -y nginx certbot python3-certbot-nginx
Create a new server block for OpenClaw:
sudo nano /etc/nginx/sites-available/openclaw
Paste the following, replacing openclaw.example.com with your actual domain:
server {
listen 80;
server_name openclaw.example.com;
location / {
proxy_pass http://127.0.0.1:18789;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 86400;
}
}
Two details in that block do the heavy lifting:
proxy_read_timeout 86400(24 hours) prevents Nginx from closing the long-running WebSocket connections OpenClaw uses for real-time messaging. This is the single most common cause of an OpenClaw gateway thatworks, then goes quiet after a few minutes
— the default 60-second proxy timeout silently kills the WebSocket.- The
Upgrade/Connectionheaders are what make the WebSocket upgrade work at all. Omit them and the Control UI loads but never connects.
If you're weighing Nginx against alternatives for this job, our comparison of Nginx, Apache and Caddy covers the trade-offs — Caddy in particular handles the certificate step for you.
Enable the site and test the config:
sudo ln -s /etc/nginx/sites-available/openclaw /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx
Obtain a free TLS certificate from Let's Encrypt:
sudo certbot --nginx -d openclaw.example.com
Certbot automatically reconfigures Nginx for HTTPS and sets up auto-renewal. Your gateway is now reachable at https://openclaw.example.com with a valid certificate — and, because of Step 6, it asks for a token before doing anything.
Browser-origin gotcha: a Control UI served from anything other than loopback also has to pass gateway.controlUi.allowedOrigins. If the UI loads over your domain but the WebSocket immediately drops — the classic symptom is a 1008 unauthorized close code — add your public origin to that list and restart the gateway.
Step 8 — Run OpenClaw as a Managed Service
Right now OpenClaw stops when you close your SSH session. Rather than hand-writing a unit file, use OpenClaw's own service installer, which generates and owns the correct unit:
openclaw gateway install
openclaw gateway status
On Linux this installs a systemd unit named openclaw-gateway.service (the same thing openclaw onboard --install-daemon sets up during onboarding). The managed unit owns the restart policy — Restart=always, RestartSec=5 — so a crash or a bad config won't leave you without a running gateway.
Customise only host-specific settings with a drop-in rather than editing the unit directly:
systemctl --user edit openclaw-gateway.service
[Service]
Environment=OPENCLAW_NO_RESPAWN=1
Environment=NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache
TimeoutStartSec=90
Those three settings come straight from OpenClaw's VPS tuning checklist and matter most on small or ARM instances: NODE_COMPILE_CACHE speeds up repeated CLI startups (the first run warms the cache), OPENCLAW_NO_RESPAWN=1 keeps routine gateway restarts in-process so PID tracking stays simple, and the longer TimeoutStartSec stops systemd giving up on a slow cold start. If you installed a system-wide unit instead of a user unit, use sudo systemctl edit openclaw-gateway.service.
Service lifecycle from here on is:
openclaw gateway start
openclaw gateway restart
openclaw gateway stop
With the gateway supervised and surviving reboots, the remaining manual work is config changes — and that's the part worth automating. A build pipeline can validate an OpenClaw config with openclaw config validate before it ever reaches the server, so a malformed edit fails the deploy instead of taking the gateway down. Step 10 wires that up.
Step 9 — Connect Your Messaging Channel
With the gateway running, add a Telegram bot.
- Open Telegram and message @BotFather — confirm the handle is exactly
@BotFather - Run
/newbotand follow the prompts to get a bot token - On your server, write the token into your config:
openclaw channels add --channel telegram --token <bot-token>
- Restart the gateway, because a new channel is only picked up once the gateway reloads config:
openclaw gateway restart
- Approve your first DM. This is the step that makes people think their bot is broken. Telegram's default
dmPolicyin OpenClaw ispairing, so your first message to the bot doesn't get a reply — it creates a pairing request you have to approve on the server:
openclaw pairing list telegram
openclaw pairing approve telegram <CODE>
Pairing codes expire after one hour. Once approved, send another message and the bot responds via whichever AI provider you configured.
For a one-owner bot, the docs suggest going further than pairing: set dmPolicy: "allowlist" with your explicit numeric Telegram user ID in allowFrom. Note that dmPolicy: "allowlist" with an empty allowFrom blocks all DMs and is rejected by config validation, so add the ID at the same time. And remember that approving a DM pairing doesn't authorise that sender anywhere else — group sender authorisation comes from explicit config allowlists only.
Step 10 — Automate Configuration Updates with DeployHQ
As you customise OpenClaw — adding OpenClaw Skills (plugins for Gmail, GitHub, Notion, Home Assistant, and many others), tweaking system prompts, or updating webhook configs — you'll want those changes deployed to your VPS automatically rather than manually SSH-ing in.
The pattern is straightforward: store your OpenClaw configuration and custom skills in a Git repository, then use DeployHQ to deploy from GitHub to your server whenever you push.
Set up your config repository:
mkdir ~/openclaw-config && cd ~/openclaw-config
git init
# Copy any custom skills or config overrides into this directory
cp ~/.openclaw/openclaw.json ./openclaw.json
cp -r ~/.openclaw/skills ./skills
Before you commit anything, strip the secrets. Your openclaw.json holds the gateway auth token and may hold provider and bot credentials — those belong in environment variables or a secret store on the server, never in the repo. Commit a sanitised config with placeholders and keep the real values in ~/.openclaw outside Git.
Create a deployment script (deploy.sh) that your VPS runs on every push:
#!/bin/bash
set -e
# Copy config updates into place
cp openclaw.json ~/.openclaw/openclaw.json
rsync -av skills/ ~/.openclaw/skills/
# Restart the gateway to pick up changes
openclaw gateway restart
echo "OpenClaw updated and restarted"
Push this to your Git host (GitHub, GitLab, Bitbucket, or Codebase):
git add .
git commit -m "Initial OpenClaw config"
git remote add origin <your-repo-url>
git push -u origin main
Connect DeployHQ:
- Log in to DeployHQ and create a new project
- Connect it to your repository
- Add your VPS as a server (SSH key authentication)
- Set the deployment path to
/home/openclawops/openclaw-config - Add a post-deployment command:
bash deploy.sh
Now every time you push a config change or add a new skill, DeployHQ runs the deployment automatically. No more SSH sessions for routine updates — you get automatic deployments on every push, a full deployment history, and one-click rollback if a config change breaks the gateway.
This same workflow applies to any Node.js application you're running on your VPS. DeployHQ supports deploying Node.js apps alongside OpenClaw, so you can manage multiple services on the same server from a single dashboard. If you're building out a wider agent stack, the same VPS pattern covers deploying your first AI agent to a VPS with Docker, and the container-based variant is in our guide to deploying Docker containers to a VPS.
Keeping OpenClaw Updated
OpenClaw ships calendar-versioned releases (v2026.9.x) at a fast cadence, so upgrades are routine. Use OpenClaw's own updater rather than npm — it detects your install type, validates the candidate while the old gateway is still serving, then activates and verifies:
openclaw update
Older guides recommend npm update -g openclaw. That's no longer the documented path, and a direct npm install now also needs --allow-scripts=openclaw on npm 12 and npm 11.16+. Stick with openclaw update.
Two rules worth remembering:
- Upgrade Node before you upgrade OpenClaw, not the other way around — the runtime floors in Step 3 move over time.
- Check the OpenClaw GitHub releases for breaking changes before upgrading a production gateway. Because the managed unit uses
Restart=always, a bad update that crashes the process will keep retrying rather than silently leaving you offline — but it will also keep crashing until you fix it, so read the release notes.
Troubleshooting
Gateway won't start: check logs with journalctl -u openclaw-gateway -n 50, then run openclaw doctor. Most failures are an unsupported Node version (see Step 3), a missing provider API key, or a port conflict.
Nginx 502 Bad Gateway: the OpenClaw gateway isn't running, or Nginx can't reach it on 127.0.0.1:18789. Run openclaw gateway status and check the service logs. A 502 almost always means the upstream is down or bound to the wrong interface — our full NGINX 502 Bad Gateway causes and fixes guide walks through every cause in order.
Control UI loads but the WebSocket drops (1008 unauthorized): this is an auth or origin problem, not a proxy problem. Confirm your gateway token is set (Step 6) and that your public origin is in gateway.controlUi.allowedOrigins (Step 7).
Telegram bot not responding: first check whether it's waiting on pairing — run openclaw pairing list telegram and approve the code. If there's no pending request, verify the token with openclaw channels status --probe; getMe returned 401 means Telegram rejected the configured bot token. Also check that your VPS can reach api.telegram.org — some providers block outbound traffic by default.
Build killed / exit code 137: you ran out of memory during a source build. Resize the server or switch to a pre-built image.
Certificate renewal failing: run sudo certbot renew --dry-run to debug. Certbot needs ports 80 and 443 open and Nginx running.
Frequently Asked Questions
Do I need a VPS to run OpenClaw?
Not strictly — OpenClaw runs on any always-on Linux machine, including a home server or a Raspberry Pi (which has its own official install page). But for a messaging assistant that has to respond 24/7, a VPS is the pragmatic choice: it has a static public IP, stays online through power cuts and ISP outages, and gives you a clean place to terminate SSL. Running it on a laptop that sleeps, or behind a home NAT you have to port-forward, tends to be more hassle than a $5–$10/month VPS is worth.
Do I need a domain name?
No — you can skip Steps 6 and 7 entirely and access the Control UI via an SSH tunnel instead. This is the pattern OpenClaw's own documentation recommends, and it means the gateway is never reachable from the public internet at all:
ssh -N -L 18789:127.0.0.1:18789 openclawops@<your-vps-ip>
Then open http://127.0.0.1:18789/ in your browser. The downside is you need the tunnel running whenever you want to use the web UI. If the tunnel fails with administratively prohibited, check the AllowTcpForwarding setting from Step 1. Tailscale Serve is the other supported option if you'd rather not keep an SSH session open. If you're using Telegram or another messaging channel, those work fine without any web access.
Is it safe to run OpenClaw on a public VPS?
Yes, but only if you're honest about which exposure pattern you've chosen. OpenClaw's exposure runbook ranks them, from safest to riskiest: loopback plus an SSH tunnel; loopback plus Tailscale Serve; a tailnet or LAN bind with gateway auth and a firewall allowlist; a trusted identity-aware reverse proxy; and finally direct public internet, which the docs describe as rare and high-risk.
The setup in this guide sits between the last two. UFW blocks every port except SSH, HTTP and HTTPS; the gateway binds to 127.0.0.1 so it's unreachable directly; Nginx terminates TLS; and gateway token auth means the proxy isn't handing out free access. Skip Step 6 and you have collapsed straight into the high-risk row — a publicly reachable, unauthenticated AI agent.
The other risk is the AI provider API key stored on the server. Treat it like a password: never commit it to your config repo, rotate it if the box is ever compromised, and set a spend limit in your provider dashboard so a leaked key can't run up an unbounded bill.
Which AI provider should I use?
Anthropic's Claude is the most capable for complex tasks and follows instructions precisely. OpenAI's models are solid all-rounders with broad third-party skill compatibility. Google Gemini Flash is the cheapest option for high-volume use. Models and agent harnesses are plugins in OpenClaw, so you can swap providers without changing anything else in your setup — useful if you want cheaper models for quick queries and stronger ones for coding tasks.
Can multiple people share one OpenClaw instance?
Technically yes, but read the security model first. OpenClaw's docs call a shared company agent a valid setup when every user is in the same trust boundary and the agent is business-only
— keep it on a dedicated runtime with its own OS user, and don't sign that runtime into personal Apple, Google, browser or password-manager profiles. If your users are adversarial to each other, the docs are clear that isolation has to come from separate gateways, hosts or OS users, not from prompts or session labels. When more than one person can message the bot, set session.dmScope: "per-channel-peer" so DM sessions don't share context.
How much will API costs actually run?
That depends entirely on your provider, your model choice, and your volume — OpenClaw itself adds nothing to the bill, since there's no paid tier or token. The cost lever that matters most is model routing: use a cheap, fast model for routine queries and reserve the stronger models for complex or coding tasks. Because models are swappable plugins, you can change that mix without touching the rest of your setup. Whatever you choose, set a hard spend limit in your provider dashboard before you expose the gateway — that cap is also your blast radius if the key ever leaks.
Is my data private if I use a cloud AI provider?
Your messages are sent to whichever AI provider's API you configure, plus any diagnostics export you enable yourself. OpenClaw itself keeps state, memory and credentials on your hardware; by default it phones home for nothing but a daily version check, anonymous feature statistics are opt-in, and setting update.checkOnStart: false disables both. If you need full end-to-end privacy, point OpenClaw at a local model via Ollama and your data never leaves the VPS.
Can I run other services on the same VPS?
Yes. OpenClaw runs as a single Node.js process and is relatively lightweight — a 4 GB RAM server comfortably runs OpenClaw alongside a small web app, database, or other services. Use separate Nginx server blocks for each service and manage them all through DeployHQ. One caveat from the docs: only run one gateway per host unless you deliberately isolate ports, config, state and workspaces.
How do I back up my OpenClaw configuration?
Follow the 3-2-1 rule: three copies of your data, on two different media, with one off-site. In practice that means your sanitised openclaw.json and custom skills live in Git (the DeployHQ workflow above is your primary, versioned copy), the working copy sits on the VPS, and you push a periodic backup of the ~/.openclaw state directory — which holds session memory and conversation history — to off-site object storage. A cron job that rsyncs that directory to an S3-compatible bucket nightly covers the off-site leg for most setups. Back up your credentials separately and securely.
What happens when OpenClaw releases a breaking update?
Run openclaw update, which validates the candidate before activating it, and check the release notes first — breaking changes are rare but do happen, usually around skill and plugin API changes. Test on a staging VPS if you have critical automations running. The Restart=always policy in the managed systemd unit means a crash won't leave you without a running service, and openclaw doctor --fix can repair config keys that a release has removed.
How is this different from deploying a Hermes Agent?
OpenClaw is a messaging gateway — it routes messages between your apps and an AI model. Hermes Agent is a heavier, self-improving agent framework with a different skill model. If you're weighing the two, we cover the deployment differences in how OpenClaw compares to Hermes Agent on a VPS. The VPS hardening, Nginx, and DeployHQ workflow in this guide apply to both.
OpenClaw gives you a genuinely useful AI assistant that runs on infrastructure you control — no subscription lock-in, no data leaving your servers unless you choose it. A $5–$10/month VPS handles typical personal use comfortably, and your only ongoing cost is API usage. Get the Node runtime and the gateway token right and the rest is routine server administration.
For teams managing multiple VPS instances, DeployHQ simplifies keeping configurations consistent across servers — deploy once to all your nodes from a single push, or drive deployments from your terminal or an AI agent and connect your first server in minutes.
Have questions or hit an issue? Reach out at support@deployhq.com or find us on X at @deployhq.