Host OpenClaw

On your computer (pick another name if my-openclaw is taken):

ssh exe.dev new --name=my-openclaw
ssh my-openclaw.exe.xyz

All remaining installation commands run on the VM, as exedev.

Install OpenClaw#

The official installer also updates Node.js if needed:

curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard --no-prompt
export PATH="$HOME/.npm-global/bin:$PATH"
command -v jq >/dev/null || sudo apt-get install -y jq
openclaw --version
node --version

Expect OpenClaw 2026.x and Node 24.16+ or 26.1+.

Set up the Gateway service#

--accept-risk acknowledges that the agent can run commands on this VM:

openclaw onboard --non-interactive --accept-risk --mode local \
  --auth-choice skip --install-daemon --skip-channels --skip-search
sudo loginctl enable-linger "$USER"
loginctl show-user "$USER" -p Linger
systemctl --user is-enabled openclaw-gateway
curl -fsS --retry 30 --retry-connrefused --retry-delay 5 --max-time 5 \
  http://127.0.0.1:18789/healthz

Expect Linger=yes, enabled, and "ok":true. Startup can take a minute.

Connect Claude through exe.dev#

The API key below is a placeholder; exe.dev supplies the real credentials outside the VM. The network exception permits the integration endpoint. Memory search uses keywords, so there's no embeddings key to arrange.

openclaw config patch --stdin <<EOF
{
  models: { providers: { anthropic: {
    baseUrl: "https://llm.int.exe.xyz",
    apiKey: "exe-llm-integration",
    request: { allowPrivateNetwork: true },
  } } },
  agents: { defaults: { model: { primary: "anthropic/claude-sonnet-5-5" } } },
  memory: { search: { provider: "none" } },
  gateway: {
    publicOrigin: "https://$(hostname).exe.xyz",
    controlUi: { allowedOrigins: ["https://$(hostname).exe.xyz"] },
    trustedProxies: ["127.0.0.1"],
  },
}
EOF
openclaw gateway restart
curl -fsS --retry 30 --retry-connrefused --retry-delay 5 --max-time 5 \
  http://127.0.0.1:18789/readyz
openclaw agent --agent main -m "Reply with exactly: pong"

The agent should answer pong.

Set up the dashboard proxy#

The exe.dev proxy handles HTTPS and login. nginx passes requests to the loopback-only Gateway. This replaces the image's default site:

sudo tee /etc/nginx/sites-available/openclaw >/dev/null <<'EOF'
map $http_upgrade $openclaw_connection {
    default upgrade;
    ""      close;
}
server {
    listen 8000 default_server;
    listen [::]:8000 default_server;
    server_name _;
    location / {
        proxy_pass http://127.0.0.1:18789;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $openclaw_connection;
        proxy_set_header Host $host;
        # Overwrite, never append, client attribution.
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host $host;
        proxy_read_timeout 1d;
        proxy_send_timeout 1d;
        proxy_buffering off;
        client_max_body_size 50m;
    }
}
EOF
sudo rm -f /etc/nginx/sites-enabled/default
sudo ln -sf /etc/nginx/sites-available/openclaw /etc/nginx/sites-enabled/openclaw
sudo nginx -t && sudo systemctl enable --now nginx && sudo systemctl reload nginx
curl -fsS http://127.0.0.1:8000/healthz

Expect "ok":true through nginx, too.

Set up nightly backups#

Keep two weeks of private archives:

mkdir -p ~/.config/systemd/user ~/backups/openclaw
chmod 700 ~/backups ~/backups/openclaw
cat > ~/.config/systemd/user/openclaw-backup.service <<'EOF'
[Unit]
Description=OpenClaw backup

[Service]
Type=oneshot
UMask=0077
ExecStart=%h/.npm-global/bin/openclaw backup create --output %h/backups/openclaw --verify
ExecStart=/usr/bin/find %h/backups/openclaw -name *-openclaw-backup.tar.gz -mtime +14 -delete
EOF
cat > ~/.config/systemd/user/openclaw-backup.timer <<'EOF'
[Unit]
Description=Nightly OpenClaw backup

[Timer]
OnCalendar=*-*-* 03:30:00
RandomizedDelaySec=30m
Persistent=true

[Install]
WantedBy=timers.target
EOF
systemctl --user daemon-reload
systemctl --user enable --now openclaw-backup.timer
systemctl --user start openclaw-backup.service
journalctl --user -u openclaw-backup -n 20 --no-pager
systemctl --user list-timers openclaw-backup.timer

Look for Archive verification: passed and a scheduled next run.

Open the dashboard#

Open https://my-openclaw.exe.xyz/ and sign in first. On the VM, generate your private, one-time pairing link:

(
  set -o pipefail
  openclaw dashboard --json | jq -er '.browserUrl // empty' | sed \
    -e "s#^http://[^/]*/#https://$(hostname).exe.xyz/#" \
    -e "s#gatewayUrl=[^&]*#gatewayUrl=wss%3A%2F%2F$(hostname).exe.xyz#"
)

Open the printed link in the same browser within ten minutes, then try the chat. Rerun the command if the link expires.

On the VM, paste the token from @BotFather when prompted:

read -rsp "Telegram bot token: " token; echo
openclaw channels add --channel telegram --token "$token"
unset token
openclaw channels status --probe

Expect Telegram to be enabled and configured. Message your bot, then replace YOUR_PAIRING_CODE below with the code it sends you:

openclaw pairing approve telegram YOUR_PAIRING_CODE

Enter your numeric user ID from that same reply—not your @username:

read -rp "Your Telegram user ID: " telegram_id
openclaw config set channels.telegram.allowFrom "[\"$telegram_id\"]" --strict-json
openclaw config set channels.telegram.dmPolicy allowlist
openclaw config set commands.ownerAllowFrom "[\"telegram:$telegram_id\"]" --strict-json
unset telegram_id
openclaw config get channels.telegram.dmPolicy
openclaw config get channels.telegram.allowFrom

Expect allowlist and only your ID. Send another message to check the reply. Groups stay blocked; see Telegram access control before adding any.

On the VM, take a fresh backup:

openclaw backup create --output ~/backups/openclaw --verify

For this recipe's default paths, replace BACKUP.tar.gz with your chosen archive's filename. Use fresh staging and old-state directory names if these already exist:

openclaw backup restore ~/backups/openclaw/BACKUP.tar.gz --target ~/openclaw-restore

Only continue if verification and extraction succeeded:

state=(~/openclaw-restore/*/payload/posix/home/exedev/.openclaw)
test "${#state[@]}" -eq 1 &&
test -f "${state[0]}/openclaw.json" &&
test ! -e ~/.openclaw.before-restore &&
systemctl --user stop openclaw-gateway &&
mv ~/.openclaw ~/.openclaw.before-restore &&
mv "${state[0]}" ~/.openclaw &&
openclaw doctor --non-interactive &&
systemctl --user start openclaw-gateway &&
openclaw gateway status

Try a chat before removing the old state in ~/.openclaw.before-restore. Old archives also restore old access permissions; review your pairings. Moving to a new VM? Ask Shelley to restore your archive and update the dashboard address. More in OpenClaw's backup reference.

On the VM, back up before upgrading:

openclaw backup create --output ~/backups/openclaw --verify &&
openclaw update &&
openclaw gateway status

Reload the dashboard and try a chat. Your settings and memory stay put.

Ask Shelley, or check on the VM:

openclaw gateway status
journalctl --user -u openclaw-gateway -n 50 --no-pager
openclaw doctor

• Expired pairing link? Make a fresh one.
• 502 or a slow restart? Give it a minute, then check the log above.
• Browser origin not allowed? Rerun the address configuration.
• Telegram is quiet? openclaw channels status --probe reports token errors. Check that the allowlist contains your numeric user ID.
• Claude won't reply? Check the provider's allowPrivateNetwork setting above and your LLM integration.