How to Install OpenClaw on a Linux VPS with Guardrails, Model Selection & Security

A self-hosted AI agent is only as good as the rails around it. This is the production setup we run at WIPL across five business functions, with the exact VPS sizing, guardrail config, model trade-offs, and security hardening we use ourselves.

01Why a Linux VPS is the right home for OpenClaw

OpenClaw can technically run on a developer laptop, but the moment you connect it to WhatsApp, Slack, your CRM, or a payments API, you need three things a laptop cannot give you, persistent uptime, a stable public IP for webhook callbacks, and proper isolation from anything else you are running. A Linux VPS gives you all three, at a cost that starts at about $15 per month and scales with usage.

At WIPL we run OpenClaw across five named agents, Priya for executive support, Dhan for sales, Preeti for HR operations, Mahima for marketing, and Bala for SRE. All five live on a single managed VPS behind Traefik, with separate API keys, separate audit logs, and separate cost ceilings. The setup below is the one we actually use.

02Prerequisites & VPS sizing

OpenClaw is light at the framework level. The cost comes from the model API calls and from the integrations, queues, and background jobs that pile up as you add channels. Size for the integrations, not the framework.

03Phase 1, Installing OpenClaw the right way

The 30-second install works. The production install takes 30 minutes and saves you 30 hours later.

Step 1, Create a dedicated user and harden the box

# As root
adduser openclaw
usermod -aG sudo openclaw
mkdir /home/openclaw/.ssh
cp ~/.ssh/authorized_keys /home/openclaw/.ssh/
chown -R openclaw:openclaw /home/openclaw/.ssh
chmod 700 /home/openclaw/.ssh
chmod 600 /home/openclaw/.ssh/authorized_keys

# Disable root SSH
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd

Step 2, Install Node and Docker

# Node 22 LTS via NodeSource
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs

# Docker Engine + Compose
curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker openclaw
newgrp docker

Step 3, Install OpenClaw under the openclaw user

# Switch user
su - openclaw

# Install OpenClaw globally
npm install -g openclaw@latest

# Initialise the config in the home directory
openclaw init

# Config now lives at ~/.openclaw/openclaw.json
# Environment variables at ~/.openclaw/.env

Step 4, Wire up Traefik as a reverse proxy

Do not expose port 18789 directly. Put Traefik in front of it, handle TLS termination, and route only the paths you want public:

mkdir -p ~/openclaw-stack && cd ~/openclaw-stack

cat > docker-compose.yml << 'EOF'
services:
  traefik:
    image: traefik:v3.2
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./acme.json:/letsencrypt/acme.json
      - /var/run/docker.sock:/var/run/docker.sock:ro
EOF

touch acme.json && chmod 600 acme.json

Step 5, Start OpenClaw with the correct sequence

# The order matters
openclaw config validate          # 1. Verify config is valid
openclaw services start           # 2. Start background services
openclaw whatsapp connect         # 3. Connect channels one at a time
openclaw agents enable priya      # 4. Enable agents one at a time
openclaw status                   # 5. Confirm everything is green

04Phase 2, Choosing your AI model

OpenClaw is model-agnostic. You can point it at any LLM that supports the OpenAI-compatible API spec, which today means almost everything. The question is not can you use it, the question is should you. Here is how we think about it.

The four dimensions that matter

Capability, latency, cost, and data residency. Every model is a different trade-off across these four. There is no universal winner.

How to decide, the WIPLON shortcut

If you want a single decision rule, here it is. Pick a balanced model (Claude Sonnet, Gemini 2.5 Pro, MiniMax M2.5) as your primary, and configure a premium model (Claude Opus or GPT-5) as your fallback for "important" tool calls. You get 80 percent of the cost savings of the budget tier, and you get the premium model exactly when you need it, which is for the decisions where being wrong is expensive.

OpenClaw supports model routing natively in openclaw.json:

{
  "models": {
    "primary": {
      "provider": "minimax",
      "model": "abab-m2.5",
      "api_key_env": "MINIMAX_API_KEY"
    },
    "fallback": {
      "provider": "anthropic",
      "model": "claude-opus-4",
      "api_key_env": "ANTHROPIC_API_KEY",
      "trigger": "high_stakes"
    }
  }
}

05Phase 3, Configuring guardrails

An agent that can read but cannot write is a chatbot. An agent that can write is powerful. An agent that can write without guardrails is a liability. Configure these five guardrails before you turn on production traffic, not after.

1. Human approval for write actions

Every tool that writes to an external system (CRM update, email sent, invoice issued, payment processed) should require explicit human approval. OpenClaw supports approval queues out of the box:

{
  "tools": {
    "send_invoice": {
      "approval_required": true,
      "approvers": ["[email protected]"],
      "timeout_minutes": 60
    },
    "update_crm": {
      "approval_required": true,
      "approvers": ["[email protected]"]
    }
  }
}

2. Rate limits per agent and per channel

Without rate limits, a misbehaving agent or a malicious user can rack up thousands of dollars in API costs in under an hour. We have seen this happen. Set both per-minute and per-day ceilings:

{
  "rate_limits": {
    "global": { "tokens_per_day": 10000000 },
    "per_agent": { "tokens_per_hour": 500000 },
    "per_user": { "messages_per_minute": 20 }
  }
}

3. Cost caps with daily alerts

Set a hard daily cost cap. When you hit 80 percent, get an alert. When you hit 100 percent, the agent stops responding until reset. Treat this like a credit card spending limit, because that is exactly what it is.

4. Tool allowlist, not denylist

An allowlist of approved tools is safer than a denylist of forbidden ones. New integrations should be added explicitly, never inferred. By default OpenClaw ships with allowlist mode enabled, do not disable it.

5. Structured audit logging

Every prompt, every model response, every tool call, every approval decision should be logged with a timestamp, the agent name, the user identifier, and the cost. Pipe these into a log aggregator (Loki, Elasticsearch, or even just rotating JSON files) so you can audit what happened when something goes wrong.

06Phase 4, Security hardening

OpenClaw running on the public internet is exposed to the same threat model as any other application server, plus a few of its own (model API key theft, prompt injection, runaway costs). Here is the hardening pass we run before any OpenClaw VPS goes live.

The .env file is your most sensitive asset

The ~/.openclaw/.env file holds your model API keys, channel tokens, and database credentials. Treat it the way you treat your SSH private key:

chmod 600 ~/.openclaw/.env
chown openclaw:openclaw ~/.openclaw/.env

# Encrypt at-rest backups
tar czf - ~/.openclaw/ | \
  openssl enc -aes-256-cbc -pbkdf2 -salt -out /backups/openclaw-$(date +%F).tar.gz.enc

# Add .openclaw and .env to global gitignore
echo ".openclaw/" >> ~/.gitignore_global
echo ".env" >> ~/.gitignore_global
git config --global core.excludesfile ~/.gitignore_global

07Phase 5, Keeping it safe in production

Day-one security is the easy part. Keeping a production OpenClaw deployment safe over months and years takes operational discipline. These are the routines we run.

Weekly

Monthly

Quarterly

08Common pitfalls we see every month

1. Storing API keys in the OpenClaw config JSON

Always reference keys via environment variable names ("api_key_env": "MINIMAX_API_KEY") and keep the values in the .env file. We have seen production configs committed to private GitHub repos with live keys inside, which is one ex-employee away from a problem.

2. Running OpenClaw as root

Easy to set up, terrible to recover from if something goes wrong. Always run under a dedicated user (openclaw), and use systemd or Docker to manage the process. Root access for an LLM-powered agent is the kind of mistake you only make once.

3. No cost cap, learning by surprise

Without a cap, a misbehaving prompt loop can burn through hundreds of dollars overnight. We have a customer who had this happen at a previous host, $1,400 in 11 hours. Configure the cap on day one.

4. Skipping webhook signature verification

WhatsApp, Slack, and Telegram all sign their webhook callbacks. If you do not verify the signature, anyone who knows your endpoint URL can post fake messages and trigger your agents. This is one of the easiest attacks on the internet and one of the easiest defences.

5. Forgetting that the model can be wrong

Guardrails are not about catching malicious users. They are about catching the model. Even the best LLMs hallucinate, misread sarcasm, and occasionally generate confidently wrong tool calls. Human approval on writes is not paranoia, it is just engineering for the system you actually have.

6. Mixing dev and production on the same VPS

If you must, use separate users, separate Docker networks, and separate API keys. Better, use two VPS instances, one for staging at half the size, one for production at full size. The cost difference is rarely worth the operational risk.

7. No kill switch rehearsal

Knowing the command exists is not the same as having run it under pressure. Run a kill-switch drill once a quarter, time how long it takes, and shorten that time until it is under a minute. The first time you need it will be in the middle of an incident, not a calm afternoon.

09FAQ

Written by the WIPLON Engineering team, based on our own production OpenClaw deployment running across five named agents on managed VPS infrastructure. Last technical review, June 2026.