​

Ansible Installation

​

Quick Start

curl -fsSL https://raw.githubusercontent.com/openclaw/openclaw-ansible/main/install.sh | bash

📦 Full guide: github.com/openclaw/openclaw-ansible The openclaw-ansible repo is the source of truth for Ansible deployment. This page is a quick overview.

​

What You Get

• 🔒 Firewall-first security: UFW + Docker isolation (only SSH + Tailscale accessible)
• 🔐 Tailscale VPN: Secure remote access without exposing services publicly
• 🐳 Docker: Isolated sandbox containers, localhost-only bindings
• 🛡️ Defense in depth: 4-layer security architecture
• 🚀 One-command setup: Complete deployment in minutes
• 🔧 Systemd integration: Auto-start on boot with hardening

​

Requirements

• OS: Debian 11+ or Ubuntu 20.04+
• Access: Root or sudo privileges
• Network: Internet connection for package installation
• Ansible: 2.14+ (installed automatically by quick-start script)

​

What Gets Installed

1. Tailscale (mesh VPN for secure remote access)
2. UFW firewall (SSH + Tailscale ports only)
3. Docker CE + Compose V2 (for agent sandboxes)
4. Node.js 22.x + pnpm (runtime dependencies)
5. OpenClaw (host-based, not containerized)
6. Systemd service (auto-start with security hardening)

​

Post-Install Setup

sudo -i -u openclaw

1. Onboarding wizard: Configure OpenClaw settings
2. Provider login: Connect WhatsApp/Telegram/Discord/Signal
3. Gateway testing: Verify the installation
4. Tailscale setup: Connect to your VPN mesh

​

Quick commands

# Check service status
sudo systemctl status openclaw

# View live logs
sudo journalctl -u openclaw -f

# Restart gateway
sudo systemctl restart openclaw

# Provider login (run as openclaw user)
sudo -i -u openclaw
openclaw channels login

​

Security Architecture

​

4-Layer Defense

1. Firewall (UFW): Only SSH (22) + Tailscale (41641/udp) exposed publicly
2. VPN (Tailscale): Gateway accessible only via VPN mesh
3. Docker Isolation: DOCKER-USER iptables chain prevents external port exposure
4. Systemd Hardening: NoNewPrivileges, PrivateTmp, unprivileged user

​

Verification

nmap -p- YOUR_SERVER_IP

​

Docker Availability

​

Manual Installation

# 1. Install prerequisites
sudo apt update && sudo apt install -y ansible git

# 2. Clone repository
git clone https://github.com/openclaw/openclaw-ansible.git
cd openclaw-ansible

# 3. Install Ansible collections
ansible-galaxy collection install -r requirements.yml

# 4. Run playbook
./run-playbook.sh

# Or run directly (then manually execute /tmp/openclaw-setup.sh after)
# ansible-playbook playbook.yml --ask-become-pass

​

Updating OpenClaw

cd openclaw-ansible
./run-playbook.sh

​

Troubleshooting

​

Firewall blocks my connection

• Ensure you can access via Tailscale VPN first
• SSH access (port 22) is always allowed
• The gateway is only accessible via Tailscale by design

​

Service won’t start

# Check logs
sudo journalctl -u openclaw -n 100

# Verify permissions
sudo ls -la /opt/openclaw

# Test manual start
sudo -i -u openclaw
cd ~/openclaw
pnpm start

​

Docker sandbox issues

# Verify Docker is running
sudo systemctl status docker

# Check sandbox image
sudo docker images | grep openclaw-sandbox

# Build sandbox image if missing
cd /opt/openclaw/openclaw
sudo -u openclaw ./scripts/sandbox-setup.sh

​

Provider login fails

sudo -i -u openclaw
openclaw channels login

​

Advanced Configuration

• Security Architecture
• Technical Details
• Troubleshooting Guide

​

Related

• openclaw-ansible — full deployment guide
• Docker — containerized gateway setup
• Sandboxing — agent sandbox configuration
• Multi-Agent Sandbox & Tools — per-agent isolation