How to Install OpenClaw on VPS Securely (Tailscale Step-by-Step Tutorial)
Learn how to run OpenClaw on your own server without exposing it to the public internet. This setup is one of the easiest and safest ways to do it. In this guide, you'll install OpenClaw on a VPS and secure it using Tailscale. No complicated DevOps. Just a clean, working setup. Why Use Tailscale? Most VPS setups expose your app directly to the internet. That's risky. With Tailscale, you: Create a private network (a WireGuard mesh) Access your server securely with no public-facing ports Avoid opening unnecessary ports to the internet Bottom line: Your app stays private, but still accessible to you from any device on your Tailnet. What You Need VPS hosting (I use Hostinger) SSH keys (no password logins) A free Tailscale account A firewall (UFW or your provider's) to keep unused ports closed Step 1 - Set Up Your VPS Start with a clean VPS. Connect via SSH using the IP your provider assigned: ssh root@VPSIPHERE Now your server is ready for the next steps. Step 2 - Create a New User Don't run things as root. Create a regular user and add them to the sudo group: adduser --gecos "" username adduser username sudo Step 3 - Create an SSH Key On your local machine, generate a modern Ed25519 key. Give it a name and a strong passphrase when prompted: ssh-keygen -t ed25519 Copy the public key to your VPS: ssh-copy-id -i keyname.pub username@VPSIPHERE Then disable password authentication. Open the SSH config: nano /etc/ssh/sshd_config.d/50-cloud-init.conf Set PasswordAuthentication no. Press Ctrl + X, then Y, then Enter to save and exit. Restart SSH: service ssh restart Always keep your existing SSH session open while testing the new key in a second terminal. If anything is wrong, you still have a way back in. Connect with the new SSH key: ssh -i ./keyname 'username@VPSIPHERE' Step 4 - Set Up Tailscale Download Tailscale to your local computer first: tailscale.com/download Then install Tailscale on the VPS: curl -fsSL https://tailscale.com/install.sh | sh