OpenClaw Linux 服务器完全部署指南：Ubuntu/Debian 安装与生产配置

# 适用系统：Ubuntu 22.04 LTS / 24.04 LTS / Debian 12
# 最低配置：1 核 1GB RAM（推荐 2 核 2GB）

# 更新系统
sudo apt update && sudo apt upgrade -y

# 安装 Node.js 20+ (via NodeSource)
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs

# 验证版本
node -v   # v20.x.x
npm -v    # 10.x.x

# 全局安装
sudo npm install -g openclaw

# 验证安装
openclaw --version
openclaw status

# 创建配置目录（以运行用户身份）
mkdir -p ~/.openclaw
cat > ~/.openclaw/openclaw.json << 'EOF'
{
  "providers": [
    {
      "name": "anthropic",
      "apiKey": "sk-ant-xxxxxxx",
      "models": ["claude-sonnet-4-6", "claude-haiku-4-5"]
    }
  ],
  "defaultProvider": "anthropic",
  "defaultModel": "claude-sonnet-4-6",
  "channels": {
    "telegram": {
      "botToken": "1234567890:AAxxxxxxxxxxxxxxxxxxxxxx",
      "allowedUsers": [123456789]
    }
  },
  "gateway": {
    "port": 3000,
    "host": "127.0.0.1"
  }
}
EOF

# 创建专用系统用户（推荐，避免 root 运行）
sudo useradd -r -s /bin/false -m -d /opt/openclaw openclaw

# 将配置迁移到专用用户目录
sudo mkdir -p /opt/openclaw/.openclaw
sudo cp ~/.openclaw/openclaw.json /opt/openclaw/.openclaw/
sudo chown -R openclaw:openclaw /opt/openclaw

# 创建 systemd service 文件
sudo tee /etc/systemd/system/openclaw.service << 'EOF'
[Unit]
Description=OpenClaw AI Gateway
Documentation=https://docs.openclaw.ai
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=openclaw
Group=openclaw
WorkingDirectory=/opt/openclaw
ExecStart=/usr/bin/openclaw gateway start --foreground
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=openclaw

# 环境变量
Environment="NODE_ENV=production"
Environment="HOME=/opt/openclaw"

# 安全限制
NoNewPrivileges=yes
PrivateTmp=yes

[Install]
WantedBy=multi-user.target
EOF

# 启用并启动
sudo systemctl daemon-reload
sudo systemctl enable openclaw
sudo systemctl start openclaw

# 查看状态和日志
sudo systemctl status openclaw
sudo journalctl -u openclaw -f  # 实时日志

sudo apt install -y nginx certbot python3-certbot-nginx

# 创建 Nginx 配置
sudo tee /etc/nginx/sites-available/openclaw << 'EOF'
server {
    listen 80;
    server_name your-domain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name your-domain.com;

    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;

    # WebSocket 支持（OpenClaw 需要）
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
        proxy_send_timeout 300s;
    }
}
EOF

sudo ln -s /etc/nginx/sites-available/openclaw /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

# 申请 SSL 证书
sudo certbot --nginx -d your-domain.com --non-interactive   --agree-tos --email admin@your-domain.com

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh          # 22
sudo ufw allow 80/tcp       # HTTP（用于证书验证和跳转）
sudo ufw allow 443/tcp      # HTTPS
sudo ufw enable
sudo ufw status

# 查看实时日志
sudo journalctl -u openclaw -f

# 重启服务
sudo systemctl restart openclaw

# 更新 OpenClaw
sudo npm install -g openclaw@latest
sudo systemctl restart openclaw

# 查看资源占用
sudo systemctl status openclaw
top -p $(pgrep -f openclaw)

# 修改配置后重启
sudo nano /opt/openclaw/.openclaw/openclaw.json
sudo systemctl restart openclaw

{
  "channels": {
    "telegram": [
      {
        "name": "personal",
        "botToken": "BOT_TOKEN_1",
        "allowedUsers": [123456789]
      },
      {
        "name": "team",
        "botToken": "BOT_TOKEN_2",
        "allowedUsers": [123456789, 987654321, 111222333]
      }
    ]
  }
}

# /opt/openclaw/healthcheck.sh
#!/bin/bash
HEALTH=$(curl -sf http://127.0.0.1:3000/health | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(d.get('status','unknown'))
" 2>/dev/null)

if [ "$HEALTH" != "ok" ]; then
    echo "OpenClaw 健康检查失败，重启服务..."
    sudo systemctl restart openclaw
fi

# 加入 cron 每 5 分钟检查一次
*/5 * * * * /opt/openclaw/healthcheck.sh >> /var/log/openclaw-health.log 2>&1