A step-by-step reference for securely deploying OpenClaw on a DigitalOcean Droplet with Tailscale, SSH hardening, and firewall configuration.

Companion guide to the YouTube video: [COMING SOON]

Go to the DigitalOcean Marketplace and deploy the OpenClaw 1-Click Droplet.

Recommended plan: 4 GB RAM / 2 vCPU (s-2vcpu-4gb)

Use SSH Key authentication (not password).

The dashboard may show "ready" before SSH is available. Wait about 60 seconds before connecting.

Connect to your Droplet:

ssh root@your-droplet-ip

The interactive setup will ask for your LLM provider (Anthropic, OpenAI, or Gradient) and API key. Follow the prompts to pair with the Gateway Dashboard.

Verify OpenClaw is running by launching the Terminal UI:

/opt/openclaw-tui.sh

In Telegram, message @BotFather and type /newbot to create a bot. Copy the bot token.

On the Droplet, add Telegram as a channel:

/opt/openclaw-cli.sh channels add

Select Telegram and paste your bot token.

Open the deep link BotFather gave you and send a message. Copy your Telegram user ID from the response, then add it to the allow list in the OpenClaw Gateway Dashboard.

Install Tailscale on the Droplet:

curl -fsSL https://tailscale.com/install.sh | sh

Bring it up with SSH support:

tailscale up --ssh

Authenticate via the link provided, then verify:

tailscale status

Note your Tailscale IP (e.g. 100.x.x.x). You'll need it for the next steps.

Install Tailscale on your local machine as well and log in with the same account.

Edit the SSH config:

sudo nano /etc/ssh/sshd_config

Add or update these lines:

ListenAddress 100.x.x.x PasswordAuthentication no PermitRootLogin no 

Replace 100.x.x.x with your actual Tailscale IP.

What each setting does:

• ListenAddress: SSH only accepts connections from the Tailscale interface. Public internet connections are refused.
• PasswordAuthentication no: Forces key-based authentication only.
• PermitRootLogin no: Blocks all root login attempts.

Check for cloud provider override files that can undo these settings:

ls /etc/ssh/sshd_config.d/

If 50-cloud-init.conf exists, edit it:

sudo nano /etc/ssh/sshd_config.d/50-cloud-init.conf

Ensure it contains:

PasswordAuthentication no 

Create a new user:

adduser akshay

Grant sudo privileges:

usermod -aG sudo akshay

Verify:

su - akshay sudo whoami

If the output is root, the user has sudo access but isn't running as root by default.

Restart SSH to apply all changes:

sudo systemctl restart ssh

From this point, SSH only works through Tailscale. Test from your local machine:

ssh akshay@your-tailscale-ip

Access the Terminal UI as the new user:

sudo /opt/openclaw-tui.sh

In the DigitalOcean dashboard, go to Networking, then Firewalls, and create a new firewall.

Add a single inbound rule:

This allows only the Tailscale WireGuard tunnel. All other inbound traffic is blocked.

Attach the firewall to your Droplet.

On your local machine, use SSH port forwarding:

ssh -N -L 18789:127.0.0.1:18789 akshay@your-tailscale-ip

Then open http://localhost:18789 in your browser.

This works because the SSH connection runs through the Tailscale tunnel (UDP 41641). Port 18789 is never exposed to the public internet.

SSH into your Droplet and run:

sudo /opt/openclaw-cli.sh config set tools.exec.host gateway sudo /opt/openclaw-cli.sh config set tools.exec.ask off sudo /opt/openclaw-cli.sh config set tools.exec.security full

Restart the service:

sudo systemctl restart openclaw

What each setting does:

• tools.exec.host gateway: Routes commands through the gateway process. Without this, commands have nowhere to run on a headless VPS.
• tools.exec.ask off: Disables approval prompts. On a headless server, nobody is there to approve, so commands would hang forever.
• tools.exec.security full: Gives OpenClaw the highest execution tier within its sandbox. Required for network calls, shell commands, and skill execution. This does not grant root access.

Verify your settings:

sudo /opt/openclaw-cli.sh config get tools.exec

• DigitalOcean Marketplace: OpenClaw
• OpenClaw Documentation
• OpenClaw GitHub
• Tailscale
• DigitalOcean SSH Key Guide