Self-Host OpenClaw on Oracle Cloud

# Update system
sudo apt update && sudo apt upgrade -y
sudo apt install -y ufw fail2ban unattended-upgrades

# UFW: allow SSH only (Tailscale handles everything else)
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw --force enable
sudo ufw status verbose

# Fail2Ban: protect SSH from brute-force
sudo tee /etc/fail2ban/jail.local > /dev/null << 'EOF'
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600
EOF
sudo systemctl enable --now fail2ban

# Harden SSH: key-only auth, no root login
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# Auto security updates
sudo dpkg-reconfigure -plow unattended-upgrades

# 16 GB swap — prevents OOM kills when loading large models
sudo fallocate -l 16G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
echo 'vm.swappiness=10' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
free -h

# Install Tailscale
curl -fsSL https://tailscale.com/install.sh | sh

# Connect to your Tailnet and enable Tailscale SSH.
# This prints an auth URL — open it on your local machine to approve.
sudo tailscale up --ssh --hostname=openclaw

# Confirm it is connected and note the Tailscale IP
tailscale status

# Install Docker Engine via official script (ARM64 compatible)
curl -fsSL https://get.docker.com | sudo sh

sudo usermod -aG docker $USER
newgrp docker
sudo systemctl enable docker

# Verify
docker --version
docker compose version

# Create Ollama project directory
mkdir -p ~/ollama && cd ~/ollama

services:
  ollama:
    image: ollama/ollama:latest
    container_name: ollama
    restart: unless-stopped
    volumes:
      - ollama_data:/root/.ollama
    environment:
      - OLLAMA_HOST=0.0.0.0:11434
      - OLLAMA_FLASH_ATTENTION=1
      - OLLAMA_NUM_PARALLEL=2
      - OLLAMA_KEEP_ALIVE=5m
    ports:
      - "127.0.0.1:11434:11434"
    deploy:
      resources:
        limits:
          memory: 20G

volumes:
  ollama_data:

# Start Ollama (first run pulls the image — ~2 GB)
docker compose up -d
docker compose ps

# Verify the API is reachable
curl http://localhost:11434/api/tags

# Recommended: start with these three
docker exec -it ollama ollama pull gemma4:e4b      # ~3.0 GB — multimodal, recommended
docker exec -it ollama ollama pull gemma4:e2b      # ~1.5 GB — fastest variant
docker exec -it ollama ollama pull llama3.1:8b     # ~4.7 GB — general purpose workhorse

# Confirm they're available
docker exec -it ollama ollama list

# Quick smoke test
docker exec -it ollama ollama run gemma4:e4b "Respond in one sentence: what are you?"

# Install Node 24 (OpenClaw requires Node 22.14+ or Node 24)
curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
sudo apt-get install -y nodejs
node --version   # should print v24.x.x

# Install OpenClaw
curl -fsSL https://openclaw.ai/install.sh | bash

# Reload shell to pick up the openclaw binary
source ~/.bashrc

# Verify
openclaw --version
openclaw doctor

openclaw onboard
# When prompted for a provider, select: Ollama
# When prompted for the endpoint, enter: http://localhost:11434
# OpenClaw queries /api/tags and auto-discovers all pulled models

# Bind gateway to loopback only (Tailscale Serve proxies to it)
openclaw config set gateway.bind loopback
openclaw config set gateway.trustedProxies '["127.0.0.1"]'

# Auth mode: none is fine behind Tailscale. Use token for stricter access control.
openclaw config set gateway.auth.mode none
openclaw config set gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback true

# Enable Tailscale Serve integration (wired up in Step 8)
openclaw config set gateway.tailscale.mode serve

# Start as a user systemd service (auto-restarts on reboot)
systemctl --user enable --now openclaw-gateway.service
openclaw gateway status

# Health checks — both should return "ok"
curl -fsS http://127.0.0.1:18789/healthz
curl -fsS http://127.0.0.1:18789/readyz

# After Step 8, open https://openclaw.<tailnet-name>.ts.net in a browser.
# A pairing request will appear — approve it here on the server:
openclaw devices approve <requestId>

# Confirm the device is connected
openclaw devices list

# Proxy HTTPS → OpenClaw gateway (Tailscale provisions the cert automatically)
sudo tailscale serve https / http://127.0.0.1:18789

# Confirm the serve rule is active
tailscale serve status

# Confirm Tailscale is fully connected
tailscale status

# Drop the public SSH port — Tailscale SSH handles all access from here on
sudo ufw delete allow 22/tcp
sudo ufw reload
sudo ufw status verbose   # should show no remaining ingress rules

# Pull latest Ollama image and restart
cd ~/ollama && docker compose pull && docker compose up -d

# Update an existing model to its latest version
docker exec -it ollama ollama pull gemma4:e4b

# List all models and their sizes
docker exec -it ollama ollama list

# Check resource usage
docker stats ollama

# Re-run the installer to get the latest version
curl -fsSL https://openclaw.ai/install.sh | bash

# Restart the systemd service to apply the update
systemctl --user restart openclaw-gateway.service
openclaw gateway status
openclaw --version

# Backup Ollama model data (Docker volume)
docker run --rm \
  -v ollama_data:/data \
  -v $HOME/backups:/backup \
  ubuntu tar czf /backup/ollama-$(date +%Y%m%d).tar.gz /data

# Backup OpenClaw config and sessions
tar czf $HOME/backups/openclaw-$(date +%Y%m%d).tar.gz ~/.openclaw

# Restore Ollama data
docker run --rm \
  -v ollama_data:/data \
  -v $HOME/backups:/backup \
  ubuntu tar xzf /backup/ollama-YYYYMMDD.tar.gz -C /