OpenClaw VPS部署方案

┌─────────────────────────────────────────────────────────────┐
│                      外部访问层                              │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐      │
│  │   Telegram   │  │  Control UI  │  │    SSH       │      │
│  │   Bot API    │  │   (HTTP)     │  │   管理       │      │
│  └──────┬───────┘  └──────┬───────┘  └──────┬───────┘      │
└─────────┼─────────────────┼─────────────────┼───────────────┘
          │                 │                 │
          ▼                 ▼                 ▼
┌─────────────────────────────────────────────────────────────┐
│                    AWS EC2 服务器                            │
│  实例ID: <your-ec2-instance-id>                             │
│  公网IP: <your-ec2-ip>                                      │
│  类型: t3.small (2 vCPU, 2GB RAM)                           │
│  系统: Amazon Linux 2023                                    │
│                                                             │
│  ┌───────────────────────────────────────────────────────┐  │
│  │         OpenClaw Gateway v2026.2.3-1                  │  │
│  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐   │  │
│  │  │  Telegram   │  │  WebSocket  │  │  HTTP API   │   │  │
│  │  │   通道      │  │ 服务器     │  │ 接口       │   │  │
│  │  │  (端口: -)  │  │ (端口:18789)│  │ (端口:18789)│   │  │
│  │  └──────┬──────┘  └──────┬──────┘  └──────┬──────┘   │  │
│  │         │                │                 │          │  │
│  │         └────────────────┴─────────────────┘          │  │
│  │                          │                            │  │
│  │              ┌───────────┴───────────┐                │  │
│  │              │   Agent 处理引擎      │                │  │
│  │              │   (AI 模型: GPT-OSS)  │                │  │
│  │              └───────────┬───────────┘                │  │
│  │                          │                            │  │
│  │              ┌───────────┴───────────┐                │  │
│  │              │   工具路由层          │                │  │
│  │              │   (exec → Node)       │                │  │
│  │              └───────────┬───────────┘                │  │
│  └──────────────────────────┼────────────────────────────┘  │
└─────────────────────────────┼───────────────────────────────┘
                              │
                              │ WebSocket over SSH 隧道
                              │ (端口: 18790 → 18789)
                              │
┌─────────────────────────────┼───────────────────────────────┐
│                             ▼                               │
│                    本地 Mac 客户端                          │
│                                                             │
│  ┌───────────────────────────────────────────────────────┐  │
│  │         OpenClaw Node v2026.2.3-1 (<your-node-name>)  │  │
│  │                                                        │  │
│  │  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐   │  │
│  │  │  SSH 隧道   │  │  WebSocket  │  │  Exec       │   │  │
│  │  │  客户端     │  │  客户端     │  │  审批系统   │   │  │
│  │  │(launchd管理)│  │             │  │ (allowlist) │   │  │
│  │  └─────────────┘  └─────────────┘  └─────────────┘   │  │
│  │         │                │                 │          │  │
│  │         └────────────────┴─────────────────┘          │  │
│  │                          │                            │  │
│  │              ┌───────────┴───────────┐                │  │
│  │              │   本地执行层          │                │  │
│  │              │   - 文件读写          │                │  │
│  │              │   - 命令执行          │                │  │
│  │              │   - 浏览器控制        │                │  │
│  │              └───────────────────────┘                │  │
│  └───────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────┘

# 安装 fnm (Node 版本管理器)
curl -fsSL https://fnm.vercel.app/install | bash

# 加载 fnm
export PATH=$HOME/.local/share/fnm/bin:$PATH
eval $(fnm env)

# 安装 Node.js 22
fnm install 22
fnm use 22

# 验证
node -v  # v22.x.x
npm -v   # 10.x.x

{
  "gateway": {
    "mode": "local",
    "bind": "loopback",
    "port": 18789,
    "auth": {
      "mode": "token",
      "token": "your-secret-token-here"
    },
    "http": {
      "endpoints": {
        "chatCompletions": {
          "enabled": true
        }
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "openai-compat/openai/gpt-oss-120b"
      },
      "elevatedDefault": "full",
      "maxConcurrent": 4,
      "subagents": {
        "maxConcurrent": 8
      }
    }
  },
  "models": {
    "mode": "merge",
    "providers": {
      "openai-compat": {
        "baseUrl": "https://api.agentify.top/v1",
        "apiKey": "your-api-key-here",
        "api": "openai-completions",
        "models": [
          {
            "id": "openai/gpt-oss-120b",
            "name": "GPT-OSS-120B"
          }
        ]
      }
    }
  },
  "tools": {
    "allow": [
      "exec", "process", "read", "write", "edit",
      "web_search", "web_fetch", "cron"
    ],
    "elevated": {
      "enabled": true,
      "allowFrom": {
        "telegram": ["your-telegram-user-id"]
      }
    },
    "exec": {
      "backgroundMs": 10000,
      "timeoutSec": 1800,
      "cleanupMs": 1800000,
      "notifyOnExit": true
    }
  },
  "channels": {
    "telegram": {
      "enabled": true,
      "botToken": "your-telegram-bot-token",
      "dmPolicy": "pairing",
      "allowFrom": ["your-telegram-user-id"],
      "groupPolicy": "disabled",
      "groups": {
        "*": {
          "requireMention": true
        }
      }
    }
  },
  "plugins": {
    "entries": {
      "telegram": {
        "enabled": true
      }
    }
  }
}

mkdir -p ~/.config/systemd/user
cat > ~/.config/systemd/user/openclaw-gateway.service << 'EOF'
[Unit]
Description=OpenClaw Gateway (v2026.2.3-1)
After=network.target

[Service]
Type=simple
Environment="PATH=/home/ec2-user/.local/share/fnm/bin:/usr/local/bin:/usr/bin:/bin"
Environment="HOME=/home/ec2-user"
ExecStart=/bin/bash -c 'export PATH=/home/ec2-user/.local/share/fnm/bin:$PATH && eval $(fnm env) && openclaw gateway --port 18789'
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=default.target
EOF

# 启用并启动服务
systemctl --user daemon-reload
systemctl --user enable openclaw-gateway
systemctl --user start openclaw-gateway

# 验证状态
systemctl --user status openclaw-gateway

# 查看 Gateway 状态
systemctl --user status openclaw-gateway

# 重启 Gateway
systemctl --user restart openclaw-gateway

# 查看日志
journalctl --user -u openclaw-gateway -f

# Gateway CLI 命令
export PATH=$HOME/.local/share/fnm/bin:$PATH
eval $(fnm env)
openclaw --version
openclaw status
openclaw nodes status
openclaw models list

{
  "gateway": {
    "mode": "local",
    "bind": "loopback",
    "port": 18789,
    "auth": {
      "mode": "token",
      "token": "<your-gateway-token>"
    }
  },
  "channels": {
    "telegram": {
      "enabled": true,
      "dmPolicy": "pairing",
      "botToken": "<your-telegram-bot-token>",
      "allowFrom": ["<your-telegram-user-id>"],
      "groupPolicy": "disabled"
    }
  },
  "models": {
    "providers": {
      "openai-compat": {
        "baseUrl": "https://api.agentify.top/v1",
        "apiKey": "<your-api-key>",
        "models": [{"id": "openai/gpt-oss-120b"}]
      }
    }
  },
  "tools": {
    "exec": {
      "host": "node",
      "security": "allowlist",
      "node": "<your-node-name>"
    }
  }
}

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.openclaw.ssh-tunnel</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/bin/ssh</string>
        <string>-N</string>
        <string>-L</string>
        <string>18790:127.0.0.1:18789</string>
        <string>-i</string>
        <string>~/.ssh/openclaw.pem</string>
        <string>-o</string>
        <string>ServerAliveInterval=30</string>
        <string>-o</string>
        <string>ServerAliveCountMax=3</string>
        <string>-o</string>
        <string>ExitOnForwardFailure=yes</string>
        <string>-o</string>
        <string>StrictHostKeyChecking=yes</string>
        <string>ec2-user@<your-ec2-ip></string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <dict>
        <key>NetworkState</key>
        <true/>
    </dict>
    <key>ThrottleInterval</key>
    <integer>30</integer>
    <key>StandardOutPath</key>
    <string>/tmp/openclaw-ssh-tunnel.log</string>
    <key>StandardErrorPath</key>
    <string>/tmp/openclaw-ssh-tunnel.log</string>
</dict>
</plist>

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.openclaw.node</string>
    <key>ProgramArguments</key>
    <array>
        <string>/opt/homebrew/bin/openclaw</string>
        <string>node</string>
        <string>run</string>
        <string>--host</string>
        <string>127.0.0.1</string>
        <string>--port</string>
        <string>18790</string>
        <string>--display-name</string>
        <string><your-node-name></string>
    </array>
    <key>EnvironmentVariables</key>
    <dict>
        <key>OPENCLAW_GATEWAY_TOKEN</key>
        <string><your-gateway-token></string>
        <key>PATH</key>
        <string>/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
    </dict>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <dict>
        <key>NetworkState</key>
        <true/>
    </dict>
    <key>ThrottleInterval</key>
    <integer>15</integer>
    <key>StandardOutPath</key>
    <string>/tmp/openclaw-node.log</string>
    <key>StandardErrorPath</key>
    <string>/tmp/openclaw-node.log</string>
</dict>
</plist>

{
  "version": 1,
  "defaults": {
    "security": "allowlist",
    "ask": "off",
    "askFallback": "allowlist"
  },
  "agents": {
    "main": {
      "security": "allowlist",
      "ask": "off",
      "askFallback": "allowlist",
      "autoAllowSkills": true,
      "allowlist": [
        {"pattern": "/bin/sh"},
        {"pattern": "/bin/bash"},
        {"pattern": "/bin/ls"},
        {"pattern": "/bin/cat"},
        {"pattern": "/bin/echo"},
        {"pattern": "/usr/bin/find"},
        {"pattern": "/usr/bin/grep"},
        {"pattern": "/usr/bin/wc"},
        {"pattern": "/usr/bin/head"},
        {"pattern": "/usr/bin/tail"},
        {"pattern": "/usr/bin/file"},
        {"pattern": "/usr/bin/stat"},
        {"pattern": "/usr/bin/du"},
        {"pattern": "/usr/bin/df"},
        {"pattern": "/usr/bin/uname"},
        {"pattern": "/usr/bin/whoami"},
        {"pattern": "/usr/bin/sw_vers"},
        {"pattern": "/usr/bin/git"},
        {"pattern": "/usr/bin/python3"},
        {"pattern": "/usr/bin/open"},
        {"pattern": "/opt/homebrew/bin/*"}
      ]
    }
  }
}

# 停止服务
launchctl unload ~/Library/LaunchAgents/com.openclaw.node.plist
launchctl unload ~/Library/LaunchAgents/com.openclaw.ssh-tunnel.plist

# 启动服务
launchctl load ~/Library/LaunchAgents/com.openclaw.ssh-tunnel.plist
launchctl load ~/Library/LaunchAgents/com.openclaw.node.plist

# 查看日志
tail -f /tmp/openclaw-ssh-tunnel.log
tail -f /tmp/openclaw-node.log

# 终止现有隧道
pkill -f "ssh.*18790.*<your-ec2-ip-short>"

# 启动隧道
ssh -i ~/.ssh/openclaw.pem -N \
  -L 18790:127.0.0.1:18789 \
  -o ServerAliveInterval=30 \
  -o ServerAliveCountMax=3 \
  -o StrictHostKeyChecking=yes \
  ec2-user@<your-ec2-ip>

# 或后台运行
ssh -i ~/.ssh/openclaw.pem -N \
  -L 18790:127.0.0.1:18789 \
  -o ServerAliveInterval=30 \
  -o ServerAliveCountMax=3 \
  -f ec2-user@<your-ec2-ip>

# 设置环境变量
export OPENCLAW_GATEWAY_TOKEN="<your-gateway-token>"

# 启动 Node（前台）
openclaw node run \
  --host 127.0.0.1 \
  --port 18790 \
  --display-name "<your-node-name>"

# 或后台运行
export OPENCLAW_GATEWAY_TOKEN="<your-gateway-token>"
nohup openclaw node run \
  --host 127.0.0.1 \
  --port 18790 \
  --display-name "<your-node-name>" \
  > /tmp/openclaw-node-manual.log 2>&1 &

# 前台运行
export PATH=$HOME/.local/share/fnm/bin:$PATH
eval $(fnm env)
openclaw gateway --port 18789

# 或后台运行
export PATH=$HOME/.local/share/fnm/bin:$PATH
eval $(fnm env)
nohup openclaw gateway --port 18789 > /tmp/openclaw-gateway.log 2>&1 &

# 检查进程
ps aux | grep openclaw-gateway

# 停止进程
pkill -f openclaw-gateway

# 查看可用模型列表
openclaw models list

# 设置默认模型
openclaw models set openai-compat/openai/gpt-oss-120b

# 查看模型状态
openclaw models status

# 查看模型提供商状态
openclaw models providers

# 查看待配对请求
openclaw pairing list telegram

# 批准配对请求
openclaw pairing approve telegram <CODE>

# 拒绝配对请求
openclaw pairing deny telegram <CODE>

# 查看所有配对
openclaw pairing list

# 查看所有已配对节点
openclaw nodes list

# 查看节点详细描述
openclaw nodes describe --node <node-id>

# 查看待配对请求
openclaw nodes pending

# 批准节点配对
openclaw nodes approve <request-id>

# 重命名节点
openclaw nodes rename --node <id> --name "新名称"

# 在节点上执行命令（需节点支持 system.run）
openclaw nodes run --node <node-id> -- echo "Hello"

# 查看节点执行审批
openclaw approvals allowlist list --node <node-id>

# 查看配置
openclaw config get

# 查看特定配置项
openclaw config get gateway.port
openclaw config get channels.telegram.dmPolicy

# 设置配置项
openclaw config set tools.exec.host node
openclaw config set tools.exec.security allowlist

# 删除配置项
openclaw config unset tools.exec.node

# 查看 Gateway 状态
openclaw status

# 深度检查
openclaw status --deep

# 查看健康状态
openclaw health

# 发送测试消息到 Gateway
openclaw gateway send --agent main "测试消息"

#!/bin/bash
# backup-openclaw.sh

BACKUP_DIR="$HOME/openclaw-backup-$(date +%Y%m%d)"
mkdir -p "$BACKUP_DIR"

# Mac 本地
cp -r ~/.openclaw "$BACKUP_DIR/"
cp ~/.ssh/openclaw.pem "$BACKUP_DIR/"
cp ~/Library/LaunchAgents/com.openclaw.*.plist "$BACKUP_DIR/"

# EC2 (通过 SSH)
ssh -i ~/.ssh/openclaw.pem ec2-user@<your-ec2-ip> \
  'tar czf - -C /home/ec2-user .openclaw' > "$BACKUP_DIR/ec2-openclaw.tar.gz"

echo "备份完成: $BACKUP_DIR"