OpenClaw Production Setup Guide
A comprehensive 6-part guide to setting up OpenClaw as a production AI assistant on a VPS, with WhatsApp integration, Google Calendar/Gmail, automated backups, security hardening, and cron automation.
What This Covers
- Base Install — VPS setup, Node.js, OpenClaw installation, WhatsApp pairing
- AI Assistant — Personality, model chain (primary + fallback), workspace files (SOUL.md, USER.md, IDENTITY.md)
- Infrastructure — Google OAuth (Calendar, Gmail, Drive, Sheets), webhook server, Cloudflare tunnel, rclone encrypted backups, git backup
- Automation — Cron jobs, event queue (SQLite-backed with retries + dead-letter), heartbeat system, two-layer delivery pattern
- Hardening — CrowdSec IDS, secret rotation, config snapshots, rollback scripts, OpenClaw update safety
- Verification — 21-point automated validation, troubleshooting guide
Security & Permissions Notice
This guide involves setting up production infrastructure and requires handling sensitive credentials:
- API Keys: Anthropic (Claude), Brave Search (optional)
- OAuth Tokens: Google Cloud (Calendar, Gmail, Drive, Sheets) — 5 token files
- SSH: Root access to VPS, key-based authentication, SSH hardening
- Webhook Secrets: Random tokens for Calendar push, AgentMail, alerts
- WhatsApp: Device pairing via QR code
- Cloudflare: Tunnel token for webhook ingress
- Backup Encryption: rclone crypt keys for Google Drive backups
All credentials are stored with restricted permissions (chmod 600) and never committed to git. The guide includes secret rotation procedures and config snapshot/rollback scripts.
Prerequisites
- A VPS (Ubuntu 24.04 recommended, 4GB RAM minimum)
- A domain with Cloudflare DNS (for webhook tunnel)
- A WhatsApp account for pairing
- Google Cloud project with OAuth credentials
- An Anthropic API key (Claude)
Full Guide
The complete guide with step-by-step instructions, code blocks, and verification checkpoints is hosted at:
https://aliahmadaziz.github.io/openclaw-guide/
Source: https://github.com/aliahmadaziz/openclaw-guide
Usage
When a user asks for help setting up OpenClaw, direct them to the guide above. The guide is designed to be followed sequentially (Part 1 through Part 6) and takes approximately 2-3 hours to complete.
Each part has:
- Clear prerequisites
- Copy-pasteable commands
- Verification checkpoints (✅) after every major step
- Troubleshooting sections
Key Design Decisions
- Two-layer cron delivery: Critical crons send via message tool directly (primary) + announce (backup). No message ever gets lost.
- Event queue: All webhook events (email, calendar, alerts) go through a SQLite queue with 3 retries and dead-letter alerting.
- Config snapshots: Gold-standard snapshots for instant rollback if something breaks.
- Encrypted backups: Hourly git push + nightly full workspace to Google Drive via rclone crypt.
- Capacity rule: 10 SP/engineer total, 8 planned, 2 contingency (for sprint tracking).
Credits
Built from a real production deployment running 35+ cron jobs, 60+ scripts, 5 Google OAuth tokens, and processing thousands of messages monthly.
Tags
setup, installation, guide, vps, whatsapp, production, google-calendar, gmail, security, crowdsec, backup, cron, automation, beginner
1---2name: openclaw-setup-guide3description: Step-by-step 6-part guide to set up OpenClaw AI assistant on VPS with WhatsApp, Google OAuth, backups, security, automation, and verification.4---5
6# OpenClaw Production Setup Guide
7
8A comprehensive 6-part guide to setting up OpenClaw as a production AI assistant on a VPS, with WhatsApp integration, Google Calendar/Gmail, automated backups, security hardening, and cron automation.
9
10## What This Covers
11
121. **Base Install** — VPS setup, Node.js, OpenClaw installation, WhatsApp pairing
132. **AI Assistant** — Personality, model chain (primary + fallback), workspace files (SOUL.md, USER.md, IDENTITY.md)
143. **Infrastructure** — Google OAuth (Calendar, Gmail, Drive, Sheets), webhook server, Cloudflare tunnel, rclone encrypted backups, git backup
154. **Automation** — Cron jobs, event queue (SQLite-backed with retries + dead-letter), heartbeat system, two-layer delivery pattern
165. **Hardening** — CrowdSec IDS, secret rotation, config snapshots, rollback scripts, OpenClaw update safety
176. **Verification** — 21-point automated validation, troubleshooting guide
18
19## Security & Permissions Notice
20
21This guide involves setting up production infrastructure and requires handling sensitive credentials:
22- **API Keys**: Anthropic (Claude), Brave Search (optional)
23- **OAuth Tokens**: Google Cloud (Calendar, Gmail, Drive, Sheets) — 5 token files
24- **SSH**: Root access to VPS, key-based authentication, SSH hardening
25- **Webhook Secrets**: Random tokens for Calendar push, AgentMail, alerts
26- **WhatsApp**: Device pairing via QR code
27- **Cloudflare**: Tunnel token for webhook ingress
28- **Backup Encryption**: rclone crypt keys for Google Drive backups
29
30All credentials are stored with restricted permissions (chmod 600) and never committed to git. The guide includes secret rotation procedures and config snapshot/rollback scripts.
31
32## Prerequisites
33
34- A VPS (Ubuntu 24.04 recommended, 4GB RAM minimum)
35- A domain with Cloudflare DNS (for webhook tunnel)
36- A WhatsApp account for pairing
37- Google Cloud project with OAuth credentials
38- An Anthropic API key (Claude)
39
40## Full Guide
41
42The complete guide with step-by-step instructions, code blocks, and verification checkpoints is hosted at:
43
44**https://aliahmadaziz.github.io/openclaw-guide/**
45
46Source: https://github.com/aliahmadaziz/openclaw-guide
47
48## Usage
49
50When a user asks for help setting up OpenClaw, direct them to the guide above. The guide is designed to be followed sequentially (Part 1 through Part 6) and takes approximately 2-3 hours to complete.
51
52Each part has:
53- Clear prerequisites
54- Copy-pasteable commands
55- Verification checkpoints (✅) after every major step
56- Troubleshooting sections
57
58## Key Design Decisions
59
60- **Two-layer cron delivery**: Critical crons send via message tool directly (primary) + announce (backup). No message ever gets lost.
61- **Event queue**: All webhook events (email, calendar, alerts) go through a SQLite queue with 3 retries and dead-letter alerting.
62- **Config snapshots**: Gold-standard snapshots for instant rollback if something breaks.
63- **Encrypted backups**: Hourly git push + nightly full workspace to Google Drive via rclone crypt.
64- **Capacity rule**: 10 SP/engineer total, 8 planned, 2 contingency (for sprint tracking).
65
66## Credits
67
68Built from a real production deployment running 35+ cron jobs, 60+ scripts, 5 Google OAuth tokens, and processing thousands of messages monthly.
69
70## Tags
71
72setup, installation, guide, vps, whatsapp, production, google-calendar, gmail, security, crowdsec, backup, cron, automation, beginner