Openclaw Infra

OpenClaw Infrastructure

Self-hosted [OpenClaw](https://openclaw.ai) gateway on a Hetzner VPS with zero-trust Tailscale networking. No public ports exposed. ~€11.39/month.

**This is a reference template.** Clone it and adapt for your own deployment — the config values (timezone, model, cron prompts) are working examples you'll customize.

Features

• Cheap: Hetzner CX43 x86 (8 vCPU, 16 GB) €9.49/mo + backups (€11.39/mo total)
• Secure: Hetzner firewall + UFW + Tailscale-only access + device pairing
• Simple: Pulumi IaC, single command deploy, systemd user service
• Telegram: Optional scheduled tasks (configurable cron jobs)
• Workspace sync: Optional hourly git backup of the agent's workspace to GitHub

Prerequisites

• Node.js 18+
• Pulumi CLI
• Ansible (pip install ansible)
• Tailscale installed and connected on your machine
• Hetzner Cloud API token (console.hetzner.cloud)
• Tailscale auth key (login.tailscale.com/admin/settings/keys)
• Tailscale MagicDNS and HTTPS enabled (login.tailscale.com/admin/dns) — required for Tailscale Serve
• Claude setup token (run claude setup-token)

See [CLAUDE.md](./CLAUDE.md#first-time-setup) for detailed setup instructions.

First-Time Tailscale Setup

If you've never used Tailscale before:

1. **Create account**: Go to https://tailscale.com/start

   • Sign up with GitHub (recommended for infra projects), Google, or email
   • Free tier supports up to 100 devices

2. **Install on your Mac**:

   brew install --cask tailscale

   • Open Tailscale from Applications
   • Click "Allow" for System Extension and VPN Configuration prompts
   • Click menu bar icon → Log in → Authorize in browser

3. **Generate auth key for serv