⚡ Setup Guide · VPS + Tailscale + Telegram

OpenClaw Zero to One
Setup Guide

Run your own always-on AI agent on a private server — for as little as $9.99/month. This guide covers the full stack: VPS provisioning, Tailscale security, OpenClaw install, Telegram integration, and hatching your first Claw.

~$10 per month (Hetzner KVM 2)
7 setup phases
24/7 always-on agent
0 subscription bypasses needed
INSIGHT
What Makes OpenClaw Different
Key ideas from CJ Hes & Alex Lieberman's walkthrough
🦀 What is OpenClaw? ▼

OpenClaw is an always-on AI agent that runs on your own server, 24/7 — even while you sleep. Think of it as Jarvis from Iron Man: it monitors channels, executes tasks, remembers your preferences, and can orchestrate sub-agents to do complex work autonomously.

Unlike Claude.ai or ChatGPT sessions, OpenClaw persists between conversations, builds long-term memory about you, and proactively does things without you asking.

🔐 Why Tailscale is Non-Negotiable ▼

The second you spin up a VPS, bots immediately start probing it. Tailscale creates a private network overlay that makes your server invisible to the public internet — only your devices can reach it.

⚠ Real Example
CJ had a dev server with nothing sensitive on it get compromised — someone put a crypto miner on it. Tailscale prevents exactly this.

Think of it as: your VPS moves from a public street address to a gated community where only you know the address.

📡 The Gateway — OpenClaw's Core Innovation ▼

The gateway is a message bus that runs 24/7 on your server. Everything flows through it:

  • Inputs: Messages from you (Telegram/Discord/Slack) + messages from sub-agents
  • Queue: Incoming messages wait in a queue
  • Main Agent: Picks up messages, takes action, orchestrates sub-agents
  • Outputs: Replies back to you + instructions to sub-agents

This is what enables true agent collaboration — your Claw can spin up a sub-agent, they communicate through the gateway, and you get a final result.

📝 Skills vs Hooks — Know the Difference ▼
ConceptWhat it isExample
SkillMarkdown file = instructions for a specific workflowGitHub PR flow, Notion writes, image generation
HookCode that fires when a specific event occursboot.md (runs on startup), command logger (records all actions)
💡 Pro Tip
Don't start with pre-built skills. Walk your Claw through a workflow manually 2–3 times, then say: "Based on this workflow, make a repeatable skill for yourself." Custom > generic.
REF
Core Concepts at a Glance
TermWhat it means
TailscalePrivate network overlay — makes VPS invisible to the public internet. Only your devices connect.
GatewayThe central message bus. Runs 24/7. Routes all messages between you, the Claw, and sub-agents.
SkillsMarkdown instruction files for specific workflows (think: YouTube tutorial for your agent).
HooksEvent-triggered code that fires when things happen (boot, command run, etc.).
HatchingFirst-run onboarding. The Claw wakes up and learns who you are.
BotFatherTelegram's official bot for creating new Telegram bots — used to get your bot token.
01
VPS Setup
Spin up your server on Hetzner
ℹ Recommended Provider
Hetzner — European company, reliable, great pricing. KVM 2 plan (~$9.99/mo) = 2 vCPU, 8GB RAM, 100GB NVMe. Choose Ubuntu 24.04 LTS.
Steps
1
Create a Hetzner account → click Add Server
2
Choose Ubuntu 24.04 LTS, US East (or nearest region)
3
Select KVM 2 plan (~$9.99/mo) — 8GB RAM recommended. 4GB works but 8GB is safer.
4
Add your SSH key during setup (this is the password between your laptop and server)
5
Give it a name (e.g. Jarvis, Ron) — you'll be talking to it
6
Note the public IP address — you'll need this next
⚠ Skip These
Volumes, firewalls, backups, placement groups — ignore all of these during initial setup.
02
Secure the Server
Use Claude Code locally to harden and isolate via Tailscale
💡 Use Claude Code for This
Open Claude Code locally. Paste your VPS IP + the OpenClaw setup guide. Let Claude handle the SSH commands and hardening — this is the fastest path.
Security Layers (Apply in Order)
1
Tell Claude: "Set this up and tell me when we can SSH into the VPS" — confirm connectivity
2
Tell Claude: "Set up Tailscale" → Claude installs it → approve the auth link in your browser
3
Your VPS now has a Tailscale IP — this is your new private-only address
4
Apply hardening: SSH keys-only (no passwords), UFW firewall, fail2ban intrusion prevention, auto-updates
5
Optional: "Red team this box. Find any security flaws." — Codex will find attack surface and suggest fixes
ℹ Security Principle
No single layer is bulletproof — stack them. Tailscale → UFW firewall → SSH key-only → fail2ban → auto-updates = robust defence in depth.
03
Install OpenClaw
Install Node, OpenClaw, and run onboarding on the VPS
Steps
1
Tell Claude: "Skip security for now. Install Node and OpenClaw. Don't run onboarding."
2
SSH directly into the VPS: ssh user@<tailscale-ip>
3
Run: openclaw onboard → select Quick Start
💡 Why Run Onboarding Yourself?
You can't have Claude do onboarding — you need to log into accounts (Codex, Telegram), approve redirects, and interact with the setup prompts directly. Plus, the hatching experience is fun.
ssh user@<your-tailscale-ip>
openclaw onboard
04
Connect Codex (Model Provider)
Log in with a Codex account for better rate limits and cost
Steps
1
In onboarding, choose Codex as the model provider
2
A URL appears in the terminal → open it in your browser → log in to your Codex account
3
Copy the redirect URL your browser shows after login — it won't open locally
4
Paste that redirect URL back into the OpenClaw terminal — this completes auth
5
Select model: GPT-4.5.3 Codex
⛔ Common Gotcha
The redirect URL after Codex login will NOT open in your local browser — it's trying to redirect to the remote machine. Copy it and paste it into the OpenClaw terminal instead.
05
Connect Telegram
Create a bot via BotFather and link it to your Claw
Steps
1
In onboarding, select Telegram as the messaging channel
2
Open Telegram → search for @BotFather → start a chat
3
Send: /newbot → give it a display name (e.g. Ron)
4
Choose a username ending in bot (e.g. RonJohnbot) — most short names are taken
5
Copy the bot token BotFather gives you → paste it into OpenClaw onboarding
6
Skip skills for now. Skip API keys for now. You can add these later.
06
Enable Hooks & Hatch
Install the gateway, enable memory hooks, and hatch your Claw
Steps
1
Enable ALL hooks — especially: boot.md (runs on startup) and command logger (records all actions for memory)
2
OpenClaw installs the gateway automatically — this is the message bus that runs 24/7
3
Run: openclaw hatch in your terminal
4
In Telegram, find your bot → tap Start → a pairing code appears
5
Paste the pairing code back into OpenClaw — Telegram and terminal are now linked
💡 Why Enable All Hooks?
Hooks are what give OpenClaw long-term memory. The command logger records everything it does — so it can reference past actions in future sessions. This is one of OpenClaw's biggest differentiators.
07
Configure Your Claw's Identity
Give it a personality, preferences, and context about who you are
Steps
1
Dump as much about yourself as possible: who you are, your preferences, your workflows, your goals
2
Give it a personality — example: "You are very sassy. You are opinionated and you act on those opinions."
3
Test it: say "hi" in Telegram — same agent, different channel than your terminal
4
When it does something wrong, ask it: "Why did you do that, and what can we do so you do it right in the future?"
💡 Building Workflows
Walk the Claw through a workflow manually 2–3 times (e.g., GitHub PR → preview deploy → browser test → ship). Then say: "Based on this workflow, make a repeatable skill for yourself."
REF
Which Model to Use
ModelUse CaseTrade-off
GPT-4.5.3 Codex Default for most use cases High rate limits, cost-effective, no subscription bypass needed
Claude Opus (Anthropic API) Complex agentic reasoning Best quality, but expensive — Claude Code sub token won't work here
⚠ Note
Anthropic has blocked Claude Code subscription tokens from being used with OpenClaw. If you use Anthropic API, you pay full API prices. Codex avoids this entirely.
REF
Best First Use Case
The "now what?" answer — lowest hanging fruit
💡 CJ's Recommendation
"If you had a perfect assistant, what would they do for you?" — That's your first use case. Start with the simplest version of task management.

The best starting point: personal assistant for email + Slack + task management.

  • Monitor your Slack channels and email inbox
  • Keep a self-updating task tracker
  • Message you daily with your to-dos and priorities
  • When it breaks, ask why — the amount it can self-correct will surprise you

Once this runs smoothly, expand to custom workflows specific to your work — GitHub PRs, content creation, research, client management, etc.

⚠
Watch-Outs & Gaps
What to be careful about
⛔ Don't Use 4GB RAM
It technically works but 8GB is strongly recommended. Don't cheap out on RAM — it's the difference between smooth operation and constant issues.
⛔ Don't Skip Tailscale
Your VPS gets probed by bots immediately after spin-up. Tailscale is not optional — it's the foundation of your security.
⚠ Codex Redirect URL
The redirect URL after logging in to Codex will NOT open locally — your browser is on a different machine than OpenClaw. Always copy and paste it back into the terminal.
⚠ "Now What?" is Real
Setup is half the battle. Many people get OpenClaw running, then stall. Have a first use case (email/Slack monitoring) queued up and ready to configure immediately after hatching.
ℹ What This Guide Doesn't Cover
Specific personal assistant workflow setup (email integration, Slack monitoring, task management config) — that's a Part 2 topic. This guide gets you to zero-to-one.
✓
Complete Setup Checklist
Tick off as you go — state saves automatically
Create Hetzner account + spin up Ubuntu 24.04 LTS, KVM 2 plan (8GB RAM)
Add SSH key during VPS setup — note the public IP
Use Claude Code locally to SSH into the VPS and confirm access
Install Tailscale via Claude — approve auth link — get Tailscale IP
Apply security hardening: SSH keys-only, UFW, fail2ban, auto-updates
Install Node and OpenClaw via Claude (don't run onboarding yet)
SSH into VPS using Tailscale IP → run openclaw onboard
Choose Codex → log in → copy redirect URL → paste it into terminal
Select model: GPT-4.5.3 Codex
Select Telegram → open @BotFather → /newbot → get token → paste into OpenClaw
Skip skills and API keys for now
Enable ALL hooks (boot.md + command logger most important)
Gateway installs automatically — run openclaw hatch
Open your Telegram bot → Start → get pairing code → paste into terminal
Configure identity: dump info about yourself, assign personality
Test: say "hi" in Telegram — same agent should respond
Set up first use case: email/Slack monitoring + task tracker

🦀 Your Claw is Hatched

You now have an always-on AI agent running on your own private server. Start with the personal assistant use case, build from there, and make it yours.