HN Showcase
Back to browse
GitHub Repository
0 starsShell

OpenClaw – Self-host OpenClaw in one command

by congzhangzh·Mar 8, 2026·2 points·0 comments
Visit ProjectView on HN

AI Analysis

●●SolidSolve My ProblemCozy

Layered security (LUKS+Debian+Docker+token auth) for self-hosted AI; one-command setup.

Strengths
  • •Genuine multi-layer security approach: encryption at rest, hardened base OS, container isolation, explicit auth
  • •Plain-text files on disk (no opaque volumes) + standard Unix tooling (ls, rsync) for transparency
  • •Clear philosophy document and pragmatic quick-start reduce friction for first-time users
Weaknesses
  • •Limited feature set—OpenClaw is the real product; this is just deployment scaffolding around it
  • •No clear evidence of security audit or production maturity; encryption story is solid but unvalidated
Target Audience

Privacy-conscious users, self-hosters, developers wanting encrypted local AI infrastructure

Similar To

Ollama (local AI) · LocalAI · Paperless-ngx (encrypted self-hosted document mgmt)

Post Description

Hi HN,

I got tired of trusting cloud services with my AI conversations — so I built the setup I actually wanted: encrypted disk, hardened OS, one-command deploy.

Demo: https://github.com/congzhangzh/your_openclaw/raw/main/demos/...

The idea is simple: if you're going to self-host AI, do it right — from the bare metal up.

Layer 1 — The disk: LUKS encryption + Btrfs compression (or ZFS native encryption). AI logs, API keys, model configs — everything at rest is encrypted. Someone pulls your disk? They get nothing.

Layer 2 — The OS: Debian Trixie. Stable, predictable, full toolchain. No surprise updates breaking your gateway at 3 AM.

Layer 3 — The container: Docker with Tini as PID 1 (proper signals, no zombies). Data lives on the host as plain files (~/.openclaw) — ls, cp, rsync. No opaque volumes.

Layer 4 — The gateway: OpenClaw with token auth + device approval. Connect Telegram and more. Guided onboard walks you through everything.

The whole setup:

git clone https://github.com/congzhangzh/your_openclaw.git && cd your_openclaw ./shell

That's it. `openclaw onboard` inside the container does the rest.

Built-in monitoring (btop, nload, iftop) in the container. Ctrl+P, Ctrl+Q to detach — gateway runs 24/7.

Repo includes VPS disk encryption guides and provider recommendations. MIT-licensed. I use this daily on a cheap European VPS.

Feedback welcome: - Is the layered security overkill or just right? - Are you encrypting your VPS disks? - What AI backends are you running?

GitHub: https://github.com/congzhangzh/your_openclaw

Similar Projects

Infrastructure●●Solid

Clawstash – Encrypted incremental backups for OpenClaw

Nice little CLI: one-liner install and an interactive 'clawstash setup' get you an hourly daemon that auto-downloads restic and uploads AES-256 encrypted, deduplicated blocks to any S3-compatible store. It's pragmatic and tightly scoped — excellent if you run OpenClaw, but mostly a focused wrapper around restic rather than a novel backup system.

Niche GemSolve My Problem
a_micali
214mo ago
AI/ML●●Solid

SwarmClaw – Manage a swarm of OpenClaw agents from one self-hosted UI

OpenClaw orchestration with MCP support, but agent management is crowded.

Ship ItNiche Gem
jamesweb
403mo ago