Infrastructure-as-code for deploying OpenClaw on a Hetzner Cloud VPS inside Docker. Terraform provisions the VPS, Ansible handles deployment, Docker Compose runs the services — all driven by make.

Section	What’s inside
Getting Started	Prerequisites, installation, first deploy
Configuration	OpenClaw config, secrets, version pinning
Guides	Skills, headless browser, agents, workspace sync, lossless context
Operations	Make targets reference, update/backup/restore workflows
Security	Firewall, SSH hardening, SOPS encryption, fail2ban
Add-ons	Optional extensions (morning weather report, …)

OpenClaw Deploy

Self-hosted AI assistant infrastructure — one-command Hetzner VPS provisioning with Terraform, Ansible, and Docker

Agents & Sessions

Agents OpenClaw supports multiple isolated agents, each with their own workspace and model. Define them in openclaw.json under agents.list. Adding an Agent 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 { "agents": { "list": [ { "id": "main", "workspace": "~/.openclaw/workspace", "default": true }, { "id": "researcher", "workspace": "~/.openclaw/workspace-researcher", "model": "anthropic/claude-haiku-4-5" } ] } } Then deploy: ...

Lossless Context

lossless-claw — Lossless Context Management What lossless-claw is an OpenClaw plugin that replaces the built-in sliding-window compaction with a DAG-based summarization system. Instead of truncating older messages when context fills up, it: Persists every message in a SQLite database Summarizes chunks of older messages into compressed nodes Condenses summaries into higher-level nodes as they accumulate (forming a DAG) Assembles context each turn by combining summaries + recent raw messages Provides agent tools (lcm_grep, lcm_describe, lcm_expand) so the agent can search and recall details from compacted history Why we install it The problem: Without LCM, OpenClaw’s default compaction simply drops older messages when context fills up. In long conversations (multi-hour sessions, daily check-ins), context gets lost — the agent forgets decisions made hours or days ago. ...

Skills & Tools

Skills OpenClaw is extended via skills — slash commands, hooks, templates, and tool definitions. docker/skills-manifest.txt lists which skills are auto-installed at container startup via clawhub install. Adding a ClawHub Skill ClawHub is the community skill registry. Find the skill at clawhub.ai (e.g. pdf, jira) Add it to docker/skills-manifest.txt: 1 pdf Rebuild and deploy (the manifest is baked into the image): 1 make deploy REBUILD=1 Included Skills Skill Description yt YouTube transcript fetching and video search agent-browser Headless browser for JS-heavy/paywalled pages system-monitor CPU/RAM/GPU status check conventional-commits Format commit messages per convention github GitHub issues, PRs, CI runs via gh CLI summarize Summarize URLs, PDFs, images, audio, YouTube weather Weather lookup

Headless Browser

Headless Browser The stack includes a chromium container (chromedp/headless-shell) so OpenClaw can use the browser tool on the VPS — useful for scraping JS-heavy or paywalled pages via the agent-browser skill. How It Works Chrome’s CDP endpoint rejects WebSocket connections where the Host header is not an IP address or localhost (DNS rebinding protection). To work around this without a proxy, the chromium service is assigned a static IP (172.20.0.10) on a custom Docker bridge subnet (172.20.0.0/24). OpenClaw connects directly to http://172.20.0.10:9222 — Chrome accepts IP addresses unconditionally. ...

Workspace Git Sync

Workspace Git Sync Back up ~/.openclaw/workspace to a private GitHub repo automatically. Runs as a native cron job on the VPS, pushing to a configurable branch (default: auto). Setup Add to secrets/.env: 1 2 3 4 GIT_WORKSPACE_REPO=your-username/openclaw-workspace GIT_WORKSPACE_BRANCH=auto GIT_WORKSPACE_TOKEN=ghp_your_personal_access_token GIT_WORKSPACE_SYNC_SCHEDULE=0 4 * * * The cron job auto-enables when GIT_WORKSPACE_REPO is set. Deploy with make deploy. Operations 1 2 3 4 5 # Trigger sync immediately make workspace-sync # Disable: remove or clear GIT_WORKSPACE_REPO from .env and redeploy make deploy Logs The cron job writes to ~/openclaw/logs/workspace-sync.log on the VPS: ...