2026 OpenClaw Gateway production on Linux: onboard wizard, doctor --fix, HTTPS reverse proxy, upgrade and rollback

Running OpenClaw as a public-ish Gateway on a small Linux VPS is less about copy-pasting one config file and more about boring reliability: predictable ports, a single source of truth for auth tokens, TLS termination you can rotate, and a rollback path when the CLI moves faster than your runbook. Pair this with OpenClaw on Linux VPS: curl vs Docker, checks, FAQ for install layout, and with OpenClaw MCP server workflow notes when you split laptop stdio clients from the VPS edge.

What we actually care about in openclaw onboard

The onboarding wizard is the fastest way to end up with a coherent openclaw.json, workspace location, and Gateway auth story — especially on Linux where PATH, Node, and service units vary by image. Treat the wizard as a contract with your future self: pick bind addresses deliberately (loopback versus LAN versus tailnet), write down the Gateway token flow (file versus environment SecretRef), and decide up front whether you want the service installer to manage restarts. Non-interactive flags exist for cloud-init, but the first production pass should be interactive so a human confirms ports, auth mode, and channel scope.

Official CLI pages name openclaw onboard for guided setup and openclaw setup when you want initialization plus optional onboarding flags — log the output of openclaw config file and the owning UNIX user so rebuild scripts never write into the wrong home directory.

openclaw doctor and the --fix alias (repairs live here)

Upstream ships repairs under openclaw doctor: use --repair or its alias --fix to apply automatic fixes, --non-interactive for automation with safe migrations only, and --deep when you suspect duplicate Gateway installs from old experiments. If clients suddenly report unauthorized responses while nothing "changed" in Git, compare on-disk config with environment overrides — stale shell exports are a classic false trail. When channels look sick but the Gateway process is up, start with openclaw channels status --probe and follow the hints back to doctor rather than hand-editing half the tree.

Reproducible Linux cloud host steps (short and opinionated)

Provision Ubuntu 22.04/24.04 LTS or Debian 12, create a dedicated UNIX user, install the OpenClaw distribution your team standardizes on, and run onboarding once from a real TTY or SSH session with a known-good locale and UTF-8. Open only what you need in the security group: 22/tcp from admin IPs, 80 and 443/tcp from the world if you terminate TLS on this host, and nothing directly to the Gateway port from 0.0.0.0/0. Enable unattended security updates for the kernel stack, but pin OpenClaw upgrades to maintenance windows because feature flags evolve quickly between minor releases.

# Adjust install location to match your package or tarball layout
openclaw --version
openclaw config validate
openclaw gateway status
openclaw health

Nginx or Caddy HTTPS reverse proxy (terminates TLS, forwards to loopback)

Let the Gateway speak plain HTTP on 127.0.0.1 and move certificates, HTTP/2, rate limits, and access logs to the edge proxy — that keeps ACME renewal simple and avoids exposing Node directly. Issue certificates with your preferred ACME client, then proxy to the loopback listener your onboard run configured (verify the live port with openclaw gateway status instead of trusting a stale snippet). Preserve WebSocket upgrade headers if your Control UI or streaming clients need them, add a conservative upload cap so large attachments cannot wedge the worker, and mirror the same loopback target in Caddy with a short reverse_proxy site block if that is your edge of choice.

server {
  listen 443 ssl http2;
  server_name claw.example.com;
  # ssl_certificate ...; ssl_certificate_key ...;

  location / {
    proxy_pass http://127.0.0.1:<gateway-port>;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
  }
}

Upgrade and rollback without drama

Before openclaw update or package bumps, run openclaw backup create --verify (or snapshot ~/.openclaw plus the workspace with your orchestrator) and export the active openclaw.json into a private ops repository. Upgrade during a window when you can tolerate a brief disconnect, then run openclaw doctor --repair once to normalize migrated fields. Rollback is "restore the tarball or snapshot, reinstall the previous CLI build, restart the unit" — if rollback takes more than ten minutes, your backup scope is too narrow.

FAQ we file under "Gateway edge"

Do I need a separate openclaw fix command? Repairs are surfaced through openclaw doctor --repair (alias --fix); there is no standalone openclaw fix in the upstream tree we track.

Why do browsers work but automation fails? Check token SecretRefs, clock skew, and whether your proxy strips Authorization headers — compare curl against loopback versus through TLS.

Can I skip HTTPS? Only on trusted tailnets or lab VLANs; anything routable from the public Internet should terminate TLS and log at the proxy.