OpenClaw 云部署指南

使用 Tailscale 和 Brave Search 在 GCP 上部署 OpenClaw。

必需的环境变量

export OPENCLAW_PROJECT_ID="你的-gcp-项目"
export OPENCLAW_USERNAME="你的-ssh-用户名"
export ANTHROPIC_TOKEN="sk-ant-oat01-..."   # 请保密
export BRAVE_API_KEY="..."                   # 请保密

快速开始

chmod +x openclaw-quick-setup.sh
./openclaw-quick-setup.sh

手动设置（复制粘贴）

# 首先设置变量（见上文）
ZONE="us-central1-a"
VM="openclaw"

# 创建虚拟机
gcloud compute instances create "$VM" \
  --project="$OPENCLAW_PROJECT_ID" --zone="$ZONE" \
  --machine-type=e2-medium \
  --image-family=debian-12 --image-project=debian-cloud \
  --boot-disk-size=10GB \
  --metadata=ssh-keys="${OPENCLAW_USERNAME}:$(cat ~/.ssh/id_ed25519.pub)"

IP=$(gcloud compute instances describe "$VM" \
  --project="$OPENCLAW_PROJECT_ID" --zone="$ZONE" \
  --format='get(networkInterfaces[0].accessConfigs[0].natIP)')

# 等待 SSH 可用，然后运行设置
sleep 30
ssh -o StrictHostKeyChecking=no "${OPENCLAW_USERNAME}@${IP}" "
set -euo pipefail
sudo apt-get update && sudo apt-get install -y git curl ufw jq
curl -fsSL https://tailscale.com/install.sh | sh
"

# 手动步骤：授权 Tailscale
ssh "${OPENCLAW_USERNAME}@${IP}" "sudo tailscale up"

# 继续设置
ssh "${OPENCLAW_USERNAME}@${IP}" "
set -euo pipefail
sudo ufw allow 22/tcp && sudo ufw allow in on tailscale0 && echo y | sudo ufw enable
echo 'nameserver 8.8.8.8' | sudo tee -a /etc/resolv.conf
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
source ~/.nvm/nvm.sh && nvm install 22
source ~/.nvm/nvm.sh && npm install -g openclaw@latest
"

# 配置 OpenClaw（通过标准输入传递凭证）
ssh "${OPENCLAW_USERNAME}@${IP}" '
source ~/.nvm/nvm.sh
openclaw onboard --non-interactive --accept-risk \
  --auth-choice token --token-provider anthropic \
  --token "$(cat)" --gateway-bind loopback --install-daemon
' <<< "$ANTHROPIC_TOKEN"

# 添加 Brave API 密钥并启用 Tailscale 认证
ssh "${OPENCLAW_USERNAME}@${IP}" "
set -euo pipefail
mkdir -p ~/.config/systemd/user/openclaw-gateway.service.d
cat > ~/.config/systemd/user/openclaw-gateway.service.d/brave.conf << CONF
[Service]
Environment=\"BRAVE_API_KEY=\$(cat)\"
CONF
chmod 600 ~/.config/systemd/user/openclaw-gateway.service.d/brave.conf
systemctl --user daemon-reload
source ~/.nvm/nvm.sh
jq '.gateway.auth.allowTailscale = true' ~/.openclaw/openclaw.json > /tmp/oc.json
mv /tmp/oc.json ~/.openclaw/openclaw.json
chmod 600 ~/.openclaw/openclaw.json
openclaw gateway restart
sudo tailscale serve --bg 18789
" <<< "$BRAVE_API_KEY"

# 获取仪表板 URL
ssh "${OPENCLAW_USERNAME}@${IP}" "tailscale serve status"

# 首次浏览器访问后，批准设备
ssh "${OPENCLAW_USERNAME}@${IP}" 'source ~/.nvm/nvm.sh && openclaw devices list'
# 然后执行：openclaw devices approve <请求ID>

关键要点

安全说明

• 凭证通过标准输入 (<<<) 传递，而非命令行参数
• 配置文件权限设置为 chmod 600
• 网关仅绑定到环回地址，仅通过 Tailscale 暴露
• UFW 防火墙仅允许 SSH 和 Tailscale 入站连接