grep -q 'NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache' ~/.bashrc || cat >> ~/.bashrc <<'EOF'
export NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache
mkdir -p /var/tmp/openclaw-compile-cache
export OPENCLAW_NO_RESPAWN=1
EOF
source ~/.bashrc

systemctl --user edit openclaw-gateway.service

[Service]
Environment=OPENCLAW_NO_RESPAWN=1
Environment=NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache
Restart=always
RestartSec=2
TimeoutStartSec=90

# Create a new Fly app (pick your own name)
fly apps create my-openclaw

# Create a persistent volume (1GB is usually enough)
fly volumes create openclaw_data --size 1 --region iad
```

**提示：** 选择离你较近的区域。常见选项：`lhr`（伦敦）、`iad`（弗吉尼亚）、`sjc`（圣何塞）。

**安全注意事项：** 默认配置会暴露一个公开 URL。若要使用没有公网 IP 的加固部署，请参阅[私有部署](#private-deployment-hardened)，或使用 `deploy/fly.private.toml`。

```toml
app = "my-openclaw"  # Your app name
primary_region = "iad"

[build]
  dockerfile = "Dockerfile"

[env]
  NODE_ENV = "production"
  OPENCLAW_PREFER_PNPM = "1"
  OPENCLAW_STATE_DIR = "/data"
  NODE_OPTIONS = "--max-old-space-size=1536"

[processes]
  app = "node dist/index.js gateway --allow-unconfigured --port 3000 --bind lan"

[http_service]
  internal_port = 3000
  force_https = true
  auto_stop_machines = false
  auto_start_machines = true
  min_machines_running = 1
  processes = ["app"]

[[vm]]
  size = "shared-cpu-2x"
  memory = "2048mb"

[mounts]
  source = "openclaw_data"
  destination = "/data"
```

OpenClaw Docker 镜像使用 `tini` 作为其入口点。Fly 进程命令会替换 Docker `CMD`，但不会替换 `ENTRYPOINT`，因此进程仍会在 `tini` 下运行。

**关键设置：**

| 设置                           | 原因                                                                        |
| ------------------------------ | --------------------------------------------------------------------------- |
| `--bind lan`                   | 绑定到 `0.0.0.0`，让 Fly 的代理可以访问 Gateway 网关                        |
| `--allow-unconfigured`         | 在没有配置文件时启动（之后你会创建一个）                                    |
| `internal_port = 3000`         | 必须匹配 `--port 3000`（或 `OPENCLAW_GATEWAY_PORT`），供 Fly 健康检查使用   |
| `memory = "2048mb"`            | 512MB 太小；建议 2GB                                                        |
| `OPENCLAW_STATE_DIR = "/data"` | 将状态持久化到卷上                                                          |

# Model provider API keys
fly secrets set ANTHROPIC_API_KEY=sk-ant-...

# Optional: Other providers
fly secrets set OPENAI_API_KEY=sk-...
fly secrets set GOOGLE_API_KEY=...

# Channel tokens
fly secrets set DISCORD_BOT_TOKEN=MTQ...
```

**注意：**

- 非 local loopback 绑定（`--bind lan`）需要有效的 Gateway 网关认证路径。这个 Fly.io 示例使用 `OPENCLAW_GATEWAY_TOKEN`，但 `gateway.auth.password` 或正确配置的非 local loopback `trusted-proxy` 部署也满足要求。
- 像对待密码一样对待这些 token。
- **对于所有 API key 和 token，优先使用环境变量而不是配置文件**。这样可以避免密钥进入 `openclaw.json`，从而降低被意外暴露或记录到日志中的风险。

首次部署会构建 Docker 镜像（约 2-3 分钟）。后续部署会更快。

部署后，验证：

```bash
fly status
fly logs
```

你应该会看到：

```
[gateway] listening on ws://0.0.0.0:3000 (PID xxx)
[discord] logged in to discord as xxx
```

```bash
fly ssh console
```

创建配置目录和文件：

```bash
mkdir -p /data
cat > /data/openclaw.json << 'EOF'
{
  "agents": {
    "defaults": {
      "model": {
        "primary": "anthropic/claude-opus-4-6",
        "fallbacks": ["anthropic/claude-sonnet-4-6", "openai/gpt-5.4"]
      },
      "maxConcurrent": 4
    },
    "list": [
      {
        "id": "main",
        "default": true
      }
    ]
  },
  "auth": {
    "profiles": {
      "anthropic:default": { "mode": "token", "provider": "anthropic" },
      "openai:default": { "mode": "token", "provider": "openai" }
    }
  },
  "bindings": [
    {
      "agentId": "main",
      "match": { "channel": "discord" }
    }
  ],
  "channels": {
    "discord": {
      "enabled": true,
      "groupPolicy": "allowlist",
      "guilds": {
        "YOUR_GUILD_ID": {
          "channels": { "general": { "allow": true } },
          "requireMention": false
        }
      }
    }
  },
  "gateway": {
    "mode": "local",
    "bind": "auto",
    "controlUi": {
      "allowedOrigins": [
        "https://my-openclaw.fly.dev",
        "http://localhost:3000",
        "http://127.0.0.1:3000"
      ]
    }
  },
  "meta": {}
}
EOF
```

**注意：** 设置 `OPENCLAW_STATE_DIR=/data` 后，配置路径是 `/data/openclaw.json`。

**注意：** 将 `https://my-openclaw.fly.dev` 替换为你真实的 Fly 应用源。Gateway 网关启动时会根据运行时 `--bind` 和 `--port` 值初始化本地 Control UI 源，因此首次启动可以在配置尚不存在时继续进行，但通过 Fly 的浏览器访问仍需要在 `gateway.controlUi.allowedOrigins` 中列出精确的 HTTPS 源。

**注意：** Discord token 可以来自以下任一位置：

- 环境变量：`DISCORD_BOT_TOKEN`（推荐用于密钥）
- 配置文件：`channels.discord.token`

如果使用环境变量，就不需要将 token 添加到配置中。Gateway 网关会自动读取 `DISCORD_BOT_TOKEN`。

重启以应用：

```bash
exit
fly machine restart <machine-id>
```

在浏览器中打开：

```bash
fly open
```

或访问 `https://my-openclaw.fly.dev/`

使用已配置的共享密钥进行认证。本指南使用来自 `OPENCLAW_GATEWAY_TOKEN` 的 Gateway 网关 token；如果你切换到了密码认证，请改用该密码。

### 日志

```bash
fly logs              # Live logs
fly logs --no-tail    # Recent logs
```

### SSH 控制台

```bash
fly ssh console
```

[[vm]]
  memory = "2048mb"

fly machine update <machine-id> --vm-memory 2048 -y

fly ssh console --command "rm -f /data/gateway.*.lock"
fly machine restart <machine-id>

fly ssh console --command "cat /data/openclaw.json"

# Use echo + tee (pipe from local to remote)
echo '{"your":"config"}' | fly ssh console -C "tee /data/openclaw.json"

# Or use sftp
fly sftp shell
> put /local/path/config.json /data/openclaw.json

fly ssh console --command "rm /data/openclaw.json"

# Pull latest changes
git pull

# Redeploy
fly deploy

# Check health
fly status
fly logs

# Get machine ID
fly machines list

# Update command
fly machine update <machine-id> --command "node dist/index.js gateway --port 3000 --bind lan" -y

# Or with memory increase
fly machine update <machine-id> --vm-memory 2048 --command "node dist/index.js gateway --port 3000 --bind lan" -y

# Deploy with private config
fly deploy -c deploy/fly.private.toml

# List current IPs
fly ips list -a my-openclaw

# Release public IPs
fly ips release <public-ipv4> -a my-openclaw
fly ips release <public-ipv6> -a my-openclaw

# Switch to private config so future deploys don't re-allocate public IPs
# (remove [http_service] or deploy with the private template)
fly deploy -c deploy/fly.private.toml

# Allocate private-only IPv6
fly ips allocate-v6 --private -a my-openclaw

VERSION  IP                   TYPE             REGION
v6       fdaa:x:x:x:x::x      private          global

# Forward local port 3000 to the app
fly proxy 3000:3000 -a my-openclaw

# Then open http://localhost:3000 in browser

# Create WireGuard config (one-time)
fly wireguard create

# Import to WireGuard client, then access via internal IPv6
# Example: http://[fdaa:x:x:x:x::x]:3000

fly ssh console -a my-openclaw

{
  plugins: {
    entries: {
      "voice-call": {
        enabled: true,
        config: {
          provider: "twilio",
          tunnel: { provider: "ngrok" },
          webhookSecurity: {
            allowedHosts: ["example.ngrok.app"],
          },
        },
      },
    },
  },
}

以 root 身份连接：

```bash
ssh root@YOUR_VPS_IP
```

本指南假设该 VPS 是有状态的。
不要将它视为一次性基础设施。

验证：

```bash
docker --version
docker compose version
```

本指南假设你会构建一个自定义镜像，以保证二进制文件持久存在。

```bash
mkdir -p /root/.openclaw/workspace

# Set ownership to the container user (uid 1000):
chown -R 1000:1000 /root/.openclaw
```

```bash
OPENCLAW_IMAGE=openclaw:latest
OPENCLAW_GATEWAY_TOKEN=
OPENCLAW_GATEWAY_BIND=lan
OPENCLAW_GATEWAY_PORT=18789

OPENCLAW_CONFIG_DIR=/root/.openclaw
OPENCLAW_WORKSPACE_DIR=/root/.openclaw/workspace

GOG_KEYRING_PASSWORD=
XDG_CONFIG_HOME=/home/node/.openclaw
```

如果你想通过 `.env` 管理稳定的 Gateway 网关
令牌，请设置 `OPENCLAW_GATEWAY_TOKEN`；否则，请先配置 `gateway.auth.token`，
再依赖客户端在重启后继续使用。如果两个来源都不存在，OpenClaw 会为该次启动
使用仅运行时令牌。生成一个密钥环密码，并将其粘贴到 `GOG_KEYRING_PASSWORD`：

```bash
openssl rand -hex 32
```

**不要提交此文件。**

此 `.env` 文件用于容器/运行时环境变量，例如 `OPENCLAW_GATEWAY_TOKEN`。
存储的提供商 OAuth/API-key 身份验证位于挂载的
`~/.openclaw/agents/<agentId>/agent/auth-profiles.json`。

```yaml
services:
  openclaw-gateway:
    image: ${OPENCLAW_IMAGE}
    build: .
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - HOME=/home/node
      - NODE_ENV=production
      - TERM=xterm-256color
      - OPENCLAW_GATEWAY_BIND=${OPENCLAW_GATEWAY_BIND}
      - OPENCLAW_GATEWAY_PORT=${OPENCLAW_GATEWAY_PORT}
      - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
      - GOG_KEYRING_PASSWORD=${GOG_KEYRING_PASSWORD}
      - XDG_CONFIG_HOME=${XDG_CONFIG_HOME}
      - PATH=/home/linuxbrew/.linuxbrew/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
    volumes:
      - ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
      - ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
    ports:
      # Recommended: keep the Gateway loopback-only on the VPS; access via SSH tunnel.
      # To expose it publicly, remove the `127.0.0.1:` prefix and firewall accordingly.
      - "127.0.0.1:${OPENCLAW_GATEWAY_PORT}:18789"
    command:
      [
        "node",
        "dist/index.js",
        "gateway",
        "--bind",
        "${OPENCLAW_GATEWAY_BIND}",
        "--port",
        "${OPENCLAW_GATEWAY_PORT}",
        "--allow-unconfigured",
      ]
```

`--allow-unconfigured` 仅用于便捷引导，它不能替代正确的 Gateway 网关配置。仍需设置身份验证（`gateway.auth.token` 或密码），并为你的部署使用安全的绑定设置。

- [将所需二进制文件烘焙进镜像](/zh-CN/install/docker-vm-runtime#bake-required-binaries-into-the-image)
- [构建并启动](/zh-CN/install/docker-vm-runtime#build-and-launch)
- [哪些内容会持久化到哪里](/zh-CN/install/docker-vm-runtime#what-persists-where)
- [更新](/zh-CN/install/docker-vm-runtime#updates)

**前提条件：**确保你的 VPS sshd 配置允许 TCP 转发。如果你
加固过 SSH 配置，请检查 `/etc/ssh/sshd_config` 并设置：

```
AllowTcpForwarding local
```

`local` 允许从你的笔记本电脑使用 `ssh -L` 本地转发，同时阻止
来自服务器的远程转发。将其设置为 `no` 会导致隧道失败，
并显示：
`channel 3: open failed: administratively prohibited: open failed`

确认已启用 TCP 转发后，重启 SSH 服务
（`systemctl restart ssh`），并从你的笔记本电脑运行隧道：

```bash
ssh -N -L 18789:127.0.0.1:18789 root@YOUR_VPS_IP
```

打开：

`http://127.0.0.1:18789/`

粘贴已配置的共享密钥。本指南默认使用 Gateway 网关令牌；如果你已切换到密码身份验证，请改用该密码。

从 [https://cloud.google.com/sdk/docs/install](https://cloud.google.com/sdk/docs/install) 安装

初始化并认证：

```bash
gcloud init
gcloud auth login
```

**选项 B：Cloud Console**

所有步骤都可以通过 [https://console.cloud.google.com](https://console.cloud.google.com) 的网页 UI 完成

```bash
gcloud projects create my-openclaw-project --name="OpenClaw Gateway"
gcloud config set project my-openclaw-project
```

在 [https://console.cloud.google.com/billing](https://console.cloud.google.com/billing) 启用结算（Compute Engine 必需）。

启用 Compute Engine API：

```bash
gcloud services enable compute.googleapis.com
```

**Console：**

1. 前往 IAM & Admin > Create Project
2. 命名并创建
3. 为项目启用结算
4. 导航到 APIs & Services > Enable APIs > 搜索 “Compute Engine API” > Enable

| 类型      | 规格                    | 费用               | 备注                                        |
| --------- | ------------------------ | ------------------ | -------------------------------------------- |
| e2-medium | 2 vCPU，4GB RAM          | 约 25 美元/月      | 本地 Docker 构建最可靠        |
| e2-small  | 2 vCPU，2GB RAM          | 约 12 美元/月      | Docker 构建的最低推荐配置         |
| e2-micro  | 2 vCPU（共享），1GB RAM | 符合免费层条件 | Docker 构建常因 OOM 失败（退出 137） |

**CLI：**

```bash
gcloud compute instances create openclaw-gateway \
  --zone=us-central1-a \
  --machine-type=e2-small \
  --boot-disk-size=20GB \
  --image-family=debian-12 \
  --image-project=debian-cloud
```

**Console：**

1. 前往 Compute Engine > VM instances > Create instance
2. 名称：`openclaw-gateway`
3. 区域：`us-central1`，可用区：`us-central1-a`
4. 机器类型：`e2-small`
5. 启动磁盘：Debian 12，20GB
6. 创建

```bash
gcloud compute ssh openclaw-gateway --zone=us-central1-a
```

**Console：**

在 Compute Engine 控制台中点击你的 VM 旁边的 “SSH” 按钮。

注意：创建 VM 后，SSH 密钥传播可能需要 1-2 分钟。如果连接被拒绝，请等待后重试。

退出并重新登录，使组变更生效：

```bash
exit
```

然后重新 SSH 进入：

```bash
gcloud compute ssh openclaw-gateway --zone=us-central1-a
```

验证：

```bash
docker --version
docker compose version
```

本指南假设你将构建自定义镜像，以保证二进制文件持久存在。

```bash
mkdir -p ~/.openclaw
mkdir -p ~/.openclaw/workspace
```

```bash
OPENCLAW_IMAGE=openclaw:latest
OPENCLAW_GATEWAY_TOKEN=
OPENCLAW_GATEWAY_BIND=lan
OPENCLAW_GATEWAY_PORT=18789

OPENCLAW_CONFIG_DIR=/home/$USER/.openclaw
OPENCLAW_WORKSPACE_DIR=/home/$USER/.openclaw/workspace

GOG_KEYRING_PASSWORD=
XDG_CONFIG_HOME=/home/node/.openclaw
```

如果你想通过 `.env` 管理稳定的网关令牌，请设置 `OPENCLAW_GATEWAY_TOKEN`；
否则请在依赖客户端跨重启连接之前配置 `gateway.auth.token`。
如果两个来源都不存在，OpenClaw 会为该次启动使用仅运行时有效的令牌。
生成一个 keyring 密码并粘贴到 `GOG_KEYRING_PASSWORD`：

```bash
openssl rand -hex 32
```

**不要提交此文件。**

此 `.env` 文件用于容器/运行时环境变量，例如 `OPENCLAW_GATEWAY_TOKEN`。
已存储的提供商 OAuth/API key 认证位于挂载的
`~/.openclaw/agents/<agentId>/agent/auth-profiles.json`。

```yaml
services:
  openclaw-gateway:
    image: ${OPENCLAW_IMAGE}
    build: .
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - HOME=/home/node
      - NODE_ENV=production
      - TERM=xterm-256color
      - OPENCLAW_GATEWAY_BIND=${OPENCLAW_GATEWAY_BIND}
      - OPENCLAW_GATEWAY_PORT=${OPENCLAW_GATEWAY_PORT}
      - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
      - GOG_KEYRING_PASSWORD=${GOG_KEYRING_PASSWORD}
      - XDG_CONFIG_HOME=${XDG_CONFIG_HOME}
      - PATH=/home/linuxbrew/.linuxbrew/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
    volumes:
      - ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
      - ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
    ports:
      # 推荐：让 Gateway 网关在 VM 上仅监听 loopback；通过 SSH 隧道访问。
      # 如需公开暴露，请移除 `127.0.0.1:` 前缀并相应配置防火墙。
      - "127.0.0.1:${OPENCLAW_GATEWAY_PORT}:18789"
    command:
      [
        "node",
        "dist/index.js",
        "gateway",
        "--bind",
        "${OPENCLAW_GATEWAY_BIND}",
        "--port",
        "${OPENCLAW_GATEWAY_PORT}",
        "--allow-unconfigured",
      ]
```

`--allow-unconfigured` 只是为了方便引导启动，并不能替代正确的网关配置。仍需设置认证（`gateway.auth.token` 或密码），并为你的部署使用安全的绑定设置。

- [将所需二进制文件内置到镜像中](/zh-CN/install/docker-vm-runtime#bake-required-binaries-into-the-image)
- [构建并启动](/zh-CN/install/docker-vm-runtime#build-and-launch)
- [哪些内容会持久化到哪里](/zh-CN/install/docker-vm-runtime#what-persists-where)
- [更新](/zh-CN/install/docker-vm-runtime#updates)

绑定到 LAN（`OPENCLAW_GATEWAY_BIND=lan`）时，请先配置受信任的浏览器来源再继续：

```bash
docker compose run --rm openclaw-cli config set gateway.controlUi.allowedOrigins '["http://127.0.0.1:18789"]' --strict-json
```

如果你更改了网关端口，请将 `18789` 替换为你配置的端口。

```bash
gcloud compute ssh openclaw-gateway --zone=us-central1-a -- -L 18789:127.0.0.1:18789
```

在浏览器中打开：

`http://127.0.0.1:18789/`

重新打印一个干净的仪表盘链接：

```bash
docker compose run --rm openclaw-cli dashboard --no-open
```

如果 UI 提示进行共享密钥认证，请将已配置的令牌或密码粘贴到控制 UI 设置中。
此 Docker 流程默认会写入令牌；如果你将容器配置切换为密码认证，请改用该密码。

如果控制 UI 显示 `unauthorized` 或 `disconnected (1008): pairing required`，请批准浏览器设备：

```bash
docker compose run --rm openclaw-cli devices list
docker compose run --rm openclaw-cli devices approve <requestId>
```

还需要再次查看共享持久化和更新参考？
请参见 [Docker VM 运行时](/zh-CN/install/docker-vm-runtime#what-persists-where) 和 [Docker VM 运行时更新](/zh-CN/install/docker-vm-runtime#updates)。

gcloud compute os-login describe-profile

# Stop the VM first
gcloud compute instances stop openclaw-gateway --zone=us-central1-a

# Change machine type
gcloud compute instances set-machine-type openclaw-gateway \
  --zone=us-central1-a \
  --machine-type=e2-small

# Start the VM
gcloud compute instances start openclaw-gateway --zone=us-central1-a

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/trycua/cua/main/libs/lume/scripts/install.sh)"

echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.zshrc && source ~/.zshrc

lume --version

lume create openclaw --os macos --ipsw latest

lume get openclaw

ssh youruser@192.168.64.X

npm install -g openclaw@latest
openclaw onboard --install-daemon

nano ~/.openclaw/openclaw.json

{
  channels: {
    whatsapp: {
      dmPolicy: "allowlist",
      allowFrom: ["+15551234567"],
    },
    telegram: {
      botToken: "YOUR_BOT_TOKEN",
    },
  },
}

openclaw channels login

lume stop openclaw
lume run openclaw --no-display

ssh youruser@192.168.64.X "openclaw status"

{
  channels: {
    imessage: {
      enabled: true,
      cliPath: "imsg",
      dbPath: "~/Library/Messages/chat.db",
    },
  },
}

lume stop openclaw
lume clone openclaw openclaw-golden

lume stop openclaw && lume delete openclaw
lume clone openclaw-golden openclaw
lume run openclaw --no-display

Set up OpenClaw (https://docs.openclaw.ai/install) on this VM. Use the non-interactive and accept-risk flags for openclaw onboarding. Add the supplied auth or token as needed. Configure nginx to forward from the default port 18789 to the root location on the default enabled site config, making sure to enable Websocket support. Pairing is done by "openclaw devices list" and "openclaw devices approve <request id>". Make sure the dashboard shows that OpenClaw's health is OK. exe.dev handles forwarding from port 8000 to port 80/443 and HTTPS for us, so the final "reachable" should be <vm-name>.exe.xyz, without port specification.

ssh exe.dev new

ssh <vm-name>.exe.xyz

sudo apt-get update
sudo apt-get install -y git curl jq ca-certificates openssl

curl -fsSL https://openclaw.ai/install.sh | bash

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    listen 8000;
    listen [::]:8000;

    server_name _;

    location / {
        proxy_pass http://127.0.0.1:18789;
        proxy_http_version 1.1;

        # WebSocket support
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Standard proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeout settings for long-lived connections
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }
}

cat >> ~/.openclaw/.env <<'EOF'
SLACK_BOT_TOKEN=xoxb-...
SLACK_APP_TOKEN=xapp-...
DISCORD_BOT_TOKEN=...
OPENAI_API_KEY=sk-...
EOF

// openclaw.remote.patch.json5
{
  secrets: {
    providers: {
      default: { source: "env" },
    },
  },
  channels: {
    slack: {
      enabled: true,
      mode: "socket",
      botToken: { source: "env", provider: "default", id: "SLACK_BOT_TOKEN" },
      appToken: { source: "env", provider: "default", id: "SLACK_APP_TOKEN" },
      groupPolicy: "open",
      requireMention: false,
    },
    discord: {
      enabled: true,
      token: { source: "env", provider: "default", id: "DISCORD_BOT_TOKEN" },
      dmPolicy: "disabled",
      dm: { enabled: false },
      groupPolicy: "allowlist",
    },
  },
  agents: {
    defaults: {
      model: { primary: "openai/gpt-5.5" },
      models: {
        "openai/gpt-5.5": { params: { fastMode: true } },
      },
    },
  },
}

ssh <vm-name>.exe.xyz 'openclaw config patch --stdin --dry-run' < ./openclaw.remote.patch.json5
ssh <vm-name>.exe.xyz 'openclaw config patch --stdin' < ./openclaw.remote.patch.json5
ssh <vm-name>.exe.xyz 'openclaw gateway restart && openclaw health'

ssh <vm-name>.exe.xyz 'openclaw config patch --stdin --replace-path "channels.discord.guilds[\"123\"].channels"' < ./discord.patch.json5

npm i -g openclaw@latest
openclaw doctor
openclaw gateway restart
openclaw health

openclaw backup create

services:
  - type: web
    name: openclaw
    runtime: docker
    plan: starter
    healthCheckPath: /health
    envVars:
      - key: OPENCLAW_GATEWAY_PORT
        value: "8080"
      - key: OPENCLAW_STATE_DIR
        value: /data/.openclaw
      - key: OPENCLAW_WORKSPACE_DIR
        value: /data/workspace
      - key: OPENCLAW_GATEWAY_TOKEN
        generateValue: true # auto-generates a secure token
    disk:
      name: openclaw-data
      mountPath: /data
      sizeGB: 1

openclaw backup create