How to Deploy OpenClaw on Coolify for Self-Hosted Agent Infrastructure

Most OpenClaw self-hosting guides assume you are comfortable writing Docker Compose files by hand or that you want a fully managed platform like Railway. Coolify occupies the middle ground. It is an open-source, self-hostable PaaS alternative that gives you a web dashboard for deploying containers on your own servers, with automatic Let's Encrypt SSL, Git-based deploys, and one-click service management. You keep root access and full data ownership.

For OpenClaw specifically, this matters because the agent requires HTTPS to function correctly, uses HTTP Basic Auth for its dashboard, and benefits from Docker isolation to contain crashes. Coolify handles all three out of the box. You point it at a Git repo containing a Docker Compose file, configure your environment variables, and Coolify provisions the container with a valid TLS certificate, reverse proxy routing through Traefik, and persistent volumes for workspace data.

The practical difference compared to raw Docker: you skip writing Nginx or Traefik configs, managing Certbot renewals, and debugging port-binding issues. Compared to Railway or Render, you keep your data on hardware you control and avoid per-seat pricing that scales poorly for always-on agents.

Before deploying OpenClaw, you need a server running Coolify and an API key for at least one LLM provider.

Server requirements:

• A VPS, dedicated server, or home machine with SSH access and at least 2 CPU cores, 4GB RAM, and 13GB free disk space (Docker build cache is large)
• Coolify installed on the server, either via the self-hosted install script or Coolify Cloud (starts at $5/month for managed infrastructure)
• A domain or subdomain pointed at your server's IP address for HTTPS

LLM provider keys (pick at least one):

• Anthropic (ANTHROPIC_API_KEY)
• OpenAI (OPENAI_API_KEY)
• Google Gemini (GEMINI_API_KEY)
• OpenRouter (OPENROUTER_API_KEY)
• Groq, Mistral, xAI, or Cerebras
• AWS Bedrock (requires AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION)
• Ollama for local models (OLLAMA_BASE_URL)

Coolify's official documentation at coolify.io/docs covers server installation if you need to set it up first.

Coolify deploys services from Git repositories containing Docker Compose configurations. Several community-maintained repos on GitHub package OpenClaw for Coolify, including repos from essamamdani, wiselancer, and the Coolify team itself (coollabsio/openclaw). Each bundles a slightly different set of companion services, so review their README files to pick the one that fits your use case.

General deployment flow:

1. In the Coolify dashboard, create a new service pointing at a public Git repository containing an OpenClaw Docker Compose file
2. Coolify detects the compose configuration and lists the available services
3. Set your environment variables (covered in the next section)
4. Deploy and watch the service logs for the startup confirmation
5. Open the Coolify-generated HTTPS URL to access the OpenClaw dashboard

Coolify's Traefik reverse proxy maps the container's internal port to your domain with automatic HTTPS. Make sure the container listens on 0.0.0.0 rather than 127.0.0.1 so the proxy can reach it.

Give your OpenClaw agent persistent, searchable storage

generous storage workspace with automatic indexing, MCP server access, and no credit card. Your agent writes files, your team finds them.

Start 14-Day Trial

Coolify auto-generates AUTH_USERNAME and AUTH_PASSWORD for HTTP Basic Auth during deployment. These protect the OpenClaw web dashboard from unauthorized access. You will also want to set OPENCLAW_GATEWAY_TOKEN for API access.

Required variables:

• At least one LLM provider API key (e.g., ANTHROPIC_API_KEY)
• OPENCLAW_PRIMARY_MODEL to set the default model. For proxy services like OpenRouter, use the provider/model-name format

Optional but recommended:

• BROWSER_DEFAULT_PROFILE (defaults to openclaw) for persistent browser sessions
• BROWSER_SNAPSHOT_MODE (defaults to efficient) controls how browser state is saved
• BROWSER_EVALUATE_ENABLED (defaults to true) allows JavaScript execution in the built-in browser

Set all variables through the Coolify dashboard under your service's Environment tab. Coolify encrypts secrets at rest and injects them at container startup, so you never need to commit credentials to a repository.

Chat Channel Integration OpenClaw supports messaging platforms as its primary interface. Setup complexity varies by channel:

• Telegram is the fast to configure. Create a bot via BotFather, paste the token into your environment variables, and redeploy
• WhatsApp requires scanning a QR code from the OpenClaw dashboard's Channels tab
• Discord and Slack use CLI-managed setup through the dashboard or channel management commands

After connecting a channel, you message your agent directly from the chat app. It can run commands, manage files, browse the web, and handle multi-step tasks through natural conversation.

OpenClaw 2026.5.x introduced a significant safety change: gateway config validation now fails closed. If openclaw.json contains invalid configuration, the gateway refuses to start rather than silently falling back to defaults. This prevents a situation where a bad config edit strips security settings and leaves the agent exposed.

How it works in practice:

• Direct file edits are treated as untrusted. The config watcher waits for editor write churn to settle, reads the final file, and rejects invalid changes without overwriting your config
• OpenClaw-owned config writes go through the same schema gate. Destructive changes like dropping gateway.mode or shrinking the file by more than half are rejected and saved as .rejected.* for inspection
• Hot reload skips invalid external edits and keeps the current running config active

If you do end up with a broken config, run openclaw doctor --fix from the Coolify terminal. It can remove non-JSON prefixes, restore the last known good copy, and preserve the rejected payload as .clobbered.* for review.

Additional hardening for Coolify deployments:

• The Docker Socket Proxy sidecar (in the essamamdani repo) restricts container API access, blocking Swarm, Secrets, and System functions while permitting only Container, Image, and Network operations
• Sub-agents run in disposable containers with restricted Docker API access, so a misbehaving agent cannot affect the host or other services
• SearXNG runs as a local sidecar for private web search, keeping research queries off third-party search providers
• Coolify's built-in backup system can snapshot your volumes to S3-compatible storage for disaster recovery

Docker volumes keep your agent's workspace data across container restarts, but they are tied to a single server. If you need to share files between agents and humans, access agent output from a browser, or survive a server migration, you need external persistent storage.

Local storage options like mounting a host directory or using NFS shares work but require manual backup configuration and offer no built-in search or collaboration features. S3-compatible storage (MinIO, Backblaze B2, AWS S3) handles durability well but treats files as opaque blobs with no semantic understanding.

Fastio provides intelligent workspaces where files are automatically indexed for semantic search once Intelligence Mode is enabled. Your OpenClaw agent can read, write, and organize files through the Fastio MCP server using Streamable HTTP at /mcp, while your team accesses the same files through the web UI. When the agent finishes a project, you can transfer workspace ownership to a human recipient who gets full access without needing to touch the command line.

The Business Trial includes 50GB of storage, included credits, and 5 workspaces with no credit card required. That is enough to run a production OpenClaw deployment with persistent file storage, audit trails, and granular permissions at the workspace and folder level.

To connect your OpenClaw instance to Fastio, configure the MCP server endpoint in your agent's tool configuration. Files your agent creates, research it downloads, and browser snapshots it captures all persist in a shared workspace that survives container rebuilds, server migrations, and team changes.