How to Manage Self-Hosted Services on Raspberry Pi with an OpenClaw Agent

Installing self-hosted services on a Raspberry Pi is straightforward. You follow a guide, run a few Docker Compose commands, and suddenly you have your own cloud storage, password manager, and ad blocker running on a $60 board. The problem starts about two weeks later.

Nextcloud runs out of disk space because you forgot to set up log rotation. Vaultwarden stops syncing after a silent crash. Pi-hole's gravity database corrupts during a power fluctuation, and your entire network loses DNS resolution at 2 AM. You only find out when your phone stops loading web pages.

This is the Day 2 problem. Most self-hosting guides cover installation thoroughly but say nothing about ongoing management. You end up maintaining a mental checklist: SSH in to check disk space, open Portainer to verify containers are running, check each service's web UI for errors. With 10 or 15 services on a single Pi, that checklist consumes real time.

OpenClaw changes the maintenance model. Instead of opening five browser tabs and two terminal sessions, you send a Telegram message: "Is anything down?" The agent checks container health across your Docker stack and replies with a status summary. If Jellyfin is eating too much memory, you ask "restart jellyfin" and the agent confirms before executing. If you want to know why Traefik started throwing 502 errors, ask for the last 50 lines of its logs and get them back in seconds.

The Pi already has the spare capacity for this. OpenClaw runs as a lightweight gateway process that relays your messages to a cloud LLM for reasoning. The actual inference happens on remote servers. On a Pi 5, the gateway consumes a small fraction of available RAM, leaving the rest for your self-hosted services. According to the official OpenClaw Raspberry Pi documentation, the minimum requirement is just 1GB RAM, 1 CPU core, and 500MB free disk, though 2GB or more RAM is recommended for comfortable operation.

Before diving in, here is the full list of hardware, software, and accounts you will need.

Raspberry Pi hardware:

• Raspberry Pi 5 (4GB or 8GB). The 8GB model gives the most headroom for running services alongside the OpenClaw gateway. A Pi 4 with 4GB works but leaves less room for growth
• USB-C power supply rated for your Pi model (27W official supply for Pi 5)
• USB SSD or NVMe drive via M.2 HAT. SD cards work for testing, but they degrade quickly under the constant write load that Docker containers produce. An SSD costs $15-25 and dramatically improves both speed and longevity
• Ethernet connection for stable network access
• A case with active cooling. Under sustained Docker workloads, a Pi 5 without cooling throttles from 2.4 GHz down to roughly 1.8 GHz

Software:

• Raspberry Pi OS Lite (64-bit). Skip the desktop environment since you want every byte of RAM for services
• Docker and Docker Compose (the modern docker compose plugin, not the deprecated docker-compose binary)
• Node.js 24 (ARM64 build via NodeSource)
• Git and curl

Accounts and API keys:

• An API key from Anthropic, OpenAI, Google, or another LLM provider. The official docs recommend cloud-hosted models because local LLMs are too slow on Pi hardware
• A Telegram bot token from BotFather (OpenClaw also supports Discord, WhatsApp, and Signal)
• Optional: a Fastio account for backing up configs and sharing files between your agent and other people

Total one-time hardware cost for a Pi 5 with case, power supply, and SSD runs between $80 and $120. If you already have a Pi, the marginal cost is zero. Ongoing costs are the LLM API usage, which typically runs $1-3 per month for a personal server with daily queries.

A Raspberry Pi 5 with 8GB RAM can comfortably run 10 to 15 lightweight Docker containers simultaneously. The key word is lightweight. Media transcoding services or databases with large working sets will hit resource limits fast, but most self-hosted alternatives to common SaaS products are designed to run on modest hardware.

Here are the services that work well on Pi hardware and that OpenClaw can manage effectively:

Network and security:

• Pi-hole for network-wide ad blocking and DNS filtering. Uses minimal RAM and runs quietly in the background
• Vaultwarden, an unofficial Bitwarden-compatible password server. Extremely lightweight, handles password sync for a family without breaking a sweat
• WireGuard for VPN access to your home network. Runs as a single container and gives you secure remote access

Cloud storage and files:

• Nextcloud for file sync, calendar, contacts, and notes. This is the heaviest service on the list and benefits from the SSD recommendation above. Allocate at least 512MB RAM
• Immich as a Google Photos replacement with automatic phone backup and facial recognition. Resource-hungry during initial photo indexing but stable afterward

Media and entertainment:

• Jellyfin for media streaming. Handles direct play to most clients without transcoding. Avoid on-the-fly transcoding on Pi hardware
• Navidrome for music streaming with a clean web UI and subsonic API compatibility
• Audiobookshelf for audiobook and podcast management

Productivity and monitoring:

• Uptime Kuma for monitoring all your other services with a clean dashboard and notifications
• Gitea for lightweight self-hosted Git with built-in CI
• Firefly III for personal finance tracking
• Home Assistant for home automation (runs well as a standalone container)

Reverse proxy:

• Traefik or Caddy to route traffic to each service with automatic HTTPS via Let's Encrypt. Every multi-service Pi setup needs a reverse proxy

The services above replace SaaS subscriptions that would cost $30-80 per month combined: cloud storage, password manager, VPN, photo backup, and media streaming. After the one-time Pi purchase, operating costs are near zero.

You do not need to run all of these at once. Start with three or four core services, verify they run stably, then add more. OpenClaw makes this easier because you can check resource usage across all containers with a single question rather than SSH-ing in and running docker stats manually.

Back up your self-hosted configs with one workspace

generous storage for Docker configs, database exports, and service backups. No credit card, no expiration. Your OpenClaw agent can write directly to Fastio through the MCP server.

Start 14-Day Trial

Start with a fresh Raspberry Pi OS Lite 64-bit image. Flash it using Raspberry Pi Imager with SSH enabled and your network configured, then boot the Pi and connect over SSH.

Update the system packages, install Git, curl, and build tools, then install Node.js 24 from the NodeSource ARM64 repository. If your Pi has 2GB or 4GB of RAM, create a 2GB swap file and set vm.swappiness=10 to keep the system responsive during heavier operations.

Run the OpenClaw installer, which handles dependencies and configuration. During onboarding, use API key authentication rather than OAuth since headless setups work more reliably with key-based auth. The installer creates a configuration directory at ~/.openclaw/ where gateway settings, channel bindings, and skill definitions live. The gateway binds to localhost on port 18789 by default, keeping it off the network unless you explicitly expose it.

Set up your Telegram bot by creating one through BotFather, adding the token to OpenClaw's channel configuration, and restricting access to your Telegram user ID. This last step is critical because the agent will have the ability to execute commands on your server.

Writing skills for your service stack

Skills are Markdown files that give the agent context about your environment. They describe what services exist, how to interact with them, and what the agent is allowed to do. OpenClaw's skill system supports hot-reloading, so you can update a skill file and the agent picks up the changes without restarting.

For a self-hosted services setup, you want at least two skills:

A Docker Management skill that describes all your running containers, their names, the compose file locations, and common operations. This gives the agent enough context to handle requests like "restart nextcloud" or "show me vaultwarden logs from the last hour" without you having to specify which compose file to use or which container name maps to which service.

A System Health skill that describes what "healthy" looks like for your Pi: expected disk usage thresholds, memory limits, CPU temperature bounds, and which services are critical versus optional. When you ask "is everything OK?" the agent reads this skill and checks each metric against your defined thresholds.

OpenClaw also has a dedicated Docker skill available in the skills library that provides container management, log viewing with time-range filtering, image management, Docker Compose operations, and container stats viewing. Installing a community skill gives you a baseline, and you customize it by adding your own service-specific context on top.

The skills approach is more maintainable than hardcoding scripts. When you add a new service to your Pi, you update the skill file with a few lines of context instead of writing new monitoring scripts from scratch.

Once your services are running and OpenClaw knows about them through skills, daily management becomes conversational.

Checking service health

The simplest check is asking "what's running?" The agent runs docker ps under the hood and returns a formatted summary of container status, uptime, and resource usage. For deeper inspection, ask about specific services: "how much memory is jellyfin using?" or "is nextcloud healthy?"

Pair OpenClaw with Uptime Kuma for proactive monitoring. Uptime Kuma pings each service on a schedule and sends notifications when something goes down. OpenClaw handles the response: when you get an alert that Pi-hole stopped responding, you message the agent to check logs and restart the container without opening a laptop.

Pulling logs

Log retrieval is one of the most common homelab tasks and one of the most tedious to do manually. With OpenClaw, asking "show traefik logs from the last hour" or "are there any errors in the nextcloud logs?" replaces the usual chain of docker logs --since 1h traefik 2>&1 | grep -i error. The agent filters and summarizes the output, highlighting what matters.

Restarting services

OpenClaw prompts for confirmation before running destructive operations. When you say "restart vaultwarden," the agent asks you to confirm before executing. This safety net prevents accidental restarts of critical services. For services managed through Docker Compose, the agent can run the appropriate compose restart command for the specific service rather than bouncing the entire stack.

Disk and resource management

Disk space is the silent killer of self-hosted setups. Docker images, container logs, and application data accumulate faster than most people expect. Ask the agent "how much disk space is left?" regularly, or describe a threshold in your System Health skill so the agent flags it proactively. Common cleanup tasks like pruning unused Docker images or clearing old logs can be triggered through conversation.

Handling updates

Updating self-hosted services is where many people make mistakes, pulling a new image without checking release notes or updating all services at once. Use the agent to check for available updates one service at a time, pull the new image, and restart. If something breaks, the agent can help you roll back by pulling the previous image tag. This is not automatic, and it should not be. Updates on a home server deserve the same caution you would give a production deployment.

Multi-service debugging

The real power shows up when problems span multiple services. If your reverse proxy returns 502 errors, the issue might be in Traefik's configuration, the upstream container being down, or a network misconfiguration. Instead of checking each piece separately, describe the symptom to the agent: "traefik is returning 502 for nextcloud." The agent can check Traefik logs, verify the Nextcloud container is running, test the upstream connection, and report back with a diagnosis.

Self-hosted services generate configuration files, database backups, and operational data that you do not want to lose if the SD card fails or you need to rebuild the Pi. Local backups to an external drive help, but having an off-site copy adds real protection.

Fastio workspaces work as an off-site backup target that your OpenClaw agent can write to directly. The free tier includes 50GB of storage, included credits, and 5 workspaces with no credit card required. That is enough space for Docker Compose files, service configs, database dumps, and periodic state snapshots from most home server setups.

What to back up:

• Docker Compose files and .env files for each service stack
• OpenClaw skill files and gateway configuration from ~/.openclaw/
• Database exports from services like Nextcloud, Vaultwarden, and Firefly III
• Reverse proxy configurations (Traefik dynamic configs or Caddyfile)
• Uptime Kuma's SQLite database

The Fastio MCP server exposes workspace, storage, and AI operations through 19 consolidated tools that agents can use programmatically. Your OpenClaw agent can upload backup files to a dedicated workspace, and you can access those files through the Fastio web UI, share them with others through branded share links, or pull them down during a rebuild.

Fastio workspaces also have an Intelligence Mode that auto-indexes uploaded files for semantic search. This means you can search across your backed-up configs by meaning rather than filename. If you forget which service uses a specific environment variable, ask the workspace and it searches your config files to find it.

For teams running shared homelabs, or if you want to hand off server management to someone else, Fastio's ownership transfer feature lets you build a workspace full of documentation and configs and then transfer it to another person while keeping admin access. The recipient gets a complete package without needing to SSH into the Pi or understand the underlying file structure.

Other backup targets worth considering include Borg or Restic for encrypted incremental backups to any S3-compatible storage, rsync to a NAS on your local network, or git repositories for version-controlled config files. The choice depends on how much automation you want and whether you need off-site copies. Fastio fits the use case where you want both backup storage and the ability to search, share, and hand off files without extra infrastructure.