How to Self-Host a Website on Raspberry Pi with an OpenClaw Web Server Agent

Most Raspberry Pi web server guides end at the same place: you install nginx, drop an index.html into /var/www/html, open port 80, and call it done. The tutorial works. Your site loads. Then three months pass.

You push a change to your Git repo and forget to SSH in and pull it. Your Let's Encrypt certificate expires because the renewal cron silently failed after an OS update broke certbot's snap package. The Pi reboots after a power blip and nginx does not come back because a config typo crept in during your last edit. You find out when a friend texts you that your site is down.

A self-hosted website agent adds a management layer between you and the bare server. OpenClaw, running as a lightweight gateway process on the same Pi, monitors the web server, pulls deployments from Git, restarts services when they crash, and alerts you over Telegram or Discord when something needs attention. The key is that OpenClaw does not run inference locally. It sends your messages and system events to a cloud LLM (Claude, GPT-4, or similar) for reasoning, then executes the resulting actions on the Pi. This means the agent consumes minimal resources on top of your web server stack.

The Raspberry Pi Foundation highlighted this exact use case in their official blog post about OpenClaw, noting that it "can use tools, run commands, interact with APIs, manage workflows, and carry out tasks on your behalf." For a web server, those capabilities translate to pulling code, reloading configs, checking process health, and renewing certificates, all triggered by scheduled jobs or plain-language messages.

A Raspberry Pi web server does not need much power. nginx serves static files with a memory footprint measured in single-digit megabytes. Adding OpenClaw on top increases the baseline by a modest amount since the gateway process is lightweight and inference happens remotely. Here is what you need.

Hardware:

• Raspberry Pi 5 (4GB or 8GB) or Pi 4 (4GB). The Pi 5's Cortex-A76 cores handle concurrent connections noticeably better than the Pi 4's Cortex-A72. Either model works, but the Pi 5 with 8GB RAM gives the most headroom
• USB SSD or NVMe via M.2 HAT. SD cards work for testing, but the constant small writes from web server logs and Git pulls degrade them over months. A $20 SSD avoids the problem entirely
• 27W USB-C power supply for Pi 5 (15W for Pi 4). Underpowered supplies cause random reboots under load
• Ethernet connection. Wi-Fi adds latency and drops packets under sustained traffic
• A case with passive or active cooling. Under load, a Pi 5 without cooling throttles from 2.4 GHz to around 1.8 GHz

Software:

• Raspberry Pi OS Lite (64-bit). The desktop environment wastes RAM you could allocate to serving requests
• nginx or Caddy as the web server. nginx is the traditional choice with lower memory usage. Caddy handles HTTPS automatically through built-in Let's Encrypt integration, which simplifies SSL management
• Node.js 24 (ARM64 via NodeSource), required by OpenClaw
• Git, curl, and build-essential for the install process
• certbot if you choose nginx (Caddy handles certificates internally)

Accounts:

• An API key from Anthropic, OpenAI, or another LLM provider. According to the OpenClaw docs, API keys are recommended over OAuth for headless Pi devices
• A domain name pointed at your public IP (or a Cloudflare Tunnel if you want to skip port forwarding)
• Optional: a Telegram bot token from BotFather for receiving alerts and sending commands remotely

Start with a fresh Raspberry Pi OS Lite install flashed via the official Raspberry Pi Imager. Pre-configure SSH, hostname, and Wi-Fi credentials during flashing so you can go headless from the start.

Step 1: System updates and nginx installation.

SSH into the Pi, run a full system update, then install nginx. After installation, nginx starts automatically and serves the default welcome page on port 80. Verify it works by hitting the Pi's local IP from a browser on your network.

If you prefer Caddy, install it from the official Caddy apt repository instead. Caddy's advantage is automatic HTTPS: point a domain at your Pi, add a Caddyfile with the domain name, and Caddy provisions a Let's Encrypt certificate on its own. No certbot, no renewal cron, no manual intervention.

Step 2: Configure your site.

Create a directory for your project under /var/www/ and clone your Git repository into it. Point your nginx server block (or Caddyfile) at that directory. For nginx, create a new config file in /etc/nginx/sites-available/, symlink it into sites-enabled/, remove the default site, and reload nginx. Test the config with nginx -t before reloading to catch syntax errors before they take the server down.

Step 3: Install Node.js 24 and OpenClaw.

The OpenClaw Raspberry Pi documentation specifies Node.js 24 installed via the NodeSource repository. After Node.js is in place, run the OpenClaw install script. The install takes 3 to 5 minutes on a Pi 5 with SSD storage. Run the onboarding wizard with the --install-daemon flag, which sets up OpenClaw as a systemd service that starts on boot. Choose API key authentication during onboarding since it is more reliable than OAuth on headless devices.

Step 4: Set up swap (if your Pi has 2GB RAM or less).

The OpenClaw docs recommend configuring 2GB of swap with swappiness set to 10 for devices with limited RAM. On a 4GB or 8GB Pi 5, you can skip this step, but it does not hurt to have swap configured as a safety net for traffic spikes.

Step 5: Verify the stack.

At this point you should have nginx (or Caddy) serving your site and OpenClaw running as a daemon. Send a test message through your configured channel (Telegram, Discord, or the OpenClaw Control UI via SSH tunnel) and confirm the agent responds. Ask it something simple about the system state to verify it can execute commands on the Pi.

Back up your Pi web server to a workspace that agents can read and write

Fastio gives your OpenClaw agent generous storage for site backups, config snapshots, and deployment artifacts. No credit card, no expiration, MCP-ready.

Start 14-Day Trial

With the server stack running, the next step is teaching OpenClaw to manage it. This is where the agent moves beyond a chatbot and into actual infrastructure automation.

Git-based deployments.

The simplest deployment model is a scheduled cron job that pulls from your Git remote and reloads the web server. OpenClaw's built-in cron scheduler runs inside the gateway process and persists job definitions across reboots. Unlike traditional crontab entries that execute shell scripts, OpenClaw cron spawns subagents with access to the full tool ecosystem.

Set up a recurring job that runs every 15 minutes (or whatever interval fits your workflow). The agent checks if the remote has new commits, pulls if there are changes, validates the nginx config, and reloads the server. If the config test fails, it rolls back the pull and alerts you instead of leaving a broken server.

You can also trigger deployments manually. Send "deploy the latest changes" over Telegram, and the agent runs the same pull-test-reload sequence on demand. For sites backed by a static generator like Hugo, Jekyll, or Astro, the agent can run the build step before copying output to the web root.

Uptime monitoring.

Create a second scheduled job that runs every 5 minutes and checks whether nginx (or Caddy) is responding to HTTP requests on localhost. If the health check fails, the agent attempts a restart. If the restart also fails, it sends you an alert with the relevant log output so you can diagnose remotely.

OpenClaw's cron system distinguishes between transient errors (retried up to 3 times with exponential backoff) and permanent errors (disabled immediately with an alert). This means a brief network hiccup during a check will not flood your Telegram with false alarms, but a genuine process crash gets escalated quickly.

SSL certificate management.

If you chose nginx with certbot, set up a weekly cron job that checks the certificate expiration date and runs certbot renew when the certificate is within 30 days of expiring. The agent should reload nginx after a successful renewal since OpenClaw does not detect certificate file changes automatically. If you went with Caddy, this entire concern disappears because Caddy handles renewal internally.

Log monitoring.

A daily or twice-daily job can scan nginx error and access logs for anomalies: repeated 500 errors, unusual traffic spikes, or requests hitting paths that suggest automated vulnerability scanning. The agent summarizes findings and flags anything that looks actionable.

A Raspberry Pi 5 with 8GB RAM can handle more than one website. nginx's virtual host system lets you serve multiple domains from the same Pi, each with its own document root and SSL certificate. The agent manages all of them through the same monitoring and deployment jobs.

Dynamic sites.

Static HTML is the lowest-resource option, but the Pi can also serve dynamic content. PHP-FPM behind nginx handles WordPress or custom PHP applications. Node.js or Python apps can run as systemd services with nginx acting as a reverse proxy. The OpenClaw agent manages these the same way: monitor the process, restart on failure, pull updates from Git, and alert on errors.

For context on what the hardware can handle, the Pi 5 with 8GB RAM can comfortably serve both static and dynamic sites to hundreds of concurrent visitors. The bottleneck is usually upstream bandwidth from your ISP, not the Pi's CPU or memory.

Reverse proxy for self-hosted services.

If you already run services like Nextcloud, Gitea, or Jellyfin on the same Pi, nginx can act as a reverse proxy that routes traffic to each service based on the domain name or URL path. The agent monitors all backend services through a single set of health checks.

Storing deployment artifacts and backups on Fastio.

One practical gap in the self-hosted setup is off-site storage. If the SD card or SSD fails, you lose everything local. Fastio provides a workspace where the agent can push site backups, config snapshots, and build artifacts. The free tier includes 50GB of storage with no credit card required, which covers most personal sites many times over.

The OpenClaw agent can use Fastio's MCP server to upload backups on a schedule. You get versioned files, audit trails, and the ability to share specific builds or configs with collaborators through branded share links. If you need to rebuild the Pi from scratch, the agent on the new device pulls the latest backup from Fastio and restores the full web server configuration.

Other storage options work too. An S3 bucket, a NAS on your local network, or rsync to a remote server all solve the backup problem. Fastio's advantage is that the agent can interact with it through natural language via MCP without writing custom backup scripts.

Exposing a Raspberry Pi to the public internet requires deliberate security choices. The Pi is physically in your home, which means a compromised server is on your home network.

Network exposure.

The safest approach is a Cloudflare Tunnel or Tailscale Funnel, which routes traffic through a relay without opening any ports on your router. Your Pi connects outbound to the tunnel service, and the service handles inbound traffic. No port forwarding, no dynamic DNS hassle, and your home IP stays private.

If you prefer direct port forwarding, open only ports 80 and 443. Keep SSH on a non-standard port or restrict it to your Tailscale network. The OpenClaw self-hosting guide recommends binding the OpenClaw gateway to localhost and accessing it through Tailscale or a VPN, never exposing it directly to the internet.

Firewall rules.

Configure ufw to deny all inbound traffic except the ports you explicitly need. Log denied connections so the agent can include firewall events in its daily summary.

System updates.

Set up an unattended-upgrades configuration for security patches, or create an OpenClaw cron job that checks for available updates daily and applies security patches automatically. For kernel updates that require a reboot, the agent should notify you and wait for confirmation rather than rebooting a production server on its own.

OpenClaw's security model.

Since OpenClaw can execute arbitrary commands on the Pi, the security of the agent itself matters. Use a dedicated LLM API key with spending limits. Configure OpenClaw's permission boundaries to restrict which directories and commands the agent can access. The official docs note that running on an isolated Pi already provides a layer of containment compared to installing on a primary workstation.

Ongoing maintenance.

Set a monthly reminder (or an OpenClaw cron job) to check disk usage, review logs for errors you might have missed, update OpenClaw itself, and verify that backups are completing successfully. A Pi web server can run for years with minimal attention, but "minimal" is not zero. The agent reduces the maintenance burden from active management to periodic review.