Installation

Mon, 01 Jan 0001 00:00:00 +0000

Prerequisites

Terraform >= 1.5 (install)
Ansible (install)
age and sops — required for secret encryption (make secrets-encrypt). Install via your package manager or age releases / sops releases.
jq — required for make validate. Install via your package manager.
Hetzner Cloud account with API token (console)
SSH key uploaded to Hetzner Cloud. Default path: ~/.ssh/id_rsa. Override with SSH_KEY env var.
(Optional) Remote Terraform state — the default is local (no setup needed). For GCS or other remote backends, see Remote State Backend.

1. Clone

1
2


git clone https://github.com/tardigrde/openclaw-deploy.git
cd openclaw-deploy

2. Configure infrastructure secrets

1
2


cp secrets/inputs.example.sh secrets/inputs.sh
vim secrets/inputs.sh

Required: HCLOUD_TOKEN, TF_VAR_ssh_key_fingerprint (from Hetzner Console → Security → SSH Keys). See Secrets Reference for the full variable reference and Tailscale-specific notes.

Deployment & Bootstrap

Mon, 01 Jan 0001 00:00:00 +0000

Continues from Installation. Run source secrets/inputs.sh before any make target that touches the VPS.

5. Provision the VPS

1
2
3
4


source secrets/inputs.sh
make init
make plan
make apply

6. Configure container secrets

1
2


cp secrets/.env.example secrets/.env
vim secrets/.env

Required: OPENCLAW_GATEWAY_TOKEN, ANTHROPIC_API_KEY (or leave empty for subscription auth), TELEGRAM_BOT_TOKEN. See Secrets Reference for the full variable reference.