25a - 高可用部署

# docker-compose.yml — OpenClaw 生产部署（安全加固版）
# 适用于：Hetzner / DigitalOcean / Vultr 等 VPS
# 最低配置：2 vCPU / 4 GB RAM / Ubuntu 24.04
 
version: '3.8'
 
services:
  # ============================================
  # OpenClaw Gateway — 核心服务
  # ============================================
  openclaw-gateway:
    image: openclaw/openclaw:latest  # 生产环境建议锁定版本号
    container_name: openclaw-gateway
    restart: unless-stopped
 
    # --- 安全加固 ---
    user: "1000:1000"              # 非 root 运行
    cap_drop:
      - ALL                        # 移除所有 Linux capabilities
    security_opt:
      - no-new-privileges:true     # 禁止提权
 
    # --- 网络 ---
    ports:
      - "127.0.0.1:18789:18789"   # ⚠️ 仅绑定 localhost，绝不暴露到公网
    networks:
      - openclaw-net
 
    # --- 数据持久化 ---
    volumes:
      - ./data/config:/home/node/.openclaw/config:rw
      - ./data/workspace:/home/node/.openclaw/workspace:rw
      - ./data/state:/home/node/.openclaw/state:rw
      - ./data/credentials:/home/node/.openclaw/credentials:rw
 
    # --- 环境变量 ---
    environment:
      - NODE_ENV=production
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
      # Gateway 绑定模式：loopback = 仅 localhost
      - OPENCLAW_GATEWAY_BIND=loopback
 
    # --- 健康检查 ---
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://127.0.0.1:18789/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
 
    # --- 资源限制 ---
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 3G
        reservations:
          cpus: '0.5'
          memory: 512M
 
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
 
  # ============================================
  # Caddy — 反向代理 + 自动 HTTPS
  # ============================================
  caddy:
    image: caddy:2-alpine
    container_name: openclaw-caddy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"  # HTTP/3 支持
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - openclaw-net
    depends_on:
      openclaw-gateway:
        condition: service_healthy
 
networks:
  openclaw-net:
    driver: bridge
    internal: false
 
volumes:
  caddy_data:
  caddy_config:

# .env — OpenClaw 环境变量
# ⚠️ 此文件包含敏感信息，务必加入 .gitignore
 
# AI 模型 API 密钥
ANTHROPIC_API_KEY=sk-ant-api03-your-key-here
OPENAI_API_KEY=sk-your-openai-key-here
 
# Gateway 认证令牌（必须设置！）
# 生成方式：openssl rand -hex 32
OPENCLAW_GATEWAY_TOKEN=your-64-char-hex-token-here
 
# 可选：消息平台令牌
DISCORD_BOT_TOKEN=
TELEGRAM_BOT_TOKEN=
SLACK_BOT_TOKEN=

# 生成 Gateway 认证令牌
openssl rand -hex 32
 
# 写入 .env 文件
echo "OPENCLAW_GATEWAY_TOKEN=$(openssl rand -hex 32)" >> .env

openclaw-deploy/
├── docker-compose.yml
├── .env                    # 敏感配置（加入 .gitignore）
├── Caddyfile               # 反向代理配置
└── data/                   # 持久化数据
    ├── config/             # openclaw.json 等配置
    ├── workspace/          # MEMORY.md, SOUL.md, 日志
    ├── state/              # 会话状态、SQLite 数据库
    └── credentials/        # OAuth 令牌、设备密钥

# 1. 创建数据目录
mkdir -p data/{config,workspace,state,credentials}
 
# 2. 设置目录权限（匹配容器内 user 1000:1000）
chown -R 1000:1000 data/
 
# 3. 启动服务
docker compose up -d
 
# 4. 检查服务状态
docker compose ps
docker compose logs -f openclaw-gateway
 
# 5. 验证健康检查
curl -s http://127.0.0.1:18789/health | jq .
 
# 6. 验证 Gateway 认证
curl -s -H "Authorization: Bearer ${OPENCLAW_GATEWAY_TOKEN}" \
  http://127.0.0.1:18789/api/status | jq .
 
# 7. 确认端口未暴露到公网
ss -tlnp | grep 18789
# 应显示 127.0.0.1:18789，而非 0.0.0.0:18789

┌─────────────────────────────────────────────────────┐
│                  Kubernetes Cluster                   │
│                                                       │
│  ┌──────────┐    ┌──────────────┐    ┌────────────┐ │
│  │ Ingress  │───▶│   Service    │───▶│ Deployment │ │
│  │Controller│    │ (ClusterIP)  │    │ (1 replica)│ │
│  │ + TLS    │    └──────────────┘    └─────┬──────┘ │
│  └──────────┘                              │        │
│                                            │        │
│  ┌──────────┐    ┌──────────────┐    ┌─────▼──────┐ │
│  │ConfigMap │    │    Secret    │    │    PVC     │ │
│  │(配置文件)│    │ (API 密钥)  │    │(工作空间)  │ │
│  └──────────┘    └──────────────┘    └────────────┘ │
│                                                       │
│  ┌──────────────────────────────────────────────────┐ │
│  │           NetworkPolicy（网络隔离）               │ │
│  └──────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────┘

# namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: openclaw
  labels:
    name: openclaw
    app.kubernetes.io/part-of: openclaw

# secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: openclaw-secrets
  namespace: openclaw
type: Opaque
stringData:
  anthropic-api-key: "sk-ant-api03-your-key-here"
  openai-api-key: "sk-your-openai-key-here"
  gateway-token: "your-64-char-hex-token"
  discord-bot-token: "your-discord-token"

# configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: openclaw-config
  namespace: openclaw
data:
  openclaw.json: |
    {
      "agents": {
        "defaults": {
          "workspace": "/home/openclaw/.openclaw/workspace",
          "model": {
            "primary": "anthropic/claude-sonnet-4-20250514"
          },
          "models": {
            "anthropic/claude-sonnet-4-20250514": {},
            "openai/gpt-4.1": {}
          }
        }
      },
      "gateway": {
        "port": 18789,
        "bind": "0.0.0.0",
        "auth": {
          "mode": "token"
        },
        "controlUi": {
          "allowInsecureAuth": false,
          "dangerouslyDisableDeviceAuth": false
        }
      },
      "channels": {
        "discord": {
          "enabled": true
        }
      }
    }

# pvc.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openclaw-workspace
  namespace: openclaw
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi
  storageClassName: local-path  # 根据集群调整：gp3、standard、longhorn 等

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openclaw
  namespace: openclaw
  labels:
    app: openclaw
    app.kubernetes.io/name: openclaw
    app.kubernetes.io/component: gateway
spec:
  replicas: 1  # OpenClaw Gateway 设计为单实例运行
  strategy:
    type: Recreate  # 非 RollingUpdate，因为只有 1 个副本且需要独占 PVC
  selector:
    matchLabels:
      app: openclaw
  template:
    metadata:
      labels:
        app: openclaw
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: openclaw
          image: ghcr.io/openclaw/openclaw:2026.2.6  # 锁定版本号
          ports:
            - containerPort: 18789
              name: gateway
              protocol: TCP
          env:
            - name: NODE_ENV
              value: "production"
            - name: ANTHROPIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: openclaw-secrets
                  key: anthropic-api-key
            - name: OPENAI_API_KEY
              valueFrom:
                secretKeyRef:
                  name: openclaw-secrets
                  key: openai-api-key
            - name: OPENCLAW_GATEWAY_TOKEN
              valueFrom:
                secretKeyRef:
                  name: openclaw-secrets
                  key: gateway-token
            - name: DISCORD_BOT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: openclaw-secrets
                  key: discord-bot-token
          volumeMounts:
            - name: config
              mountPath: /home/openclaw/.openclaw/config
              subPath: openclaw.json
            - name: workspace
              mountPath: /home/openclaw/.openclaw/workspace
            - name: state
              mountPath: /home/openclaw/.openclaw/state
          # --- 健康检查 ---
          livenessProbe:
            httpGet:
              path: /health
              port: gateway
            initialDelaySeconds: 15
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /health
              port: gateway
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 2
          startupProbe:
            httpGet:
              path: /health
              port: gateway
            initialDelaySeconds: 5
            periodSeconds: 5
            failureThreshold: 12  # 最多等待 60 秒启动
          # --- 资源限制 ---
          resources:
            requests:
              cpu: 500m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 3Gi
      volumes:
        - name: config
          configMap:
            name: openclaw-config
        - name: workspace
          persistentVolumeClaim:
            claimName: openclaw-workspace
        - name: state
          persistentVolumeClaim:
            claimName: openclaw-workspace  # 共享 PVC，不同 subPath

# service.yaml
apiVersion: v1
kind: Service
metadata:
  name: openclaw-service
  namespace: openclaw
spec:
  type: ClusterIP
  selector:
    app: openclaw
  ports:
    - port: 18789
      targetPort: gateway
      protocol: TCP
      name: http

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: openclaw-ingress
  namespace: openclaw
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    # WebSocket 支持
    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - openclaw.yourdomain.com
      secretName: openclaw-tls
  rules:
    - host: openclaw.yourdomain.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: openclaw-service
                port:
                  number: 18789

# network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: openclaw-network-policy
  namespace: openclaw
spec:
  podSelector:
    matchLabels:
      app: openclaw
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # 仅允许 Ingress Controller 访问
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ingress-nginx
      ports:
        - port: 18789
          protocol: TCP
  egress:
    # 允许 DNS 解析
    - to: []
      ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # 允许访问外部 API（Anthropic、OpenAI 等）
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - port: 443
          protocol: TCP

# 一键部署所有资源
kubectl apply -f namespace.yaml
kubectl apply -f secret.yaml
kubectl apply -f configmap.yaml
kubectl apply -f pvc.yaml
kubectl apply -f deployment.yaml
kubectl apply -f service.yaml
kubectl apply -f ingress.yaml
kubectl apply -f network-policy.yaml
 
# 验证部署状态
kubectl get all -n openclaw
kubectl logs -n openclaw deployment/openclaw -f
 
# 进入 Pod 执行初始化
kubectl exec -it -n openclaw deployment/openclaw -- /bin/bash
# 在 Pod 内运行：/app/openclaw.mjs onboard

# 添加 Helm 仓库
helm repo add openclaw https://serhanekicii.github.io/openclaw-helm
helm repo update
 
# 查看可配置项
helm show values openclaw/openclaw
 
# 安装（使用自定义 values）
helm install openclaw openclaw/openclaw \
  --namespace openclaw \
  --create-namespace \
  -f values.yaml

# values.yaml — Helm Chart 自定义配置
image:
  repository: ghcr.io/openclaw/openclaw
  tag: "2026.2.6"
  pullPolicy: IfNotPresent
 
replicaCount: 1
 
gateway:
  port: 18789
  bind: "0.0.0.0"
  auth:
    mode: token
 
secrets:
  anthropicApiKey: ""      # 通过 --set 传入或使用 External Secrets
  gatewayToken: ""
 
persistence:
  enabled: true
  storageClass: "local-path"
  size: 20Gi
 
ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: openclaw.yourdomain.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: openclaw-tls
      hosts:
        - openclaw.yourdomain.com
 
resources:
  requests:
    cpu: 500m
    memory: 512Mi
  limits:
    cpu: "2"
    memory: 3Gi
 
networkPolicy:
  enabled: true

# Caddyfile
openclaw.yourdomain.com {
    # 反向代理到 OpenClaw Gateway
    reverse_proxy localhost:18789 {
        # 保留客户端 IP
        header_up X-Forwarded-For {remote_host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-Proto {scheme}
    }

    # 安全头
    header {
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy strict-origin-when-cross-origin
        -Server
    }

    # 速率限制（需要 caddy-ratelimit 插件）
    # rate_limit {remote.ip} 100r/m

    # 访问日志
    log {
        output file /var/log/caddy/openclaw-access.log
        format json
    }
}

# /etc/nginx/sites-available/openclaw
upstream openclaw_gateway {
    server 127.0.0.1:18789;
    keepalive 32;
}
 
# HTTP → HTTPS 重定向
server {
    listen 80;
    server_name openclaw.yourdomain.com;
    return 301 https://$server_name$request_uri;
}
 
server {
    listen 443 ssl http2;
    server_name openclaw.yourdomain.com;
 
    # --- TLS 证书（Certbot 自动填充） ---
    ssl_certificate /etc/letsencrypt/live/openclaw.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/openclaw.yourdomain.com/privkey.pem;
 
    # --- TLS 安全配置 ---
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_stapling on;
    ssl_stapling_verify on;
 
    # --- 安全头 ---
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options DENY always;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
 
    # --- 反向代理 ---
    location / {
        proxy_pass http://openclaw_gateway;
        proxy_http_version 1.1;
 
        # WebSocket 支持（Control UI 必需）
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
 
        # 保留客户端信息
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
 
        # 超时设置（Agent 会话可能持续较长时间）
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
 
    # --- 速率限制 ---
    limit_req_zone $binary_remote_addr zone=openclaw:10m rate=30r/m;
    location /api/ {
        limit_req zone=openclaw burst=10 nodelay;
        proxy_pass http://openclaw_gateway;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

# 安装 Certbot
sudo apt install certbot python3-certbot-nginx
 
# 申请证书（Nginx 模式）
sudo certbot --nginx -d openclaw.yourdomain.com
 
# 验证自动续期
sudo certbot renew --dry-run
 
# Certbot 自动续期定时任务（通常自动配置）
# 检查：systemctl status certbot.timer

{
  "gateway": {
    "bind": "loopback",
    "trustedProxies": ["127.0.0.1"],
    "auth": {
      "mode": "token",
      "token": "${OPENCLAW_GATEWAY_TOKEN}"
    },
    "controlUi": {
      "allowInsecureAuth": false,
      "dangerouslyDisableDeviceAuth": false
    }
  }
}

# 基本健康检查
curl -sf http://127.0.0.1:18789/health
# 返回：{"status":"ok","uptime":12345,"version":"2026.2.6"}
 
# 深度健康检查（包含 Agent 状态）
curl -sf -H "Authorization: Bearer ${TOKEN}" \
  http://127.0.0.1:18789/api/status

healthcheck:
  test: ["CMD", "curl", "-sf", "http://127.0.0.1:18789/health"]
  interval: 30s      # 每 30 秒检查一次
  timeout: 10s       # 超时 10 秒视为失败
  retries: 3         # 连续 3 次失败标记为 unhealthy
  start_period: 15s  # 启动后 15 秒开始检查

# restart policy 选项：
# - no：不自动重启
# - always：总是重启（包括手动停止后）
# - unless-stopped：除非手动停止，否则自动重启（推荐）
# - on-failure：仅在非零退出码时重启
restart: unless-stopped

# /etc/systemd/system/openclaw.service
[Unit]
Description=OpenClaw AI Agent Gateway
After=network-online.target
Wants=network-online.target
 
[Service]
Type=simple
User=openclaw
Group=openclaw
WorkingDirectory=/home/openclaw
ExecStart=/usr/local/bin/openclaw gateway start
Restart=always
RestartSec=5
StartLimitIntervalSec=60
StartLimitBurst=5
 
# 安全加固
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=read-only
ReadWritePaths=/home/openclaw/.openclaw
 
# 环境变量
EnvironmentFile=/home/openclaw/.openclaw/.env
 
[Install]
WantedBy=multi-user.target

# 启用并启动服务
sudo systemctl daemon-reload
sudo systemctl enable openclaw
sudo systemctl start openclaw
 
# 查看状态
sudo systemctl status openclaw
sudo journalctl -u openclaw -f

#!/bin/bash
# backup-openclaw.sh — OpenClaw 数据自动备份
# 建议通过 cron 每日执行
 
BACKUP_DIR="/backups/openclaw"
DATA_DIR="/path/to/openclaw/data"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
RETENTION_DAYS=30
 
# 创建备份目录
mkdir -p "${BACKUP_DIR}"
 
# 创建压缩备份
tar -czf "${BACKUP_DIR}/openclaw-backup-${TIMESTAMP}.tar.gz" \
  -C "${DATA_DIR}" \
  config/ workspace/ state/ credentials/
 
# 清理过期备份
find "${BACKUP_DIR}" -name "openclaw-backup-*.tar.gz" \
  -mtime +${RETENTION_DAYS} -delete
 
# 可选：上传到远程存储
# aws s3 cp "${BACKUP_DIR}/openclaw-backup-${TIMESTAMP}.tar.gz" \
#   s3://your-bucket/openclaw-backups/
 
echo "[$(date)] 备份完成: openclaw-backup-${TIMESTAMP}.tar.gz"

# 每日凌晨 3 点执行备份
echo "0 3 * * * /opt/scripts/backup-openclaw.sh >> /var/log/openclaw-backup.log 2>&1" \
  | crontab -

# 1. 停止 OpenClaw
docker compose down
 
# 2. 解压备份
tar -xzf /backups/openclaw/openclaw-backup-20260215_030000.tar.gz \
  -C /path/to/openclaw/data/
 
# 3. 修复权限
chown -R 1000:1000 /path/to/openclaw/data/
 
# 4. 重新启动
docker compose up -d
 
# 5. 验证恢复
docker compose logs -f openclaw-gateway

# 在 Hetzner CX22（2 vCPU/4 GB/€3.49/月）上
ssh root@your-vps-ip
 
# 创建专用用户
adduser openclaw
usermod -aG docker openclaw
 
# 安装 Docker
curl -fsSL https://get.docker.com | sh

# 在 Mac Mini 上
tar -czf openclaw-migration.tar.gz \
  ~/.openclaw/config \
  ~/.openclaw/workspace \
  ~/.openclaw/state \
  ~/.openclaw/credentials
 
scp openclaw-migration.tar.gz openclaw@your-vps-ip:~/

# 在 VPS 上
su - openclaw
mkdir -p ~/openclaw-deploy/data
cd ~/openclaw-deploy
 
# 解压迁移数据
tar -xzf ~/openclaw-migration.tar.gz -C data/
 
# 创建 docker-compose.yml、Caddyfile、.env（使用上方模板）
# ...
 
# 启动
docker compose up -d

# 将 openclaw.yourdomain.com 的 A 记录指向 VPS IP
# Caddy 会自动申请 Let's Encrypt 证书
 
# 验证 HTTPS
curl -v https://openclaw.yourdomain.com/health

# 检查 MEMORY.md 是否完整
docker compose exec openclaw-gateway cat /home/node/.openclaw/workspace/MEMORY.md
 
# 检查 Agent 是否正常响应
# 通过 Telegram/Discord 发送测试消息
 
# 设置备份 cron
crontab -e
# 添加：0 3 * * * /home/openclaw/scripts/backup-openclaw.sh