Tutorial: Secure OpenClaw with CloudConnexa (Docker — Advanced)

Install Docker Engine using the official documentation: Docker Install.

Verify the installation:

docker --version
docker compose version

Navigate to Hosts → Hosts.

Click Add Host.

Configure:

Click Finish.

Open the new Host, and click the Connectors tab.

Click Deploy → Deploy Connector.

Select your Linux distribution running on your VM.

Run the provided script on your VM's terminal.

Paste the token shown under "Generate Token" (located below the script).

Click Next.

Verify that the Connector shows "Connected."

Record the tunnel IP shown next to the Connector (e.g., 100.96.1.50) for a later step.

Open the new Host, and click the Applications tab.

Click Add Application.

Add an application for HTTPS:

(Optional) Add an application for HTTP (useful for curl testing from the tunnel):

Save and ensure the appropriate Access Groups have permission to reach these Applications.

Prepare the project directory on Docker:

mkdir -p ~/openclaw-docker
cd ~/openclaw-docker
mkdir -p config workspace

Set ownership to uid 1000 (the node user inside the container) and lock down permissions:

sudo chown -R 1000:1000 config workspace
chmod 700 config workspace

Keep ~/openclaw-docker/config/ and ~/openclaw-docker/workspace/ at 700 to prevent other users or processes from reading tokens and credentials.

Detect the CloudConnexa tunnel IP and store it for use in the compose file:

TUNNEL_IP=$(sudo openvpn3 sessions-list | grep 'tun' | awk -F ':' '{print $3}') && \
TUNNEL_IP=$(ip -4 addr show $TUNNEL_IP | grep -oP '(?:\b\.?(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){4}' | head -1)

echo "Detected tunnel IP: $TUNNEL_IP"

Verify this matches the tunnel IP shown in the CloudConnexa Admin portal (Step 3: Deploy the host connector). If it doesn't, set it manually:

TUNNEL_IP='100.96.1.50'

Create the docker-compose.yml file using the detected tunnel IP:

tee docker-compose.yml > /dev/null << EOF
services:
  openclaw-gateway:
    image: ghcr.io/openclaw/openclaw:latest
    container_name: openclaw-gateway
    restart: unless-stopped
    init: true
    ports:
      - "127.0.0.1:80:80"        # HTTP — local access for curl testing
      - "$TUNNEL_IP:443:443"     # HTTPS — CloudConnexa tunnel access
    volumes:
      - ./config:/home/node/.openclaw
      - ./workspace:/home/node/.openclaw/workspace
    environment:
      HOME: /home/node
      TERM: xterm-256color
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  openclaw-cli:
    image: ghcr.io/openclaw/openclaw:latest
    container_name: openclaw-cli
    profiles: ["cli"]
    network_mode: "service:openclaw-gateway"
    cap_drop:
      - NET_RAW
      - NET_ADMIN
    security_opt:
      - no-new-privileges:true
    stdin_open: true
    tty: true
    init: true
    entrypoint: ["node", "dist/index.js"]
    volumes:
      - ./config:/home/node/.openclaw
      - ./workspace:/home/node/.openclaw/workspace
    environment:
      HOME: /home/node
      TERM: xterm-256color
      BROWSER: echo
    depends_on:
      - openclaw-gateway

  caddy:
    image: caddy:latest
    container_name: caddy
    restart: unless-stopped
    network_mode: "service:openclaw-gateway"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
    depends_on:
      - openclaw-gateway

volumes:
  caddy_data:
EOF

Add firewall rules that restrict container traffic, allow localhost and CloudConnexa tunnel traffic, and block other inbound connections:

sudo tee -a /etc/ufw/after.rules > /dev/null << 'EOF'
*filter
:DOCKER-USER - [0:0]
-A DOCKER-USER -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
-A DOCKER-USER -s 127.0.0.0/8 -j RETURN
-A DOCKER-USER -s 100.96.0.0/11 -j RETURN
-A DOCKER-USER -m conntrack --ctstate NEW -j DROP
-A DOCKER-USER -j RETURN
COMMIT
EOF

Reload firewall rules:

sudo ufw reload
sudo iptables -S DOCKER-USER

Verify rules (optional) by displaying active Docker firewall rules:

sudo iptables -S DOCKER-USER

Connect to CloudConnexa.

In a web browser, navigate to:

https://openclaw.local1/#token=<your-token>2

Accept the certificate warning. (Caddy uses a self-signed internal certificate.)

Connect to your server.

List pending device requests:

openclaw devices list

Note the device ID you'll need to approve.

Approve the device:

openclaw devices approve <requestId>1

Refresh the browser.

The Control UI should now load.