Tutorial: Secure OpenClaw with CloudConnexa
Overview
You can securely deploy OpenClaw with CloudConnexa to provide private, remote access without exposing your service to the public internet.
CloudConnexa creates an always-on encrypted tunnel to your server, allowing authorized users to access OpenClaw using a private domain and tunnel IP. You can add HTTPS using a reverse proxy for a secure browser experience.
This guide provides two deployment options depending on your environment and level of control required.
Choose your deployment method
Option 1: Standalone deployment (recommended)
Deploy OpenClaw directly on your server using a Caddy reverse proxy and a CloudConnexa Host Connector.
Best for:
Quick and simple setup.
Most users and small teams.
Minimal infrastructure.
Standard production use.
Benefits:
Easiest to install and maintain.
Fewer moving parts.
No container or orchestration overhead.
👉 Use this guide: Tutorial: Secure OpenClaw on a Linux Server Using CloudConnexa and Caddy
Option 2: Docker deployment (advanced)
Deploy OpenClaw using Docker Compose with Caddy and additional security hardening.
Best for:
Advanced users or DevOps teams.
Containerized environments.
Greater control over isolation and configuration.
Environments requiring stricter security controls.
Benefits:
Container isolation.
More advanced security configuration.
Easier to integrate into existing container workflows.
👉 Use this guide: Tutorial: Secure OpenClaw with CloudConnexa (Docker — Advanced)
What both options provide
Regardless of the deployment method, both approaches:
Use a CloudConnexa Host Connector for private connectivity.
Provide secure remote access without opening public ports.
Support HTTPS access using Caddy.
Enforce authentication and device approval.
Allow access using a private domain (e.g., openclaw.local).
Recommendation
If you're unsure which option to choose, start with the Standalone deployment. You can move to Docker later if you need more control or integration with container-based workflows.