Deploy and Host OpenClaw on Railway

OpenClaw is a self-hosted personal AI assistant gateway: one long-running process that bridges your chat channels (WhatsApp, Telegram, Discord, Slack, Signal, iMessage, Matrix, Teams) to an LLM backend and a set of tool plugins, so you talk to one assistant from wherever you already are.

This template runs it on nix, which is the part that makes it different. The agent has the whole nixpkgs collection available at runtime — nix run nixpkgs#ffmpeg, nix profile add nixpkgs#pandoc — without you rebuilding an image or redeploying. An agent that can reach for any tool mid-task is a meaningfully more capable agent than one boxed into whatever its image shipped with.

About Hosting OpenClaw

OpenClaw wants to be always-on: it holds channel connections open and answers whenever you message it, which is exactly the workload a laptop is bad at and a small always-on container is good at. The gateway keeps config, credentials, session history and its workspace on disk, so it needs persistent storage to stay itself across restarts. This template mounts a volume over the entire home directory rather than a single config folder — OpenClaw splits state across ~/.openclaw and ~/.config/openclaw (the second holds the OAuth-token encryption key), and a narrower mount quietly loses key material on redeploy.

Memory floor: 1 GB. Measured, not guessed. The Free plan's 0.5 GB is OOM-killed while unpacking the nixpkgs channel; on 1 GB this image idles around 290–365 MB with headroom for the channel spike. Deploy it on Trial or Hobby.

Why Deploy OpenClaw

Runtime access to all of nixpkgs. The agent installs what a task needs, when the task needs it.
One volume, all state. Config, workspace, auth profiles and the OAuth encryption key are all under the mounted home directory, so a redeploy does not amnesia your assistant.
Auth is on before you touch anything. The template mints a gateway token on first boot if you did not supply one, prints it once in the deploy log, and persists it on the volume.
Binds Railway's injected port. Sounds trivial; it is the single most common reason a template deploys and then fails its healthcheck.
Version pinned by digest, so the deploy you get is the deploy that was tested.

Common Use Cases

A personal assistant reachable from your existing chat apps, on your own infrastructure and keys.
A long-running agent that does real work between messages — fetching, summarising, filing.
A scratch environment for agent work where any CLI tool is one nix run away.

Security — read this before you expose it

This is the honest part, and it is your decision to make.

OpenClaw loads plugins that can act on the world. This deploy starts with: browser, canvas, device-pair, file-transfer, memory-core, ollama, phone-control, talk-voice. The exec tool runs shell commands. Anyone who can drive the gateway can, in effect, run code in this container and reach whatever it can reach.

What the template does for you by default:

Auth is on. The gateway is bound off-loopback, and upstream refuses to serve an unauthenticated non-loopback gateway. If you set no OPENCLAW_GATEWAY_TOKEN, one is generated for you rather than starting open.
Verified refusal, 2026-08-15. Against this exact image: a connection with no token and one with a guessed token are both closed with WebSocket code 1008 before a session is established, logged server-side as reason=token_mismatch, phase=auth_credentials_received. A correct token connects, and privileged calls still require operator scope on top of it.

What is left for you to decide:

The token is already out of the log. Railway generates a unique 48-character token per deploy and injects it as a service variable, so it is never printed anywhere. Read or rotate it in the service's Variables tab.
Do not hand out the public URL. A Railway public domain is world-reachable. If you only use chat channels, remove the public domain entirely — the gateway does not need inbound HTTP for Telegram or WhatsApp to work.
The volume is the blast radius. Persistent state is the point of the volume, and it also means anything an intruder leaves behind survives the redeploy that would otherwise clear it. If that trade is wrong for you, drop the volume and accept re-onboarding.
Rotate by deleting. Remove ~/.openclaw/.gateway-token (or change the service variable) and restart; a new token is minted on next boot.
Pin your own version. OPENCLAW_VERSION is a build arg. Upstream had an unauthenticated command-injection issue before 2026.1.20 (CVE-2026-25593); this template pins well past it, but if you change the version, check what you are moving to.
Least-privilege the keys you give it. The LLM API key you set is a key the agent can spend.

Dependencies for OpenClaw

Deployment Dependencies

An LLM provider key — Anthropic, OpenAI, Google Gemini, OpenRouter, DeepSeek, Groq, Mistral, or a local/OpenAI-compatible endpoint. OpenClaw does no useful work without one.
A persistent volume mounted at /home/node.
1 GB RAM minimum (Trial or Hobby).

Implementation Details

Built on nixos/nix, digest-pinned. OpenClaw is installed from npm at a pinned version. The entrypoint binds Railway's injected PORT, ensures a token exists, creates a baseline config on first boot with openclaw setup --baseline --non-interactive, then runs openclaw gateway run.