How to Deploy AI Agents

Running AI agents on your laptop works for quick experiments, but falls apart in production. Your laptop sleeps, loses Wi-Fi, and shares resources with everything else you're doing. A VPS gives you a dedicated machine that's always on, always reachable, and isolated from your daily workflow. It's also the only sane way to expose messaging integrations (Telegram, WhatsApp) that need a persistent connection.

More importantly, a VPS behind Tailscale (which we'll set up in the next section) means your agent infrastructure is invisible on the public internet, no open ports for bots to scan, no brute-force attempts filling your logs.

Hetzner's CX23 plan gives you 2 vCPUs, 4 GB RAM, 40 GB NVMe, and 20 TB of traffic for €5.99/month (about $7) including the public IPv4, at the prices Hetzner has charged since 15 June 2026. That's roughly 3-5x cheaper than equivalent specs on AWS, GCP, or DigitalOcean. Billing is hourly with a monthly cap, so you can spin up a server, test for a few hours, and destroy it for pennies. Datacenters are in Germany and Finland (Hetzner's US and Singapore locations don't sell the CX line), which keeps latency low for European users and respects EU data residency requirements by default.

For OpenClaw with cloud-hosted models (Anthropic, OpenAI), the CX23 is more than sufficient. If you plan to run local models through Ollama, you'll want to step up to a CX33 (4 vCPUs, 8 GB RAM) or higher, more on that in the OpenClaw install section.

As of September 2026 you may not be able to buy one. Since 26 June 2026 Hetzner has restricted new cloud servers for new customers and a random share of existing ones, citing high demand and limited hardware components, and its pricing page lists every Cost-Optimized plan (CX and CAX) as "not available". If the CX23 is greyed out for you, the Regular Performance CPX22 (2 vCPUs, 4 GB RAM, 80 GB NVMe) costs €19.99/month, or you can follow the same process on another provider with an Ubuntu 24.04 image. Check status.hetzner.com to see whether the restriction is still in place.

Select Shared vCPU under the server type. This is the cost-optimized tier where CPU cores are shared across tenants, perfectly fine for an agent gateway that spends most of its time waiting on API responses rather than crunching data locally.

Pick CX23 as the plan (2 vCPUs, 4 GB RAM, 40 GB NVMe). For reference, here's how the cost-optimized line scales if you need more later (June 2026 prices, IPv4 included):

• CX23: 2 vCPUs, 4 GB RAM, 40 GB NVMe for €5.99/month
• CX33: 4 vCPUs, 8 GB RAM, 80 GB NVMe for €8.99/month
• CX43: 8 vCPUs, 16 GB RAM, 160 GB NVMe for €16.49/month
• CX53: 16 vCPUs, 32 GB RAM, 320 GB NVMe for €29.99/month

You can resize between these tiers later without losing data, Hetzner handles the migration. Start small, scale when you need to.

Choose Ubuntu 24.04 LTS. OpenClaw's docs name Ubuntu LTS as the best-tested Linux install path, and 24.04 gets standard security updates through May 2029. Ubuntu 26.04 LTS (released April 2026, supported through May 2031) is also in Hetzner's image list with a newer kernel, but the screenshots in this runbook were taken on 24.04.

Some operators prefer Debian for its conservative update policy and lighter footprint. Both work, Ubuntu just has broader community support for troubleshooting, and it's what most OpenClaw guides assume.

Enable both IPv4 and IPv6. The IPv4 address is what you'll use for initial SSH access (before Tailscale takes over). IPv6 is free and future-proofs your setup, some services and APIs are starting to prefer it.

Don't worry about the public IPv4 being exposed right now. In the next section, we'll lock it down so only Tailscale traffic gets through.

Paste your public SSH key in the dialog. If you don't have one yet, generate a key pair on your local machine:

Leave Volumes and Firewalls empty for now. The 40 GB NVMe included with CX23 is plenty for OpenClaw (which needs around 1-2 GB for the installation plus workspace). We'll handle firewall rules at the OS level with ufw and Tailscale, which gives us more granular control than Hetzner's cloud firewall.

If the connection succeeds, you're in. This is the last time you'll SSH over the public internet, by the end of the next section, public SSH access will be completely disabled.

If it fails, double-check that the SSH key you pasted matches the private key on your local machine (~/.ssh/id_ed25519), and that your local IP isn't being blocked by any corporate firewall or VPN.

By the end of this section, your VPS will have a completely different security posture:

• Before: SSH on port 22 accepting connections from any IP on earth. Root login enabled. Password authentication possible.


• After: SSH only listens on the Tailscale network interface. Root login disabled. Password auth disabled. Only authorized devices on your Tailscale tailnet can reach the server at all.

This is the "zero trust" approach. The server doesn't trust any network. Access is granted per-device, per-user, through an encrypted mesh, not by IP address or network location.

Tailscale creates a private mesh network (called a "tailnet") between your devices using WireGuard encryption under the hood. Every device on the tailnet gets a stable 100.x.x.x IP address that works regardless of physical network, NAT, or firewall. Traffic between devices is end-to-end encrypted and peer-to-peer, it doesn't route through Tailscale's servers (except for initial coordination, or through an encrypted relay as a last resort when a direct path isn't possible).

Think of it as a VPN, but without the VPN server bottleneck. Your laptop talks directly to your VPS through an encrypted tunnel, and that tunnel works from your home Wi-Fi, a coffee shop, a hotel, or a corporate network, no port forwarding or firewall exceptions required.

For our setup, Tailscale replaces traditional SSH key management entirely. With --ssh enabled, Tailscale handles authentication and authorization for SSH connections. You don't need to manage authorized_keys files, rotate SSH keys, or worry about compromised keys, access is controlled through Tailscale's admin console.

For the private network to work, both ends need Tailscale. Download and install Tailscale on the machine you'll manage the VPS from, e.g. your laptop, desktop, or workstation. Tailscale supports macOS, Windows, Linux, iOS, and Android.

Once both devices are connected, you can ping one from the other using their Tailscale IPs. This confirms the encrypted tunnel is working.

The admin console at login.tailscale.com/admin/machines shows all devices on your tailnet, their Tailscale IPs, connection status, and last-seen timestamps. Bookmark this, you'll use it whenever you add a new device or debug connectivity issues.

While you're on that page, open the menu at the far right of your VPS's row and select Disable Key Expiry. Tailscale node keys expire after 180 days by default, and once public SSH is closed later in this section, an expired key on the VPS leaves Hetzner's web console as your only way in.

Now the critical part: we tell the SSH daemon to only listen on the Tailscale network interface. This means SSH becomes completely invisible on the public internet, even a port scan of your public IP won't find it.

Open the SSH configuration file in your VPS terminal:

Then set these two additional options to disable password authentication and root login:

Running everything as root is a security anti-pattern. If an agent or tool gets compromised, root access means the attacker owns the entire machine. A dedicated non-root user limits the blast radius and gives you an audit trail of privileged actions through sudo.

This is the moment of truth. We'll restart the SSH daemon with the new configuration, then verify that:

1. Root SSH over the public IP fails (expected, we disabled both)


2. SSH as clawuser over the Tailscale IP succeeds

This connection goes to Tailscale SSH, not sshd, because Tailscale claims port 22 on the VPS's Tailscale IP. PermitRootLogin doesn't apply to it. The default tailnet policy runs Tailscale SSH in check mode, so the first connection may print a link to re-authenticate in your browser (valid for 12 hours). The same policy lets you in as root as well. To block root over Tailscale too, open Access controls in the admin console and remove "root" from the users list of the ssh rule.

If you need to access the server from another device (phone, a second laptop, a CI runner), install Tailscale on that device and connect it to the same tailnet. No SSH key copying needed, Tailscale handles the authentication.

You may still be able to ping the public IP at this stage. That's fine, ping doesn't give an attacker much. We'll close this completely with ufw firewall rules after OpenClaw is installed, in the Firewall & Gateway section.