openclaw-nix is a robust NixOS module designed for securely deploying OpenClaw, an industry-leading agent infrastructure platform boasting over 180,000 GitHub stars. Despite its popularity, many OpenClaw installations suffer from critical security misconfigurations, including over 15,200 exposed admin panels on the public internet and an alarming lack of default security measures.

The Challenge

The configuration pitfalls of OpenClaw can lead to significant vulnerabilities:

• Public Exposure: Default configurations expose control panels to the internet without proper authentication.
• Security Risks: Unrestricted tool execution can allow for unauthorized shell access.
• Lack of Protections: Many installations do not enforce TLS or firewall rules, putting user data at risk.

The Solution

openclaw-nix addresses these security challenges with just two simple lines in the NixOS configuration:

services.openclaw.enable = true;
services.openclaw.domain = "agents.example.com";

By enabling this module, users benefit from:

Quick Setup Options

Two methods simplify the deployment process:

1. Interactive Setup using the command:

   nix run github:Scout-DJ/openclaw-nix#quick-setup
   

   This script guides users through configuring their domain and API keys while generating a deployable NixOS configuration.

2. Manual Setup for advanced users:

   • Add to flake inputs:

     inputs = {
       nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
       openclaw.url = "github:Scout-DJ/openclaw-nix";
     };
     

   • Configure as follows:

     # configuration.nix
     { config, pkgs, ... }:
     {
       services.openclaw = {
         enable = true;
         domain = "agents.example.com";
         modelProvider = "anthropic";
         modelApiKeyFile = "/run/secrets/anthropic-api-key";
         telegram = {
           enable = true;
           tokenFile = "/run/secrets/telegram-bot-token";
         };
       };
     }
     

   • Deploy the configuration:

     sudo nixos-rebuild switch --flake .#myhost
     

   • Retrieve the generated authentication token:

     sudo cat /var/lib/openclaw/auth-token
     

Module Options Overview

Strong Security Foundation

The service implements robust systemd hardening features to enhance security:

NoNewPrivileges=yes        # Prevents privilege escalation.
PrivateTmp=yes             # Isolates temporary files.
ProtectSystem=strict       # Enforces read-only filesystem policies.
ProtectHome=yes            # Restricts access to user home directories.

With NixOS, the project benefits from a declarative configuration that is auditable and reproducible, ensuring that deployments remain consistently secure and reliable.

Production-Level Considerations

For environments that require secure management of secrets, consider utilizing:

• agenix for age-encrypted secrets.
• sops-nix for SOPS integration.

openclaw-nix serves as a critical tool for deploying OpenClaw securely, ensuring that users can utilize its capabilities without compromising on safety.