WorkFlows

graph TD subgraph "Phase 1: Initial Setup" A[Start: Buy VPS] --> B[Get Public IP and SSH Access] B --> C[Immediate SSH Attacks Begin] end subgraph "Phase 2: Basic Security Hardening" C --> D["Update System
apt update and apt upgrade"] D --> E["Install Security Tools
curl, wget, ufw, fail2ban"] E --> F["Create Non-Root User 'claw'"] F --> G["Generate SSH Key (ed25519)"] G --> H["Configure SSH (Port 2222, No Root)"] H --> I["Test and Reload SSH"] end subgraph "Phase 3: Network Security" I --> J["Configure Firewall (UFW)"] J --> K["Allow Port 2222 Only"] K --> L["Configure Fail2ban Jail"] L --> M["Enable Auto Security Updates"] end subgraph "Phase 4: OS Configuration" M --> N["Set Timezone (UTC)"] N --> O["Disable IPv6"] O --> P["Install Tailscale VPN"] P --> Q["Remove Public SSH Access"] end subgraph "Phase 5: Application Installation" Q --> R["Install Node.js 20.x"] R --> S["Install Git"] S --> T["Install pnpm"] T --> U["Clone OpenClaw Repository"] U --> V["Build OpenClaw"] V --> W["Create /opt/openclaw Directory"] W --> X["Configure Environment File"] end subgraph "Phase 6: Service Management" X --> Y["Create Systemd Service"] Y --> Z["Configure Service Permissions"] Z --> AA["Enable and Start Service"] AA --> AB["Verify with openclaw doctor"] end subgraph "Phase 7: Final Security" AB --> AC["Run Security Audit"] AC --> AD["Configure Logging"] AD --> AE["Setup Backups"] AE --> AF[Final State: Secure Server] end %% Critical Security Paths C -.->|"Time-sensitive"| D G -.->|"Key Management"| I Q -.->|"VPN Isolation"| AF Y -.->|"Service Hardening"| AF %% Failure Recovery Paths I -.->|"SSH Key Lost"| G AF -.->|"Weekly Kernel Panics"| AD