From zero to a fully operational AI agent with Telegram, web search, browser automation, and X/Twitter integration — for under $10/month.

Why This Guide Exists

Most OpenClaw tutorials cover the basics but skip the real-world problems: permission errors, config mismatches, Docker gotchas, and the "pairing required" errors that make you want to throw your laptop. This guide covers everything — including the mistakes — so you don't have to figure them out yourself.

What you'll have by the end:

• A 24/7 AI agent running on a Hetzner VPS
• Telegram integration (chat with your agent from your phone)
• Web search (SearXNG — free, unlimited, self-hosted)
• Browser automation (Chromium for web scraping and research)
• X/Twitter integration (post, reply, search via xurl)
• Text-to-speech (Microsoft TTS — free)
• Tailscale HTTPS access (no SSH tunnel needed)
• GitHub workspace backup
• Secure, production-ready configuration

Cost: ~$7-10/month (Hetzner VPS only)

Time: ~2 hours (including inevitable troubleshooting)

Pro tip: Use Claude Code (or any AI coding assistant) to streamline this process. I built this entire setup in a single session with Claude helping me debug every issue in real-time.

Table of Contents

1. Choose Your VPS
2. Initial Server Setup
3. Clone and Configure OpenClaw
4. Docker Compose Customization
5. Configuration File (openclaw.json)
6. Build and Launch
7. Access: Tailscale vs SSH Tunnel
8. Telegram Channel Setup
9. Model Provider Setup (OpenAI Codex OAuth)
10. Fallback Model (Gemini Flash)
11. Web Search (SearXNG + Codex Native)
12. Browser Automation (Chromium)
13. Text-to-Speech
14. X/Twitter Integration (xurl)
15. GitHub Workspace Backup
16. Google Workspace (Calendar, Gmail, Drive)
17. Security Hardening
18. Skills & Tools
19. Mobile Access (Termius)
20. Maintenance & Updates
21. Common Errors & Fixes

1. Choose Your VPS

Why Hetzner?

• Cheapest reliable VPS in Europe (~€4-7/month)
• Great uptime and network
• Easy scaling (upgrade RAM without losing data)

Recommended Specs

Important: Before choosing a location, check server availability at radar.iodev.org. Pick a location with good availability — if you need to scale up/down later, low-availability locations will block you. I got stuck and couldn't rescale for hours because my location had no availability.

Why 8 GB RAM?

With 4 GB I hit memory limits during Docker builds (exit code 137 = OOM killed) and couldn't run Chromium + SearXNG + the gateway simultaneously. With 8 GB, everything runs comfortably with ~5 GB free.

2. Initial Server Setup

SSH into your VPS

ssh root@YOUR_VPS_IP

Install Docker

apt-get update
apt-get install -y git curl ca-certificates
curl -fsSL https://get.docker.com | sh

Install Tailscale (optional but recommended)

curl -fsSL https://tailscale.com/install.sh | sh
tailscale up

Open the auth URL in your browser to join the VPS to your tailnet.

Install GitHub CLI

apt install -y gh
gh auth login

Create persistent directories

mkdir -p /root/.openclaw/workspace
chown -R 1000:1000 /root/.openclaw

Why uid 1000? The OpenClaw container runs as user node (uid 1000), not root. All mounted volumes must be owned by uid 1000 or the gateway will crash with EACCES: permission denied.

3. Clone and Configure OpenClaw

git clone https://github.com/openclaw/openclaw.git
cd openclaw
git checkout v2026.4.2  # Use stable release, not main HEAD

Lesson learned: I initially used main branch and hit stack overflow errors in all plugins. Always use a stable release tag.

Create your .env file

cat > .env << 'EOF'
OPENCLAW_IMAGE=openclaw:latest
OPENCLAW_GATEWAY_TOKEN=GENERATE_WITH_openssl_rand_-hex_32
OPENCLAW_GATEWAY_BIND=lan
OPENCLAW_GATEWAY_PORT=18789

OPENCLAW_CONFIG_DIR=/root/.openclaw
OPENCLAW_WORKSPACE_DIR=/root/.openclaw/workspace

TELEGRAM_BOT_TOKEN=YOUR_TELEGRAM_BOT_TOKEN
GEMINI_API_KEY=YOUR_GEMINI_API_KEY
SEARXNG_BASE_URL=http://searxng:8080

GOG_KEYRING_PASSWORD=GENERATE_WITH_openssl_rand_-hex_32
TZ=UTC
EOF

Generate strong tokens:

openssl rand -hex 32

4. Docker Compose Customization

The default docker-compose.yml needs several modifications. Here's what to change and why:

Key modifications:

1. Add build directive — the default image doesn't exist in any registry; you build locally
2. Install Chromium — OPENCLAW_INSTALL_BROWSER: "1" build arg
3. Bind ports to loopback — 127.0.0.1: prefix for security
4. Add environment variables — Telegram, Gemini, SearXNG
5. Mount persistent volumes — SSH keys, git config, xurl tokens
6. Add SearXNG service — free, unlimited web search
7. Add --allow-unconfigured — lets gateway start without gateway.mode=local

Complete docker-compose.yml (gateway service):

services:
  openclaw-gateway:
    image: ${OPENCLAW_IMAGE:-openclaw:local}
    build:
      context: .
      args:
        OPENCLAW_INSTALL_BROWSER: "1"
    environment:
      HOME: /home/node
      TERM: xterm-256color
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN:-}
      NODE_ENV: production
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
      GEMINI_API_KEY: ${GEMINI_API_KEY:-}
      SEARXNG_BASE_URL: http://searxng:8080
      TZ: ${OPENCLAW_TZ:-UTC}
    volumes:
      - ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
      - ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
      - /root/.agent-ssh:/home/node/.ssh
      - /root/.agent-gitconfig/.gitconfig:/home/node/.gitconfig:ro
      - /root/.agent-xurl/.xurl:/home/node/.xurl
    ports:
      - "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
      - "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"
    init: true
    restart: unless-stopped
    command:
      [
        "node", "dist/index.js", "gateway",
        "--bind", "${OPENCLAW_GATEWAY_BIND:-lan}",
        "--port", "18789",
        "--allow-unconfigured",
      ]
    healthcheck:
      test: ["CMD", "node", "-e",
        "fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  searxng:
    image: docker.io/searxng/searxng:latest
    restart: unless-stopped
    volumes:
      - searxng-data:/var/cache/searxng/
    environment:
      - SEARXNG_BASE_URL=http://searxng:8080/

volumes:
  searxng-data:

Baking custom CLI tools into the image

If you need tools like xurl (X/Twitter), clawhub (skill discovery), or summarize (URL/video summarization), add them to the Dockerfile before the USER node line:

# Custom agent CLI tools
RUN npm i -g @xdevplatform/xurl clawhub @steipete/summarize

5. Configuration File

The gateway config lives at /root/.openclaw/openclaw.json (mounted inside the container at /home/node/.openclaw/openclaw.json).

Critical: The file must be named openclaw.json, NOT config.json. I wasted 30 minutes on this.

Critical: After editing from the host as root, always run:

chown 1000:1000 /root/.openclaw/openclaw.json

Otherwise the container (uid 1000) can't read it.

Complete openclaw.json:

{
  "gateway": {
    "mode": "local",
    "controlUi": {
      "allowedOrigins": [
        "http://127.0.0.1:18789",
        "http://localhost:18789",
        "https://YOUR-HOSTNAME.tailnet-name.ts.net"
      ],
      "allowInsecureAuth": true
    },
    "auth": {
      "mode": "token",
      "token": "SAME_TOKEN_AS_YOUR_ENV_FILE",
      "rateLimit": {
        "maxAttempts": 10,
        "windowMs": 60000,
        "lockoutMs": 300000
      }
    },
    "port": 18789,
    "bind": "loopback",
    "tailscale": {
      "mode": "off",
      "resetOnExit": false
    },
    "nodes": {
      "denyCommands": []
    }
  },
  "channels": {
    "telegram": {
      "enabled": true,
      "dmPolicy": "pairing",
      "allowFrom": ["YOUR_TELEGRAM_USER_ID"],
      "defaultTo": "YOUR_TELEGRAM_USER_ID",
      "execApprovals": {
        "enabled": true,
        "target": "dm"
      },
      "groups": {
        "*": { "requireMention": true }
      }
    }
  },
  "agents": {
    "defaults": {
      "workspace": "/home/node/.openclaw/workspace",
      "model": {
        "primary": "openai-codex/gpt-5.4",
        "fallbacks": ["google/gemini-3-flash-preview"]
      }
    }
  },
  "messages": {
    "tts": {
      "auto": "inbound",
      "provider": "microsoft",
      "maxTextLength": 3000,
      "summaryModel": "google/gemini-3-flash-preview",
      "providers": {
        "microsoft": {
          "voice": "en-US-MichelleNeural",
          "lang": "en-US"
        }
      }
    }
  },
  "session": {
    "dmScope": "per-channel-peer"
  },
  "tools": {
    "profile": "full",
    "web": {
      "search": {
        "enabled": true,
        "openaiCodex": {
          "enabled": true,
          "mode": "cached",
          "contextSize": "high"
        }
      }
    }
  }
}

Token mismatch warning

The openclaw onboard wizard writes its own gateway token to openclaw.json. If it's different from your .env token, CLI commands, subagents, and cron jobs will fail. Always sync them:

# Check token in config
docker compose exec openclaw-gateway cat /home/node/.openclaw/openclaw.json | grep token

# Compare with .env
grep OPENCLAW_GATEWAY_TOKEN .env

6. Build and Launch

docker compose build    # First build takes 5-10 minutes
docker compose up -d openclaw-gateway searxng

Verify:

# Wait ~30 seconds for startup, then:
curl http://127.0.0.1:18789/healthz
# Should return: {"ok":true,"status":"live"}

docker compose ps
# All services should show "Up"

docker logs openclaw-openclaw-gateway-1 2>&1 | grep "listening"
# Should show: [gateway] listening on ws://0.0.0.0:18789

7. Access: Tailscale vs SSH Tunnel

Option A: Tailscale Serve (recommended)

No SSH tunnel needed. HTTPS built-in.

tailscale serve --bg http://127.0.0.1:18789

Important: Use http:// not https+insecure:// — the gateway serves HTTP, not HTTPS. Using the wrong protocol gives you a 502 error.

Add the Tailscale origin to your openclaw.json:

"allowedOrigins": [
  "http://127.0.0.1:18789",
  "https://YOUR-HOSTNAME.tailnet-name.ts.net"
]

Access from any device on your tailnet: https://YOUR-HOSTNAME.tailnet-name.ts.net/

Option B: SSH Tunnel (fallback)

ssh -N -L 18789:127.0.0.1:18789 root@YOUR_VPS_IP

Then open http://127.0.0.1:18789/ in your browser.

Note: With SSH tunnel, you need "allowInsecureAuth": true because you're accessing via HTTP (the tunnel encrypts the transport, but the browser sees HTTP).

Device Pairing

Every new browser/device needs to be "paired" (approved):

docker compose exec openclaw-gateway node dist/index.js devices list
docker compose exec openclaw-gateway node dist/index.js devices approve --latest

8. Telegram Channel Setup

Create your bot

1. Open @BotFather in Telegram
2. /newbot → follow prompts → copy the bot token
3. Add token to your .env file

Configure in openclaw.json

The key settings:

• dmPolicy: "pairing" — unknown users get a pairing code you must approve
• execApprovals.enabled: true — the agent asks your permission before running commands
• allowFrom + defaultTo — required for exec approvals to work (needs your Telegram user ID)
• groups.*: { requireMention: true } — bot only responds when mentioned in groups

Find your Telegram User ID

Send a message to your bot, then check:

docker compose logs openclaw-gateway | grep "sendMessage.*chat="

Approve your user

After sending a DM to the bot:

docker compose exec openclaw-gateway node dist/index.js pairing list telegram
docker compose exec openclaw-gateway node dist/index.js pairing approve telegram CODE

BotFather settings (for groups)

• /setprivacy → Disable (so bot sees all group messages)
• Remove and re-add bot to groups after changing privacy

9. Model Provider Setup (OpenAI Codex OAuth)

OpenAI Codex lets you use your ChatGPT subscription (no separate API billing):

docker compose exec -it openclaw-gateway node dist/index.js onboard --auth-choice openai-codex

This opens an OAuth flow — paste the URL in your browser, authorize, and return the code.

10. Fallback Model (Gemini Flash)

If OpenAI goes down, your agent is dead without a fallback. Gemini Flash is free (with limits):

1. Get API key at aistudio.google.com/apikey
2. Add GEMINI_API_KEY=your-key to .env
3. Config: "fallbacks": ["google/gemini-3-flash-preview"]

Note: The config key is "fallbacks" (array), not "fallback" (string). This tripped me up.

11. Web Search

Dual-layer approach:

1. Codex Native Search — built into OpenAI Codex, works automatically for your primary model
2. SearXNG — self-hosted, free, unlimited, works for fallback model and provides Google+Bing+DuckDuckGo combined results

SearXNG runs as a Docker service alongside your gateway (see docker-compose above). No API keys needed.

SearXNG requires OpenClaw v2026.4.1+ — earlier versions don't have the bundled plugin.

12. Browser Automation (Chromium)

Build with OPENCLAW_INSTALL_BROWSER: "1" in docker-compose build args. Adds ~300MB to image.

Use cases:

• Navigate competitor websites
• Take screenshots of search results
• Extract content from pages
• Automate web tasks

13. Text-to-Speech

Microsoft TTS is free (no API key), but you need to explicitly enable the Microsoft plugin — otherwise you'll get "no provider registered" errors even with the correct TTS config.

Step 1: Enable the plugin

docker compose exec openclaw-gateway openclaw config set plugins.entries.microsoft.enabled true
docker compose restart openclaw-gateway

Step 2: Configure TTS in openclaw.json

"messages": {
  "tts": {
    "auto": "inbound",
    "provider": "microsoft",
    "providers": {
      "microsoft": {
        "voice": "en-US-MichelleNeural",
        "lang": "en-US"
      }
    }
  }
}

• "inbound" = responds with audio only when you send audio
• For Spanish: "voice": "es-MX-DaliaNeural"
• For always audio: "auto": "always"

Common gotcha: The TTS config alone is not enough. You must also set plugins.entries.microsoft.enabled: true or the Microsoft speech provider won't register and TTS will silently fail.

14. X/Twitter Integration (xurl)

Setup

1. Create a free X Developer account at developer.x.com

   • App type: Automated App or Bot
   • Permissions: Read and Write
   • Callback URL: http://localhost:8080/callback
   • Free tier: 500 posts/month (plenty for personal brand)

2. Get your OAuth 1.0a tokens (API Key, Secret, Access Token, Access Token Secret)

3. Authenticate inside the container:

docker compose exec -it openclaw-gateway xurl auth oauth1 \
  --consumer-key YOUR_API_KEY \
  --consumer-secret YOUR_API_SECRET \
  --access-token YOUR_ACCESS_TOKEN \
  --token-secret YOUR_TOKEN_SECRET

Use OAuth 1.0a, not OAuth 2.0 for Docker setups. OAuth 2.0 requires a localhost callback that doesn't work inside containers without port forwarding.

1. Verify: docker compose exec openclaw-gateway xurl whoami

Persistence

Mount the xurl tokens as a volume:

volumes:
  - /root/.agent-xurl/.xurl:/home/node/.xurl

15. GitHub Workspace Backup

Create a dedicated agent GitHub account

Don't use your personal account — create a separate one (e.g., your-agent-dev) for:

• Security isolation
• Clear audit trail
• Easy revocation

SSH key setup (inside container)

docker compose exec openclaw-gateway ssh-keygen -t ed25519 -C "agent@email.com" -f /home/node/.ssh/id_ed25519 -N ""
docker compose exec openclaw-gateway cat /home/node/.ssh/id_ed25519.pub

Add the public key to GitHub (Settings → SSH keys).

Persist SSH keys

Mount as volume:

volumes:
  - /root/.agent-ssh:/home/node/.ssh
  - /root/.agent-gitconfig/.gitconfig:/home/node/.gitconfig:ro

Connect workspace to GitHub

docker compose exec -w /home/node/.openclaw/workspace openclaw-gateway \
  git remote set-url origin git@github.com:YOUR_AGENT_USER/your-workspace-repo.git

16. Google Workspace (Calendar, Gmail, Drive)

Give your agent access to your Google Calendar, Gmail, Drive, Sheets, and Docs using gog (Google Workspace CLI).

Install gog

Add to your Dockerfile (before USER node):

RUN curl -fsSL https://github.com/steipete/gogcli/releases/download/v0.12.0/gogcli_0.12.0_linux_amd64.tar.gz | tar -xz -C /usr/local/bin gog && chmod +x /usr/local/bin/gog

Create Google OAuth credentials

1. Go to console.cloud.google.com
2. Create a new project (e.g., "openclaw-agent")
3. Enable APIs: Google Calendar API, Gmail API, Google Drive API, Google Sheets API, Google Docs API
4. Go to APIs & Services → Credentials → Create Credentials → OAuth Client ID
5. Type: Desktop App (not Web Application — web clients fail with dynamic port mismatches)
6. Download client_secret_XXXX.json

OAuth consent screen

Your app will be in Testing mode by default. Add your personal email as a Test user (OAuth consent screen → Test users), otherwise you'll get a 403 access_denied error.

Use OAuth, not Service Accounts. Service accounts need Google Workspace admin + domain-wide delegation — overkill and dangerous for personal use. OAuth is designed for this.

Upload credentials to VPS

scp client_secret_XXXX.json root@YOUR_VPS_IP:/root/.openclaw/client_secret.json
chown 1000:1000 /root/.openclaw/client_secret.json
chmod 600 /root/.openclaw/client_secret.json

Authenticate (headless VPS flow)

The --remote flag is key — it gives you a URL to open in your local browser instead of trying to open a browser on the VPS.

# Step 1: Register credentials
docker compose exec -it openclaw-gateway gog auth credentials /home/node/.openclaw/client_secret.json

# Step 2: Start OAuth flow (generates URL)
docker compose exec -it openclaw-gateway gog auth add YOUR_EMAIL@gmail.com --services calendar,gmail,drive,sheets,docs --remote --step 1

Open the URL in your browser, authorize, then copy the full callback URL from your browser's address bar. Then:

# Step 3: Complete OAuth with the callback URL
docker compose exec -it openclaw-gateway gog auth add YOUR_EMAIL@gmail.com --services calendar,gmail,drive,sheets,docs --remote --step 2 --auth-url "PASTE_FULL_CALLBACK_URL_HERE"

Use your personal email, not the agent's email. The whole point is to give the agent access to your calendar and emails.

Verify

docker compose exec -e GOG_ACCOUNT=YOUR_EMAIL@gmail.com openclaw-gateway gog auth list
docker compose exec -e GOG_ACCOUNT=YOUR_EMAIL@gmail.com openclaw-gateway gog calendar events primary --from \((date -u +%Y-%m-%dT00:00:00Z) --to \)(date -u -d "+7 days" +%Y-%m-%dT23:59:59Z)

Persistence

Add these to your docker-compose.yml:

environment:
  GOG_KEYRING_PASSWORD: ${GOG_KEYRING_PASSWORD:-}
  GOG_ACCOUNT: YOUR_EMAIL@gmail.com

volumes:
  - /root/.agent-gog:/home/node/.config/gogcli

Create the persistent directory:

mkdir -p /root/.agent-gog && chown 1000:1000 /root/.agent-gog

Common gotcha: gog stores config in /home/node/.config/gogcli/ (not .config/gog/). Mount to the correct path or auth will fail.

Usage

Ask your agent in Telegram:

• "What's on my calendar this week?"
• "Create a meeting tomorrow at 10am called Team Sync"
• "Search my emails from the last 3 days"
• "Create a Google Doc with a draft for my blog post"

The gog skill is bundled with OpenClaw — no skill installation needed.

17. Security Hardening

Run the security audit

docker compose exec openclaw-gateway openclaw security audit

Key fixes:

1. Config file permissions (critical):

chmod 600 /root/.openclaw/openclaw.json
chown 1000:1000 /root/.openclaw/openclaw.json

1. Auth rate limiting — protects against brute force:

"rateLimit": {
  "maxAttempts": 10,
  "windowMs": 60000,
  "lockoutMs": 300000
}

1. Loopback port binding — 127.0.0.1: prefix prevents direct internet exposure

2. Exec approvals — agent asks permission before running commands

3. allowFrom — whitelist your Telegram user ID

18. Skills & Tools

Built-in (no setup needed)

• skill-creator — create custom skills
• github — GitHub operations via gh CLI
• weather — weather data (no API key)

Recommended installs (add to Dockerfile)

RUN npm i -g @xdevplatform/xurl clawhub @steipete/summarize

• xurl — X/Twitter posting and engagement
• clawhub — discover and install community skills
• summarize — summarize URLs, YouTube videos, podcasts

Useful bundled skills

• blogwatcher — monitor competitor blogs
• video-frames — extract frames from videos (needs ffmpeg)
• nano-pdf — edit PDFs
• session-logs — search conversation history

19. Mobile Access (Termius)

Use Termius for SSH from Android/iOS:

1. Generate a biometric key (fingerprint/Face ID)
2. Add the public key to your VPS:

echo "YOUR_PUBLIC_KEY" >> /root/.ssh/authorized_keys

1. Each device needs its own key — biometric keys don't sync between devices

20. Maintenance & Updates

Update OpenClaw

cd /root/openclaw
git fetch --tags
git checkout v2026.X.Y  # Latest stable tag
docker compose build --no-cache
docker compose down && docker compose up -d

After editing openclaw.json from host

Always fix ownership:

chown 1000:1000 /root/.openclaw/openclaw.json

Or edit from inside the container to avoid this:

docker compose exec openclaw-gateway openclaw config set <key> <value>

21. Common Errors & Fixes

"non-loopback Control UI requires gateway.controlUi.allowedOrigins"

Add your access URL to allowedOrigins in openclaw.json. The gateway blocks browsers from origins not in the list.

"pairing required" on Control UI login

Your browser needs to be approved as a device:

docker compose exec openclaw-gateway node dist/index.js devices approve --latest

"exec approval is required, but chat exec approvals are not enabled"

You need allowFrom with your Telegram user ID AND execApprovals.enabled: true. Without a resolved approver, exec approvals silently disable themselves.

"EACCES: permission denied" on openclaw.json

The file is owned by root but the container runs as uid 1000:

chown 1000:1000 /root/.openclaw/openclaw.json

"fatal: could not open .git/COMMIT_EDITMSG: Permission denied"

Same ownership issue in the workspace .git/ directory:

chown -R 1000:1000 /root/.openclaw/workspace/.git/

Config not loading / "Invalid input"

• Config file must be named openclaw.json (not config.json)
• "fallbacks" is an array: ["model"] not "model"
• After editing, do docker compose down && docker compose up -d (not just restart)

Build killed (exit code 137)

Out of memory. Upgrade to 8 GB RAM or add swap:

fallocate -l 2G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile

Tailscale serve gives 502

You used https+insecure:// but the gateway serves HTTP:

tailscale serve --https=443 off
tailscale serve --bg http://127.0.0.1:18789

Stack overflow errors in plugins

You're on an unstable commit. Use a release tag:

git checkout v2026.4.2
docker compose build --no-cache

Resources

• Official Hetzner Setup Guide
• Docker VM Runtime Guide
• Gateway Configuration Reference
• Telegram Channel Docs
• Skills Documentation
• Hetzner Availability Radar
• xurl GitHub

Final Setup Checklist

• Hetzner VPS provisioned (8 GB RAM recommended)
• Docker + Tailscale installed
• OpenClaw cloned on stable release tag
• .env configured with strong tokens
• docker-compose.yml customized
• openclaw.json created with correct permissions (uid 1000, mode 600)
• Image built with Chromium (OPENCLAW_INSTALL_BROWSER=1)
• Gateway healthy (/healthz returns ok)
• Tailscale serve configured (HTTPS access)
• Device paired in Control UI
• Telegram bot created and paired
• Model provider authenticated (OpenAI Codex OAuth)
• Fallback model configured (Gemini Flash)
• SearXNG running and connected
• TTS configured (Microsoft, free)
• xurl authenticated for X/Twitter
• SSH keys + git config mounted as volumes
• Workspace connected to GitHub
• Google Workspace authenticated (Calendar, Gmail, Drive, Sheets, Docs)
• Security audit clean (0 critical)

Built from real experience setting up OpenClaw from scratch. Every error in this guide is one I actually hit and solved.