docs(gcp): Actualize GCP installation guide, add native install path, Tailscale, and security hardening by rodion-m · Pull Request #4426 · openclaw/openclaw

rodion-m · 2026-01-30T06:29:11Z

Summary

This PR improves the GCP deployment guide by adding:

Native installation option alongside Docker for simpler personal setups
Tailscale integration for secure remote access without exposing public IP
Cloud NAT configuration for VMs without public IP
Budget alerts setup to avoid billing surprises
Security checklist with recommended file permissions
Telegram channel configuration example with pairing workflow
Simplified structure and improved readability
Updated cost estimates (~$18/mo minimum)

Changes

Before	After
Docker-only installation	Docker + Native options
SSH tunnel for access	SSH tunnel + Tailscale Serve
No security hardening section	Security checklist + permissions
No budget alerts	Budget alerts with gcloud CLI
~500 lines	~500 lines (restructured)

Test plan

Verify all gcloud commands work
Test native installation path
Test Tailscale integration
Verify internal doc links

Based on production experience running OpenClaw on GCP with Tailscale.

Greptile Overview

Greptile Summary

This PR significantly restructures docs/platforms/gcp.md to cover both Docker and native installation paths, adds Tailscale-based access, removes public IP guidance (with Cloud NAT), and expands the doc with budget alerts, a security checklist/permissions, channel setup examples, troubleshooting, and an updated monthly cost estimate.

Main things to double-check are that the new “native + systemd/onboarding” instructions match what the current OpenClaw Linux CLI actually supports, and that the config/code snippets are copy/paste safe (JSON vs JSON5, OS Login + Tailscale SSH examples, permission commands).

Confidence Score: 3/5

This PR is generally safe to merge, but a few doc instructions are likely to mislead users or fail when copy/pasted.
Changes are documentation-only and mostly additive, but there are a couple of high-impact accuracy/security concerns (remote install via curl|bash, potentially unsupported systemd onboarding commands, and a config snippet that may not parse) that should be corrected to avoid broken deployments.
docs/platforms/gcp.md

_{(2/5) Greptile learns from your feedback when you react with thumbs up/down!}

rodion-m · 2026-01-30T06:33:16Z

Hi @steipete ! Just installed OpenClaw to GCP and actualized the guide.
Btw, thanks for a great work.

- Add native installation option alongside Docker - Add Tailscale setup for secure remote access without public IP - Add Cloud NAT configuration for VMs without public IP - Add budget alerts setup - Add security checklist with recommended permissions - Add Telegram channel configuration example - Simplify structure and improve readability - Update cost estimates Co-Authored-By: Claude Opus 4.5 <[email protected]>

rodion-m · 2026-02-01T15:51:47Z

@clawdinator what prevents you from merging these updates?

greptile-apps

_{1 file reviewed, 6 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-03T02:26:54Z

docs/platforms/gcp.md

+**Install OpenClaw:**

 ```bash
-exit
+curl -fsSL https://openclaw.ai/install.sh | bash
 ```


[P0] Installing via curl https://openclaw.ai/install.sh | bash is a supply-chain risk and also conflicts with the repo guideline that installers live in the sibling openclaw.ai repo (so this doc change can’t be validated here). In practice, readers may prefer the npm install -g openclaw@latest path or at least a pinned version/checksum step; otherwise this doc encourages executing remote code as-is.

Prompt To Fix With AI

This is a comment left during a code review. Path: docs/platforms/gcp.md Line: 172:176 Comment: [P0] Installing via `curl https://openclaw.ai/install.sh | bash` is a supply-chain risk and also conflicts with the repo guideline that installers live in the sibling `openclaw.ai` repo (so this doc change can’t be validated here). In practice, readers may prefer the `npm install -g openclaw@latest` path or at least a pinned version/checksum step; otherwise this doc encourages executing remote code as-is. How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-03T02:26:55Z

docs/platforms/gcp.md


 ```bash
-docker --version
-docker compose version
+openclaw onboard --install-daemon
 ```


[P0] openclaw onboard --install-daemon looks like it assumes the Linux daemon/systemd flow exists, but the repo guidelines note “Gateway currently runs only as the menubar app” (CLAUDE.md). If that’s accurate for current releases, this command will fail or mislead users; consider aligning the doc to the actually-supported Linux install/onboarding commands (or clarifying this is for the separate installer repo / newer CLI behavior).

Prompt To Fix With AI

This is a comment left during a code review. Path: docs/platforms/gcp.md Line: 185:188 Comment: [P0] `openclaw onboard --install-daemon` looks like it assumes the Linux daemon/systemd flow exists, but the repo guidelines note “Gateway currently runs only as the menubar app” (CLAUDE.md). If that’s accurate for current releases, this command will fail or mislead users; consider aligning the doc to the actually-supported Linux install/onboarding commands (or clarifying this is for the separate installer repo / newer CLI behavior). How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-03T02:26:56Z

docs/platforms/gcp.md


+```bash
+ssh user@openclaw-gateway  # Tailscale SSH
 ```


[P1] The Tailscale SSH example uses a placeholder ssh user@openclaw-gateway, but earlier the VM is created with OS Login enabled (--metadata=enable-oslogin=TRUE) and SSH is shown via gcloud compute ssh. For OS Login setups, the username is typically your Google identity username and the host is the Tailscale DNS name (e.g. openclaw-gateway or openclaw-gateway.<tailnet>.ts.net), so this command as written may not work for many readers.

Prompt To Fix With AI

This is a comment left during a code review. Path: docs/platforms/gcp.md Line: 360:363 Comment: [P1] The Tailscale SSH example uses a placeholder `ssh user@openclaw-gateway`, but earlier the VM is created with OS Login enabled (`--metadata=enable-oslogin=TRUE`) and SSH is shown via `gcloud compute ssh`. For OS Login setups, the username is typically your Google identity username and the host is the Tailscale DNS name (e.g. `openclaw-gateway` or `openclaw-gateway.<tailnet>.ts.net`), so this command as written may not work for many readers. How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-03T02:26:57Z

docs/platforms/gcp.md

+```json5
+{
+  gateway: {
+    bind: "loopback",
+    tailscale: { mode: "serve" }
+  }
+}
 ```


[P1] The openclaw.json snippet is labeled json5 but it isn’t valid JSON5 as written because the keys aren’t quoted (e.g. gateway:). If the config parser expects strict JSON, users copying this will get a parse error. Either quote keys ("gateway": { ... }) or explicitly say the config supports JSON5.

Prompt To Fix With AI

This is a comment left during a code review. Path: docs/platforms/gcp.md Line: 369:376 Comment: [P1] The `openclaw.json` snippet is labeled `json5` but it isn’t valid JSON5 as written because the keys aren’t quoted (e.g. `gateway:`). If the config parser expects strict JSON, users copying this will get a parse error. Either quote keys (`"gateway": { ... }`) or explicitly say the config supports JSON5. How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-03T02:26:58Z

docs/platforms/gcp.md

+```bash
+chmod 700 ~/.openclaw
+chmod 600 ~/.openclaw/openclaw.json
+chmod 600 ~/.openclaw/credentials/*
+```


[P2] chmod 600 ~/.openclaw/credentials/* will fail if credentials/ contains directories (common for per-provider subfolders like credentials/whatsapp/). Consider using something like find ~/.openclaw/credentials -type f -exec chmod 600 {} + and chmod 700 on directories, or at least mention that subdirectories need separate handling.

Prompt To Fix With AI

This is a comment left during a code review. Path: docs/platforms/gcp.md Line: 482:486 Comment: [P2] `chmod 600 ~/.openclaw/credentials/*` will fail if `credentials/` contains directories (common for per-provider subfolders like `credentials/whatsapp/`). Consider using something like `find ~/.openclaw/credentials -type f -exec chmod 600 {} +` and `chmod 700` on directories, or at least mention that subdirectories need separate handling. How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-03T02:26:59Z

docs/platforms/gcp.md

+**Create `.env`:**

 ```bash
 OPENCLAW_IMAGE=openclaw:latest
-OPENCLAW_GATEWAY_TOKEN=change-me-now
+OPENCLAW_GATEWAY_TOKEN=<generate-with-openssl-rand-hex-32>
 OPENCLAW_GATEWAY_BIND=lan
 OPENCLAW_GATEWAY_PORT=18789
-
 OPENCLAW_CONFIG_DIR=/home/$USER/.openclaw
 OPENCLAW_WORKSPACE_DIR=/home/$USER/.openclaw/workspace
-
-GOG_KEYRING_PASSWORD=change-me-now
+GOG_KEYRING_PASSWORD=<generate-with-openssl-rand-hex-32>
 XDG_CONFIG_HOME=/home/node/.openclaw
 ```


[P2] Docker .env example sets OPENCLAW_GATEWAY_BIND=lan while later the security checklist requires “Gateway on loopback only”. For a hardened default, consider using loopback consistently (and only mention lan as an opt-in for trusted private networks).

Prompt To Fix With AI

This is a comment left during a code review. Path: docs/platforms/gcp.md Line: 226:237 Comment: [P2] Docker `.env` example sets `OPENCLAW_GATEWAY_BIND=lan` while later the security checklist requires “Gateway on loopback only”. For a hardened default, consider using `loopback` consistently (and only mention `lan` as an opt-in for trusted private networks). How can I resolve this? If you propose a fix, please make it concise.

vincentkoc · 2026-02-19T10:55:14Z

Thanks for your submission however we are closing your PR as stale, if you need to re-open please review contributing guide and if you feel like its required re-open under a new PR. Ensure you have addressed all checks, conflicts and issues. Thanks.

openclaw-barnacle bot added the docs Improvements or additions to documentation label Jan 30, 2026

rodion-m force-pushed the gcp-guide-improvements branch from 32ef525 to a29c99d Compare January 30, 2026 06:32

rodion-m changed the title ~~docs(gcp): add native install path, Tailscale, and security hardening~~ docs(gcp): Actualize GCP installation guide, add native install path, Tailscale, and security hardening Feb 1, 2026

rodion-m force-pushed the gcp-guide-improvements branch from a29c99d to be9c712 Compare February 1, 2026 15:50

greptile-apps bot reviewed Feb 3, 2026

View reviewed changes

Realowg mentioned this pull request Feb 9, 2026

OpenAI Responses API: Stale previous_response_id causes 404 'Item not found' errors #12885

Closed

thewilloftheshadow force-pushed the main branch from bfc1ccb to f92900f Compare February 15, 2026 18:46

vincentkoc closed this Feb 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs(gcp): Actualize GCP installation guide, add native install path, Tailscale, and security hardening#4426

docs(gcp): Actualize GCP installation guide, add native install path, Tailscale, and security hardening#4426
rodion-m wants to merge 1 commit intoopenclaw:mainfrom
rodion-m:gcp-guide-improvements

rodion-m commented Jan 30, 2026 •

edited by greptile-apps bot

Loading

Uh oh!

rodion-m commented Jan 30, 2026

Uh oh!

rodion-m commented Feb 1, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Feb 3, 2026

Uh oh!

greptile-apps bot Feb 3, 2026

Uh oh!

greptile-apps bot Feb 3, 2026

Uh oh!

greptile-apps bot Feb 3, 2026

Uh oh!

greptile-apps bot Feb 3, 2026

Uh oh!

greptile-apps bot Feb 3, 2026

Uh oh!

vincentkoc commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

rodion-m commented Jan 30, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

Greptile Overview

Greptile Summary

Confidence Score: 3/5

Uh oh!

rodion-m commented Jan 30, 2026

Uh oh!

rodion-m commented Feb 1, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

vincentkoc commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rodion-m commented Jan 30, 2026 •

edited by greptile-apps bot

Loading