docs: add Azure VM deployment guide with in-repo ARM templates and bootstrap script by johnsonshi · Pull Request #47898 · openclaw/openclaw

johnsonshi · 2026-03-16T04:41:05Z

Summary

Problem: OpenClaw docs had no Azure VM install guide.
Why it matters: Azure users lacked a first-party path. Microsoft loves open source now and we'd love OpenClaw to be deployed on Azure.
What changed: Added a new Azure install guide and moved Azure assets into docs/install/azure/ (azure.md, ARM templates, bootstrap script), plus nav/redirect updates.
What did NOT change (scope boundary): No Gateway/runtime code, auth logic, provider behavior, or installer execution behavior changed.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes #N/A
Related #N/A

User-visible / Behavior Changes

New Azure install documentation at /install/azure/azure.
VPS/Platforms pages now include Azure link.
Azure guide now includes Azure Network Security Group rules+Azure Bastion hardening guidance.
Azure guide links to in-repo raw template/script files.

Security Impact (required)

New permissions/capabilities? (No)
Secrets/tokens handling changed? (No)
New/changed network calls? (No)
Command/tool execution surface changed? (No)
Data access scope changed? (No)
If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

OS: macOS
Runtime/container: N/A (docs-only)
Model/provider: N/A
Integration/channel (if any): GitHub docs/navigation
Relevant config (redacted): N/A

Steps

Open diff main...docs/azure-vm-install-guide.
Verify new files under docs/install/azure/{azure.md,templates/,scripts/} exist.
Validate docs navigation/redirect entries in docs/docs.json.
Confirm links in Azure guide and hub pages point to /install/azure/azure and correct raw GitHub paths.
Run through all installation steps in a fresh Azure resource group.
Access the Azure VM via Azure Bastion SSH and go through the OpenClaw onboarding wizard successfully.
Build site locally and go through all added pages and links.

Expected

Azure page is reachable via docs nav and redirects.
Linked template/script files resolve to in-repo paths.
No broken internal docs links introduced.
Azure resource group with compute + networking resources provisioned.
OpenClaw bootstrapped and installed on Azure VM.
OpenClaw onboarding wizard successfully executed through Azure Bastion SSH.
Site builds locally without errors.
All added pages render and all modified links are live (no broken links).

Actual

All above checks passed.
All expected Azure resources created with the included Azure Resource Manager template deployments and deployment commands:
After VM provisioning and OpenClaw bootstrapping, the Azure Bastion SSH shell is successfully created and OpenClaw onboarding is able to proceed:
OpenClaw onboarding via Azure Bastion SSH succeeds without issues, and openclaw status shows no issues running on Azure VM:
Successfully set up Telegram bot and messaged the OpenClaw within the Azure VM via Telegram:
Site builds locally without errors:
All added pages render and all modified links are live (no broken links):
- vps page includes a live link to the Azure docs:
- platforms page includes a live link to the Azure docs:
- azure page preview with all live links within the doc validated:

Evidence

Attach at least one:

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

Verified scenarios:
- Reviewed main...HEAD diff and file-level changes.
- Checked docs/docs.json redirects/nav entries for Azure.
- Checked Azure guide links and raw asset paths.
- Built site without errors with all links active and correctly resolving.
- Successfully executed Azure deployment and OpenClaw onboarding commands in a live Azure subscription.
Edge cases checked:
- Redirect compatibility from /azure, /platforms/azure, and /install/azure.
- Directory-based page path (/install/azure/azure) consistency across hubs/nav.
- Links from vps and platforms pages to the azure page resolve successfully.
- Setting up Telegram bot for the OpenClaw gateway running within the Azure VM, and successfully being able to receive back-and-forth messages with it via Telegram.
What you did not verify:
- N/A.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

Backward compatible? (Yes)
Config/env changes? (No)
Migration needed? (No)
If yes, exact upgrade steps: N/A

Failure Recovery (if this breaks)

How to disable/revert this change quickly: Revert this PR/commit branch.
Files/config to restore: docs/docs.json, docs/vps.md, docs/platforms/index.md, and remove docs/install/azure/.
Known bad symptoms reviewers should watch for: N/A

Risks and Mitigations

None or N/A.

greptile-apps · 2026-03-16T04:44:32Z

Greptile Summary

This PR adds a first-party Azure VM installation guide for OpenClaw, including an ARM template, parameters file, bootstrap script, and navigation/redirect wiring. The infrastructure design is solid — the ARM template correctly chains resource dependencies, the NSG locks down SSH access to the Bastion subnet CIDR only (blocking both Internet and VirtualNetwork sources), and the VM has no public IP. The docs navigation and redirect entries are consistent and correctly target the new install/azure/azure path.

Key items to be aware of:

curl | bash bootstrap (azure.md step 8, bootstrap-openclaw.sh): The deployment guide instructs users to bootstrap the VM by piping the in-repo script from main directly to bash via az vm run-command invoke, and the script itself then pipes NodeSource's setup_24.x to bash. Both patterns lack integrity verification (checksum or GPG). A brief note recommending pinning to a commit SHA and/or using the --scripts @localfile form of az vm run-command invoke would benefit production-oriented readers.
Non-reproducible image version: The ARM template uses "version": "latest" for the Ubuntu 24.04 image, which means repeated deployments may provision different patch levels over time. Adding a note about pinning to a specific image version for reproducibility would be a helpful callout.

Confidence Score: 4/5

This is a docs-only PR with no changes to runtime code, auth, or infrastructure execution — safe to merge with minor best-practice caveats.
The ARM template, bootstrap script, and guide are well-constructed and have been verified end-to-end by the author. The only concerns are non-critical best-practice gaps around supply chain integrity (curl | bash without checksum) and image reproducibility ("version": "latest"), neither of which blocks functionality or introduces a vulnerability in the existing codebase.
docs/install/azure/scripts/bootstrap-openclaw.sh and docs/install/azure/azure.md (step 8) — both use curl | bash patterns that could benefit from integrity verification notes for production deployments.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: docs/install/azure/scripts/bootstrap-openclaw.sh
Line: 35

Comment:
**Unverified third-party script piped to bash**

`curl -fsSL https://deb.nodesource.com/setup_24.x | bash -` fetches and immediately executes a script from `nodesource.com` without any integrity check (e.g. a SHA-256 checksum or GPG verification). This is the standard NodeSource installation pattern, but it means a compromised CDN or MITM could push arbitrary code to every freshly-provisioned VM.

For a production-grade bootstrap script, consider one of these alternatives:

1. **Download, inspect, then execute:**
```bash
curl -fsSL https://deb.nodesource.com/setup_24.x -o /tmp/nodesource_setup.sh
# optionally verify checksum here
bash /tmp/nodesource_setup.sh
```

2. **Use the official NodeSource Debian package directly** via their signed apt repository, which gives package-manager-level verification.

At minimum, a comment here explaining the trust model (e.g. "script is fetched over HTTPS from NodeSource's official CDN") would help readers understand the deliberate trade-off.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: docs/install/azure/azure.md
Line: 132-136

Comment:
**`curl | bash` bootstrap via `az vm run-command invoke`**

The `--scripts` value pipes the bootstrap script directly from a GitHub raw URL into bash on the provisioned VM without any integrity verification. If the `main` branch is force-pushed, a commit is rewritten, or there is a transient MITM during the curl, arbitrary code will execute as root on the VM.

A small improvement for security-conscious users would be to mention pinning to a specific commit SHA instead of `main`:

```
--scripts "curl -fsSL https://raw.githubusercontent.com/openclaw/openclaw/<COMMIT_SHA>/docs/install/azure/scripts/bootstrap-openclaw.sh | bash"
```

Alternatively, the guide could suggest downloading the script first, reviewing it, and then invoking via `--scripts @/path/to/bootstrap-openclaw.sh` using the local-file form of `az vm run-command invoke`. Even a one-line note explaining the trust assumption (i.e. "this runs the in-repo script as root — pin to a commit SHA for reproducibility") would be a useful callout for production deployments.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: docs/install/azure/templates/azuredeploy.json
Line: 292-296

Comment:
**Non-reproducible image version `"latest"`**

Using `"version": "latest"` for the Ubuntu image means two deployments at different points in time may provision VMs running different OS patch levels. This is convenient for a getting-started guide, but it means the environment isn't fully reproducible — a regression in a future Canonical image could silently affect new deployments.

Consider noting in the guide (or as a comment in the template) that users who care about reproducibility should pin to a specific image version. You can list available versions with:

```bash
az vm image list --publisher Canonical --offer ubuntu-24_04-lts --sku server --all -o table
```

Then replace `"latest"` with the desired version string (e.g. `"24.04.202503010"`).

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: 701f278}

docs/install/azure/scripts/bootstrap-openclaw.sh

docs/install/azure/azure.md

infra/azure/templates/azuredeploy.json

BradGroux · 2026-03-16T06:16:39Z

Thank you, @johnsonshi - I'll begin working on this. It'll be busy the next few days, but I'll get some eyes on it as soon as I can!

BradGroux · 2026-03-17T14:55:32Z

Nice work on this, @johnsonshi! The ARM template is well-constructed, the NSG rules correctly lock SSH to the Bastion subnet, and the end-to-end flow is clear. A few things I'd flag:

Directory structure breaks the established pattern

Every existing install guide is a flat file in docs/install/ (gcp.md, fly.md, hetzner.md, etc.). This PR introduces a nested docs/install/azure/azure.md with templates/ and scripts/ alongside it, which creates a redundant nav path (install/azure/azure vs. install/gcp).

Suggestion: keep the guide itself as a flat docs/install/azure.md consistent with the other guides, and move the ARM templates + bootstrap script to a separate location in the repo (e.g. contrib/azure/ or infra/azure/), linked from the guide.

`curl | bash` is the primary example in step 8

The follow-up note about pinning to a commit SHA is good, but the example users will actually copy-paste is the unpinned curl | bash from main. Consider flipping it — make the safer pattern (download, review, --scripts @./bootstrap-openclaw.sh) the primary example, with curl | bash as the quick alternative.

Bootstrap runs as root but `openclaw` runs as the user

The bootstrap script requires EUID == 0 and does npm install -g openclaw as root, but later the guide has users SSH in as the openclaw user and run openclaw onboard. There's no chown or user-level setup in the script — depending on npm's global prefix configuration, this could cause permission issues when running as the non-root user. The GCP guide avoids this by having the user do setup in their own shell session.

Minor

azuredeploy.parameters.json has a literal placeholder "<contents of ~/.ssh/id_ed25519.pub>" for sshPublicKey. If someone passes the params file without the CLI override, this will fail with a confusing error. Consider removing the default or adding a validation pattern.

Overall this is solid content and a welcome addition. The main structural ask is flattening the directory layout to match the existing install guides. Happy to re-review once that's addressed.

johnsonshi · 2026-03-17T20:50:22Z

Hi @BradGroux thanks for the thorough review! Addressed all four points in this update:

Directory structure:
- Flattened the guide to docs/install/azure.md so it matches the other install guides.
- Moved ARM assets to infra/azure/templates/*.
- Updated docs nav/redirects/links so old /install/azure/azure routes to /install/azure.
Safer install flow:
- Removed the az vm run-command invoke + remote bootstrap flow entirely.
- After Bastion SSH, the guide now uses the OpenClaw installer script flow documented at https://docs.openclaw.ai/install (download, run locally, then remove temp script), instead of curl | bash.
Root/user mismatch:
- Removed the root bootstrap script path from this guide. Setup now runs in the Bastion SSH user shell via the installer flow above.
sshPublicKey placeholder:
- Removed the placeholder entry from infra/azure/templates/azuredeploy.parameters.json.
- sshPublicKey remains required in the ARM template and is passed explicitly in deployment (--parameters sshPublicKey="${SSH_PUB_KEY}").

Commit:
johnsonshi@8e6fabf

Docs validation with the latest commit:

OpenClaw installation as you suggested (having users SSH in like in GCP to run the install script and onboarding wizard themselves - in the user's SSH shell session).

Onboarding wizard continues as part of the setup script:

BradGroux

Review — Azure VM Install Guide

Overall: Approve with suggestions. The core content is production-quality, well-tested (end-to-end screenshots are appreciated), and follows the existing install guide patterns. ARM template is clean with recent API versions, and the security posture (Bastion-only SSH, no public IP, password auth disabled) is solid.

Suggestions

1. Add a cost callout (strongly recommended)

Azure Bastion Standard SKU runs ~$140/month just for the Bastion host, on top of the VM cost. The other install guides in this repo target cheap or free tiers (Oracle free tier, Hetzner, Fly). Users experimenting with OpenClaw on Azure could get a surprise bill.

Suggest adding a note after Step 7 or in a "Cost considerations" section:

> **Cost note:** Azure Bastion Standard runs ~\$140/month. If you only need
> SSH access occasionally, you can deallocate or delete the Bastion host after
> initial setup and recreate it when needed, or use the Azure Portal Bastion
> connect feature with the Basic SKU (~\$38/month) instead.
>
> The VM itself (Standard_B2as_v2) runs ~\$55/month. To stop billing when not
> in use: `az vm deallocate -g rg-openclaw -n vm-openclaw`

2. Add a cleanup/teardown section

Every experimentation guide benefits from a cleanup note. Users who spin this up to try OpenClaw and forget about it will get billed indefinitely.

## Cleanup

To delete all resources created by this guide:

\`\`\`bash
az group delete -n rg-openclaw --yes --no-wait
\`\`\`

3. `sshPublicKey` missing from parameters file

The parameters file includes every parameter except sshPublicKey, which means az deployment group create with just the params file will fail. This is likely intentional (don't commit keys), but a brief comment in the params file or a note in the guide would prevent confusion:

// sshPublicKey intentionally omitted — pass via CLI override

Or add a note after the params file reference in the guide.

4. Redirect `/install/azure/azure` → `/install/azure` — is it needed?

The doc file is docs/install/azure.md which resolves to /install/azure. The redirect from /install/azure/azure handles a path that shouldn't naturally occur. Not a blocker — just unnecessary noise in docs.json unless there's a known linking pattern that generates this path.

5. PR template checkboxes

Minor: the Change Type and Scope checkboxes are all unchecked. Should have "Docs" and "CI/CD / infra" checked.

What looks good

NSG rules are correctly ordered: Allow Bastion (100) → Deny Internet (110) → Deny VNet (120). Priority ordering is right.
Bastion Standard with enableTunneling: true — required for CLI-based az network bastion ssh, good call.
No public IP on the VM — correct security posture for a Bastion-fronted setup.
disablePasswordAuthentication: true with SSH key only — good.
Ubuntu 24.04 LTS with the version: "latest" caveat documented — pragmatic default with escape hatch noted.
Resource provider registration step — often missed in Azure guides, good inclusion.
VM sizing guidance with az vm list-skus and az vm list-usage — helps users pick the right SKU for their region/quota.
End-to-end verification with screenshots showing actual Azure deployment, Bastion SSH, openclaw status, and Telegram messaging — thorough.

Resolved: - openclaw#25790 (Teams issue, CLOSED) - openclaw#47860 (Teams PR, CLOSED) - openclaw#48116 (Azure issue, CLOSED) - openclaw#48899 (Azure issue, CLOSED) - openclaw#47898 (Azure PR, MERGED) - openclaw#17970 (Azure PR, CLOSED) - openclaw#21678 (Windows issue, CLOSED)

Rewrites the Azure install guide to use individual az CLI commands instead of referencing ARM templates in infra/azure/templates/ (removed upstream). Each Azure resource (NSG, VNet, subnets, VM, Bastion) is now created with explicit az commands, preserving the same security posture (Bastion-only SSH, no public IP, NSG hardening). Also addresses BradGroux review feedback from openclaw#47898: - Add cost considerations section (Bastion ~$140/mo, VM ~$55/mo) - Add cleanup/teardown section (az group delete) - Remove stale /install/azure/azure redirect from docs.json Co-authored-by: Copilot <[email protected]>

…otstrap script (openclaw#47898) * docs: add Azure Linux VM install guide * docs: move Azure guide into dedicated docs/install/azure layout * docs: polish Azure guide onboarding and reference links * docs: address Azure review feedback on bootstrap safety * docs: format azure ARM template * docs: flatten Azure install docs and move ARM assets

#50700) * docs(azure): replace ARM template deployment with pure az CLI commands Rewrites the Azure install guide to use individual az CLI commands instead of referencing ARM templates in infra/azure/templates/ (removed upstream). Each Azure resource (NSG, VNet, subnets, VM, Bastion) is now created with explicit az commands, preserving the same security posture (Bastion-only SSH, no public IP, NSG hardening). Also addresses BradGroux review feedback from #47898: - Add cost considerations section (Bastion ~$140/mo, VM ~$55/mo) - Add cleanup/teardown section (az group delete) - Remove stale /install/azure/azure redirect from docs.json Co-authored-by: Copilot <[email protected]> * docs(azure): split into multiple Steps blocks for richer TOC Add Quick path and What you need sections. Split the single Steps block into three (Configure deployment, Deploy Azure resources, Install OpenClaw) so H2 headers appear in the Mintlify sidebar TOC. Co-authored-by: Copilot <[email protected]> * docs(azure): remove Quick path section Co-authored-by: Copilot <[email protected]> * docs(azure): fix cost section LaTeX rendering, remove comparison Escape dollar signs to prevent Mintlify LaTeX interpretation. Also escape underscores in VM SKU name within bold text. Co-authored-by: Copilot <[email protected]> * docs(azure): add caveat that deallocated VM stops Gateway Co-authored-by: Copilot <[email protected]> * docs(azure): simplify install step with clearer description Download then run pattern (no sudo). Clarify that installer handles Node LTS, dependencies, OpenClaw install, and onboarding wizard. Co-authored-by: Copilot <[email protected]> * docs(azure): add Bastion provisioning latency note Co-authored-by: Copilot <[email protected]> * docs(azure): use deployment variables in cost and cleanup sections Replace hardcoded rg-openclaw/vm-openclaw with variables in deallocate/start and group delete commands so users who customized names in step 3 get correct commands. Co-authored-by: Copilot <[email protected]> * docs(azure): fix formatting (oxfmt) Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Copilot <[email protected]>

…otstrap script (openclaw#47898) * docs: add Azure Linux VM install guide * docs: move Azure guide into dedicated docs/install/azure layout * docs: polish Azure guide onboarding and reference links * docs: address Azure review feedback on bootstrap safety * docs: format azure ARM template * docs: flatten Azure install docs and move ARM assets

openclaw#50700) * docs(azure): replace ARM template deployment with pure az CLI commands Rewrites the Azure install guide to use individual az CLI commands instead of referencing ARM templates in infra/azure/templates/ (removed upstream). Each Azure resource (NSG, VNet, subnets, VM, Bastion) is now created with explicit az commands, preserving the same security posture (Bastion-only SSH, no public IP, NSG hardening). Also addresses BradGroux review feedback from openclaw#47898: - Add cost considerations section (Bastion ~$140/mo, VM ~$55/mo) - Add cleanup/teardown section (az group delete) - Remove stale /install/azure/azure redirect from docs.json Co-authored-by: Copilot <[email protected]> * docs(azure): split into multiple Steps blocks for richer TOC Add Quick path and What you need sections. Split the single Steps block into three (Configure deployment, Deploy Azure resources, Install OpenClaw) so H2 headers appear in the Mintlify sidebar TOC. Co-authored-by: Copilot <[email protected]> * docs(azure): remove Quick path section Co-authored-by: Copilot <[email protected]> * docs(azure): fix cost section LaTeX rendering, remove comparison Escape dollar signs to prevent Mintlify LaTeX interpretation. Also escape underscores in VM SKU name within bold text. Co-authored-by: Copilot <[email protected]> * docs(azure): add caveat that deallocated VM stops Gateway Co-authored-by: Copilot <[email protected]> * docs(azure): simplify install step with clearer description Download then run pattern (no sudo). Clarify that installer handles Node LTS, dependencies, OpenClaw install, and onboarding wizard. Co-authored-by: Copilot <[email protected]> * docs(azure): add Bastion provisioning latency note Co-authored-by: Copilot <[email protected]> * docs(azure): use deployment variables in cost and cleanup sections Replace hardcoded rg-openclaw/vm-openclaw with variables in deallocate/start and group delete commands so users who customized names in step 3 get correct commands. Co-authored-by: Copilot <[email protected]> * docs(azure): fix formatting (oxfmt) Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Copilot <[email protected]>

…otstrap script (openclaw#47898) * docs: add Azure Linux VM install guide * docs: move Azure guide into dedicated docs/install/azure layout * docs: polish Azure guide onboarding and reference links * docs: address Azure review feedback on bootstrap safety * docs: format azure ARM template * docs: flatten Azure install docs and move ARM assets

openclaw#50700) * docs(azure): replace ARM template deployment with pure az CLI commands Rewrites the Azure install guide to use individual az CLI commands instead of referencing ARM templates in infra/azure/templates/ (removed upstream). Each Azure resource (NSG, VNet, subnets, VM, Bastion) is now created with explicit az commands, preserving the same security posture (Bastion-only SSH, no public IP, NSG hardening). Also addresses BradGroux review feedback from openclaw#47898: - Add cost considerations section (Bastion ~$140/mo, VM ~$55/mo) - Add cleanup/teardown section (az group delete) - Remove stale /install/azure/azure redirect from docs.json Co-authored-by: Copilot <[email protected]> * docs(azure): split into multiple Steps blocks for richer TOC Add Quick path and What you need sections. Split the single Steps block into three (Configure deployment, Deploy Azure resources, Install OpenClaw) so H2 headers appear in the Mintlify sidebar TOC. Co-authored-by: Copilot <[email protected]> * docs(azure): remove Quick path section Co-authored-by: Copilot <[email protected]> * docs(azure): fix cost section LaTeX rendering, remove comparison Escape dollar signs to prevent Mintlify LaTeX interpretation. Also escape underscores in VM SKU name within bold text. Co-authored-by: Copilot <[email protected]> * docs(azure): add caveat that deallocated VM stops Gateway Co-authored-by: Copilot <[email protected]> * docs(azure): simplify install step with clearer description Download then run pattern (no sudo). Clarify that installer handles Node LTS, dependencies, OpenClaw install, and onboarding wizard. Co-authored-by: Copilot <[email protected]> * docs(azure): add Bastion provisioning latency note Co-authored-by: Copilot <[email protected]> * docs(azure): use deployment variables in cost and cleanup sections Replace hardcoded rg-openclaw/vm-openclaw with variables in deallocate/start and group delete commands so users who customized names in step 3 get correct commands. Co-authored-by: Copilot <[email protected]> * docs(azure): fix formatting (oxfmt) Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Copilot <[email protected]>

…otstrap script (openclaw#47898) * docs: add Azure Linux VM install guide * docs: move Azure guide into dedicated docs/install/azure layout * docs: polish Azure guide onboarding and reference links * docs: address Azure review feedback on bootstrap safety * docs: format azure ARM template * docs: flatten Azure install docs and move ARM assets

openclaw#50700) * docs(azure): replace ARM template deployment with pure az CLI commands Rewrites the Azure install guide to use individual az CLI commands instead of referencing ARM templates in infra/azure/templates/ (removed upstream). Each Azure resource (NSG, VNet, subnets, VM, Bastion) is now created with explicit az commands, preserving the same security posture (Bastion-only SSH, no public IP, NSG hardening). Also addresses BradGroux review feedback from openclaw#47898: - Add cost considerations section (Bastion ~$140/mo, VM ~$55/mo) - Add cleanup/teardown section (az group delete) - Remove stale /install/azure/azure redirect from docs.json Co-authored-by: Copilot <[email protected]> * docs(azure): split into multiple Steps blocks for richer TOC Add Quick path and What you need sections. Split the single Steps block into three (Configure deployment, Deploy Azure resources, Install OpenClaw) so H2 headers appear in the Mintlify sidebar TOC. Co-authored-by: Copilot <[email protected]> * docs(azure): remove Quick path section Co-authored-by: Copilot <[email protected]> * docs(azure): fix cost section LaTeX rendering, remove comparison Escape dollar signs to prevent Mintlify LaTeX interpretation. Also escape underscores in VM SKU name within bold text. Co-authored-by: Copilot <[email protected]> * docs(azure): add caveat that deallocated VM stops Gateway Co-authored-by: Copilot <[email protected]> * docs(azure): simplify install step with clearer description Download then run pattern (no sudo). Clarify that installer handles Node LTS, dependencies, OpenClaw install, and onboarding wizard. Co-authored-by: Copilot <[email protected]> * docs(azure): add Bastion provisioning latency note Co-authored-by: Copilot <[email protected]> * docs(azure): use deployment variables in cost and cleanup sections Replace hardcoded rg-openclaw/vm-openclaw with variables in deallocate/start and group delete commands so users who customized names in step 3 get correct commands. Co-authored-by: Copilot <[email protected]> * docs(azure): fix formatting (oxfmt) Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Copilot <[email protected]>

…otstrap script (openclaw#47898) * docs: add Azure Linux VM install guide * docs: move Azure guide into dedicated docs/install/azure layout * docs: polish Azure guide onboarding and reference links * docs: address Azure review feedback on bootstrap safety * docs: format azure ARM template * docs: flatten Azure install docs and move ARM assets (cherry picked from commit 191e194)

openclaw#50700) * docs(azure): replace ARM template deployment with pure az CLI commands Rewrites the Azure install guide to use individual az CLI commands instead of referencing ARM templates in infra/azure/templates/ (removed upstream). Each Azure resource (NSG, VNet, subnets, VM, Bastion) is now created with explicit az commands, preserving the same security posture (Bastion-only SSH, no public IP, NSG hardening). Also addresses BradGroux review feedback from openclaw#47898: - Add cost considerations section (Bastion ~$140/mo, VM ~$55/mo) - Add cleanup/teardown section (az group delete) - Remove stale /install/azure/azure redirect from docs.json Co-authored-by: Copilot <[email protected]> * docs(azure): split into multiple Steps blocks for richer TOC Add Quick path and What you need sections. Split the single Steps block into three (Configure deployment, Deploy Azure resources, Install OpenClaw) so H2 headers appear in the Mintlify sidebar TOC. Co-authored-by: Copilot <[email protected]> * docs(azure): remove Quick path section Co-authored-by: Copilot <[email protected]> * docs(azure): fix cost section LaTeX rendering, remove comparison Escape dollar signs to prevent Mintlify LaTeX interpretation. Also escape underscores in VM SKU name within bold text. Co-authored-by: Copilot <[email protected]> * docs(azure): add caveat that deallocated VM stops Gateway Co-authored-by: Copilot <[email protected]> * docs(azure): simplify install step with clearer description Download then run pattern (no sudo). Clarify that installer handles Node LTS, dependencies, OpenClaw install, and onboarding wizard. Co-authored-by: Copilot <[email protected]> * docs(azure): add Bastion provisioning latency note Co-authored-by: Copilot <[email protected]> * docs(azure): use deployment variables in cost and cleanup sections Replace hardcoded rg-openclaw/vm-openclaw with variables in deallocate/start and group delete commands so users who customized names in step 3 get correct commands. Co-authored-by: Copilot <[email protected]> * docs(azure): fix formatting (oxfmt) Co-authored-by: Copilot <[email protected]> --------- Co-authored-by: Copilot <[email protected]>

johnsonshi added 3 commits March 15, 2026 20:58

docs: add Azure Linux VM install guide

4828239

docs: move Azure guide into dedicated docs/install/azure layout

67b660f

docs: polish Azure guide onboarding and reference links

701f278

openclaw-barnacle bot added docs Improvements or additions to documentation size: XS labels Mar 16, 2026

greptile-apps bot reviewed Mar 16, 2026

View reviewed changes

docs/install/azure/scripts/bootstrap-openclaw.sh Outdated Show resolved Hide resolved

docs/install/azure/azure.md Outdated Show resolved Hide resolved

infra/azure/templates/azuredeploy.json Show resolved Hide resolved

johnsonshi added 2 commits March 15, 2026 21:48

docs: address Azure review feedback on bootstrap safety

2262a00

docs: format azure ARM template

26ef895

BradGroux self-assigned this Mar 16, 2026

BradGroux mentioned this pull request Mar 17, 2026

WORKING: All Microsoft Issues and PRs #49126

Draft

docs: flatten Azure install docs and move ARM assets

8e6fabf

openclaw-barnacle bot added size: M and removed size: XS labels Mar 17, 2026

BradGroux reviewed Mar 19, 2026

View reviewed changes

BradGroux merged commit 191e194 into openclaw:main Mar 19, 2026
26 of 39 checks passed

github-actions bot mentioned this pull request Mar 19, 2026

📡 Upstream Digest — 2026-03-19 14:41 UTC curtismercier/openclaw-mods#307

Open

johnsonshi deleted the docs/azure-vm-install-guide branch March 19, 2026 23:12

johnsonshi mentioned this pull request Mar 19, 2026

docs(azure): replace ARM template deployment with pure az CLI commands #50700

Merged

6 tasks

kimvaddi mentioned this pull request Mar 23, 2026

docs: add Azure Container Apps install guide with managed identity an… #52555

Draft

20 tasks

alexey-pelykh mentioned this pull request Mar 23, 2026

Cherry-pick: Documentation updates (3/4) (50 commits) remoteclaw/remoteclaw#1910

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs: add Azure VM deployment guide with in-repo ARM templates and bootstrap script#47898

docs: add Azure VM deployment guide with in-repo ARM templates and bootstrap script#47898
BradGroux merged 6 commits intoopenclaw:mainfrom
johnsonshi:docs/azure-vm-install-guide

johnsonshi commented Mar 16, 2026 •

edited by BradGroux

Loading

Uh oh!

greptile-apps bot commented Mar 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BradGroux commented Mar 16, 2026

Uh oh!

BradGroux commented Mar 17, 2026

Uh oh!

johnsonshi commented Mar 17, 2026

Uh oh!

BradGroux left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

johnsonshi commented Mar 16, 2026 • edited by BradGroux Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Failure Recovery (if this breaks)

Risks and Mitigations

Uh oh!

greptile-apps bot commented Mar 16, 2026

Greptile Summary

Confidence Score: 4/5

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BradGroux commented Mar 16, 2026

Uh oh!

BradGroux commented Mar 17, 2026

Directory structure breaks the established pattern

curl | bash is the primary example in step 8

Bootstrap runs as root but openclaw runs as the user

Minor

Uh oh!

johnsonshi commented Mar 17, 2026

Uh oh!

BradGroux left a comment

Choose a reason for hiding this comment

Review — Azure VM Install Guide

Suggestions

1. Add a cost callout (strongly recommended)

2. Add a cleanup/teardown section

3. sshPublicKey missing from parameters file

4. Redirect /install/azure/azure → /install/azure — is it needed?

5. PR template checkboxes

What looks good

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

johnsonshi commented Mar 16, 2026 •

edited by BradGroux

Loading

`curl | bash` is the primary example in step 8

Bootstrap runs as root but `openclaw` runs as the user

3. `sshPublicKey` missing from parameters file

4. Redirect `/install/azure/azure` → `/install/azure` — is it needed?