|
| 1 | +--- |
| 2 | +summary: "Run OpenClaw Gateway 24/7 on an Azure Linux VM with durable state" |
| 3 | +read_when: |
| 4 | + - You want OpenClaw running 24/7 on Azure with Network Security Group hardening |
| 5 | + - You want a production-grade, always-on OpenClaw Gateway on your own Azure Linux VM |
| 6 | + - You want secure administration with Azure Bastion SSH |
| 7 | + - You want repeatable deployments with Azure Resource Manager templates |
| 8 | +title: "Azure" |
| 9 | +--- |
| 10 | + |
| 11 | +# OpenClaw on Azure Linux VM |
| 12 | + |
| 13 | +This guide sets up an Azure Linux VM, applies Network Security Group (NSG) hardening, configures Azure Bastion (managed Azure SSH entry point), and installs OpenClaw. |
| 14 | + |
| 15 | +## What you’ll do |
| 16 | + |
| 17 | +- Deploy Azure compute and network resources with Azure Resource Manager (ARM) templates |
| 18 | +- Apply Azure Network Security Group (NSG) rules so VM SSH is allowed only from Azure Bastion |
| 19 | +- Use Azure Bastion for SSH access |
| 20 | +- Install OpenClaw with the installer script |
| 21 | +- Verify the Gateway |
| 22 | + |
| 23 | +## Before you start |
| 24 | + |
| 25 | +You’ll need: |
| 26 | + |
| 27 | +- An Azure subscription with permission to create compute and network resources |
| 28 | +- Azure CLI installed (see [Azure CLI install steps](https://learn.microsoft.com/cli/azure/install-azure-cli) if needed) |
| 29 | + |
| 30 | +## 1) Sign in to Azure CLI |
| 31 | + |
| 32 | +```bash |
| 33 | +az login # Sign in and select your Azure subscription |
| 34 | +az extension add -n ssh # Extension required for Azure Bastion SSH management |
| 35 | +``` |
| 36 | + |
| 37 | +## 2) Register required resource providers (one-time) |
| 38 | + |
| 39 | +```bash |
| 40 | +az provider register --namespace Microsoft.Compute |
| 41 | +az provider register --namespace Microsoft.Network |
| 42 | +``` |
| 43 | + |
| 44 | +Verify Azure resource provider registration. Wait until both show `Registered`. |
| 45 | + |
| 46 | +```bash |
| 47 | +az provider show --namespace Microsoft.Compute --query registrationState -o tsv |
| 48 | +az provider show --namespace Microsoft.Network --query registrationState -o tsv |
| 49 | +``` |
| 50 | + |
| 51 | +## 3) Set deployment variables |
| 52 | + |
| 53 | +```bash |
| 54 | +RG="rg-openclaw" |
| 55 | +LOCATION="westus2" |
| 56 | +TEMPLATE_URI="https://raw.githubusercontent.com/openclaw/openclaw/main/infra/azure/templates/azuredeploy.json" |
| 57 | +PARAMS_URI="https://raw.githubusercontent.com/openclaw/openclaw/main/infra/azure/templates/azuredeploy.parameters.json" |
| 58 | +``` |
| 59 | + |
| 60 | +## 4) Select SSH key |
| 61 | + |
| 62 | +Use your existing public key if you have one: |
| 63 | + |
| 64 | +```bash |
| 65 | +SSH_PUB_KEY="$(cat ~/.ssh/id_ed25519.pub)" |
| 66 | +``` |
| 67 | + |
| 68 | +If you don’t have an SSH key yet, run the following: |
| 69 | + |
| 70 | +```bash |
| 71 | +ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519 -C "[email protected]" |
| 72 | +SSH_PUB_KEY="$(cat ~/.ssh/id_ed25519.pub)" |
| 73 | +``` |
| 74 | + |
| 75 | +## 5) Select VM size and OS disk size |
| 76 | + |
| 77 | +Set VM and disk sizing variables: |
| 78 | + |
| 79 | +```bash |
| 80 | +VM_SIZE="Standard_B2as_v2" |
| 81 | +OS_DISK_SIZE_GB=64 |
| 82 | +``` |
| 83 | + |
| 84 | +Choose a VM size and OS disk size that are available in your Azure subscription/region and matches your workload: |
| 85 | + |
| 86 | +- Start smaller for light usage and scale up later |
| 87 | +- Use more vCPU/RAM/OS disk size for heavier automation, more channels, or larger model/tool workloads |
| 88 | +- If a VM size is unavailable in your region or subscription quota, pick the closest available SKU |
| 89 | + |
| 90 | +List VM sizes available in your target region: |
| 91 | + |
| 92 | +```bash |
| 93 | +az vm list-skus --location "${LOCATION}" --resource-type virtualMachines -o table |
| 94 | +``` |
| 95 | + |
| 96 | +Check your current VM vCPU and OS disk size usage/quota: |
| 97 | + |
| 98 | +```bash |
| 99 | +az vm list-usage --location "${LOCATION}" -o table |
| 100 | +``` |
| 101 | + |
| 102 | +## 6) Create the resource group |
| 103 | + |
| 104 | +```bash |
| 105 | +az group create -n "${RG}" -l "${LOCATION}" |
| 106 | +``` |
| 107 | + |
| 108 | +## 7) Deploy resources |
| 109 | + |
| 110 | +This command applies your selected SSH key, VM size, and OS disk size. |
| 111 | + |
| 112 | +```bash |
| 113 | +az deployment group create \ |
| 114 | + -g "${RG}" \ |
| 115 | + --template-uri "${TEMPLATE_URI}" \ |
| 116 | + --parameters "${PARAMS_URI}" \ |
| 117 | + --parameters location="${LOCATION}" \ |
| 118 | + --parameters vmSize="${VM_SIZE}" \ |
| 119 | + --parameters osDiskSizeGb="${OS_DISK_SIZE_GB}" \ |
| 120 | + --parameters sshPublicKey="${SSH_PUB_KEY}" |
| 121 | +``` |
| 122 | + |
| 123 | +## 8) SSH into the VM through Azure Bastion |
| 124 | + |
| 125 | +```bash |
| 126 | +RG="rg-openclaw" |
| 127 | +VM_NAME="vm-openclaw" |
| 128 | +BASTION_NAME="bas-openclaw" |
| 129 | +ADMIN_USERNAME="openclaw" |
| 130 | +VM_ID="$(az vm show -g "${RG}" -n "${VM_NAME}" --query id -o tsv)" |
| 131 | + |
| 132 | +az network bastion ssh \ |
| 133 | + --name "${BASTION_NAME}" \ |
| 134 | + --resource-group "${RG}" \ |
| 135 | + --target-resource-id "${VM_ID}" \ |
| 136 | + --auth-type ssh-key \ |
| 137 | + --username "${ADMIN_USERNAME}" \ |
| 138 | + --ssh-key ~/.ssh/id_ed25519 |
| 139 | +``` |
| 140 | + |
| 141 | +## 9) Install OpenClaw (in the VM shell) |
| 142 | + |
| 143 | +```bash |
| 144 | +curl -fsSL https://openclaw.ai/install.sh -o /tmp/openclaw-install.sh |
| 145 | +bash /tmp/openclaw-install.sh |
| 146 | +rm -f /tmp/openclaw-install.sh |
| 147 | +openclaw --version |
| 148 | +``` |
| 149 | + |
| 150 | +The installer script handles Node detection/installation and runs onboarding by default. |
| 151 | + |
| 152 | +## 10) Verify the Gateway |
| 153 | + |
| 154 | +After onboarding completes: |
| 155 | + |
| 156 | +```bash |
| 157 | +openclaw gateway status |
| 158 | +``` |
| 159 | + |
| 160 | +Most enterprise Azure teams already have GitHub Copilot licenses. If that is your case, we recommend choosing the GitHub Copilot provider in the OpenClaw onboarding wizard. See [GitHub Copilot provider](/providers/github-copilot). |
| 161 | + |
| 162 | +The included ARM template uses Ubuntu image `version: "latest"` for convenience. If you need reproducible builds, pin a specific image version in `infra/azure/templates/azuredeploy.json` (you can list versions with `az vm image list --publisher Canonical --offer ubuntu-24_04-lts --sku server --all -o table`). |
| 163 | + |
| 164 | +## Next steps |
| 165 | + |
| 166 | +- Set up messaging channels: [Channels](/channels) |
| 167 | +- Pair local devices as nodes: [Nodes](/nodes) |
| 168 | +- Configure the Gateway: [Gateway configuration](/gateway/configuration) |
| 169 | +- For more details on OpenClaw Azure deployment with the GitHub Copilot model provider: [OpenClaw on Azure with GitHub Copilot](https://github.com/johnsonshi/openclaw-azure-github-copilot) |
0 commit comments