OpenClaw on Fly.io

Fly.io is the docs’ answer for people who want the Gateway on a managed machine with HTTPS and a volume without running a VM themselves: clone the repository, customise the Fly configuration, create an app and a volume, set secrets, deploy, then create the config over SSH or through the Control UI. The interesting part is the template, whose lines each answer a failure someone hit. Here is the path, the settings, the secrets rule, and the private variant.

The quick path

• Clone the repository and pick an app name; create the app and a one-gigabyte volume in a region near you, the docs naming London, Virginia and San Jose as common choices.
• Edit the Fly configuration: the tracked file is the public template, and a hardened no-public-IP variant ships beside it.
• Set secrets: a Gateway token generated with a random hex, the model provider keys, and the channel tokens; the docs say to treat them like passwords and to prefer secrets over the config file so keys stay out of it.
• Deploy, then SSH in to create the config or use the Control UI.

Non-loopback binds (--bind lan) require a valid gateway auth path.

The lines that matter

The process runs the compiled entrypoint with the Gateway bound to the LAN address so Fly’s proxy can reach it, the allow-unconfigured flag so it starts before a config exists, and a port that must match the internal port for the health checks. The health check hits the startup endpoint, which admits traffic once startup finishes regardless of channel health. Memory is two gigabytes because half a gigabyte is too small, the state directory points at the mounted volume so state survives, and the process still runs under the image’s init because Fly replaces the command, not the entrypoint. Machines are set not to auto-stop, with at least one running.

Secrets and auth

• Because the Gateway binds beyond loopback, a valid auth path is mandatory: a token in the Gateway token variable, a configured password, or a correctly configured trusted-proxy deployment.
• Provider keys and channel tokens go in as secrets and are read as environment variables; the secrets contract lets the config reference them rather than hold them.
• The private variant keeps no public IP at all and is the version the docs call hardened.

OpenClaw on Docker explains the image these machines run, and OpenClaw secrets the references that keep keys out of the config file.

Against the other platforms

Fly is the most hands-on of the three platform pages, a configuration file and a CLI, where OpenClaw on Railway is a one-click template with a volume and four variables, and OpenClaw on Render a declarative blueprint with a generated token.

On Diali

Diali is the same idea with the platform choices already made: an isolated instance, persistent state, HTTPS, a token you never see, and updates rolled out for you. Hosted OpenClaw on Diali is the assistant.

• An app, a volume, secrets, deploy.
• Bind to the LAN, match the port, check the startup endpoint.
• Two gigabytes; half a gigabyte is too small.