OpenClaw Ubuntu24多用户生产部署：Systemd+PAM+Nginx架构实践

1. 项目概述为什么“OpenClaw Ubuntu24 多用户部署”必须是生产级增强OpenClaw 是一个面向开发者与技术团队的开源智能体Agent协作平台核心能力在于将大语言模型能力封装为可编排、可复用、可审计的技能Skill支持自然语言驱动的自动化任务执行——比如自动查日志、生成周报、调用内部API、触发CI流水线、甚至协同多个Agent完成复杂工作流。它不是玩具型Demo而是真正要嵌入研发、运维、产品日常流程中的“数字同事”。而 Ubuntu 24.04 LTSNoble Numbat作为当前最新生命周期长达5年的长期支持版本已成企业级AI基础设施的事实标准底座内核更新至6.8原生支持eBPF可观测性、更成熟的cgroups v2资源隔离、默认启用systemd-resolved提升DNS稳定性更重要的是——它对NVIDIA Hopper架构GPU如H100、L40S的CUDA 12.4驱动支持更成熟这对OpenClaw背后依赖的vLLM、Triton等推理引擎至关重要。但问题来了绝大多数公开教程停留在“单用户本地跑通demo”的层面。你照着GitHub README执行完pip install openclaw启动openclaw serve浏览器打开localhost:8000看到UI界面就以为部署完成了错。真实生产环境里你面对的是3个后端工程师要同时调试自己的Skill逻辑2个SRE需要独立配置告警通知渠道1个产品经理想用自己的飞书账号登录查看Agent执行记录所有人的操作日志必须可追溯、资源使用不能互相抢占、任意用户崩溃不能拖垮整个服务——这恰恰是“多用户”场景下最脆弱的环节。Ubuntu 24 默认的桌面会话管理GDM3、systemd用户实例、Docker权限模型、Python虚拟环境隔离、Web服务反向代理链路任何一个环节没做生产级加固都会在第3个用户登录时出现Session冲突、GPU显存OOM、环境变量污染或HTTPS证书失效。我去年在给一家金融科技客户落地时就因未处理好systemd --user服务与nginx反向代理的socket权限继承问题导致新用户首次登录后所有WebSocket连接持续502排查了整整两天才定位到是/run/user/1001目录的ACL策略缺失。所以“生产级增强”不是锦上添花而是把OpenClaw从实验室标本变成产线工具的生死线。这个方案专为三类人设计一是中小企业的DevOps工程师手头只有1~2台物理服务器或云主机既要支撑内部AI应用又要保障稳定性二是高校AI实验室的系统管理员需为20学生提供隔离的OpenClaw实验环境但预算有限无法上K8s三是独立开发者想用一台NUC主机搭建个人AI工作台同时给家人开个只读Dashboard看天气预报Agent执行状态。它不假设你有集群、不依赖云厂商托管服务、不强制使用Docker Compose编排——所有增强点都锚定在Ubuntu 24原生能力之上用最少的组件、最透明的配置、最可审计的日志实现真正的多用户生产可用。接下来我会拆解每一个增强动作背后的“为什么”而不是只告诉你“怎么做”。2. 整体架构设计为什么放弃Docker Compose而选择“Systemd Nginx PAM”三位一体很多教程一上来就甩出docker-compose.yml看似省事实则埋下深坑。我们来算一笔账OpenClaw核心服务backend API frontend UI skill runner本身是Python进程若全塞进Docker意味着每个用户都要启动一套完整容器栈。Ubuntu 24默认使用cgroups v2而Docker daemon自身就是个重量级systemd服务当你要为5个用户各自运行docker run -p 8001:8000、docker run -p 8002:8000……时宿主机的iptables规则数、netns数量、containerd-shim进程数会指数级增长。我实测过在8核16G内存的阿里云ECS上仅启动4个OpenClaw容器systemctl status docker显示其内存占用就突破2.1GBCPU空闲率常年低于15%——这不是在跑AI服务是在跑Docker监控服务。因此本方案采用“分层解耦、原生优先”策略最底层Ubuntu 24原生systemd用户实例。每个用户拥有独立的systemd --user会话OpenClaw backend作为user service运行天然继承用户UID/GID、HOME路径、环境变量隔离。systemctl --user start openclaw-backend启动的服务其进程树根节点是/usr/lib/systemd/systemd --user而非docker-containerd-shim。这意味着GPU显存分配由nvidia-container-toolkit直接绑定到用户cgroup不会出现容器间显存争抢日志自动归集到journalctl --user -u openclaw-backend无需额外配置fluentd服务崩溃自动重启策略由systemd统一管理比Docker restart policy更细粒度可设StartLimitIntervalSec600防雪崩。中间层Nginx反向代理网关。不采用traefik或caddy因为它们需要额外维护配置热重载逻辑。Nginx在Ubuntu 24中已深度集成systemd socket activation/etc/systemd/system/nginx.socket监听80/443端口收到请求后按需唤醒nginx.service。我们为每个用户生成独立server块例如/etc/nginx/sites-available/openclaw-user-a其中proxy_pass http://127.0.0.1:8001;指向该用户backend端口。关键增强在于启用auth_request模块对接PAM认证所有HTTP请求先经/auth子请求校验用户凭证再放行到后端——这比JWT Token校验更底层、更安全且与Ubuntu系统账户完全同步。最上层PAMPluggable Authentication Modules统一认证。这是多用户安全的核心。我们不自己写登录页而是让Nginx调用/usr/lib/nginx/modules/ngx_http_auth_pam_module.so通过auth_pam OpenClaw Login; auth_pam_service_name openclaw;指令将认证委托给系统PAM栈。你只需在/etc/pam.d/openclaw中定义规则auth [successok defaultbad] pam_succeed_if.so user ingroup openclaw-users即可限制仅openclaw-users组成员能访问。用户密码变更、SSH密钥登录、甚至LDAP同步全部零改造生效。这个架构的收益是立竿见影的资源开销直降70%实测5用户并发时systemd用户服务总内存占用1.2GB而同等Docker方案需3.8GB故障域严格隔离用户A的backend崩溃只影响其systemctl --user会话Nginx自动将后续请求返回502其他用户服务毫发无损审计合规性拉满所有登录尝试记录在/var/log/auth.log所有服务启停记录在journalctl -u nginx所有API调用日志在OpenClaw backend的structured JSON日志中——三者时间戳精确到微秒可交叉验证。提示有人会问“为什么不用K8s”——K8s是为百节点集群设计的而本方案目标是单机极致稳定。就像你不会为修自行车买台数控机床过度工程化是生产环境最大的敌人。3. 核心细节解析从Ubuntu 24系统初始化到OpenClaw Skill沙箱的12个关键控制点3.1 Ubuntu 24最小化安装后的必要加固别跳过这一步。Ubuntu 24 Desktop版自带GNOME、Snapd、各种GUI服务对Server场景全是累赘。必须从minimal ISO开始安装时选择“Ubuntu Server”而非“Desktop”取消勾选所有额外软件包安装后立即执行# 彻底禁用snap其daemon常驻内存且更新不可控 sudo systemctl stop snapd sudo systemctl disable snapd sudo apt purge snapd -y sudo rm -rf /var/cache/snapd/ /snap/ # 禁用ubuntu-pro服务自动安全更新可能引发非预期重启 sudo systemctl stop ubuntu-pro-daemon sudo systemctl disable ubuntu-pro-daemon # 清理无用内核保留当前运行的1个备用 dpkg -l | grep linux-image- | awk {print $2} | sort -V | sed -n /$(uname -r)/q;p | xargs sudo apt purge -y关键增强启用unattended-upgrades但锁定内核版本编辑/etc/apt/apt.conf.d/20auto-upgradesAPT::Periodic::Update-Package-Lists 1; APT::Periodic::Unattended-Upgrade 1; Unattended-Upgrade::Allowed-Origins { ${distro_id}:${distro_codename}; ${distro_id}:${distro_codename}-security; // 注释掉-updates源避免内核自动升级导致NVIDIA驱动失效 // ${distro_id}:${distro_codename}-updates; };然后执行sudo unattended-upgrade --dry-run --debug验证配置。这确保安全补丁自动安装但内核保持稳定——因为NVIDIA驱动与内核ABI强绑定一次内核升级可能让GPU推理服务瘫痪数小时。3.2 多用户账户的PAM与cgroups v2精细化管控创建用户不是adduser alice就完事。生产环境要求每个用户有独立GPU显存配额防止某用户跑大模型吃光显存CPU时间片公平调度避免后台训练任务饿死前台Web服务磁盘IO限速防止日志刷盘拖慢SSD寿命。具体操作创建专用用户组并设置cgroupssudo groupadd openclaw-users sudo useradd -m -G openclaw-users -s /bin/bash alice sudo useradd -m -G openclaw-users -s /bin/bash bob # 为每个用户创建cgroups v2配置 echo alice 1001:1001 | sudo tee -a /etc/subuid /etc/subgid sudo mkdir -p /sys/fs/cgroup/openclaw/{alice,bob} echo cpu.max 500000 1000000 | sudo tee /sys/fs/cgroup/openclaw/alice/cpu.max # 50% CPU时间 echo memory.max 4G | sudo tee /sys/fs/cgroup/openclaw/alice/memory.max echo io.max 8:16 rbps10485760 wbps10485760 | sudo tee /sys/fs/cgroup/openclaw/alice/io.max # 10MB/s IO限速PAM增强强制密码强度与失败锁定编辑/etc/pam.d/common-password在末尾添加password [success1 defaultignore] pam_unix.so obscure sha512 password requisite pam_pwquality.so retry3 minlen12 difok3 reject_username编辑/etc/pam.d/common-auth添加auth [defaultdie] pam_faillock.so authfail deny5 unlock_time900 auth [defaultdie] pam_faillock.so authsucc deny5 unlock_time900这意味着连续5次输错密码该账户被锁定15分钟且密码必须12位以上、包含大小写字母数字特殊字符、不能包含用户名。3.3 OpenClaw Backend的systemd用户服务模板这是多用户隔离的核心载体。创建~/.config/systemd/user/openclaw-backend.service注意是user级非system级[Unit] DescriptionOpenClaw Backend for %i Afternetwork.target [Service] Typesimple EnvironmentPATH/opt/openclaw/venv/bin:/usr/local/bin:/usr/bin:/bin EnvironmentPYTHONPATH/opt/openclaw/src EnvironmentOPENCLAW_CONFIG/opt/openclaw/config/%i.yaml EnvironmentCUDA_VISIBLE_DEVICES0 # 若有多卡此处按用户分配 WorkingDirectory/opt/openclaw ExecStart/opt/openclaw/venv/bin/python -m openclaw.backend.server Restarton-failure RestartSec10 StartLimitIntervalSec600 StartLimitBurst5 # 关键将进程绑定到用户cgroup Sliceopenclaw-%i.slice # 关键限制单个进程最大文件描述符 LimitNOFILE65536 # 关键禁止core dump避免敏感信息泄露 LimitCORE0 [Install] WantedBydefault.target然后为每个用户启用systemctl --user daemon-reload systemctl --user enable openclaw-backend.service systemctl --user start openclaw-backend.serviceSliceopenclaw-%i.slice会自动创建/sys/fs/cgroup/openclaw/alice.slice所有该服务进程及其子进程包括skill runner均受前述cgroups规则约束。LimitNOFILE65536解决高并发WebSocket连接数不足问题——OpenClaw默认使用Starlette单连接需2个fd1000并发即需2000fd而Ubuntu 24默认ulimit -n仅为1024。3.4 Nginx反向代理的PAM认证与动态路由Nginx配置是多用户网关的灵魂。创建/etc/nginx/sites-available/openclaw-multiupstream openclaw_alice { server 127.0.0.1:8001; } upstream openclaw_bob { server 127.0.0.1:8002; } # 全局认证端点 location /auth { internal; proxy_pass_request_body off; proxy_set_header Content-Length ; proxy_pass http://127.0.0.1:8080/auth; # 关键将认证结果传递给主location proxy_set_header X-Original-URI $request_uri; } # 主路由根据Host头匹配用户 server { listen 443 ssl http2; server_name ~^(?user[a-z0-9])\.openclaw\.local$; ssl_certificate /etc/letsencrypt/live/openclaw.local/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/openclaw.local/privkey.pem; # 关键调用PAM认证 auth_request /auth; auth_request_set $auth_status $upstream_status; location / { # 根据捕获的用户名选择上游 set $backend openclaw_$user; proxy_pass http://$backend; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # 关键透传认证用户信息给backend proxy_set_header X-Authenticated-User $user; } }配套的PAM认证服务用轻量级Python Flask实现/opt/openclaw/auth/app.pyfrom flask import Flask, request, jsonify import pam import os app Flask(__name__) app.route(/auth, methods[POST]) def auth(): username request.headers.get(X-Original-URI).split(/)[1] # 从URI提取用户名 password request.form.get(password) # 实际中应走JWT或session此处简化 p pam.pam() if p.authenticate(username, password, serviceopenclaw): return jsonify({status: success}), 200 else: return jsonify({status: failed}), 401这样当用户访问https://alice.openclaw.local时Nginx自动将请求转发到alice的backend并在Header中注入X-Authenticated-User: aliceOpenClaw backend据此加载该用户的Skill配置和数据库连接。3.5 OpenClaw Skill执行沙箱基于Firejail的进程级隔离OpenClaw允许用户上传自定义Python Skill这是最大安全风险点。不能让Skill代码随意读取/etc/shadow或调用os.system(rm -rf /)。本方案采用Firejail——一个基于Linux namespaces和seccomp-bpf的轻量级沙箱比Docker更底层、启动更快。为每个用户创建沙箱配置/opt/openclaw/sandbox/alice.profile# 禁用危险系统调用 noblacklist ${HOME}/.openclaw/skills noroot caps.drop all seccomp /opt/openclaw/sandbox/seccomp.rules # 仅允许访问必要路径 whitelist ${HOME}/.openclaw/skills whitelist ${HOME}/.openclaw/logs whitelist /tmp read-only /usr read-only /lib read-only /bin # 网络仅允许访问内部API net none配套的seccomp规则/opt/openclaw/sandbox/seccomp.rules禁用openat,unlinkat,execveat等高危syscall。当OpenClaw backend执行Skill时调用import subprocess subprocess.run([ firejail, --profile/opt/openclaw/sandbox/alice.profile, --nameopenclaw-skill-alice-123, python, /home/alice/.openclaw/skills/my_skill.py ], cwd/home/alice, timeout300)实测表明Firejail沙箱启动耗时50ms而同等Docker容器启动需800ms且内存开销仅为1/10。更重要的是它与systemd用户服务无缝集成——沙箱进程天然属于openclaw-alice.slice受前述cgroups规则约束。3.6 生产级日志与监控从journalctl到Prometheus指标暴露OpenClaw默认日志是console输出生产环境必须结构化。我们在backend启动参数中加入--log-config {version:1,formatters:{json:{class:pythonjsonlogger.jsonlogger.JsonFormatter,format:%(asctime)s %(name)s %(levelname)s %(message)s}},handlers:{file:{class:logging.handlers.RotatingFileHandler,filename:/var/log/openclaw/alice/backend.log,maxBytes:10485760,backupCount:5,formatter:json}},loggers:{openclaw:{level:INFO,handlers:[file],propagate:false}}}同时为每个用户创建logrotate配置/etc/logrotate.d/openclaw-alice/var/log/openclaw/alice/*.log { daily missingok rotate 30 compress delaycompress notifempty create 640 alice openclaw-users sharedscripts postrotate systemctl --user kill --signalSIGHUP openclaw-backend.service /dev/null 21 || true endscript }监控方面OpenClaw backend内置/metrics端点Prometheus格式但默认只监听127.0.0.1。我们修改其启动命令ExecStart/opt/openclaw/venv/bin/python -m openclaw.backend.server --metrics-host 0.0.0.0 --metrics-port 8001然后在Nginx中暴露location /alice/metrics { proxy_pass http://127.0.0.1:8001/metrics; proxy_set_header Host $host; }Prometheus抓取配置- job_name: openclaw-users static_configs: - targets: [localhost:9090] metrics_path: /alice/metrics relabel_configs: - source_labels: [__address__] target_label: instance replacement: alice这样每个用户的CPU使用率、内存占用、API QPS、Skill执行成功率等指标全部可量化、可告警、可下钻。3.7 HTTPS证书自动化acme.sh DNS API的零停机续期多用户场景下不能让用户自己管理证书。我们采用acme.sh配合Cloudflare DNS API实现全自动续期安装acme.shcurl https://get.acme.sh | sh配置Cloudflare APIexport CF_Keyyour_api_key export CF_Emailadminopenclaw.local申请泛域名证书acme.sh --issue -d openclaw.local -d *.openclaw.local --dns dns_cf创建续期hook脚本/opt/openclaw/scripts/renew-hook.sh#!/bin/bash # 续期后自动复制证书到Nginx目录并重载 cp /root/.acme.sh/openclaw.local/fullchain.cer /etc/letsencrypt/live/openclaw.local/fullchain.pem cp /root/.acme.sh/openclaw.local/openclaw.local.key /etc/letsencrypt/live/openclaw.local/privkey.pem chmod 644 /etc/letsencrypt/live/openclaw.local/*.pem systemctl reload nginx设置定时任务0 0 1 * * /root/.acme.sh/acme.sh --renew -d openclaw.local --force --reloadcmd /opt/openclaw/scripts/renew-hook.sh这样证书在到期前30天自动续期Nginx零停机重载用户永远看不到证书过期警告。3.8 数据库隔离PostgreSQL Row-Level SecurityRLS实战OpenClaw默认用SQLite生产环境必须换PostgreSQL。但多用户共用一个DB如何保证数据隔离答案是PostgreSQL 14的Row-Level Security。创建用户专属schemaCREATE SCHEMA alice AUTHORIZATION alice; CREATE SCHEMA bob AUTHORIZATION bob;在openclaw_config.yaml中为每个用户指定schemadatabase: url: postgresql://alice:pwdlocalhost:5432/openclaw schema: alice然后启用RLSALTER TABLE skill_executions ENABLE ROW LEVEL SECURITY; CREATE POLICY user_isolation_policy ON skill_executions USING (user_id current_user);这样即使Alice的Skill代码执行SELECT * FROM skill_executions也只会返回user_idalice的记录。PostgreSQL在查询解析阶段就注入WHERE条件性能损耗1%远优于应用层手动拼接WHERE。3.9 文件存储安全S3兼容对象存储的用户桶隔离OpenClaw Skill常需上传文件如PDF解析、图片识别。本地磁盘存储有风险我们接入MinIOS3兼容。关键增强为每个用户创建独立bucket并通过IAM策略限制{ Version: 2012-10-17, Statement: [ { Effect: Allow, Action: [s3:GetObject, s3:PutObject], Resource: [arn:aws:s3:::openclaw-alice/*] } ] }OpenClaw backend配置中storage.s3.bucket动态替换为openclaw-{username}所有文件操作自动路由到对应bucket。MinIO的mc alias set命令可预配置各用户endpoint避免硬编码。3.10 前端静态资源优化Nginx Brotli压缩与ETag缓存OpenClaw前端是React构建的SPAJS/CSS体积大。Ubuntu 24默认Nginx不带Brotli模块需手动编译sudo apt install libbrotli-dev cd /tmp wget http://nginx.org/download/nginx-1.24.0.tar.gz tar -xzf nginx-1.24.0.tar.gz cd nginx-1.24.0 ./configure --with-http_brotli_module make sudo make install然后在Nginx配置中启用brotli on; brotli_comp_level 6; brotli_types text/plain text/css application/json application/javascript text/xml application/xml application/xmlrss text/javascript; location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ { expires 1y; add_header Cache-Control public, immutable; etag on; }实测表明Brotli比Gzip压缩率高15%首屏加载时间从2.1s降至1.3s对远程办公用户尤其关键。3.11 备份与恢复borgmatic的增量加密备份生产环境必须有可靠备份。我们选用borgmatic——基于borgbackup的封装支持去重、加密、压缩初始化仓库borg init --encryptionrepokey-blake2 /backup/openclaw-repo创建/etc/borgmatic/config.yamllocation: source_directories: - /opt/openclaw - /var/log/openclaw repositories: - /backup/openclaw-repo retention: keep_daily: 7 keep_weekly: 4 keep_monthly: 12 consistency: checks: - repository - archives设置定时任务0 2 * * * borgmatic --stats备份时自动加密恢复只需borg extract /backup/openclaw-repo::archive-name且增量备份使每日备份耗时90秒。3.12 灾难恢复演练5分钟重建OpenClaw服务最后但最重要验证备份是否真能用。我们编写一键恢复脚本/opt/openclaw/scripts/restore.sh#!/bin/bash # 1. 重装Ubuntu 24 minimal # 2. 运行此脚本 set -e # 恢复基础配置 borg extract /backup/openclaw-repo::$(borg list /backup/openclaw-repo | tail -1 | awk {print $1}) # 重装依赖 apt update apt install -y python3-pip nginx postgresql postgresql-contrib # 恢复数据库 sudo -u postgres psql -c CREATE DATABASE openclaw; sudo -u postgres pg_restore -d openclaw /backup/openclaw-db.dump # 启动服务 systemctl daemon-reload systemctl enable nginx systemctl start nginx for user in $(getent group openclaw-users | cut -d: -f4 | tr , \n); do sudo -u $user systemctl --user daemon-reload sudo -u $user systemctl --user start openclaw-backend.service done实测从裸机到OpenClaw服务完全可用耗时4分38秒。这才是真正的生产级保障。4. 实操过程从零开始部署的完整步骤与参数详解4.1 环境准备硬件选型与Ubuntu 24安装验证硬件不是越贵越好而是要匹配OpenClaw负载特征。我们推荐三档配置入门级个人/小团队Intel i5-12400 32GB DDR4 NVIDIA RTX 407012GB显存 1TB NVMe SSD。RTX 4070在FP16精度下推理7B模型可达45 tokens/sec足够支撑5用户并发Skill调用。生产级中小企业AMD EPYC 7413 128GB RAM 2×NVIDIA L40S48GB显存 4TB NVMe RAID0。L40S专为AI推理优化INT4精度下70B模型吞吐达120 tokens/sec且支持NVLink显存池化。高性能AI实验室Dual Intel Xeon Platinum 8480C 512GB RAM 4×NVIDIA H100 SXM580GB显存 10TB Optane PMEM。H100的Transformer Engine可将大模型推理延迟压至毫秒级。安装Ubuntu 24.04 Server时务必勾选“Install OpenSSH server”并禁用“Install third-party software”避免NVIDIA驱动冲突。安装完成后验证关键组件# 验证内核与cgroups v2 uname -r # 应输出 6.8.0-xx-generic stat -fc %T /sys/fs/cgroup # 应输出 cgroup2fs # 验证NVIDIA驱动以L40S为例 nvidia-smi -L # 应输出 GPU 0: NVIDIA L40S (UUID: GPU-xxxx) nvidia-smi --query-gpumemory.total --formatcsv,noheader,nounits # 应输出 48000 # 验证CUDA nvcc --version # 应输出 Cuda compilation tools, release 12.4, V12.4.131 # 验证Python环境 python3 --version # 应输出 3.12.3 python3 -c import torch; print(torch.cuda.is_available()) # 应输出 True若torch.cuda.is_available()返回False大概率是CUDA Toolkit与驱动版本不匹配。此时执行sudo apt install -y nvidia-cuda-toolkit # Ubuntu 24官方源已适配 sudo reboot4.2 系统级配置PAM、cgroups、防火墙的逐行配置登录root账户开始系统加固配置PAM认证模块# 安装必要包 sudo apt install -y libpam-pwquality libpam-modules-bin # 创建openclaw PAM服务文件 sudo tee /etc/pam.d/openclaw EOF #%PAM-1.0 auth [successok defaultbad] pam_succeed_if.so user ingroup openclaw-users auth [default1 successok] pam_localuser.so auth [defaultdone] pam_permit.so account required pam_permit.so password [successok defaultignore] pam_unix.so obscure sha512 password requisite pam_pwquality.so retry3 minlen12 difok3 reject_username EOF配置cgroups v2资源限制# 创建cgroups配置目录 sudo mkdir -p /etc/systemd/system/user-.slice.d # 为所有openclaw用户设置默认资源限制 sudo tee /etc/systemd/system/user-.slice.d/10-openclaw.conf EOF [Slice] CPUQuota50% MemoryMax4G IOWeight100 EOF # 为每个用户创建专属slice以alice为例 sudo mkdir -p /etc/systemd/system/user-1001.slice.d sudo tee /etc/systemd/system/user-1001.slice.d/20-alice.conf EOF [Slice] CPUQuota30% MemoryMax3G IOWeight80 EOF配置UFW防火墙sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow OpenSSH sudo ufw allow from 192.168.1.0/24 to any port 443 # 允许内网访问HTTPS sudo ufw enable注意不要开放8000端口所有流量必须经Nginx反向代理这是安全边界。4.3 OpenClaw核心服务部署从源码编译到systemd服务注册OpenClaw官方PyPI包常滞后于GitHub主干且不包含生产级优化。我们直接构建源码# 创建部署目录 sudo mkdir -p /opt/openclaw sudo chown root:root /opt/openclaw cd /opt/openclaw # 克隆源码指定稳定tag sudo git clone --branch v0.8.2 https://github.com/openclaw/openclaw.git src sudo chown -R root:root src # 创建Python虚拟环境 sudo python3 -m venv venv sudo chown -R root:root venv # 安装依赖启用CUDA加速 sudo -u root /opt/openclaw/venv/bin/pip install -r src/requirements.txt sudo -u root /opt/openclaw/venv/bin/pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121 # 安装OpenClaw开发模式便于后续调试 sudo -u root /opt/openclaw/venv/bin/pip install -e src # 创建用户配置目录 sudo mkdir -p /opt/openclaw/config sudo chown root:root /opt/openclaw/config为alice用户创建配置/opt/openclaw/config/alice.yaml# OpenClaw配置 backend: host: 0.0.0.0 port: 8001 metrics_host: 0.0.0.0 metrics_port: 8001 database: url: postgresql://alice:alice123localhost:5432/openclaw schema: alice storage: s3: endpoint: https://minio.openclaw.local bucket: openclaw-alice access_key: alice_access_key secret_key: alice_secret_key # 安全配置 auth: jwt_secret: generate_your_own_32_byte_secret_here session_timeout: 3600生成JWT密钥openssl rand -base64 32然后为alice用户创建systemd服务