How to Configure OpenClaw Gateway with HTTPS

sudo apt update
sudo apt install -y nginx certbot python3-certbot-nginx

sudo nano /etc/nginx/sites-available/openclaw
# Add:
# server {
#   listen 80;
#   server_name openclaw.yourdomain.com;
#
#   location / {
#     proxy_pass http://localhost:3000;
#     proxy_http_version 1.1;
#     proxy_set_header Upgrade $http_upgrade;
#     proxy_set_header Connection 'upgrade';
#     proxy_set_header Host $host;
#     proxy_cache_bypass $http_upgrade;
#     proxy_set_header X-Real-IP $remote_addr;
#     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#     proxy_set_header X-Forwarded-Proto $scheme;
#   }
# }

sudo ln -s /etc/nginx/sites-available/openclaw /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

sudo certbot --nginx -d openclaw.yourdomain.com
# Follow the prompts
# Choose option 2 (redirect HTTP to HTTPS)

nano ~/openclaw/gateway.yaml
# Update:
# server:
#   host: 127.0.0.1  # Only listen on localhost
#   port: 3000
#   trustProxy: true  # Trust X-Forwarded-* headers from nginx

sudo systemctl restart openclaw

curl https://openclaw.yourdomain.com/health
# Should return {"status":"ok"}
# Check certificate in browser — should show valid Let's Encrypt cert

sudo certbot renew --dry-run
# Should complete without errors
# Certbot automatically adds a renewal cron job