2026 OpenClaw in production
Sticky Traefik/HAProxy, SSH JumpHost & merged probes

Start with one gateway VM per region running OpenClaw on loopback only. Put Traefik or HAProxy on the same host (or a tiny “edge” sibling) as the TLS terminator and sticky scheduler. For the SSH path, mirror the bastion-first pattern from our loopback SSH tunnel gateway article: operators always enter through a JumpHost, then reach 127.0.0.1-bound admin sockets on the gateway. For probe fan-in semantics aligned with MagicDNS deployments, reuse the merge discipline from OpenClaw on Tailscale multi-region—the transport changes, the JSON contract does not.

Minimal reproducible skeleton. (1) Install OpenClaw with OPENCLAW_HOME=/var/lib/openclaw/<region> and HTTP on 127.0.0.1:18080. (2) Configure Traefik sticky cookie middleware on the router, or HAProxy cookie / balance source on the backend pointing at that loopback port—even with a single server, stickiness keeps future horizontal scale honest. (3) Add an SSH stanza: laptop → regional bastion → gateway using ProxyJump. (4) Run two probe runners per PoP (edge HTTPS and authenticated “deep” lane) writing JSON lines; feed them into a five-minute merge window. (5) Curl through the public VIP and through ssh -J to prove both paths behave before inviting traffic.

Certificates (edge TLS, origin trust, and SSH host keys)

Terminate HTTPS on Traefik or HAProxy with a public ACME certificate (Let’s Encrypt HTTP-01 or DNS-01 per regional name). Keep OpenClaw itself on plain HTTP at loopback: you avoid double TLS and certificate drift between process restarts. If compliance demands encryption even on loopback, use a short-lived local cert issued by your internal CA and pin the proxy’s upstream client to trust only that chain.

• Public names. Use one hostname per PoP (openclaw-sin.example.com) so a compromised key rolls in isolation. Wildcards are convenient but widen blast radius when uploaded to a shared WAF.
• Forwarded trust. When OpenClaw logs client IPs, enable Forwarded headers in Traefik or send HAProxy’s PROXY protocol v2 to a secondary local listener that understands it—never blindly trust X-Forwarded-For from the open Internet without stripping at the edge.
• SSH host keys. Preload bastion and gateway keys in known_hosts via your config management so ProxyJump chains do not train operators to click “yes” on every rebuild. Rotate keys with a published window; stale automation is how merge workers lose SSH-based “last resort” checks.

Timeouts (client, proxy, upstream, and SSH keepalives)

Sticky sessions amplify timeout mismatches: if the browser thinks the request died while the proxy still buffers to OpenClaw, users retry and you get duplicate side effects. Set the proxy’s server timeout slightly above OpenClaw’s worst-case handler budget but below the client’s user-visible deadline.

• Traefik. Tune transport.respondingTimeouts (read/write/idle) on the entrypoint and a per-service dial timeout for the loopback upstream. Enable HTTP keep-alive between proxy and OpenClaw so sticky connections reuse TCP.
• HAProxy. Align timeout client, timeout server, and timeout tunnel with your SSE or long-polling reality. For plain REST, keep timeout http-request aggressive enough to shed slowloris but not so tight that cold JVM or model loads fail during deploy.
• SSH chain. Add ServerAliveInterval and ServerAliveCountMax on the bastion hop so idle merge scripts or port-forwards survive NAT. Match TCPKeepAlive on sshd_config with sane system sysctl values on each vpshalo node.

# ~/.ssh/config fragment — laptop → bastion → gateway (replace hosts)
Host oc-bastion-sin
  HostName bastion.sin.example.com
  User jump

Host oc-gateway-sin
  HostName 10.x.y.z
  User admin
  ProxyJump oc-bastion-sin
  LocalForward 18080 127.0.0.1:18080

Upstream health checks (isolated paths, rise/fall, merged failure summaries)

Health checks must not share the same cookie namespace as customer traffic. Expose /healthz (anonymous, fast) and /ready (auth optional, exercises dependencies) on OpenClaw, then point Traefik’s HealthCheck or HAProxy option httpchk only at /healthz. Use independent rise/fall counts: three consecutive failures before drain, two successes before reuse is a common starting point on cross-ocean links.

• Structured output. Each probe emits one JSON line per attempt with region, lane (edge vs deep), http_status, and rtt_ms. Ship stdout to your collector; never email raw logs.
• Merge window. Collapse events inside 300 seconds keyed by region. Single-region lane-A failure opens a regional incident; escalate to “global” only when two regions fail the same lane inside the same window—this is the same moral story as the Tailscale playbook, without requiring a tailnet.
• Alert hygiene. Attach the last successful build id from collocated remote Mac builders so CI triage sees whether the gateway or the farm regressed first.

OpenClaw binding strategy (loopback, homes, and horizontal scale)

Bind OpenClaw HTTP to 127.0.0.1 until a reviewed change intentionally exposes metrics elsewhere. Keep OPENCLAW_HOME unique per PoP; never rsync live state directories across regions. When you add a second OpenClaw process behind the same VIP, insert identical servers in HAProxy with the same cookie insert rule, or Traefik weighted services under the same sticky middleware—clients keep affinity while you drain one weight at a time.

• Environment isolation. systemd Environment=OPENCLAW_HOME=… plus AmbientCapabilities off and NoNewPrivileges=yes where supported.
• Secrets. Mount API keys read-only from a tmpfs or vault sidecar path referenced inside each regional home.
• Capacity planning. Match gateway regions to where your team actually measures SSH and artifact latency; rent adjacent remote Mac builders in the same vpshalo PoP so control traffic and compile traffic share geography.

Summary and purchase guidance. Certificates belong on the proxy, timeouts must align across hops, upstream checks need their own URL and merge logic, and OpenClaw stays on loopback with one home per region. When that stack is stable, buy capacity where your probes already pass: start from the technology blog index for related OpenClaw runbooks, then use the buttons below to compare plans and check out remote Mac nodes in the same regions as your gateways.