Accessing your OpenClaw instance via a raw IP address works, but it's ugly, hard to remember, and — more importantly — it makes SSL certificate setup painful. Binding a custom domain to your server is one of those 20-minute tasks that pays dividends forever. Let's walk through the entire process.
Beyond aesthetics, there are practical reasons to bind a domain to your OpenClaw server:
ai.yourdomain.com looks better than 43.159.xxx.xxx in your team's bookmarks.openclaw.yourdomain.com, n8n.yourdomain.com, etc.Before starting, make sure you have:
Log into your domain registrar's DNS management panel and create the following records:
| Type | Host | Value | TTL |
|---|---|---|---|
| A | openclaw | Your Lighthouse IP (e.g., 43.159.xx.xx) | 600 |
This maps openclaw.yourdomain.com to your server's IP address.
If your Lighthouse instance has an IPv6 address:
| Type | Host | Value | TTL |
|---|---|---|---|
| AAAA | openclaw | Your IPv6 address | 600 |
If you prefer using a CNAME instead of an A record (useful if your IP might change):
| Type | Host | Value | TTL |
|---|---|---|---|
| CNAME | openclaw | your-lighthouse-instance.tencentcloud.com | 600 |
Note: Use a low TTL (300-600 seconds) initially. Once everything is confirmed working, you can increase it to 3600.
DNS changes can take anywhere from a few minutes to 48 hours to propagate globally, though most propagate within 5-30 minutes.
# Check if DNS has propagated
dig openclaw.yourdomain.com +short
# Alternative check
nslookup openclaw.yourdomain.com
# Check from multiple locations using an online tool
# (search "DNS propagation checker" — several free tools exist)
You should see your Lighthouse IP address in the response. If you see nothing or the old value, wait and try again.
Your OpenClaw instance likely runs on a non-standard port (e.g., 8080). Nginx sits in front and routes traffic from port 80/443 to the application.
# Install nginx if not already present
sudo apt update && sudo apt install nginx -y
# Create the site configuration
sudo nano /etc/nginx/sites-available/openclaw
Add this configuration:
server {
listen 80;
server_name openclaw.yourdomain.com;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# WebSocket support (if needed)
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
Enable the site and restart Nginx:
# Enable the site
sudo ln -s /etc/nginx/sites-available/openclaw /etc/nginx/sites-enabled/
# Test configuration
sudo nginx -t
# Restart nginx
sudo systemctl restart nginx
Verify by visiting http://openclaw.yourdomain.com in your browser. You should see the OpenClaw interface.
This is not optional. Webhook integrations for Telegram, Discord, and WhatsApp all require HTTPS.
# Install certbot
sudo apt install certbot python3-certbot-nginx -y
# Obtain and install certificate
sudo certbot --nginx -d openclaw.yourdomain.com
# Follow the prompts:
# - Enter your email address
# - Agree to terms of service
# - Choose whether to redirect HTTP to HTTPS (recommended: yes)
Certbot automatically modifies your Nginx configuration to include SSL settings and sets up auto-renewal.
Verify auto-renewal:
# Test renewal process
sudo certbot renew --dry-run
# Check the renewal timer
sudo systemctl status certbot.timer
Now that you have a domain with SSL, update your messaging platform integrations to use the new URL.
Update your webhook URL to:
https://openclaw.yourdomain.com/webhook/telegram
Update your interaction endpoint to:
https://openclaw.yourdomain.com/webhook/discord
Update your callback URL to:
https://openclaw.yourdomain.com/webhook/whatsapp
The exact paths depend on your OpenClaw configuration. Refer to the respective integration guides for details.
Ensure your Lighthouse firewall allows HTTP and HTTPS traffic:
# Using ufw
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw reload
Also verify in the Tencent Cloud console that the Lighthouse instance's security group allows inbound traffic on ports 80 and 443.
dig or nslookup.sudo systemctl status nginx.sudo cat /var/log/letsencrypt/letsencrypt.log.curl http://127.0.0.1:8080 from the server itself.proxy_pass port in Nginx matches OpenClaw's actual port.https:// (not http://).curl -X POST https://openclaw.yourdomain.com/webhook/telegram.If you're running additional services alongside OpenClaw, create separate Nginx server blocks for each subdomain:
# /etc/nginx/sites-available/n8n
server {
listen 80;
server_name n8n.yourdomain.com;
location / {
proxy_pass http://127.0.0.1:5678;
# ... same proxy headers as above
}
}
Run certbot for each subdomain separately, or use a wildcard certificate if you have many subdomains.
All of this runs smoothly on Tencent Cloud Lighthouse because the networking layer is already configured for web-facing workloads. Static IP included, bandwidth bundled, firewall management built into the console. The Tencent Cloud Lighthouse Special Offer gives you everything needed for a production-grade OpenClaw deployment with custom domain — simple, high-performance, and cost-effective.
| Task | Command/Action |
|---|---|
| Check DNS | dig openclaw.yourdomain.com +short |
| Test Nginx config | sudo nginx -t |
| Restart Nginx | sudo systemctl restart nginx |
| Renew SSL | sudo certbot renew |
| Check SSL expiry | sudo certbot certificates |
| Test webhook | curl -X POST https://openclaw.yourdomain.com/webhook/test |
Domain binding is a one-time setup that makes everything else easier. Do it early, do it right, and you'll never think about IP addresses again. If you're starting fresh, the Tencent Cloud Lighthouse Special Offer bundles everything you need — compute, storage, bandwidth, and a static IP — at a price that makes dedicated AI agent hosting genuinely affordable.