Everyone's OpenClaw runs on a cloud VM they rent from someone else's computer. Read that sentence again. We took the tool that was supposed to give us a personal AI operator and parked it on infrastructure we don't own, behind accounts we can't fully audit, on networks we can't see. That's not an operator workstation. That's a tenant relationship with extra steps.
Here's the version nobody writes about: OpenClaw running on your own hardware, offline by default, phoning home to nobody. No cloud bill. No API key sitting in someone's dashboard. No wondering which subprocessor has your prompt history. Just a machine you touched with your own hands doing exactly what you told it to do.
This is the setup guide for the paranoid, the principled, and the people whose threat model includes their own cloud provider.
Let's be honest about what the default OpenClaw deployment looks like. You rent a VPS. You paste in your API keys. Your agent now runs somewhere you will never visit, on storage you will never wipe, behind an admin panel that logs everything. You've built a personal AI with the operational security of a group chat.
Is it convenient? Extremely. Is it private? Only in the sense that nobody has bothered to look yet.
The cloud-default crowd will tell you the threat model doesn't matter for most people. Maybe. But "most people" also reuse passwords, so let's not take infrastructure advice from the median. If your agent has access to your email, your calendar, your files, and your shell, then where that agent lives is the single most important security decision in the whole setup. A VPS is a shared apartment building with good marketing. Your own box is a cabin with a deadbolt.
There's also the offline question nobody asks until the invoice arrives or the outage hits. Cloud-dependent agents die when the network dies. Local agents keep working. If you've ever tried to get work done during a fiber cut or a provider outage while your "personal" AI sat unreachable behind someone else's status page, you already understand the argument. You just haven't acted on it yet.
Forget the spec sheets. Here's the real bill of materials for a local-first OpenClaw rig:
The box. A mini PC with 16GB of RAM minimum, 32GB if you want headroom. The used market is your friend here. A ThinkCentre Tiny or an older NUC costs less than six months of VPS fees and will outlive three of them. If you're feeling spicy, a Raspberry Pi 5 with an NVMe hat works for light workloads, though you'll feel the ceiling sooner. The Dell Latitude-class laptop gathering dust in your closet? Also fine. The best server is the one you already own.
The models. This is where it gets interesting. You need a capable local model, and "capable" has a specific meaning here: strong tool use, good instruction following, and enough context window to hold a working session. The current generation of open-weight models in the 20-70B range, quantized to fit your VRAM or system RAM, gets you there. Run them through Ollama or llama.cpp. No account. No key. No telemetry. The model file sits on your disk like any other file, and it runs when you say so and stops when you say stop.
The network posture. Default deny outbound. Your agent box should not be able to reach the internet unless you explicitly punch a hole for a specific purpose. This is the part that separates "self-hosted" from "actually private." Plenty of people self-host and then let everything phone home anyway. If your local model needs no network and your agent framework needs no network, then give it no network. Whitelist, don't blacklist.
The storage. Encrypted at rest. This is non-negotiable and nearly free. LUKS on Linux takes minutes to set up and means a stolen machine is a brick, not a breach. Your agent's memory, its logs, its conversation history: all of it should live on encrypted volumes. If someone walks off with the box, they get hardware, not your life.
Step 1: Pick your OS and harden it. Debian or Ubuntu Server, minimal install. No desktop environment eating RAM and expanding attack surface. During install, enable full-disk encryption. After first boot, disable password SSH and switch to key-only auth. Set up automatic security updates. This is boring work. Boring work is what security is made of.
Step 2: Install the model runtime. Ollama is the path of least resistance: one install command, a model pull, and you're serving completions on localhost. For more control, llama.cpp gives you granular flags for context size, threading, and quantization. Either way, bind the server to 127.0.0.1 only. There is no reason your model endpoint should be reachable from the LAN, let alone the internet. Localhost means localhost.
Step 3: Point OpenClaw at localhost. This is the beautiful part. OpenClaw doesn't care where its model lives. Configure the model endpoint to your local runtime instead of a cloud API. Same agent framework, same tooling, same workflows. The only difference is that the intelligence now lives in a box under your desk instead of a datacenter you've never seen. Your prompts never leave the building. Your API key budget drops to zero.
Step 4: Lock down the network. Firewall rules: deny all outbound by default. Then add explicit allows only for what you actually need. Package updates? Allow your distro's mirrors on a schedule, then close it again. Need the agent to fetch a webpage for research? Proxy it through a specific allowlist or do it manually and feed the content in. Every outbound connection should be a conscious decision, not a default. This is annoying for about a week. Then it becomes second nature, and you'll wonder why you ever let software phone home freely.
Step 5: Set up encrypted backups. A local-first setup with no backups is just a disaster with extra steps. Encrypt backups with a key stored separately from the machine. A USB drive in a drawer beats a cloud backup service that you then have to trust. Rotate them. Test restores. The backup you never tested is a backup you don't have.
Step 6: Physical security, the forgotten layer. Your threat model now includes someone walking into the room. Lock the screen. Use a BIOS password. If the box lives in a shared space, consider a Kensington lock, which is deeply unsexy and completely effective. The cloud crowd outsources this to datacenter guards. You are the guard now. Act like it.