OpenClaw Client Bootstrap

Create and apply a reusable client kit for OpenClaw with strict governance:

• private gateway exposure through Tailscale
• Tailnet-only SSH with non-root logins by default
• Telegram notification channel (sends portal links for approval events)
• SPAPS approval backend with Unclawg portal for human review
• read-only credentials in OpenClaw
• explicit write-gateway contract for all external mutations

Use This For

• New OpenClaw client box bootstraps on a fresh droplet
• Co-located OpenClaw container setups on an existing box
• Recovery, rotation, or governed re-bootstrap of an existing client kit

Do Not Use This For