DigitalOcean offers a simple and cost-effective way to run applications in the cloud thanks to its Droplets - virtual machines that can be set up in minutes.
In this guide we will setup a DigitalOcean Droplet and strengthen its security so you can safely run IronClaw and expose it to the internet.
Do not feel like setting up your own infrastructure? You can install IronClaw with a few clicks on agent.near.ai
Create a Droplet
Register on DigitalOcean and navigate to the Droplets section to create a new Droplet.
I recommend choosing Ubuntu as the operating system - particularly the latest LTS version - and the Basic plan with a Regular disk. This currently costs around $4/month and provides more than enough resources to run IronClaw for most use cases.
To connect to your Droplet, you need to set up an SSH key. You can generate a new SSH key pair on your local machine using the ssh-keygen command, then add the public key to your DigitalOcean account.
ssh-keygen -t rsa -b 4096
# Follow the prompts to save the key pair (e.g., id_rsa and id_rsa.pub)
# Read the contents of the public key
cat ~/.ssh/id_rsa.pub
You could also log in with a password, but using SSH keys is more secure and recommended. Make sure to keep your private key safe and do not share it with anyone.
Access Your Droplet
Once your Droplet is created, you can access it via SSH using the IP address provided by Digital Ocean.
Through your terminal, use SSH to connect as the root user to your Droplet:
# Replace <IP_ADDRESS> with your Droplet's IP address
ssh root@<IP_ADDRESS>
Now that we are inside the Droplet, we need to perform some initial configuration. In particular, we do not want to leave root as the default user, and we want to strengthen Droplet security by setting a few firewall rules.
Update and Upgrade
First, let’s make sure the system is up to date:
apt update && apt upgrade -y
Create a New User
It is good practice to create a new user with sudo privileges instead of using root for daily operations. You can create a new user (for example, ironclaw) and add it to the sudo group:
adduser ironclaw
usermod -aG sudo ironclaw
root to the new user:
# Create the .ssh directory for the user
mkdir -p /home/ironclaw/.ssh
# Copy your current root authorized_keys (if you want the same key)
cp ~/.ssh/authorized_keys /home/ironclaw/.ssh/authorized_keys
# Set the correct permissions (critical — SSH will ignore the file otherwise)
chown -R ironclaw:ironclaw /home/ironclaw/
chmod 700 /home/ironclaw/.ssh
chmod 600 /home/ironclaw/.ssh/authorized_keys
ssh ironclaw@<IP_ADDRESS>
Do not move forward until you have confirmed that you can log in with the new user. If you lose access to root without having another user set up, you will need to completely reset your Droplet and start over.
Harden SSH Access
To enhance the security of your Droplet, it is recommended to disable password authentication and root login for SSH.
You can do this by editing the SSH configuration file /etc/ssh/sshd_config and setting the following parameters:
PasswordAuthentication no # Force key-based auth only
Port 2222 # Change default port (optional but helps)
ssh -p 2222 ironclaw@<IP_ADDRESS>
PermitRootLogin no in the SSH configuration and rebooting again.
Install Fail2Ban
To further enhance Droplet security, install Fail2Ban. It helps protect against brute-force attacks by monitoring log files and banning IP addresses that show malicious behavior.
apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban
Setup Firewall
It is also a good idea to set up a firewall to restrict access to only the necessary ports. You can use ufw (Uncomplicated Firewall) for this purpose:
sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp # Allow SSH on the new port
sudo ufw allow 80/tcp # Allow HTTP (if needed)
sudo ufw allow 443/tcp # Allow HTTPS (if needed)
sudo ufw enable
Install IronClaw
Now that we have set up and secured the Droplet, we can proceed with the IronClaw installation. You can follow the installation instructions in the Quickstart Guide to get IronClaw up and running.
# Install IronClaw
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/nearai/ironclaw/releases/latest/download/ironclaw-installer.sh | sh
We recommend using a session manager like tmux or screen so you can easily detach and reattach to your running IronClaw instance between SSH sessions.
Next Steps
Follow our Quickstart Guide to create your first agent, connect it to Telegram, and start exploring IronClaw’s capabilities.
Want to talk with your agent using a messaging app? Check out the Channels documentation to learn how to connect.
Need your agent to perform complex tasks that require multiple tools? Check out the Extensions documentation. 
