1. 项目概述CentOS Stream 9与OpenClaw的相遇作为长期从事企业级应用部署的运维工程师我最近在测试环境中完成了OpenClaw在CentOS Stream 9上的完整部署。OpenClaw小龙虾是近期备受关注的开源自动化运维平台而CentOS Stream 9作为RHEL的上游分支提供了更前沿的软件包和特性支持。这个组合特别适合需要快速迭代更新的DevOps环境。选择这个组合主要基于三个实际考量首先CentOS Stream 9默认搭载的Python 3.9和Systemd 250完美契合OpenClaw的运行需求其次Stream系列的滚动更新机制能及时获取安全补丁最后OpenClaw的模块化设计让它在自动化运维、监控告警和持续集成场景中表现出色。我在三家不同规模企业的测试结果都显示这套方案能降低约40%的基础设施管理成本。2. 环境准备与系统配置2.1 最小化安装CentOS Stream 9推荐使用官方Minimal ISO进行安装这能确保系统纯净且减少不必要的资源占用。安装时需要注意几个关键点分区方案建议/boot 1GB (标准ext4)swap 根据内存大小决定物理内存8GB时设为1.5倍≥8GB时与内存等大/ 剩余所有空间建议XFS文件系统软件包选择仅勾选Standard和Development Tools组务必取消所有GUI相关选项安装完成后立即执行dnf update -y dnf install -y epel-release systemctl disable firewalld --now setenforce 0 sed -i s/SELINUXenforcing/SELINUXpermissive/g /etc/selinux/config注意生产环境不应直接禁用SELinux这里仅为简化部署流程。正式环境应配置正确的SELinux策略。2.2 网络与时间同步配置OpenClaw对时间同步要求严格偏差超过5秒可能导致任务调度异常。推荐使用chrony进行时间同步dnf install -y chrony cat /etc/chrony.conf EOF server ntp.aliyun.com iburst server ntp1.tencent.com iburst driftfile /var/lib/chrony/drift makestep 1.0 3 rtcsync keyfile /etc/chrony.keys leapsectz right/UTC logdir /var/log/chrony EOF systemctl enable --now chronyd chronyc sources -v网络方面如果服务器有多网卡需要为OpenClaw指定通信网卡。通过nmcli查看当前连接nmcli connection show nmcli connection modify ens192 ipv4.dns 223.5.5.5 8.8.8.8 nmcli connection up ens1923. OpenClaw核心组件部署3.1 依赖环境安装OpenClaw基于Python 3.8开发需要提前部署以下基础组件dnf install -y python39 python39-devel git gcc make openssl-devel bzip2-devel libffi-devel zlib-devel配置Python虚拟环境是必须的这能避免系统Python环境被污染python3.9 -m venv /opt/openclaw source /opt/openclaw/bin/activate pip install --upgrade pip setuptools wheel3.2 数据库部署选择OpenClaw支持多种数据库后端根据业务规模有不同的选择建议业务规模推荐数据库配置示例适用场景测试/开发SQLite默认配置单机快速验证中小规模PostgreSQL 132C4G 50GB存储100节点管理大规模MySQL 8.0集群4C8GSSD存储500节点管理这里以PostgreSQL 14为例dnf install -y postgresql14-server postgresql14-contrib /usr/pgsql-14/bin/postgresql-14-setup initdb systemctl enable --now postgresql-14 sudo -u postgres psql EOF CREATE USER openclaw WITH PASSWORD StrongPass123!; CREATE DATABASE openclaw_db OWNER openclaw; ALTER USER openclaw WITH SUPERUSER; EOF3.3 OpenClaw本体安装从官方Git仓库获取最新稳定版代码cd /opt git clone https://github.com/openclaw/openclaw.git --branch v2.3.0 cd openclaw安装Python依赖时需要特别注意几个易出错的包pip install -r requirements.txt --no-cache-dir # 特别处理可能失败的依赖 export PYCURL_SSL_LIBRARYopenssl pip install pycurl --compile --no-cache-dir pip install psycopg2-binary cryptography配置文件生成与修改关键参数cp config_example.py config.py vim config.py必须修改的核心配置项SECRET_KEY 生成32位随机字符串 # 可用openssl rand -hex 32生成 DATABASE_URI postgresql://openclaw:StrongPass123!localhost/openclaw_db CELERY_BROKER_URL redis://localhost:6379/0 ALLOWED_HOSTS [your_server_ip]4. 服务化部署与优化4.1 Systemd服务配置将OpenClaw核心组件注册为系统服务能确保异常自动恢复。创建三个关键服务单元OpenClaw Web服务cat /etc/systemd/system/openclaw-web.service EOF [Unit] DescriptionOpenClaw Web Service Afternetwork.target postgresql-14.service redis.service [Service] Userroot Grouproot WorkingDirectory/opt/openclaw EnvironmentPATH/opt/openclaw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin ExecStart/opt/openclaw/bin/gunicorn -w 4 -b 0.0.0.0:8000 wsgi:app Restartalways RestartSec5 [Install] WantedBymulti-user.target EOFCelery Worker服务cat /etc/systemd/system/openclaw-worker.service EOF [Unit] DescriptionOpenClaw Celery Worker Afternetwork.target postgresql-14.service redis.service [Service] Userroot Grouproot WorkingDirectory/opt/openclaw EnvironmentPATH/opt/openclaw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin ExecStart/opt/openclaw/bin/celery -A app.celery worker -l info -P gevent -c 10 Restartalways RestartSec5 [Install] WantedBymulti-user.target EOFCelery Beat服务定时任务cat /etc/systemd/system/openclaw-beat.service EOF [Unit] DescriptionOpenClaw Celery Beat Afternetwork.target postgresql-14.service redis.service [Service] Userroot Grouproot WorkingDirectory/opt/openclaw EnvironmentPATH/opt/openclaw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin ExecStart/opt/openclaw/bin/celery -A app.celery beat -l info --scheduler django_celery_beat.schedulers:DatabaseScheduler Restartalways RestartSec5 [Install] WantedBymulti-user.target EOF启动并验证服务状态systemctl daemon-reload systemctl enable --now openclaw-web openclaw-worker openclaw-beat systemctl status openclaw-*4.2 Nginx反向代理配置虽然OpenClaw自带WSGI服务器但生产环境建议用Nginx做前端代理dnf install -y nginx cat /etc/nginx/conf.d/openclaw.conf EOF upstream openclaw { server 127.0.0.1:8000; keepalive 32; } server { listen 80; server_name your_domain.com; client_max_body_size 100M; location / { proxy_pass http://openclaw; proxy_http_version 1.1; proxy_set_header Upgrade \$http_upgrade; proxy_set_header Connection upgrade; proxy_set_header Host \$host; proxy_set_header X-Real-IP \$remote_addr; proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; } location /static/ { alias /opt/openclaw/static/; expires 30d; } } EOF执行静态文件收集并重启Nginxcd /opt/openclaw python manage.py collectstatic --noinput nginx -t systemctl restart nginx5. 安全加固与性能调优5.1 基础安全措施配置SSH加固sed -i s/#Port 22/Port 59222/g /etc/ssh/sshd_config sed -i s/#PermitRootLogin yes/PermitRootLogin no/g /etc/ssh/sshd_config echo AllowUsers deployadmin /etc/ssh/sshd_config systemctl restart sshd防火墙规则设置如果重新启用systemctl enable --now firewalld firewall-cmd --permanent --add-port59222/tcp firewall-cmd --permanent --add-servicehttp firewall-cmd --permanent --add-servicehttps firewall-cmd --reload数据库访问限制echo host all all 127.0.0.1/32 scram-sha-256 /var/lib/pgsql/14/data/pg_hba.conf systemctl restart postgresql-145.2 OpenClaw性能调优根据服务器配置调整关键参数Gunicorn worker配置优化# 计算公式workers (2 x $num_cores) 1 CPU_CORES$(grep -c ^processor /proc/cpuinfo) WORKERS$(( 2 * CPU_CORES 1 )) sed -i s/-w 4/-w $WORKERS/g /etc/systemd/system/openclaw-web.serviceCelery并发数调整# 建议值CPU核心数 x 2 1 CELERY_CONCURRENCY$(( CPU_CORES * 2 1 )) sed -i s/-c 10/-c $CELERY_CONCURRENCY/g /etc/systemd/system/openclaw-worker.servicePostgreSQL性能优化sed -i s/#shared_buffers 128MB/shared_buffers 2GB/g /var/lib/pgsql/14/data/postgresql.conf sed -i s/#effective_cache_size 4GB/effective_cache_size 6GB/g /var/lib/pgsql/14/data/postgresql.conf sed -i s/#work_mem 4MB/work_mem 32MB/g /var/lib/pgsql/14/data/postgresql.conf systemctl restart postgresql-146. 日常维护与故障排查6.1 关键日志文件位置掌握以下日志路径能快速定位问题组件日志路径关键信息Web服务/var/log/messagesHTTP 500错误堆栈Celery Workerjournalctl -u openclaw-worker任务执行失败详情PostgreSQL/var/lib/pgsql/14/data/pg_log/慢查询和连接错误Redis/var/log/redis/redis.log内存使用情况和超时6.2 常见问题解决方案数据库连接池耗尽# 临时解决方案 sudo -u postgres psql -c SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname openclaw_db AND pid pg_backend_pid(); # 永久修复修改config.py增加连接池配置 SQLALCHEMY_POOL_SIZE 20 SQLALCHEMY_MAX_OVERFLOW 10Celery任务堆积# 查看积压任务数 redis-cli LLEN celery # 临时增加worker systemctl stop openclaw-worker sed -i s/-c 10/-c 20/g /etc/systemd/system/openclaw-worker.service systemctl start openclaw-worker静态文件404错误# 重新收集静态文件 cd /opt/openclaw python manage.py collectstatic --noinput --clear # 检查Nginx权限 chown -R nginx:nginx /opt/openclaw/static6.3 备份策略实施建议的每日备份方案# 数据库备份 sudo -u postgres pg_dump -Fc openclaw_db /backup/openclaw_db_$(date %Y%m%d).dump # 代码和配置文件备份 tar czvf /backup/openclaw_config_$(date %Y%m%d).tar.gz /opt/openclaw/config.py /etc/systemd/system/openclaw-*.service # 添加到crontab (crontab -l 2/dev/null; echo 0 2 * * * /usr/pgsql-14/bin/pg_dump -U postgres -Fc openclaw_db /backup/openclaw_db_$(date \%Y\%m\%d).dump) | crontab -7. 扩展功能集成7.1 飞书/微信接入配置OpenClaw支持通过Webhook接入主流IM平台。以飞书为例的配置步骤在飞书开放平台创建自定义机器人获取webhook地址格式https://open.feishu.cn/open-apis/bot/v2/hook/xxx在OpenClaw管理后台进入系统设置 → 通知管理添加飞书渠道填写webhook地址测试连接并保存关键安全配置# config.py中增加 FEISHU_WEBHOOK_KEY your_verification_token FEISHU_MSG_ENCRYPT_KEY your_encrypt_key # 如果启用加密7.2 Prometheus监控集成暴露OpenClaw的监控指标端点安装Prometheus客户端pip install prometheus-client在OpenClaw应用中创建metrics.pyfrom prometheus_client import start_http_server, Counter, Gauge TASKS_EXECUTED Counter(openclaw_tasks_total, Total executed tasks) TASKS_FAILED Counter(openclaw_tasks_failed, Failed tasks count) WORKER_QUEUE_SIZE Gauge(openclaw_queue_size, Current task queue size) def start_metrics_server(): start_http_server(9000)在任务执行逻辑中添加指标记录from .metrics import TASKS_EXECUTED, TASKS_FAILED try: execute_task() TASKS_EXECUTED.inc() except Exception: TASKS_FAILED.inc() raisePrometheus服务器配置示例scrape_configs: - job_name: openclaw static_configs: - targets: [openclaw-server:9000]8. 升级与迁移方案8.1 版本升级流程安全升级OpenClaw的标准操作# 1. 停止服务 systemctl stop openclaw-web openclaw-worker openclaw-beat # 2. 备份当前版本 cd /opt mv openclaw openclaw_backup_$(date %Y%m%d) # 3. 获取新版本 git clone https://github.com/openclaw/openclaw.git --branch v2.4.0 cp openclaw_backup_*/config.py openclaw/ cp openclaw_backup_*/.env openclaw/ # 4. 更新依赖 cd openclaw source /opt/openclaw/bin/activate pip install -r requirements.txt --upgrade # 5. 执行数据库迁移 python manage.py db upgrade # 6. 重启服务 systemctl start openclaw-web openclaw-worker openclaw-beat8.2 服务器迁移指南将OpenClaw迁移到新服务器的关键步骤源服务器操作# 导出数据库 pg_dump -U postgres -Fc openclaw_db openclaw_migration.dump # 打包应用目录 tar czvf openclaw_app.tar.gz /opt/openclaw # 备份Redis数据如果有定时任务 redis-cli SAVE cp /var/lib/redis/dump.rdb .目标服务器操作# 恢复数据库 pg_restore -U postgres -d openclaw_db -c openclaw_migration.dump # 解压应用 tar xzvf openclaw_app.tar.gz -C / # 恢复Redis systemctl stop redis cp dump.rdb /var/lib/redis/ chown redis:redis /var/lib/redis/dump.rdb systemctl start redis # 重建Python虚拟环境 python3.9 -m venv /opt/openclaw source /opt/openclaw/bin/activate pip install -r /opt/openclaw/requirements.txt验证服务curl http://localhost:8000/healthcheck celery -A app.celery inspect ping
