Who this helps: teams self-hosting an OpenClaw gateway on a remote Mac who want Telegram or Slack for CI and cron alerts. You get: install baseline, bind versus reverse-proxy rules, token hygiene, webhook checks, and FAQ for silent channels. See also gateway security, LaunchAgent health, and help—no login.
  • Mismatch pain: the process listens on 127.0.0.1 while Telegram or Slack still points at an old tunnel URL.
  • Secret pain: bot tokens land in world-readable shell history or CI logs instead of a dedicated service user file.
  • Validation pain: unsigned webhook traffic is accepted, so a replayed POST can spam a channel after a leak.

① Pre-flight checks: versions, ports, localhost bind versus reverse proxy

Start from the 2026 OpenClaw install path most teams report: official installer or npm global package on Node 22+, then openclaw onboard and openclaw doctor to surface missing CLIs and permission errors before you touch IM channels.

Run these on the Mac that will own the gateway:

node -v
which openclaw
openclaw doctor
lsof -nP -iTCP -sTCP:LISTEN | grep -E 'node|openclaw'

Bind the gateway to 127.0.0.1 and terminate TLS on nginx or Caddy on the same host when possible. If you expose a port, firewall to your VPN CIDR and keep bearer auth on. Align CI callback hostnames with what runners resolve—mixed internal and public URLs commonly yield 502 while localhost curls still pass.

Matrix. Localhost + reverse proxy: strong audit and mTLS. Wide bind: simpler, larger blast radius. Managed panel: faster OAuth, less control of raw webhook paths and Mac logs.

② Telegram bot, token storage, and least-privilege checklist

Create the bot with BotFather and store the token in a 600 file owned by the service user, for example ~svc/.config/openclaw/telegram.env, loaded via launchd EnvironmentVariables—not shared runbooks or shell history.

Minimum practical checklist:

ls -l ~/.config/openclaw/telegram.env   # expect -rw------- svcuser
grep -n BOT_TOKEN ~/.zsh_history || echo "ok: not in shell history"

setWebhook needs a public HTTPS URL and Telegram’s secret_token so your gateway rejects posts without the header. Drop unnecessary group-add permissions for a CI-only bot.

③ Slack: Incoming Webhook versus Slack App (security, audit, rate limits)

Approach Security & audit Ops trade-off
Incoming Webhook URL Single long-lived URL secret; compromise posts to one channel; limited audit granularity Fastest to test; rotate URL when leaked; watch per-workspace posting limits
Slack App + signing secret Verify X-Slack-Signature with timestamp skew tolerance; better replay resistance when implemented correctly More moving parts; needs event subscription hygiene and token scopes reviewed quarterly
Enterprise proxy pattern Central WAF or API gateway logs every POST Higher latency; requires SRE ownership of allowlists for Slack egress IPs

Many teams start with a webhook for alerts, then move to an App for slash commands. Store Slack secrets in the same 600 pattern as Telegram.

④ Reproducible path: from CLI to the first test message

1
Install and verify. Finish Node 22+, install OpenClaw, run openclaw doctor, fix every warning about file permissions or missing tools.
2
Start gateway locally. Bind to 127.0.0.1, note the port from your config, and curl the health route from the same host before you add channels.
3
Wire the reverse proxy. Map https://alerts.example.com/openclaw/... to that port with valid certificates; reload and test with curl -I through the public name.
4
Register the provider. Telegram: webhook URL plus secret_token. Slack: webhook URL or App endpoint plus signing secret per your OpenClaw channel config.
5
Send a synthetic event. Trigger the built-in ping or post a dummy CI JSON payload; confirm the log line shows signature verification success before you rely on real pipelines.

Heavy pulls on the same host? See OpenClaw pre-pull consistency and Git/Docker pull acceleration.

⑤ FAQ: silent channels, replay protection, token rotation, CI callbacks

Silent channel. Check DNS, TLS expiry, and public reachability for Telegram. On Slack verify the webhook and channel state. curl -v https://your-host/health from outside versus inside the VPC.

Replay protection. Use Telegram’s secret header and Slack signatures; add idempotency keys where CI retries POSTs.

Rotation. Mint a new token or secret, update the env file, restart launchd, revoke the old credential same day.

CI callbacks. Pin YAML URLs to hostnames all runners resolve; avoid RFC1918 literals unless DNS split-horizon is deliberate.

Summary

Ship Node 22+, run openclaw doctor, and lock localhost-first binds before Telegram or Slack. Keep tokens in 600 files and verify every webhook cryptographically.

For Apple Silicon with stable egress, use the homepage, pricing, and purchase flows to match CI plus gateway load. More OpenClaw and Git topics live on the blog—no login.

Add mirror CI tuning and help while you harden webhooks.

Remote Mac for OpenClaw & CI alerts

Dedicated Mac Mini nodes for gateways, Git/npm acceleration, and stable outbound IM delivery. Browse pricing, purchase, and help without signing in.

View Pricing Purchase Help Blog