5.8 KiB
summary, read_when
| summary | read_when | |||
|---|---|---|---|---|
| Automated, hardened Moltbot installation with Ansible, Tailscale VPN, and firewall isolation |
|
Ansible Installation
The recommended way to deploy Moltbot to production servers is via moltbot-ansible — an automated installer with security-first architecture.
Quick Start
One-command install:
curl -fsSL https://raw.githubusercontent.com/moltbot/moltbot-ansible/main/install.sh | bash
📦 Full guide: github.com/moltbot/moltbot-ansible
The moltbot-ansible repo is the source of truth for Ansible deployment. This page is a quick overview.
What You Get
- 🔒 Firewall-first security: UFW + Docker isolation (only SSH + Tailscale accessible)
- 🔐 Tailscale VPN: Secure remote access without exposing services publicly
- 🐳 Docker: Isolated sandbox containers, localhost-only bindings
- 🛡️ Defense in depth: 4-layer security architecture
- 🚀 One-command setup: Complete deployment in minutes
- 🔧 Systemd integration: Auto-start on boot with hardening
Requirements
- OS: Debian 11+ or Ubuntu 20.04+
- Access: Root or sudo privileges
- Network: Internet connection for package installation
- Ansible: 2.14+ (installed automatically by quick-start script)
What Gets Installed
The Ansible playbook installs and configures:
- Tailscale (mesh VPN for secure remote access)
- UFW firewall (SSH + Tailscale ports only)
- Docker CE + Compose V2 (for agent sandboxes)
- Node.js 22.x + pnpm (runtime dependencies)
- Moltbot (host-based, not containerized)
- Systemd service (auto-start with security hardening)
Note: The gateway runs directly on the host (not in Docker), but agent sandboxes use Docker for isolation. See Sandboxing for details.
Post-Install Setup
After installation completes, switch to the moltbot user:
sudo -i -u moltbot
The post-install script will guide you through:
- Onboarding wizard: Configure Moltbot settings
- Provider login: Connect WhatsApp/Telegram/Discord/Signal
- Gateway testing: Verify the installation
- Tailscale setup: Connect to your VPN mesh
Quick commands
# Check service status
sudo systemctl status moltbot
# View live logs
sudo journalctl -u moltbot -f
# Restart gateway
sudo systemctl restart moltbot
# Provider login (run as moltbot user)
sudo -i -u moltbot
moltbot channels login
Security Architecture
4-Layer Defense
- Firewall (UFW): Only SSH (22) + Tailscale (41641/udp) exposed publicly
- VPN (Tailscale): Gateway accessible only via VPN mesh
- Docker Isolation: DOCKER-USER iptables chain prevents external port exposure
- Systemd Hardening: NoNewPrivileges, PrivateTmp, unprivileged user
Verification
Test external attack surface:
nmap -p- YOUR_SERVER_IP
Should show only port 22 (SSH) open. All other services (gateway, Docker) are locked down.
Docker Availability
Docker is installed for agent sandboxes (isolated tool execution), not for running the gateway itself. The gateway binds to localhost only and is accessible via Tailscale VPN.
See Multi-Agent Sandbox & Tools for sandbox configuration.
Manual Installation
If you prefer manual control over the automation:
# 1. Install prerequisites
sudo apt update && sudo apt install -y ansible git
# 2. Clone repository
git clone https://github.com/moltbot/moltbot-ansible.git
cd moltbot-ansible
# 3. Install Ansible collections
ansible-galaxy collection install -r requirements.yml
# 4. Run playbook
./run-playbook.sh
# Or run directly (then manually execute /tmp/moltbot-setup.sh after)
# ansible-playbook playbook.yml --ask-become-pass
Updating Moltbot
The Ansible installer sets up Moltbot for manual updates. See Updating for the standard update flow.
To re-run the Ansible playbook (e.g., for configuration changes):
cd moltbot-ansible
./run-playbook.sh
Note: This is idempotent and safe to run multiple times.
Troubleshooting
Firewall blocks my connection
If you're locked out:
- Ensure you can access via Tailscale VPN first
- SSH access (port 22) is always allowed
- The gateway is only accessible via Tailscale by design
Service won't start
# Check logs
sudo journalctl -u moltbot -n 100
# Verify permissions
sudo ls -la /opt/moltbot
# Test manual start
sudo -i -u moltbot
cd ~/moltbot
pnpm start
Docker sandbox issues
# Verify Docker is running
sudo systemctl status docker
# Check sandbox image
sudo docker images | grep moltbot-sandbox
# Build sandbox image if missing
cd /opt/moltbot/moltbot
sudo -u moltbot ./scripts/sandbox-setup.sh
Provider login fails
Make sure you're running as the moltbot user:
sudo -i -u moltbot
moltbot channels login
Advanced Configuration
For detailed security architecture and troubleshooting:
Related
- moltbot-ansible — full deployment guide
- Docker — containerized gateway setup
- Sandboxing — agent sandbox configuration
- Multi-Agent Sandbox & Tools — per-agent isolation