Running OpenClaw on Android with Termux: SSH, Tailscale & Mobile AI

Install Termux & Core Packages

After installing Termux from F-Droid, install the required runtime packages:

pkg update && pkg upgrade
pkg install nodejs git curl jq python openssh

Install OpenClaw globally via npm:

npm install -g openclaw

Grant Termux access to your phone's shared storage:

termux-setup-storage

Install Termux:API for Device Integration

Install the Termux:API app from F-Droid, then add the companion package inside Termux:

pkg install termux-api

In Android Settings, grant Termux:API the permissions it needs for your intended use case. Test it's working:

termux-battery-status
# Returns JSON: level, status, temperature, plugged

Configure OpenClaw

Initialize your config and set the critical security parameter first: bind the gateway to loopback only.

openclaw config init

Key config settings:

• Gateway bind: loopback (never a public interface)
• Telegram bot token — your messaging interface to the agent
• Anthropic API key — store in a password manager, inject via env
• Allowed sender IDs — your Telegram user ID only

Store all secrets in a password manager, not in config files:

# gopass — GPG-encrypted, git-backed secret storage
gopass insert [service]/[credential-name]
# Reference in config: ${SECRET_NAME}

Set Up Tailscale

Install Tailscale from the Play Store, sign in, and enable it. Your phone gets a stable private IP on your mesh network — reachable from your laptop and any other enrolled device, completely invisible to the internet.

Once Tailscale is running, you can update your gateway bind from loopback to tailnet to make the agent accessible from your other trusted devices.

Verify from your laptop:

# From laptop, via Tailscale mesh
curl http://[phone-tailscale-ip]:[gateway-port]/health

Reverse SSH Tunnel (Recommended)

If you need external services (webhooks, automation tools) to reach your phone gateway, set up a reverse SSH tunnel. The phone initiates the connection outbound — no inbound ports needed on the phone side.

# Phone tunnels a port on laptop back to its own gateway
ssh -R [laptop-port]:localhost:[gateway-port] your-laptop-tailscale-ip

For persistence — SSH connections drop; autossh reconnects automatically:

pkg install autossh
autossh -M 0 -R [laptop-port]:localhost:[gateway-port] your-laptop

Now laptop:[laptop-port] → your phone's agent gateway. Webhooks, n8n, and other services on the laptop can reach your agent without the phone ever having a public port.

Auto-Start on Reboot with Termux:Boot

Install the Termux:Boot app from F-Droid. Any scripts in ~/.termux/boot/ run automatically when the phone reboots. Create your startup script:

mkdir -p ~/.termux/boot
cat > ~/.termux/boot/start.sh << 'EOF'
#!/data/data/com.termux/files/usr/bin/bash
# Prevent Android from killing Termux
termux-wake-lock
# Start Tailscale
# (Tailscale Android app handles its own startup)
# Start SSH tunnel to laptop
autossh -M 0 -f -N \
  -R [laptop-port]:localhost:[gateway-port] \
  your-laptop
# Start OpenClaw
openclaw start
EOF
chmod +x ~/.termux/boot/start.sh

The key line is termux-wake-lock — without it, Android will eventually kill Termux to save battery.