OpenClaw 2026 Dual-Machine Topology:
CALMVPS Gateway, Local macOS Remote, and 18789 Tunnel Triage

Stacking every capability on one Mac feels smooth in a demo. In production you pay three hidden costs:

• Compute and permissions fused. The Gateway holds long-lived sockets, cron, and multi-channel sessions. The same box must grant screen recording and automation. On 16GB hardware, overnight batch jobs swap while TCC prompts break unattended flows.
• Uncontrolled egress. Residential ISP or office NAT is hostile to WebSocket longevity. Channels drop and get misread as model failures, so triage starts in the wrong place.
• Blurry ops boundaries. Sleep, OS updates, Spotlight, and launchd overlap. It is hard to tell whether the Gateway died or macOS suspended the process.

Remote dual-machine splits roles cleanly. A remote bare-metal Mac (for example CALMVPS Hong Kong, Singapore, or US West) runs Gateway, channels, and scheduling. The local Mac is only the Node with UI and TCC, exposing Canvas, Camera, Screen, and system.run through node host. The control plane still uses 18789, but the macOS App maintains the SSH control tunnel so operators do not maintain a pile of port-forward scripts by hand.

A short rule beats a long debate. Gateway in the cloud, Node on the desk, control plane only on 18789. Draw the topology before you argue M4 tiers or rental terms.

Not every team needs dual-machine on day one. The table below draws a line between staying on Local and switching to Remote so engineering and ops can align in one review.

If you also need a multi-region hub-and-spoke (Gateway where users cluster, workers in the next cluster), Remote dual-machine is the prerequisite. For regional placement see the OpenClaw remote Mac node selection article. This post focuses on the smallest production topology: one remote Gateway plus one local Node.

Pick the CALMVPS region closest to your users and channel webhooks (Hong Kong, Japan, Korea, Singapore, US East, US West). Bind the Gateway to loopback only and expose the control plane through SSH or Tailscale — do not publish the Web UI on a public port. Install commands follow the official installer; re-open the link after each upstream release to confirm behavior:

https://openclaw.ai/install.sh

macOS platform notes (Local/Remote modes, launchd label ai.openclaw.gateway) are documented here:

https://docs.openclaw.ai/platforms/macos

curl -fsSL https://openclaw.ai/install.sh | bash
openclaw onboard --install-daemon
openclaw gateway status
launchctl kickstart -k gui/$UID/ai.openclaw.gateway
Gateway WS default 18789; bind 127.0.0.1 on the remote host

• Node runtime. Official guidance uses Node for the Gateway process. Pin one major version on bare metal so launchd and your interactive shell do not diverge.
• State directory. Do not place OPENCLAW_STATE_DIR on an iCloud-synced path. Use ~/.openclaw and fix anything openclaw doctor flags.
• Disk headroom. Logs, cron history, and memory persistence grow without pause. Reserve at least 80GB for the OpenClaw tree on a production Gateway; choose 1TB or 2TB tiers or parallel workers when queues spike.

After installing OpenClaw.app on the local Mac and completing the TCC permission checklist, switch to Remote mode using the six steps below. Behavior follows the official macOS documentation; verify against docs after each App upgrade.

1. Confirm remote Gateway health. On the CALMVPS node run openclaw gateway status and verify 18789 answers on loopback.
2. Prepare SSH keys. The App opens the control tunnel in BatchMode. Configure key-based login for the ops account so the tunnel does not stall on a password prompt.
3. Optional Tailscale. If the team already runs a tailnet, prefer MagicDNS hostnames over raw tailnet IPs that change when machines rejoin.
4. Switch the App to Remote. Enter the remote host. The App reuses or rebuilds a tunnel shaped like ssh -N -L 18789:127.0.0.1:18789 and does not spawn a local Gateway child process.
5. Start local node host. In Remote mode the App runs node host so the remote Gateway can call Canvas, Camera, Screen, and system.run under Exec approvals policy.
6. Cross-check with debug CLI. From the local repo apps/macos run swift run openclaw-mac connect --json and discover --timeout 3000 --json to match the App discovery and handshake path and separate tunnel issues from Gateway config issues.

macOS remote access (Direct ws/wss and reporting real client IP) is covered here:

https://docs.openclaw.ai/platforms/mac/remote

ssh -N -L 18789:127.0.0.1:18789 user@your-calmvps-node
curl -fsS http://127.0.0.1:18789/healthz
Over SSH loopback the Gateway may show node IP 127.0.0.1; use Direct ws/wss for real IP

In dual-machine setups, most “cannot connect” incidents sit in the control tunnel or version alignment, not the model provider. Hard parameters and a symptom table you can quote in runbooks:

• Default Gateway WebSocket port: 18789 per official macOS remote docs. The control tunnel maps the same local and remote port; the App reuses a healthy tunnel instead of random local ports.
• LaunchAgent label: ai.openclaw.gateway (with OPENCLAW_PROFILE set, ai.openclaw.<profile>). Restart with launchctl kickstart -k gui/$UID/ai.openclaw.gateway.
• Exec approvals path: Local system.run policy lives in ~/.openclaw/exec-approvals.json, separate from remote Gateway config — back it up when you migrate nodes.

Field pattern: an iOS team placed Gateway plus Discord and Telegram channels on a CALMVPS Singapore node (monthly M4 24GB) while a local MacBook Pro served only as Node for screen.record and Xcode side scripts. Peak load added a weekly parallel worker for batch builds without touching the Gateway, so channel sessions stayed up. That split produced fewer overnight pages than a single Mac carrying everything.

Size dual-machine deployments by role, not as one oversized box for both sides:

• Remote Gateway (CALMVPS). Multi-channel plus cron: start at M4 24GB. Hub nodes or local model fallback: M4 Pro. Disk: 1TB for validation, 2TB for production retention.
• Local Node Mac. TCC and UI tools dominate; 16GB is usually enough. Bottlenecks are permissions and network, not Gateway compute.
• Parallel capacity. One-off backfills or parallel builds on daily or weekly worker nodes instead of upgrading the hub tier.
• Term mix. Lock Gateway on monthly or quarterly rental; pulse work on daily or weekly parallel nodes. Blended cost often beats one max-spec long rental.

Keeping the Gateway on a personal laptop or home NAS fails on long-socket jitter, sleep interrupts, and unaudited token reuse. Pure Linux cloud VMs lack macOS TCC and Apple tooling, so the local Node in Remote topology is not optional. For teams that need a stable 18789 control plane, multi-region bare metal, and reproducible triage, CALMVPS multi-region bare-metal Mac is the natural Gateway host: dedicated Apple Silicon, 24x7 uptime, roughly 120-second provisioning, and parallel nodes to absorb channel spikes without a hub upgrade. See the pricing page for current nodes and tiers.