Your own HTTPS endpoint
claw-<id>.lunovpn.com, served behind Cloudflare. Certificates
are automatic, the origin IP stays hidden, and DDoS filtering is on from
the first second.
Included with every paid plan
Every VPN sells you a tunnel.
Every VPN sells you a tunnel.
Yours also hands you a server.
Your LunoVPN subscription now includes a dedicated OpenClaw cluster: an isolated container running in the city you choose, with its own HTTPS address, its own disk, and a full gigabyte of memory reserved for you alone. One per account, no card, no second subscription. Bring your own AI provider key and it’s yours in under a minute.
Free with any paid plan
No email required
Live in under a minute
989 of 1,000 clusters still unclaimed in this round.
Cost
$0
Included with your plan
Setup
<60s
Signed in to live endpoint
Regions
1city
Open right now
Memory
1GB
Plus 0.5 vCPU, reserved
Quota
1cluster
One-time claim per account
Interactive simulation
Build one right here.
Pick a region and run the pipeline. These are the same eight steps the real system runs, with representative timings — so you know exactly what you are signing up for before you sign in.
luno claw create
Live regions · simulated build01 Choose a region
02 Run it
Nothing is created and no account is touched. Playback is accelerated roughly 1.7× — the millisecond figures shown are representative of a real run.
Pipeline
- Verify subscription—
- Select node with free capacity—
- Allocate loopback port—
- Create Cloudflare DNS record—
- Pull container image—
- Start hardened container—
- Wire up reverse proxy—
- Wait for first healthy response—
Cluster live
—
—TOTAL BUILD
—EST. RTT
0.5vCPU
1GB RAM
Simulation only — no cluster is created and no account is contacted.
Real builds run from your dashboard.
Interactive simulation
Distance is the only thing you can’t optimise later.
You pick the region once and it is permanent, so it is worth picking well. Estimated round-trip times from your approximate location, calculated from great-circle distance.
Estimates assume light in fibre over a path about 1.4× the straight-line distance, plus 8 ms of switching. Real routing adds variance — treat these as a ranking, not a measurement. We could not place you, so this list is sorted alphabetically. Pick the city nearest you.
Do the arithmetic
What this would cost you anywhere else.
Set the slider to whatever a comparable box actually costs you — a small always-on instance with a static address and a domain on top. We are not going to quote a competitor’s price at you; use your own number.
Renting it yourself
$60/year
At $5/month for the instance.
- Plus a domain, or a subdomain you have to manage
- Plus TLS certificates and their renewals
- Plus the reverse proxy, the firewall, the OS updates
- Plus the evening you lose to setting it up
With LunoVPN
$0/year
Included with the subscription you already pay for. Nothing else to buy.
- Domain and subdomain handled
- TLS issued and renewed automatically
- Reverse proxy, firewall and updates are ours
- Live in under a minute, from one button
What lands in your hands
Not a trial. Not a shared account.
A container reserved for you, with an address of its own.
A genuinely locked-down container
Read-only root filesystem, every Linux capability dropped,
no-new-privileges, a 512-process ceiling, and a port bound only
to loopback. Your neighbours stay out.
Storage that survives
Restarts, host reboots, image updates — your data stays. If a cluster is ever removed, its disk sits in a trash directory for seven days before anything is deleted.
The region is yours to pick
Built in the city you choose, on the same infrastructure that runs the VPN fleet you already trust. Capacity is shown live before you commit.
Still no email required
Your 16-digit code is the whole account. No name, no email, no phone number appears anywhere in this flow — same as the day you signed up.
It looks after itself
Health checks every 30 seconds, automatic restart on failure, and a proxy config that rolls itself back rather than taking a node down.
Under the hood
Four hops, two of them ours.
Every request to your cluster takes the same path. Nothing about it is improvised, and nothing about it is hidden from you.
Certificates you never touch
Cloudflare terminates TLS at the edge; the origin leg runs on a
Cloudflare Origin CA certificate. Nothing expires on your watch.
Your port faces inward
The container publishes to
127.0.0.1 only. Even on the host
itself, nothing but the proxy can reach it.
A bad config can’t take the node down
Proxy changes are validated before they are applied, and rolled back
automatically if they fail.
Your key stays inside
The AI provider key you add lives in your container’s own config
file. It does not pass through our panel.
The alternative
Or you could do this yourself.
This is the short version of the evening you are not going to spend. It also assumes nothing goes wrong, which it will.
# 1. rent a box, wait for the provisioning email ssh [email protected] # 2. docker curl -fsSL https://get.docker.com | sh systemctl enable --now docker # 3. a domain, then a DNS record, then wait for it dig +short claw.example.com # nothing yet… # 4. reverse proxy + certificates apt install -y caddy vim /etc/caddy/Caddyfile # hope you know the syntax systemctl reload caddy Error: connection refused on :2019 # admin API is off # 5. firewall ufw default deny incoming && ufw allow 22,80,443/tcp ufw --force enable # don't lock yourself out # 6. finally, the app docker run -d --name claw --restart unless-stopped \ -p 127.0.0.1:18789:18789 --read-only --cap-drop ALL \ -v /srv/claw:/home/node ghcr.io/openclaw/openclaw ENOENT: mkdir '/home/node/.openclaw/state' # ownership chown -R 1000:1000 /srv/claw && docker restart claw Missing config. Run `openclaw setup` # of course vim /srv/claw/.openclaw/openclaw.json # … and so on
this goes on for a while
Or press one button.
Pick a city, wait about forty seconds, copy your key. We already made every one of those mistakes so the script above never runs on your evening.
Claim your cluster →The sandbox, in full
The flags we actually run.
Not a summary of our security posture — the literal arguments your container is started with. If you want to check our work, this is the list to check.
--read-only
Immutable root
Nothing can write outside your data volume and a 64 MB noexec tmpfs.
--cap-drop ALL
No capabilities
Every Linux capability removed. Nothing to escalate from.
--security-opt no-new-privileges
No setuid path
A process inside cannot gain privileges it did not start with.
--pids-limit 512
Fork bomb ceiling
A runaway process on one cluster cannot starve the node.
--cpus 0.5 --memory 1024m
Hard resource caps
Reserved for you, and equally, capped for everyone else.
-p 127.0.0.1:PORT:8080
Loopback only
Your port is unreachable from the internet. The proxy is the single door in.
Live capacity
Where you can run it today.
1 city across 1 country, right now. A location drops off this list the moment it fills up.
| City | Country | Region | Free capacity |
|---|---|---|---|
| Frankfurt | Germany (DE) | Europe | 193 |
Looking for the VPN fleet instead? That is on the servers page.
Four steps
Two minutes, most of it reading.
Sign in
Enter your 16-digit LunoVPN code. No account yet? One click creates one and asks for nothing — no email, no name, no phone.
Pick a region
Choose the city your cluster runs in. The build screen shows live free capacity per location.
Run the build
One button. We create your DNS record, start your container, wire up the reverse proxy, and wait for the first healthy response.
Take the keys
Your HTTPS endpoint and access key appear on screen. The key is shown exactly once — we only store a hash of it.
Category comparison
What a subscription usually buys.
Most providers’ “extras” are the thing you already bought, wrapped differently. Based on publicly listed plan features as of August 2026.
| Included with a paid plan | LunoVPN | Typical major provider |
|---|---|---|
| A hosted cluster of your own | ✓ Included | Not offered |
| Your own HTTPS subdomain | ✓ Included | Not offered |
| Signup without an email address | ✓ 16-digit code | Usually mandatory |
| Password manager / cloud storage | ✓ Free tools | ✓ Usually top tier only |
| Pay with Monero | ✓ Supported | Rare |
| Port forwarding | ✓ Supported | Mostly removed |
| Independently audited no-logs claim | ✓ Full report published | ✓ Often summary only |
Before you get excited
What this isn’t.
Four things we would rather you hear from us than discover on day three.
It is not a machine you control
We run the hardware and the host OS. We do not touch application data in your container, but we could, and no marketing sentence changes that. If a workload genuinely cannot tolerate that, run it on your own hardware — that advice costs us a signup and it is still the right advice.
It is not a free AI subscription
We give you the cluster, not the model. OpenClaw needs an API key from a provider like OpenAI or Anthropic, and that key is yours — you add it in your cluster’s settings, it stays there, and we never see it or bill for what it spends. The hosting is what’s free.
It is not a big machine
Half a core and 1 GB. That is a comfortable amount for what OpenClaw does and an uncomfortable amount for anything that wants to compile things or hold a large index in memory.
It is not movable
The region you pick at build time is the region it stays in. We would rather be blunt about this up front than let you discover it later.
It is not permanent if your subscription lapses
The cluster stops when the subscription does, and the data is held for 30 days. Renew inside that window and everything returns unchanged. After that it is gone.
A server count is not a feature. It is a number a competitor can beat next quarter. We would rather your subscription buy you something that is still sitting there, running, when the comparison charts have moved on.
Questions people actually ask
Straight answers.
What exactly is an OpenClaw cluster?
It is a dedicated OpenClaw instance running in a container we operate for you, in the city you pick. It has its own HTTPS address, its own persistent disk, and 0.5 vCPU with 1 GB of memory reserved for it. You do not share it with anyone.
What does it cost?
The cluster costs nothing beyond the LunoVPN subscription you already pay for. No separate plan, no usage billing from us, no card entry anywhere in the flow. What we do not cover is the AI model itself: OpenClaw needs an API key from a provider such as OpenAI or Anthropic, and that key and its bill stay yours.
Do I need my own AI provider API key?
Yes. We host the cluster; you bring the model. Open your cluster, go to Settings then Providers, and paste a key from any provider OpenClaw supports. The key lives inside your container — we never see it, and it survives restarts and rebuilds. Without a key, chat returns a 401 from the provider.
How many can I get?
One per account. The claim is tied to your 16-digit LunoVPN code and is enforced by a unique index in our database, not by a checkbox. Deleting the cluster does not return the claim.
Do I need an active subscription?
Yes. Any paid LunoVPN plan qualifies, including the shortest one. Free accounts can sign in and see the flow, but the build button stays locked until a subscription is active.
What address do I get?
A subdomain of the form claw-<id>.lunovpn.com. It is served over HTTPS through Cloudflare, so certificates are automatic, the origin IP stays hidden, and DDoS filtering is on by default.
Can I move it to another city later?
No. The cluster stays on the node it was built on. That is why the build screen asks you to pick the closest city first — the latency difference between regions is large enough to notice.
What happens when my subscription lapses?
The cluster stops and your data is held for 30 days. Renew inside that window and it returns at the same address with the same data. After 30 days the data is deleted.
Can LunoVPN read what is inside my cluster?
We do not access application data in your container. We also run the hardware, which means we technically could — we are not going to pretend otherwise. For genuinely sensitive workloads, hosting on machines you control is a stronger trust model than any promise we can make. Our transparency report and warrant canary are public.
Why give this away instead of charging for it?
Every VPN sells the same encrypted tunnel and competes on server counts. We would rather your subscription buy you something you can point at. At our scale a container costs us very little; renting the equivalent box yourself would not.
You already paid for the plan.
Sign in, pick a city, press the button. One claim per account, and it takes less time than reading this page did.