Running tbot on MacOS with launchd

[webvictim]

To run tbot persistently on MacOS, you'll need to use launchd.

Following these instructions will automatically run tbot when your Mac starts, no need to have a user log on.

This assumes:

• your bot's data directory is /var/lib/openclaw-tbot
• process logs will go to /var/lib/openclaw-tbot/log
  • create these two directories with sudo mkdir -p /var/lib/openclaw-tbot/log
• you already have a config file for your bot stored under /etc/tbot.yaml
  • follow the guides here to create your own config if needed
• your Mac's username is claw

1. Create a file - /Library/LaunchDaemons/com.goteleport.tbot.plist with these contents:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>com.goteleport.tbot</string>

    <!-- change this if your config path is different -->
    <key>ProgramArguments</key>
    <array>
      <string>/usr/local/bin/tbot</string>
      <string>start</string>
      <string>--config=/etc/tbot.yaml</string>
    </array>

    <!-- change this if your username is different -->
    <key>UserName</key>
    <string>claw</string>

    <key>RunAtLoad</key>
    <true/>

    <key>KeepAlive</key>
    <dict>
      <key>SuccessfulExit</key>
      <false/>
    </dict>

    <key>ThrottleInterval</key>
    <integer>30</integer>

    <!-- change these four lines below if you want to send logs elsewhere -->
    <!-- note that these directories MUST exist and the files MUST be writable or launchctl will fail -->
    <key>StandardOutPath</key>
    <string>/var/lib/openclaw-tbot/log/stdout.log</string>

    <key>StandardErrorPath</key>
    <string>/var/lib/openclaw-tbot/log/stderr.log</string>
  </dict>
</plist>

2. Start the service:

sudo launchctl bootstrap system /Library/LaunchDaemons/com.goteleport.tbot.plist

3. Check that it's running:

openclaw:~ root# launchctl list | grep tbot
291	0	com.goteleport.tbot

openclaw:~ root# ps -ef | grep -i tbot
  501 30425     1   0 11:58a.m. ??         0:00.16 /usr/local/bin/tbot start --config=/etc/tbot.yaml

4. Check that the output directory contains files:

openclaw:~ root# ls -l /Users/claw/.openclaw/workspace/tbot
total 128
-rw-------  1 claw  staff     0 30 Mar 14:58 .write-test
-rw-------  1 claw  staff  5453 30 Mar 14:58 identity
-rw-------  1 claw  staff   241 30 Mar 14:58 key
-rw-------  1 claw  staff  1222 30 Mar 14:58 key-cert.pub
-rw-------  1 claw  staff   161 30 Mar 14:58 key.pub
-rw-------  1 claw  staff   612 30 Mar 14:58 known_hosts
-rw-------  1 claw  staff  1419 30 Mar 14:58 ssh_config
-rw-------  1 claw  staff  1330 30 Mar 14:58 teleport-database-ca.crt
-rw-------  1 claw  staff  2051 30 Mar 14:58 teleport-host-ca.crt
-rw-------  1 claw  staff   794 30 Mar 14:58 teleport-user-ca.crt
-rw-------  1 claw  staff   184 30 Mar 14:58 teleport.example.com.known_hosts
-rw-------  1 claw  staff   599 30 Mar 14:58 teleport.example.com.ssh_config
-rw-------  1 claw  staff  1367 30 Mar 14:58 tlscert

If you need to stop the service again, use sudo launchctl bootout system /Library/LaunchDaemons/com.goteleport.tbot.plist

---

My bot config is also listed here for posterity.

# tbot config file generated by `configure` command
version: v2

onboarding:
  join_method: bound_keypair
  token: openclaw-bot-bound-keypair
  bound_keypair:
    registration_secret: <redacted>
  ca_pins:
    - "sha256:5c38a20ead97b0a6a46ceebbcd5ac8be8a087e6b99dace78fc60697e65acde3d"
storage:
  type: directory
  path: /var/lib/openclaw-tbot
  symlinks: try-secure
  acls: try
outputs:
- type: identity
  destination:
    type: directory
    path: /Users/claw/.openclaw/workspace/tbot
debug: false
proxy_server: teleport.example.com:443
certificate_ttl: 1h0m0s
renewal_interval: 30m0s
oneshot: false
fips: false

[zmb3]

See also https://goteleport.com/docs/ver/19.x/installation/macos/#running-teleport-services-on-macos