# OpenClaw + PAI Kubernetes Deployment
#
# Sensitive values should be stored in a Secret and referenced via secretKeyRef.
# Non-sensitive values can be set directly in the env block below.
#
# Quick start:
#   kubectl apply -f deployment.yaml
#
# To create the secrets manually:
#   kubectl create secret generic openclaw-pai-secrets \
#     --from-literal=OPENCLAW_GATEWAY_TOKEN=your-token \
#     --from-literal=ANTHROPIC_API_KEY=your-key \
#     --from-literal=GEMINI_API_KEY=your-key \
#     --from-literal=OPENCLAW_TLS_CERT=$(base64 -w0 cert.pem) \
#     --from-literal=OPENCLAW_TLS_KEY=$(base64 -w0 key.pem)

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openclaw-pai-vol
  # namespace: your-namespace
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
  # storageClassName: your-storage-class

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: openclaw-pai
  # namespace: your-namespace
  labels:
    app: openclaw-pai
spec:
  replicas: 1
  selector:
    matchLabels:
      app: openclaw-pai
  # OpenClaw maintains stateful session and gateway data on the PVC.
  # Do not scale replicas above 1 without a shared storage solution.
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: openclaw-pai
    spec:
      containers:
        - name: openclaw-pai
          image: registry.nerdrage.cloud/spaceacemonkey/openclaw-pai:0.0.4
          imagePullPolicy: Always

          ports:
            - name: gateway
              containerPort: 18800
              protocol: TCP

          volumeMounts:
            - name: vol
              mountPath: /home/agent/vol

          readinessProbe:
            exec:
              command: ["test", "!", "-f", "/home/agent/vol/.openclaw-initializing"]
            initialDelaySeconds: 5
            periodSeconds: 5
            failureThreshold: 60

          env:

            # ── Required ────────────────────────────────────────────

            # Gateway auth token — what users type to log in to the web UI
            - name: OPENCLAW_GATEWAY_TOKEN
              valueFrom:
                secretKeyRef:
                  name: openclaw-pai-secrets
                  key: OPENCLAW_GATEWAY_TOKEN

            # Primary model for OpenClaw agent
            - name: OPENCLAW_DEFAULT_MODEL
              value: "litellm/claude-sonnet-4-6"

            # Display name for the OpenClaw agent (also seeded into IDENTITY.md on first deploy)
            - name: OPENCLAW_AGENT_NAME
              value: "Seift"

            # API key for Claude Code / PAI / LiteLLM
            - name: ANTHROPIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: openclaw-pai-secrets
                  key: ANTHROPIC_API_KEY

            # Primary model for PAI / Claude Code
            - name: ANTHROPIC_MODEL
              value: "claude-sonnet-4-6"

            # Lightweight model for PAI
            - name: ANTHROPIC_SMALL_FAST_MODEL
              value: "claude-haiku-4"

            # Display name for the PAI agent identity
            - name: PAI_AGENT_NAME
              value: "Seift"

            # ── OpenClaw — TLS ──────────────────────────────────────

            # TLS mode: off | auto | custom
            - name: OPENCLAW_TLS
              value: "off"

            # Required when OPENCLAW_TLS=custom — base64-encoded cert PEM
            # - name: OPENCLAW_TLS_CERT
            #   valueFrom:
            #     secretKeyRef:
            #       name: openclaw-pai-secrets
            #       key: OPENCLAW_TLS_CERT

            # Required when OPENCLAW_TLS=custom — base64-encoded key PEM
            # - name: OPENCLAW_TLS_KEY
            #   valueFrom:
            #     secretKeyRef:
            #       name: openclaw-pai-secrets
            #       key: OPENCLAW_TLS_KEY

            # ── OpenClaw — config ───────────────────────────────────

            # Gateway port (also update containerPort above if changed)
            - name: OPENCLAW_GATEWAY_PORT
              value: "18800"

            # Comma-separated extra allowed origins for the web UI
            # e.g. https://openclaw.example.com or https://192.168.0.94:18800
            # - name: OPENCLAW_ALLOWED_ORIGINS
            #   value: "https://openclaw.example.com"

            # Set to "true" to bypass device pairing for the web UI
            - name: OPENCLAW_DISABLE_DEVICE_AUTH
              value: "false"

            # Gateway bind mode: lan (default) | loopback
            - name: OPENCLAW_GATEWAY_BIND
              value: "lan"

            # Override the agent workspace path (defaults to $OPENCLAW_STATE_DIR/workspace)
            # - name: OPENCLAW_WORKSPACE
            #   value: "/home/agent/vol/.openclaw/workspace"

            # ── OpenClaw — LiteLLM ──────────────────────────────────

            # If set, adds a LiteLLM provider block pointing at this URL
            - name: LITELLM_BASE_URL
              value: "http://localhost:4000"

            # Base URL for Anthropic/LiteLLM API calls from Claude Code
            - name: ANTHROPIC_BASE_URL
              value: "http://localhost:4000"

            # ── OpenClaw — memory search ────────────────────────────

            # Memory search provider: gemini (only supported value currently)
            # Requires GEMINI_API_KEY to be set
            # - name: OPENCLAW_MEMORY_SEARCH_PROVIDER
            #   value: "gemini"

            # Gemini API key — used for memory search and passed through to OpenClaw natively
            # - name: GEMINI_API_KEY
            #   valueFrom:
            #     secretKeyRef:
            #       name: openclaw-pai-secrets
            #       key: GEMINI_API_KEY

            # ── OpenClaw — native passthrough ───────────────────────

            # OpenAI API key — passed through to OpenClaw natively if needed
            # - name: OPENAI_API_KEY
            #   valueFrom:
            #     secretKeyRef:
            #       name: openclaw-pai-secrets
            #       key: OPENAI_API_KEY

            # OpenClaw state directory — should match PVC mountPath + /.openclaw
            - name: OPENCLAW_STATE_DIR
              value: "/home/agent/vol/.openclaw"

            # ── PAI / Claude Code ───────────────────────────────────

            # PAI state directory
            - name: PAI_DIR
              value: "/home/agent/vol/.claude"

            # Must always match PAI_DIR
            - name: CLAUDE_CONFIG_DIR
              value: "/home/agent/vol/.claude"

            # PAI config directory
            - name: PAI_CONFIG_DIR
              value: "/home/agent/vol/.config/PAI"

            # Projects directory passed to PAI
            - name: PROJECTS_DIR
              value: "/home/agent/vol/repositories"

            # ── PAI — voice server ──────────────────────────────────

            # Voice server URL for PAI TTS integration
            - name: VOICE_SERVER_URL
              value: "http://localhost:8888"

            # ElevenLabs API key — enables VoiceServer integration
            # - name: ELEVENLABS_API_KEY
            #   valueFrom:
            #     secretKeyRef:
            #       name: openclaw-pai-secrets
            #       key: ELEVENLABS_API_KEY

            # ── Deployment control ──────────────────────────────────

            # Set to "true" to wipe and redeploy OpenClaw state from image on next start.
            # Remove or set to "false" after use — leaving it "true" wipes state on every restart.
            - name: FORCE_OPENCLAW_REDEPLOY
              value: "false"

            # Set to "true" to wipe and redeploy PAI state from image on next start.
            # Remove or set to "false" after use — leaving it "true" wipes state on every restart.
            - name: FORCE_PAI_REDEPLOY
              value: "false"

      volumes:
        - name: vol
          persistentVolumeClaim:
            claimName: openclaw-pai-vol

---

apiVersion: v1
kind: Service
metadata:
  name: openclaw-pai
  # namespace: your-namespace
spec:
  selector:
    app: openclaw-pai
  ports:
    - name: gateway
      port: 18800
      targetPort: gateway
      protocol: TCP
  type: ClusterIP