# Default values for OpenClaw Gateway Helm Chart
image:
  repository: ghcr.io/openclaw/openclaw
  # Tag is "<appVersion>" or "<appVersion>-<variant>". Variants: "" (default,
  # bundles codex + diagnostics-otel), "slim", "browser" (Chromium baked in for
  # the Gateway-controlled browser).
  variant: slim
  pullPolicy: IfNotPresent

timezone: "Europe/Kyiv"

# Gateway port (WS + HTTP multiplexed: Control UI, probes, API)
httpPort: 18789

service:
  type: ClusterIP
  port: 18789
  # For LoadBalancer/NodePort: "Local" keeps the real client IP. Required when
  # gateway.trustedProxies covers the pod CIDR, otherwise SNATed direct
  # connections look like a proxy without forwarded headers and get rejected.
  externalTrafficPolicy: ""

# Secret with Gateway/provider credentials, loaded whole via envFrom. Keys
# become env vars, e.g. OPENCLAW_GATEWAY_TOKEN (required: non-loopback binds
# refuse to start without gateway auth), OPENAI_API_KEY, ... The chart never
# creates it.
existingSecret: ""

# Claude Code CLI for the claude-cli agent runtime (Claude subscription via
# `claude auth login`, no API key). The image doesn't ship it, so an init
# container installs it into the PVC once; ~/.claude (login) and the install
# live on the PVC. Log in once after first deploy:
#   kubectl exec -it deploy/<release> -- claude auth login
claudeCli:
  enabled: false
  installUrl: https://claude.ai/install.sh

# Extra plain environment variables (rendered as name/value pairs)
env: {}

# Seed config. Copied into the PVC only when missing (first boot); after that
# the PVC copy is the source of truth, so edits made through OpenClaw (Control
# UI, `openclaw config set`, doctor --fix) survive restarts. To reseed from
# here: delete ~/.openclaw/openclaw.json in the pod and restart.
config:
  gateway:
    mode: local
    # Listen on the pod IP so the Service/Ingress can reach it (upstream
    # default "loopback" only works with kubectl port-forward)
    bind: lan
    port: 18789
    auth:
      mode: token
    controlUi:
      enabled: true
  agents:
    defaults:
      workspace: ~/.openclaw/workspace

# Seeded as ~/.openclaw/workspace/AGENTS.md when missing
agentsMd: |
  # OpenClaw Assistant

  You are a helpful AI assistant running in Kubernetes.

# Upstream images run as uid/gid 1000 (user "node"); fsGroup makes the PVC writable
securityContext:
  runAsUser: 1000
  runAsGroup: 1000
  fsGroup: 1000
  runAsNonRoot: true
  seccompProfile:
    type: RuntimeDefault

containerSecurityContext:
  allowPrivilegeEscalation: false
  # Upstream manifests use a read-only root; off here because agent exec tools,
  # npm/plugin installs and Chromium write outside ~/.openclaw (only /tmp and
  # the PVC are writable when enabled).
  readOnlyRootFilesystem: false
  capabilities:
    drop:
      - ALL

resources:
  requests:
    cpu: "250m"
    memory: "512Mi"
  limits:
    cpu: "2"
    memory: "2Gi"

# In-memory /dev/shm; Chromium (browser variant) crashes on the 64Mi default
shmSize: 512Mi

# Persistent home dirs, each a subPath of one PVC mounted under /home/node:
# ~/.openclaw always (config, credentials, agent state DBs, workspace), plus
# the Claude CLI dirs when claudeCli.enabled, plus extraHomePaths.
persistence:
  enabled: true
  existingClaim: ""
  extraHomePaths: []
    # - .config/gh
  storageClass: local-path
  accessModes:
    - ReadWriteOnce
  size: 10Gi

nodeSelector: {}
tolerations: []
affinity: {}

ingresses: {}
  # https:
  #   host: openclaw.example.com
  #   annotations: {}
  #   tls:
  #     - hosts:
  #         - openclaw.example.com