apiVersion: openclaw.rocks/v1alpha1
kind: OpenClawInstance
metadata:
  name: openclaw
spec:
  # Provider API keys come from the SOPS-encrypted Secret below.
  # The gateway token is auto-generated by the operator (no mDNS pairing in k8s).
  envFrom:
    - secretRef:
        name: openclaw-api-keys
  storage:
    persistence:
      enabled: true
      size: 10Gi
      storageClass: longhorn
  networking:
    ingress:
      enabled: true
      className: traefik
      hosts:
        - host: openclaw.lan
      security:
        # Operator defaults forceHTTPS=true, which pins the Traefik router to
        # the websecure entrypoint only (404 on plain HTTP). Disabled since
        # this is a LAN-internal, token-auth-only endpoint without TLS.
        forceHTTPS: false
      annotations:
        external-dns.alpha.kubernetes.io/enabled: "true"
  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: "2"
      memory: 4Gi