AI Agent Cluster Feasibility Study: OpenClaw on PicoCluster¶

┌─────────────────────────────────────────────────────────┐
│                    ClawdBody                            │
│          (VM Management / Orchestration Layer)          │
│    - Preconfigured VM images                           │
│    - Easy instance provisioning                        │
│    - Fleet management                                  │
└─────────────────────────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────┐
│                OpenClaw / Moltbot                       │
│              (Core Agent Framework)                     │
│    - Gateway daemon                                    │
│    - Multi-agent routing (built-in)                    │
│    - Multiple gateways support (via --profile)         │
│    - Channel integrations                              │
└─────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────┐
│                        OpenClaw Gateway                         │
│                    (Single long-lived daemon)                   │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐         │
│  │   Channels   │  │    Tools     │  │    Skills    │         │
│  │  - WhatsApp  │  │  - exec      │  │  - Custom    │         │
│  │  - Telegram  │  │  - browser   │  │  - ClawdHub  │         │
│  │  - Discord   │  │  - read/write│  │  - Community │         │
│  │  - Slack     │  │  - web fetch │  │              │         │
│  │  - Signal    │  │  - apply_patch│ │              │         │
│  │  - iMessage  │  │              │  │              │         │
│  └──────────────┘  └──────────────┘  └──────────────┘         │
│                                                                 │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐         │
│  │   Agents     │  │   Sessions   │  │   Memory     │         │
│  │  - Multi-agent│ │  - Persistent│  │  - Context   │         │
│  │  - Subagents │  │  - Pruning   │  │  - Per-user  │         │
│  │  - Routing   │  │  - Compaction│  │  - Semantic  │         │
│  └──────────────┘  └──────────────┘  └──────────────┘         │
│                                                                 │
├─────────────────────────────────────────────────────────────────┤
│                        LLM Providers                            │
│  Anthropic Claude │ OpenAI GPT │ Local (Ollama) │ OpenRouter   │
└─────────────────────────────────────────────────────────────────┘

{
  "agents": {
    "defaults": {
      "model": "claude-opus-4.5"
    },
    "list": [
      {
        "id": "dev-agent",
        "name": "Developer Assistant",
        "channels": ["discord"],
        "skills": ["coding", "git", "docker"]
      },
      {
        "id": "print-agent",
        "name": "Print Farm Manager",
        "channels": ["telegram"],
        "skills": ["octoprint", "klipper", "scheduling"]
      },
      {
        "id": "support-agent",
        "name": "Customer Support",
        "channels": ["whatsapp", "webchat"],
        "skills": ["faq", "ticketing", "escalation"]
      }
    ]
  }
}

{
  "agents": {
    "defaults": {
      "sandbox": {
        "mode": "non-main",
        "scope": "agent",
        "docker": {
          "image": "openclaw-sandbox:bookworm-slim",
          "memory": "1g",
          "cpus": 1,
          "network": "none"
        }
      }
    }
  }
}

~/.openclaw/
├── config.json                    # Gateway configuration
├── workspace/                     # Agent workspace
│   ├── MEMORY.md                  # Long-term curated memory
│   └── memory/
│       ├── 2026-01-30.md          # Daily memory log
│       └── 2026-01-29.md
├── agents/
│   └── <agentId>/
│       └── sessions/
│           └── *.jsonl            # Session transcripts
└── memory/
    └── <agentId>.sqlite           # Vector embeddings index

# Each Moltbot pod needs a PVC mounted at /home/node/.openclaw
volumes:
- name: data
  persistentVolumeClaim:
    claimName: moltbot-data  # Contains ALL memory, sessions, config

{
  "agents": {
    "defaults": {
      "memorySearch": {
        "provider": "gemini",
        "model": "gemini-embedding-001",
        "query": {
          "hybrid": {
            "enabled": true,
            "vectorWeight": 0.7,
            "textWeight": 0.3
          }
        }
      }
    }
  }
}

# Quick setup
./docker-setup.sh

# Or manual
docker build -t openclaw:local -f Dockerfile .
docker compose up -d openclaw-gateway

services:
  openclaw-gateway:
    image: openclaw:local
    ports:
      - '18789:18789' # Gateway API
      - '18793:18793' # Canvas host
    volumes:
      - ~/.openclaw:/home/node/.openclaw
      - ./workspace:/home/node/workspace
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - OPENCLAW_GATEWAY_TOKEN=${GATEWAY_TOKEN}
    restart: unless-stopped

# Main gateway
moltbot --profile main setup
moltbot --profile main gateway --port 18789

# Rescue/secondary gateway
moltbot --profile rescue setup
moltbot --profile rescue gateway --port 19001

{
  "model": {
    "provider": "anthropic",
    "model": "claude-opus-4.5",
    "apiKey": "${ANTHROPIC_API_KEY}"
  }
}

┌─────────────────────────────────────────────────────────────────┐
│                     k3s Cluster Topology                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│   ┌─────────────┐                                              │
│   │   Node 1    │  ← k3s Server (control plane)                │
│   │ RockPro64   │    - API Server                              │
│   │ 4GB RAM     │    - Scheduler                               │
│   │             │    - SQLite datastore                        │
│   └─────────────┘                                              │
│          │                                                      │
│          ├───────────────┬───────────────┬───────────────┐     │
│          │               │               │               │     │
│   ┌──────▼──────┐ ┌──────▼──────┐ ┌──────▼──────┐ ┌──────▼────┐│
│   │   Node 2    │ │   Node 3    │ │   Node 4    │ │  Node 5   ││
│   │   Worker    │ │   Worker    │ │   Worker    │ │  Worker   ││
│   │ RockPro64   │ │ RockPro64   │ │ RockPro64   │ │ RockPro64 ││
│   │ 4GB RAM     │ │ 4GB RAM     │ │ 4GB RAM     │ │ 4GB RAM   ││
│   └─────────────┘ └─────────────┘ └─────────────┘ └───────────┘│
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

# Environment variable
export ANTHROPIC_API_KEY="sk-ant-..."

# OpenClaw configuration
{
  "providers": {
    "anthropic": {
      "apiKey": "${ANTHROPIC_API_KEY}",
      "defaultModel": "claude-opus-4.5"
    }
  }
}

# Kubernetes deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dev-agent
spec:
  replicas: 1
  template:
    spec:
      containers:
        - name: openclaw
          image: openclaw:arm64
          env:
            - name: AGENT_ID
              value: 'dev-agent'
            - name: ANTHROPIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: anthropic
                  key: api-key
          volumeMounts:
            - name: workspace
              mountPath: /workspace
            - name: ssh-keys
              mountPath: /home/node/.ssh
              readOnly: true
      volumes:
        - name: workspace
          persistentVolumeClaim:
            claimName: dev-workspace
        - name: ssh-keys
          secret:
            secretName: github-ssh

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  Telegram    │────▶│  OpenClaw    │────▶│  Moonraker   │
│   Channel    │     │  Print Agent │     │    API       │
└──────────────┘     └──────────────┘     └──────────────┘
                            │                    │
                            │              ┌─────▼─────┐
                            │              │  Klipper  │
                            │              │  Firmware │
                            │              └───────────┘
                            ▼
                     ┌──────────────┐
                     │  OctoEverywhere │ (AI failure detection)
                     └──────────────┘

// skills/print-farm.js
export const printFarmSkill = {
  name: 'print-farm',
  description: 'Manage 3D print farm operations',
  tools: [
    {
      name: 'start_print',
      description: 'Start a print job on specified printer',
      parameters: {
        printer_id: { type: 'string' },
        gcode_file: { type: 'string' },
      },
      handler: async ({ printer_id, gcode_file }) => {
        const moonraker = new MoonrakerAPI(printer_id);
        return await moonraker.startPrint(gcode_file);
      },
    },
    {
      name: 'check_status',
      description: 'Get current status of all printers',
      handler: async () => {
        const printers = await getAllPrinters();
        return printers.map((p) => ({
          id: p.id,
          status: p.state,
          progress: p.progress,
          eta: p.eta,
        }));
      },
    },
  ],
};

# Moonraker provides JSON-RPC and REST APIs
# WebSocket: ws://printer-ip:7125/websocket
# HTTP: http://printer-ip:7125/api

endpoints = {
    "start_print": "POST /printer/print/start",
    "cancel_print": "POST /printer/print/cancel",
    "get_status": "GET /printer/objects/query",
    "gcode_upload": "POST /server/files/upload"
}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: marketing-agent
spec:
  template:
    spec:
      containers:
        - name: openclaw
          image: openclaw:arm64
          env:
            - name: AGENT_ID
              value: 'marketing-agent'
            # Social media API keys
            - name: TWITTER_API_KEY
              valueFrom:
                secretKeyRef:
                  name: social-apis
                  key: twitter
            - name: INSTAGRAM_ACCESS_TOKEN
              valueFrom:
                secretKeyRef:
                  name: social-apis
                  key: instagram

{
  "cron": [
    {
      "schedule": "0 9 * * *",
      "action": "morning_content_review",
      "message": "Review scheduled posts for today and suggest improvements"
    },
    {
      "schedule": "0 18 * * 5",
      "action": "weekly_analytics",
      "message": "Generate weekly social media performance report"
    }
  ]
}

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│   WhatsApp   │────▶│   OpenClaw   │────▶│   Shopify    │
│   Business   │     │Support Agent │     │     API      │
└──────────────┘     └──────────────┘     └──────────────┘
                            │
                            ├───────────────────────────┐
                            │                           │
                     ┌──────▼──────┐           ┌────────▼───────┐
                     │   Zendesk   │           │  Escalation    │
                     │   Tickets   │           │  (Human Team)  │
                     └─────────────┘           └────────────────┘

{
  "webhooks": [
    {
      "path": "/shopify/orders",
      "action": "process_order_update",
      "verify": "shopify_hmac"
    },
    {
      "path": "/zendesk/tickets",
      "action": "process_ticket_update"
    }
  ]
}

# On your workstation - download Armbian Minimal (recommended for k3s)
# Ubuntu 24.04 Noble Minimal - smallest footprint, optimized for containers
wget https://dl.armbian.com/rockpro64/Noble_current_minimal

# Alternative: Debian 12 Bookworm Minimal
# wget https://dl.armbian.com/rockpro64/Bookworm_current_minimal

# Verify checksum
wget https://dl.armbian.com/rockpro64/Noble_current_minimal.sha
sha256sum -c Noble_current_minimal.sha

# Flash to SD card (repeat for each of the 5 nodes)
xz -d Armbian_*_Rockpro64_noble_current_*.img.xz
sudo dd if=Armbian_*_Rockpro64_noble_current_*.img of=/dev/sdX bs=4M status=progress
sync

# Set hostname
hostnamectl set-hostname pico-node1

# Update system
apt update && apt upgrade -y

# Install prerequisites
apt install -y curl open-iscsi nfs-common

# Add swap (important for 4GB RAM nodes)
fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile none swap sw 0 0' >> /etc/fstab

# Disable kernel swap limit (k3s requirement)
# Note: k3s works with swap enabled as of v1.28+

# Install k3s as both server and agent (single node)
curl -sfL https://get.k3s.io | sh -s - server \
  --write-kubeconfig-mode 644 \
  --disable traefik \
  --flannel-backend host-gw

# Wait for k3s to be ready
kubectl wait --for=condition=Ready node/pico-node1 --timeout=120s

# Verify k3s is running
kubectl get nodes
kubectl get pods -A

# Create namespace for Moltbot
kubectl create namespace moltbot

# Create secret for Anthropic API key
kubectl create secret generic anthropic-credentials \
  --namespace moltbot \
  --from-literal=api-key="sk-ant-YOUR_API_KEY_HERE"

# Create secret for Telegram bot token
kubectl create secret generic telegram-credentials \
  --namespace moltbot \
  --from-literal=bot-token="YOUR_TELEGRAM_BOT_TOKEN"

# Generate gateway token
export GATEWAY_TOKEN=$(openssl rand -hex 32)
kubectl create secret generic gateway-credentials \
  --namespace moltbot \
  --from-literal=token="$GATEWAY_TOKEN"

# Create PersistentVolumeClaim for Moltbot data
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: moltbot-data
  namespace: moltbot
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: local-path
  resources:
    requests:
      storage: 10Gi
EOF

# Create the Moltbot deployment
cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: moltbot
  namespace: moltbot
  labels:
    app: moltbot
spec:
  replicas: 1
  selector:
    matchLabels:
      app: moltbot
  template:
    metadata:
      labels:
        app: moltbot
    spec:
      containers:
      - name: moltbot
        image: clawdbot/clawdbot:latest
        ports:
        - containerPort: 18789
          name: gateway
        - containerPort: 18793
          name: canvas
        env:
        - name: ANTHROPIC_API_KEY
          valueFrom:
            secretKeyRef:
              name: anthropic-credentials
              key: api-key
        - name: CLAWDBOT_GATEWAY_TOKEN
          valueFrom:
            secretKeyRef:
              name: gateway-credentials
              key: token
        - name: CLAWDBOT_GATEWAY_BIND
          value: "0.0.0.0"
        volumeMounts:
        - name: data
          mountPath: /home/node/.openclaw
        - name: workspace
          mountPath: /home/node/workspace
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "1500m"
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: moltbot-data
      - name: workspace
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: moltbot
  namespace: moltbot
spec:
  type: NodePort
  selector:
    app: moltbot
  ports:
  - name: gateway
    port: 18789
    targetPort: 18789
    nodePort: 30789
  - name: canvas
    port: 18793
    targetPort: 18793
    nodePort: 30793
EOF

# Wait for pod to be ready
kubectl wait --for=condition=Ready pod -l app=moltbot -n moltbot --timeout=120s

# Get pod name
POD_NAME=$(kubectl get pods -n moltbot -l app=moltbot -o jsonpath='{.items[0].metadata.name}')

# Run interactive onboarding
kubectl exec -it $POD_NAME -n moltbot -- moltbot onboard

# Or configure Telegram directly
kubectl exec -it $POD_NAME -n moltbot -- moltbot channels add --channel telegram

# Check pod status
kubectl get pods -n moltbot

# Check logs
kubectl logs -f deployment/moltbot -n moltbot

# Check health inside container
kubectl exec $POD_NAME -n moltbot -- moltbot health

# Check channel status
kubectl exec $POD_NAME -n moltbot -- moltbot channels status

# Run all checks
kubectl get nodes                                    # Node Ready
kubectl get pods -n moltbot                          # Pod Running
kubectl exec $POD_NAME -n moltbot -- moltbot status  # Gateway running
kubectl exec $POD_NAME -n moltbot -- moltbot health  # Health OK

# View logs
kubectl logs -f deployment/moltbot -n moltbot

# Shell into container
kubectl exec -it $POD_NAME -n moltbot -- /bin/bash

# Restart deployment
kubectl rollout restart deployment/moltbot -n moltbot

# Scale (for testing)
kubectl scale deployment/moltbot -n moltbot --replicas=0
kubectl scale deployment/moltbot -n moltbot --replicas=1

# Delete everything and start fresh
kubectl delete namespace moltbot

# Get pod name
POD_NAME=$(kubectl get pods -n moltbot -l app=moltbot -o jsonpath='{.items[0].metadata.name}')

# Create backup directory with timestamp
BACKUP_DIR="moltbot-backup-$(date +%Y%m%d-%H%M%S)"
mkdir -p $BACKUP_DIR

# Copy data from pod to local machine
kubectl cp moltbot/$POD_NAME:/home/node/.openclaw $BACKUP_DIR/openclaw

# Compress
tar -czvf $BACKUP_DIR.tar.gz $BACKUP_DIR

# Upload to external storage (optional)
# rclone copy $BACKUP_DIR.tar.gz remote:backups/moltbot/

apiVersion: batch/v1
kind: CronJob
metadata:
  name: moltbot-backup
  namespace: moltbot
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: alpine:latest
            command:
            - /bin/sh
            - -c
            - |
              set -e
              TIMESTAMP=$(date +%Y%m%d-%H%M%S)
              BACKUP_FILE="/backup/moltbot-$TIMESTAMP.tar.gz"

              # Create compressed backup
              cd /data
              tar -czvf $BACKUP_FILE \
                --exclude='*.sqlite' \
                .

              # Keep only last 7 backups
              ls -t /backup/moltbot-*.tar.gz | tail -n +8 | xargs -r rm

              echo "Backup completed: $BACKUP_FILE"
              ls -lh /backup/
            volumeMounts:
            - name: data
              mountPath: /data
              readOnly: true
            - name: backup
              mountPath: /backup
          restartPolicy: OnFailure
          volumes:
          - name: data
            persistentVolumeClaim:
              claimName: moltbot-data
          - name: backup
            persistentVolumeClaim:
              claimName: moltbot-backup  # Separate PVC for backups
---
# PVC for storing backups
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: moltbot-backup
  namespace: moltbot
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: local-path
  resources:
    requests:
      storage: 20Gi

apiVersion: batch/v1
kind: CronJob
metadata:
  name: moltbot-backup-s3
  namespace: moltbot
spec:
  schedule: "0 3 * * *"  # Daily at 3 AM
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: rclone/rclone:latest
            command:
            - /bin/sh
            - -c
            - |
              TIMESTAMP=$(date +%Y%m%d-%H%M%S)

              # Sync to S3-compatible storage (Backblaze B2, MinIO, etc.)
              rclone sync /data remote:moltbot-backups/$TIMESTAMP \
                --exclude "*.sqlite" \
                --transfers 4 \
                --fast-list

              # Prune old backups (keep 30 days)
              rclone delete remote:moltbot-backups \
                --min-age 30d

              echo "Backup synced to remote:moltbot-backups/$TIMESTAMP"
            env:
            - name: RCLONE_CONFIG_REMOTE_TYPE
              value: "s3"
            - name: RCLONE_CONFIG_REMOTE_PROVIDER
              value: "Backblaze"  # or Minio, AWS, etc.
            - name: RCLONE_CONFIG_REMOTE_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
                  name: backup-credentials
                  key: access-key
            - name: RCLONE_CONFIG_REMOTE_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
                  name: backup-credentials
                  key: secret-key
            - name: RCLONE_CONFIG_REMOTE_ENDPOINT
              value: "s3.us-west-000.backblazeb2.com"
            volumeMounts:
            - name: data
              mountPath: /data
              readOnly: true
          restartPolicy: OnFailure
          volumes:
          - name: data
            persistentVolumeClaim:
              claimName: moltbot-data

# Install Velero CLI
curl -LO https://github.com/vmware-tanzu/velero/releases/download/v1.13.0/velero-v1.13.0-linux-arm64.tar.gz
tar -xvf velero-v1.13.0-linux-arm64.tar.gz
sudo mv velero-v1.13.0-linux-arm64/velero /usr/local/bin/

# Install Velero in cluster (with local-path-provisioner support)
velero install \
  --provider aws \
  --plugins velero/velero-plugin-for-aws:v1.9.0 \
  --bucket moltbot-backups \
  --secret-file ./credentials-velero \
  --backup-location-config region=us-east-1,s3ForcePathStyle=true,s3Url=http://minio:9000 \
  --use-node-agent \
  --default-volumes-to-fs-backup

# Create backup of moltbot namespace
velero backup create moltbot-backup-$(date +%Y%m%d) \
  --include-namespaces moltbot \
  --default-volumes-to-fs-backup

# Schedule daily backups
velero schedule create moltbot-daily \
  --schedule="0 2 * * *" \
  --include-namespaces moltbot \
  --default-volumes-to-fs-backup \
  --ttl 720h  # Keep for 30 days

# Scale down to avoid conflicts
kubectl scale deployment/moltbot -n moltbot --replicas=0

# Get a temporary pod for restore
kubectl run restore-pod --image=alpine -n moltbot \
  --overrides='{"spec":{"containers":[{"name":"restore","image":"alpine","command":["sleep","3600"],"volumeMounts":[{"name":"data","mountPath":"/data"}]}],"volumes":[{"name":"data","persistentVolumeClaim":{"claimName":"moltbot-data"}}]}}'

# Wait for pod
kubectl wait --for=condition=Ready pod/restore-pod -n moltbot

# Copy backup into PVC
kubectl cp moltbot-backup-20260130/openclaw moltbot/restore-pod:/data/

# Cleanup and restart
kubectl delete pod restore-pod -n moltbot
kubectl scale deployment/moltbot -n moltbot --replicas=1

# List available backups
velero backup get

# Restore entire namespace
velero restore create --from-backup moltbot-backup-20260130

# Or restore just the PVC
velero restore create --from-backup moltbot-backup-20260130 \
  --include-resources persistentvolumeclaims,persistentvolumes

# Test restore to temporary namespace
kubectl create namespace moltbot-test

# Restore backup to test namespace
velero restore create test-restore \
  --from-backup moltbot-backup-20260130 \
  --namespace-mappings moltbot:moltbot-test

# Verify data integrity
kubectl exec -it deployment/moltbot -n moltbot-test -- moltbot health
kubectl exec -it deployment/moltbot -n moltbot-test -- ls -la /home/node/.openclaw/

# Cleanup test
kubectl delete namespace moltbot-test

┌─────────────────────────────────────────────────────────────────────────┐
│                        PicoCluster k3s                                  │
├─────────────────────────────────────────────────────────────────────────┤
│                                                                         │
│  ┌─────────────┐                                                       │
│  │ pico-node1  │  k3s Server (control plane)                          │
│  │   (4GB)     │  - API Server, Scheduler, CoreDNS                    │
│  └─────────────┘  - Prometheus + Grafana                              │
│         │                                                              │
│         ├──────────────┬──────────────┬──────────────┐                │
│         │              │              │              │                │
│  ┌──────▼─────┐ ┌──────▼─────┐ ┌──────▼─────┐ ┌──────▼─────┐         │
│  │pico-node2  │ │pico-node3  │ │pico-node4  │ │pico-node5  │         │
│  │   (4GB)    │ │   (4GB)    │ │   (4GB)    │ │   (4GB)    │         │
│  │            │ │            │ │            │ │            │         │
│  │  ┌──────┐  │ │  ┌──────┐  │ │  ┌──────┐  │ │  ┌──────┐  │         │
│  │  │ Ross │  │ │  │Rachel│  │ │  │Chandler│ │ │  │ Joey │  │         │
│  │  │ Dev  │  │ │  │Print │  │ │  │Market│  │ │  │Support│  │         │
│  │  └──────┘  │ │  └──────┘  │ │  └──────┘  │ │  └──────┘  │         │
│  │     │      │ │     │      │ │     │      │ │     │      │         │
│  │  ┌──▼───┐  │ │  ┌──▼───┐  │ │  ┌──▼───┐  │ │  ┌──▼───┐  │         │
│  │  │ PVC  │  │ │  │ PVC  │  │ │  │ PVC  │  │ │  │ PVC  │  │         │
│  │  │ ross │  │ │  │rachel│  │ │  │chandler│ │ │  │ joey │  │         │
│  │  └──────┘  │ │  └──────┘  │ │  └──────┘  │ │  └──────┘  │         │
│  └────────────┘ └────────────┘ └────────────┘ └────────────┘         │
│                                                                         │
└─────────────────────────────────────────────────────────────────────────┘

# Label nodes for scheduling (run on pico-node1)
kubectl label node pico-node2 agent=ross
kubectl label node pico-node3 agent=rachel
kubectl label node pico-node4 agent=chandler
kubectl label node pico-node5 agent=joey

# Verify labels
kubectl get nodes --show-labels

# Namespace
apiVersion: v1
kind: Namespace
metadata:
  name: moltbot
---
# Shared Secrets
apiVersion: v1
kind: Secret
metadata:
  name: anthropic-credentials
  namespace: moltbot
type: Opaque
stringData:
  api-key: "sk-ant-YOUR_ANTHROPIC_API_KEY"
---
apiVersion: v1
kind: Secret
metadata:
  name: gateway-tokens
  namespace: moltbot
type: Opaque
stringData:
  ross: "GENERATE_RANDOM_TOKEN_1"
  rachel: "GENERATE_RANDOM_TOKEN_2"
  chandler: "GENERATE_RANDOM_TOKEN_3"
  joey: "GENERATE_RANDOM_TOKEN_4"
---
apiVersion: v1
kind: Secret
metadata:
  name: channel-credentials
  namespace: moltbot
type: Opaque
stringData:
  discord-token: "YOUR_DISCORD_BOT_TOKEN"
  telegram-token: "YOUR_TELEGRAM_BOT_TOKEN"
  slack-token: "YOUR_SLACK_BOT_TOKEN"
  whatsapp-token: "YOUR_WHATSAPP_TOKEN"

---
# ============================================
# ROSS - Development Agent (Node 2)
# ============================================
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ross-data
  namespace: moltbot
  labels:
    agent: ross
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: local-path
  resources:
    requests:
      storage: 20Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ross
  namespace: moltbot
  labels:
    agent: ross
spec:
  replicas: 1
  selector:
    matchLabels:
      agent: ross
  template:
    metadata:
      labels:
        agent: ross
    spec:
      nodeSelector:
        agent: ross
      containers:
      - name: moltbot
        image: clawdbot/clawdbot:latest
        ports:
        - containerPort: 18789
          name: gateway
        - containerPort: 18793
          name: canvas
        env:
        - name: AGENT_NAME
          value: "Ross"
        - name: AGENT_ROLE
          value: "Development & Code Assistant"
        - name: ANTHROPIC_API_KEY
          valueFrom:
            secretKeyRef:
              name: anthropic-credentials
              key: api-key
        - name: CLAWDBOT_GATEWAY_TOKEN
          valueFrom:
            secretKeyRef:
              name: gateway-tokens
              key: ross
        - name: CLAWDBOT_GATEWAY_BIND
          value: "0.0.0.0"
        - name: DISCORD_TOKEN
          valueFrom:
            secretKeyRef:
              name: channel-credentials
              key: discord-token
        volumeMounts:
        - name: data
          mountPath: /home/node/.openclaw
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "1500m"
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: ross-data
---
apiVersion: v1
kind: Service
metadata:
  name: ross
  namespace: moltbot
  labels:
    agent: ross
spec:
  type: NodePort
  selector:
    agent: ross
  ports:
  - name: gateway
    port: 18789
    targetPort: 18789
    nodePort: 30001
  - name: canvas
    port: 18793
    targetPort: 18793
    nodePort: 30002

---
# ============================================
# RACHEL - 3D Print Farm Agent (Node 3)
# ============================================
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: rachel-data
  namespace: moltbot
  labels:
    agent: rachel
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: local-path
  resources:
    requests:
      storage: 20Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: rachel
  namespace: moltbot
  labels:
    agent: rachel
spec:
  replicas: 1
  selector:
    matchLabels:
      agent: rachel
  template:
    metadata:
      labels:
        agent: rachel
    spec:
      nodeSelector:
        agent: rachel
      containers:
      - name: moltbot
        image: clawdbot/clawdbot:latest
        ports:
        - containerPort: 18789
          name: gateway
        - containerPort: 18793
          name: canvas
        env:
        - name: AGENT_NAME
          value: "Rachel"
        - name: AGENT_ROLE
          value: "3D Print Farm Manager"
        - name: ANTHROPIC_API_KEY
          valueFrom:
            secretKeyRef:
              name: anthropic-credentials
              key: api-key
        - name: CLAWDBOT_GATEWAY_TOKEN
          valueFrom:
            secretKeyRef:
              name: gateway-tokens
              key: rachel
        - name: CLAWDBOT_GATEWAY_BIND
          value: "0.0.0.0"
        - name: TELEGRAM_TOKEN
          valueFrom:
            secretKeyRef:
              name: channel-credentials
              key: telegram-token
        volumeMounts:
        - name: data
          mountPath: /home/node/.openclaw
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "1500m"
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: rachel-data
---
apiVersion: v1
kind: Service
metadata:
  name: rachel
  namespace: moltbot
  labels:
    agent: rachel
spec:
  type: NodePort
  selector:
    agent: rachel
  ports:
  - name: gateway
    port: 18789
    targetPort: 18789
    nodePort: 30011
  - name: canvas
    port: 18793
    targetPort: 18793
    nodePort: 30012

---
# ============================================
# CHANDLER - Marketing Agent (Node 4)
# ============================================
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: chandler-data
  namespace: moltbot
  labels:
    agent: chandler
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: local-path
  resources:
    requests:
      storage: 20Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: chandler
  namespace: moltbot
  labels:
    agent: chandler
spec:
  replicas: 1
  selector:
    matchLabels:
      agent: chandler
  template:
    metadata:
      labels:
        agent: chandler
    spec:
      nodeSelector:
        agent: chandler
      containers:
      - name: moltbot
        image: clawdbot/clawdbot:latest
        ports:
        - containerPort: 18789
          name: gateway
        - containerPort: 18793
          name: canvas
        env:
        - name: AGENT_NAME
          value: "Chandler"
        - name: AGENT_ROLE
          value: "Marketing & Social Media Manager"
        - name: ANTHROPIC_API_KEY
          valueFrom:
            secretKeyRef:
              name: anthropic-credentials
              key: api-key
        - name: CLAWDBOT_GATEWAY_TOKEN
          valueFrom:
            secretKeyRef:
              name: gateway-tokens
              key: chandler
        - name: CLAWDBOT_GATEWAY_BIND
          value: "0.0.0.0"
        - name: SLACK_TOKEN
          valueFrom:
            secretKeyRef:
              name: channel-credentials
              key: slack-token
        volumeMounts:
        - name: data
          mountPath: /home/node/.openclaw
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "1500m"
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: chandler-data
---
apiVersion: v1
kind: Service
metadata:
  name: chandler
  namespace: moltbot
  labels:
    agent: chandler
spec:
  type: NodePort
  selector:
    agent: chandler
  ports:
  - name: gateway
    port: 18789
    targetPort: 18789
    nodePort: 30021
  - name: canvas
    port: 18793
    targetPort: 18793
    nodePort: 30022

---
# ============================================
# JOEY - Customer Support Agent (Node 5)
# ============================================
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: joey-data
  namespace: moltbot
  labels:
    agent: joey
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: local-path
  resources:
    requests:
      storage: 20Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: joey
  namespace: moltbot
  labels:
    agent: joey
spec:
  replicas: 1
  selector:
    matchLabels:
      agent: joey
  template:
    metadata:
      labels:
        agent: joey
    spec:
      nodeSelector:
        agent: joey
      containers:
      - name: moltbot
        image: clawdbot/clawdbot:latest
        ports:
        - containerPort: 18789
          name: gateway
        - containerPort: 18793
          name: canvas
        env:
        - name: AGENT_NAME
          value: "Joey"
        - name: AGENT_ROLE
          value: "Customer Support Specialist"
        - name: ANTHROPIC_API_KEY
          valueFrom:
            secretKeyRef:
              name: anthropic-credentials
              key: api-key
        - name: CLAWDBOT_GATEWAY_TOKEN
          valueFrom:
            secretKeyRef:
              name: gateway-tokens
              key: joey
        - name: CLAWDBOT_GATEWAY_BIND
          value: "0.0.0.0"
        - name: WHATSAPP_TOKEN
          valueFrom:
            secretKeyRef:
              name: channel-credentials
              key: whatsapp-token
        volumeMounts:
        - name: data
          mountPath: /home/node/.openclaw
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "2Gi"
            cpu: "1500m"
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: joey-data
---
apiVersion: v1
kind: Service
metadata:
  name: joey
  namespace: moltbot
  labels:
    agent: joey
spec:
  type: NodePort
  selector:
    agent: joey
  ports:
  - name: gateway
    port: 18789
    targetPort: 18789
    nodePort: 30031
  - name: canvas
    port: 18793
    targetPort: 18793
    nodePort: 30032

# Generate random gateway tokens
export ROSS_TOKEN=$(openssl rand -hex 32)
export RACHEL_TOKEN=$(openssl rand -hex 32)
export CHANDLER_TOKEN=$(openssl rand -hex 32)
export JOEY_TOKEN=$(openssl rand -hex 32)

# Update secrets in the manifest with actual tokens
sed -i "s/GENERATE_RANDOM_TOKEN_1/$ROSS_TOKEN/" moltbot-agents.yaml
sed -i "s/GENERATE_RANDOM_TOKEN_2/$RACHEL_TOKEN/" moltbot-agents.yaml
sed -i "s/GENERATE_RANDOM_TOKEN_3/$CHANDLER_TOKEN/" moltbot-agents.yaml
sed -i "s/GENERATE_RANDOM_TOKEN_4/$JOEY_TOKEN/" moltbot-agents.yaml

# Apply the manifest
kubectl apply -f moltbot-agents.yaml

# Wait for all agents to be ready
kubectl wait --for=condition=Ready pod -l agent=ross -n moltbot --timeout=120s
kubectl wait --for=condition=Ready pod -l agent=rachel -n moltbot --timeout=120s
kubectl wait --for=condition=Ready pod -l agent=chandler -n moltbot --timeout=120s
kubectl wait --for=condition=Ready pod -l agent=joey -n moltbot --timeout=120s

# Verify all running
kubectl get pods -n moltbot -o wide

# Onboard Ross (Development)
kubectl exec -it deployment/ross -n moltbot -- moltbot onboard

# Onboard Rachel (Print Farm)
kubectl exec -it deployment/rachel -n moltbot -- moltbot onboard

# Onboard Chandler (Marketing)
kubectl exec -it deployment/chandler -n moltbot -- moltbot onboard

# Onboard Joey (Support)
kubectl exec -it deployment/joey -n moltbot -- moltbot onboard

#!/bin/bash
# Usage: ./backup-agent.sh <agent-name>
# Example: ./backup-agent.sh ross

set -e

AGENT=${1:-""}
NAMESPACE="moltbot"
BACKUP_DIR="./backups"
TIMESTAMP=$(date +%Y%m%d-%H%M%S)

if [ -z "$AGENT" ]; then
    echo "Usage: $0 <agent-name>"
    echo "Available agents: ross, rachel, chandler, joey"
    exit 1
fi

# Validate agent name
if [[ ! "$AGENT" =~ ^(ross|rachel|chandler|joey)$ ]]; then
    echo "Error: Unknown agent '$AGENT'"
    echo "Available agents: ross, rachel, chandler, joey"
    exit 1
fi

echo "=== Backing up $AGENT ==="

# Create backup directory
mkdir -p "$BACKUP_DIR/$AGENT"

# Get pod name
POD_NAME=$(kubectl get pods -n $NAMESPACE -l agent=$AGENT -o jsonpath='{.items[0].metadata.name}')

if [ -z "$POD_NAME" ]; then
    echo "Error: No pod found for agent $AGENT"
    exit 1
fi

echo "Found pod: $POD_NAME"

# Create backup
BACKUP_FILE="$BACKUP_DIR/$AGENT/$AGENT-$TIMESTAMP.tar.gz"

echo "Creating backup..."
kubectl exec $POD_NAME -n $NAMESPACE -- tar -czvf /tmp/backup.tar.gz \
    --exclude='*.sqlite' \
    -C /home/node/.openclaw .

echo "Downloading backup..."
kubectl cp $NAMESPACE/$POD_NAME:/tmp/backup.tar.gz "$BACKUP_FILE"

# Cleanup temp file in pod
kubectl exec $POD_NAME -n $NAMESPACE -- rm /tmp/backup.tar.gz

# Show backup info
echo ""
echo "=== Backup Complete ==="
echo "Agent: $AGENT"
echo "File: $BACKUP_FILE"
echo "Size: $(du -h "$BACKUP_FILE" | cut -f1)"

# Keep only last 7 backups per agent
echo ""
echo "Cleaning old backups (keeping last 7)..."
ls -t "$BACKUP_DIR/$AGENT"/*.tar.gz 2>/dev/null | tail -n +8 | xargs -r rm -v

echo "Done!"

#!/bin/bash
# Usage: ./restore-agent.sh <agent-name> <backup-file>
# Example: ./restore-agent.sh ross ./backups/ross/ross-20260130-120000.tar.gz

set -e

AGENT=${1:-""}
BACKUP_FILE=${2:-""}
NAMESPACE="moltbot"

if [ -z "$AGENT" ] || [ -z "$BACKUP_FILE" ]; then
    echo "Usage: $0 <agent-name> <backup-file>"
    echo "Example: $0 ross ./backups/ross/ross-20260130-120000.tar.gz"
    exit 1
fi

# Validate agent name
if [[ ! "$AGENT" =~ ^(ross|rachel|chandler|joey)$ ]]; then
    echo "Error: Unknown agent '$AGENT'"
    echo "Available agents: ross, rachel, chandler, joey"
    exit 1
fi

# Check backup file exists
if [ ! -f "$BACKUP_FILE" ]; then
    echo "Error: Backup file not found: $BACKUP_FILE"
    exit 1
fi

echo "=== Restoring $AGENT from $BACKUP_FILE ==="
echo ""
echo "WARNING: This will overwrite all data for $AGENT!"
read -p "Are you sure? (yes/no): " CONFIRM

if [ "$CONFIRM" != "yes" ]; then
    echo "Aborted."
    exit 0
fi

# Scale down the agent
echo "Scaling down $AGENT..."
kubectl scale deployment/$AGENT -n $NAMESPACE --replicas=0
kubectl wait --for=delete pod -l agent=$AGENT -n $NAMESPACE --timeout=60s || true

# Create restore pod
echo "Creating restore pod..."
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: restore-$AGENT
  namespace: $NAMESPACE
spec:
  containers:
  - name: restore
    image: alpine:latest
    command: ["sleep", "3600"]
    volumeMounts:
    - name: data
      mountPath: /data
  volumes:
  - name: data
    persistentVolumeClaim:
      claimName: $AGENT-data
  restartPolicy: Never
EOF

# Wait for restore pod
kubectl wait --for=condition=Ready pod/restore-$AGENT -n $NAMESPACE --timeout=60s

# Clear existing data
echo "Clearing existing data..."
kubectl exec restore-$AGENT -n $NAMESPACE -- sh -c "rm -rf /data/* /data/.*" 2>/dev/null || true

# Copy backup to pod
echo "Uploading backup..."
kubectl cp "$BACKUP_FILE" $NAMESPACE/restore-$AGENT:/tmp/backup.tar.gz

# Extract backup
echo "Extracting backup..."
kubectl exec restore-$AGENT -n $NAMESPACE -- tar -xzvf /tmp/backup.tar.gz -C /data

# Cleanup restore pod
echo "Cleaning up..."
kubectl delete pod restore-$AGENT -n $NAMESPACE

# Scale back up
echo "Starting $AGENT..."
kubectl scale deployment/$AGENT -n $NAMESPACE --replicas=1
kubectl wait --for=condition=Ready pod -l agent=$AGENT -n $NAMESPACE --timeout=120s

# Verify
echo ""
echo "=== Restore Complete ==="
POD_NAME=$(kubectl get pods -n $NAMESPACE -l agent=$AGENT -o jsonpath='{.items[0].metadata.name}')
kubectl exec $POD_NAME -n $NAMESPACE -- moltbot health

echo ""
echo "$AGENT has been restored from $BACKUP_FILE"

#!/bin/bash
# Backup all agents

set -e

AGENTS=("ross" "rachel" "chandler" "joey")

echo "=== Backing up all agents ==="
echo ""

for AGENT in "${AGENTS[@]}"; do
    echo "--- $AGENT ---"
    ./backup-agent.sh $AGENT
    echo ""
done

echo "=== All backups complete ==="
ls -la ./backups/*/

# Save as backup-cronjobs.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup-ross
  namespace: moltbot
spec:
  schedule: "0 2 * * *"  # 2 AM daily
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: alpine:latest
            command: ["/bin/sh", "-c"]
            args:
            - |
              TIMESTAMP=$(date +%Y%m%d-%H%M%S)
              cd /data
              tar -czvf /backup/ross-$TIMESTAMP.tar.gz --exclude='*.sqlite' .
              ls -t /backup/ross-*.tar.gz | tail -n +8 | xargs -r rm
            volumeMounts:
            - name: data
              mountPath: /data
              readOnly: true
            - name: backup
              mountPath: /backup
          restartPolicy: OnFailure
          nodeSelector:
            agent: ross
          volumes:
          - name: data
            persistentVolumeClaim:
              claimName: ross-data
          - name: backup
            persistentVolumeClaim:
              claimName: backup-storage
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup-rachel
  namespace: moltbot
spec:
  schedule: "15 2 * * *"  # 2:15 AM daily
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: alpine:latest
            command: ["/bin/sh", "-c"]
            args:
            - |
              TIMESTAMP=$(date +%Y%m%d-%H%M%S)
              cd /data
              tar -czvf /backup/rachel-$TIMESTAMP.tar.gz --exclude='*.sqlite' .
              ls -t /backup/rachel-*.tar.gz | tail -n +8 | xargs -r rm
            volumeMounts:
            - name: data
              mountPath: /data
              readOnly: true
            - name: backup
              mountPath: /backup
          restartPolicy: OnFailure
          nodeSelector:
            agent: rachel
          volumes:
          - name: data
            persistentVolumeClaim:
              claimName: rachel-data
          - name: backup
            persistentVolumeClaim:
              claimName: backup-storage
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup-chandler
  namespace: moltbot
spec:
  schedule: "30 2 * * *"  # 2:30 AM daily
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: alpine:latest
            command: ["/bin/sh", "-c"]
            args:
            - |
              TIMESTAMP=$(date +%Y%m%d-%H%M%S)
              cd /data
              tar -czvf /backup/chandler-$TIMESTAMP.tar.gz --exclude='*.sqlite' .
              ls -t /backup/chandler-*.tar.gz | tail -n +8 | xargs -r rm
            volumeMounts:
            - name: data
              mountPath: /data
              readOnly: true
            - name: backup
              mountPath: /backup
          restartPolicy: OnFailure
          nodeSelector:
            agent: chandler
          volumes:
          - name: data
            persistentVolumeClaim:
              claimName: chandler-data
          - name: backup
            persistentVolumeClaim:
              claimName: backup-storage
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup-joey
  namespace: moltbot
spec:
  schedule: "45 2 * * *"  # 2:45 AM daily
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: alpine:latest
            command: ["/bin/sh", "-c"]
            args:
            - |
              TIMESTAMP=$(date +%Y%m%d-%H%M%S)
              cd /data
              tar -czvf /backup/joey-$TIMESTAMP.tar.gz --exclude='*.sqlite' .
              ls -t /backup/joey-*.tar.gz | tail -n +8 | xargs -r rm
            volumeMounts:
            - name: data
              mountPath: /data
              readOnly: true
            - name: backup
              mountPath: /backup
          restartPolicy: OnFailure
          nodeSelector:
            agent: joey
          volumes:
          - name: data
            persistentVolumeClaim:
              claimName: joey-data
          - name: backup
            persistentVolumeClaim:
              claimName: backup-storage
---
# Shared backup storage PVC
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: backup-storage
  namespace: moltbot
spec:
  accessModes:
    - ReadWriteMany  # Needs to be accessible from all nodes
  storageClassName: local-path
  resources:
    requests:
      storage: 50Gi

# Check all agents status
kubectl get pods -n moltbot -o wide

# Check specific agent health
kubectl exec deployment/ross -n moltbot -- moltbot health
kubectl exec deployment/rachel -n moltbot -- moltbot health
kubectl exec deployment/chandler -n moltbot -- moltbot health
kubectl exec deployment/joey -n moltbot -- moltbot health

# View logs for specific agent
kubectl logs -f deployment/ross -n moltbot
kubectl logs -f deployment/rachel -n moltbot
kubectl logs -f deployment/chandler -n moltbot
kubectl logs -f deployment/joey -n moltbot

# Shell into specific agent
kubectl exec -it deployment/ross -n moltbot -- /bin/bash

# Restart specific agent
kubectl rollout restart deployment/ross -n moltbot

# List all PVCs
kubectl get pvc -n moltbot

# List all backups (if using CronJobs)
kubectl exec deployment/ross -n moltbot -- ls -la /backup/

# Manual backup
./backup-agent.sh ross

# Restore from backup
./restore-agent.sh ross ./backups/ross/ross-20260130-120000.tar.gz

# Download Armbian Minimal for k3s cluster
# Ubuntu 24.04 Noble Minimal (~246 MB) - recommended
wget https://dl.armbian.com/rockpro64/Noble_current_minimal

# Verify integrity
wget https://dl.armbian.com/rockpro64/Noble_current_minimal.sha
sha256sum -c Noble_current_minimal.sha

# Flash to SD card (repeat for each node)
xz -d Armbian_*_Rockpro64_noble_current_*.img.xz
sudo dd if=Armbian_*_Rockpro64_noble_current_*.img of=/dev/sdX bs=4M status=progress
sync

# Install k3s server
curl -sfL https://get.k3s.io | sh -s - server \
  --write-kubeconfig-mode 644 \
  --disable traefik \  # We'll use our own ingress
  --flannel-backend=host-gw  # Better for bare metal

# Get node token for workers
cat /var/lib/rancher/k3s/server/node-token

# Install k3s agent
curl -sfL https://get.k3s.io | K3S_URL=https://node1:6443 \
  K3S_TOKEN="<node-token>" sh -s - agent

# Local registry for ARM64 images
apiVersion: apps/v1
kind: Deployment
metadata:
  name: registry
  namespace: kube-system
spec:
  template:
    spec:
      containers:
        - name: registry
          image: registry:2
          ports:
            - containerPort: 5000

# values-openclaw.yaml
image:
  repository: openclaw/openclaw
  tag: latest-arm64
  pullPolicy: IfNotPresent

agents:
  - name: dev-agent
    replicas: 1
    nodeSelector:
      kubernetes.io/hostname: node2
    resources:
      requests:
        memory: '1Gi'
        cpu: '500m'
      limits:
        memory: '2Gi'
        cpu: '1'

  - name: print-agent
    replicas: 1
    nodeSelector:
      kubernetes.io/hostname: node3
    resources:
      requests:
        memory: '1Gi'
        cpu: '500m'

  - name: marketing-agent
    replicas: 1
    nodeSelector:
      kubernetes.io/hostname: node4

  - name: support-agent
    replicas: 1
    nodeSelector:
      kubernetes.io/hostname: node5

persistence:
  enabled: true
  storageClass: local-path
  size: 20Gi

ingress:
  enabled: true
  className: traefik
  hosts:
    - host: agents.local
      paths:
        - path: /
          pathType: Prefix

secrets:
  anthropic:
    apiKey: '${ANTHROPIC_API_KEY}'

# Prometheus + Grafana for ARM64
apiVersion: v1
kind: Namespace
metadata:
  name: monitoring
---
apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: prometheus
  namespace: monitoring
spec:
  chart: kube-prometheus-stack
  repo: https://prometheus-community.github.io/helm-charts
  valuesContent: |-
    prometheus:
      prometheusSpec:
        resources:
          requests:
            memory: "400Mi"
    grafana:
      resources:
        requests:
          memory: "100Mi"

#!/bin/bash
# create-cluster-image.sh

# Start from fresh Armbian installation
apt update && apt upgrade -y

# Install prerequisites
apt install -y \
  curl \
  git \
  ca-certificates \
  gnupg \
  lsb-release \
  open-iscsi \
  nfs-common

# Install Docker (for building images locally)
curl -fsSL https://get.docker.com | sh
usermod -aG docker $(whoami)

# Disable swap (required for k3s)
swapoff -a
sed -i '/swap/d' /etc/fstab

# Configure kernel parameters
cat >> /etc/sysctl.conf << EOF
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF

# First-boot configuration script
cat > /etc/rc.local << 'EOF'
#!/bin/bash
HOSTNAME=$(cat /etc/machine-id | head -c 8)
hostnamectl set-hostname "pico-${HOSTNAME}"

# Check for server vs worker config
if [ -f /boot/k3s-server ]; then
  curl -sfL https://get.k3s.io | sh -s - server \
    --write-kubeconfig-mode 644 \
    --flannel-backend=host-gw
elif [ -f /boot/k3s-worker ]; then
  K3S_URL=$(cat /boot/k3s-url)
  K3S_TOKEN=$(cat /boot/k3s-token)
  curl -sfL https://get.k3s.io | K3S_URL=$K3S_URL K3S_TOKEN=$K3S_TOKEN sh -s - agent
fi

# Remove rc.local after first boot
rm /etc/rc.local
EOF
chmod +x /etc/rc.local

# Create on SD card boot partition
touch /boot/k3s-server

# After Node 1 is running, copy token
touch /boot/k3s-worker
echo "https://192.168.1.100:6443" > /boot/k3s-url
ssh root@node1 'cat /var/lib/rancher/k3s/server/node-token' > /boot/k3s-token

# /boot/user-data (Node 1 - Server)
#cloud-config
hostname: pico-server
manage_etc_hosts: true

users:
  - name: admin
    sudo: ALL=(ALL) NOPASSWD:ALL
    groups: docker
    ssh_authorized_keys:
      - ssh-rsa AAAA... your-public-key

runcmd:
  - curl -sfL https://get.k3s.io | sh -s - server --write-kubeconfig-mode 644
  - kubectl create namespace openclaw

{
  "gateway": {
    "bind": "0.0.0.0",
    "port": 18789,
    "token": "${GATEWAY_TOKEN}"
  },
  "model": {
    "provider": "anthropic",
    "model": "claude-opus-4.5",
    "apiKey": "${ANTHROPIC_API_KEY}"
  },
  "agents": {
    "defaults": {
      "sandbox": {
        "mode": "non-main",
        "scope": "agent",
        "docker": {
          "image": "openclaw-sandbox:bookworm-slim",
          "memory": "1g",
          "cpus": 1,
          "network": "none"
        }
      }
    },
    "list": []
  },
  "channels": {
    "telegram": {
      "enabled": true,
      "token": "${TELEGRAM_BOT_TOKEN}"
    },
    "discord": {
      "enabled": true,
      "token": "${DISCORD_BOT_TOKEN}"
    },
    "whatsapp": {
      "enabled": true
    }
  },
  "memory": {
    "enabled": true,
    "compaction": {
      "enabled": true,
      "threshold": 100000
    }
  },
  "cron": [],
  "webhooks": []
}