From ab0a39187c9b143e1f3592b7045c2974dc24afc8 Mon Sep 17 00:00:00 2001
From: Junwei Zhao <wahyd4@gmail.com>
Date: Fri, 30 Jan 2026 11:52:28 +1100
Subject: [PATCH] Update moltbot

---
 home-apps/moltbot.yaml | 91 +++++++++++++++++++++++-------------------
 1 file changed, 51 insertions(+), 40 deletions(-)

diff --git a/home-apps/moltbot.yaml b/home-apps/moltbot.yaml
index ff79bfa..2af8fb9 100644
--- a/home-apps/moltbot.yaml
+++ b/home-apps/moltbot.yaml
@@ -119,36 +119,33 @@ spec:
         app: moltbot-gateway
         name: moltbot-gateway
     spec:
-      initContainers:
-        - name: build-image
-          image: mirror.gcr.io/node:25-bookworm
-          workingDir: /build
-          command: ["/bin/bash", "-c"]
-          args:
-            - |
-              set -e
-              if [ ! -f /build/dist/index.js ]; then
-                echo "Cloning moltbot repository..."
-                apt-get update && apt-get install -y git
-                git clone https://github.com/moltbot/moltbot.git /build
-                cd /build
-                npm install -g pnpm
-                npm install
-                npm run build
-              fi
-          volumeMounts:
-            - name: build-cache
-              mountPath: /build
       containers:
         - name: moltbot-gateway
           image: mirror.gcr.io/node:25-bookworm
           imagePullPolicy: IfNotPresent
-          workingDir: /app
+          workingDir: /home/node
           command: ["/bin/bash", "-c"]
           args:
             - |
-              cp -r /build/* /app/
-              node dist/index.js gateway --allow-unconfigured --bind lan --port 18789
+              set -e
+              # Install clawdbot (moltbot) globally if not already installed
+              if ! command -v clawdbot &> /dev/null; then
+                echo "Installing clawdbot..."
+                npm install -g clawdbot@latest
+              fi
+              # Create config directory and file with gateway settings
+              mkdir -p /home/node/.clawdbot
+              # Always update config to ensure trustedProxies is set for k8s ingress
+              # Using clawdbot.json (default config name) instead of moltbot.json
+              # Config includes:
+              # - trustedProxies: k8s pod network CIDRs for nginx ingress
+              # - controlUi.allowInsecureAuth: true - allows token-only auth behind reverse proxy (skips device pairing)
+              # - auth.mode: token - requires gateway token for authentication
+              echo '{"gateway":{"mode":"local","bind":"lan","port":18789,"trustedProxies":["10.42.0.0/16","10.43.0.0/16"],"controlUi":{"allowInsecureAuth":true},"auth":{"mode":"token"}},"agents":{"defaults":{"workspace":"/home/node/clawd"}}}' > /home/node/.clawdbot/clawdbot.json
+              echo "Config written:"
+              cat /home/node/.clawdbot/clawdbot.json
+              echo "Starting clawdbot gateway..."
+              exec clawdbot gateway --port 18789 --bind lan --verbose
           ports:
             - containerPort: 18789
               name: gateway
@@ -161,6 +158,10 @@ spec:
               value: "/home/node"
             - name: TERM
               value: "xterm-256color"
+            - name: PATH
+              value: "/usr/local/bin:/usr/bin:/bin"
+            - name: CLAWDBOT_GATEWAY_BIND
+              value: "0.0.0.0"
             - name: CLAWDBOT_GATEWAY_TOKEN
               valueFrom:
                 secretKeyRef:
@@ -186,28 +187,37 @@ spec:
                   optional: true
           volumeMounts:
             - name: config
-              mountPath: "/home/node/.moltbot"
+              mountPath: "/home/node/.clawdbot"
             - name: workspace
               mountPath: "/home/node/clawd"
-            - name: build-cache
-              mountPath: /build
           resources:
             requests:
-              cpu: 200m
+              cpu: 500m
               memory: 512Mi
             limits:
-              cpu: 1000m
+              cpu: 2000m
               memory: 2Gi
+          # Use exec probes that run INSIDE the container to reach localhost
           livenessProbe:
-            tcpSocket:
-              port: gateway
-            initialDelaySeconds: 30
-            periodSeconds: 10
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - "curl -sf http://127.0.0.1:18789/ || exit 1"
+            initialDelaySeconds: 180
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 3
           readinessProbe:
-            tcpSocket:
-              port: gateway
-            initialDelaySeconds: 10
-            periodSeconds: 5
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - "curl -sf http://127.0.0.1:18789/ || exit 1"
+            initialDelaySeconds: 120
+            periodSeconds: 15
+            timeoutSeconds: 10
+            failureThreshold: 6
       volumes:
       - name: config
         persistentVolumeClaim:
@@ -215,8 +225,6 @@ spec:
       - name: workspace
         persistentVolumeClaim:
           claimName: moltbot-workspace-local-pvc
-      - name: build-cache
-        emptyDir: {}
 
 ---
 
@@ -250,10 +258,13 @@ metadata:
   namespace: home-apps
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
+    # WebSocket support - required for moltbot gateway
+    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    # Enable WebSocket upgrade via standard nginx-ingress annotation
+    nginx.ingress.kubernetes.io/websocket-services: "moltbot-gateway"
+    # Note: OAuth2 removed - moltbot uses its own gateway token authentication
 spec:
   ingressClassName: nginx
   tls: