From 0d8a2994ec733fdad2715eed004b43d3cdfb682a Mon Sep 17 00:00:00 2001
From: Conan Scott <conanscott@gmail.com>
Date: Sun, 12 Apr 2026 11:36:57 +0000
Subject: [PATCH] Fix token patching: gateway.token, hooks.token,
 telegram.botToken all from OCP env vars; scale replicas to 1

---
 manifests/deployment.yaml | 34 ++++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/manifests/deployment.yaml b/manifests/deployment.yaml
index f48e1a5..ef4c741 100644
--- a/manifests/deployment.yaml
+++ b/manifests/deployment.yaml
@@ -30,12 +30,18 @@ spec:
                   --gateway-port 18789 --gateway-bind lan \
                   --skip-daemon --skip-channels --skip-skills --skip-health --skip-ui
               fi
-              # Patch hooks.token from OCP secret if not already set (idempotent)
-              if ! grep -q '"token":' ~/.openclaw/openclaw.json 2>/dev/null; then
-                node -e "
-                  const fs = require('fs');
-                  const d = JSON.parse(fs.readFileSync(process.env.HOME + '/.openclaw/openclaw.json', 'utf8'));
-                  d.hooks = d.hooks || {};
+              # Patch tokens from OCP secrets into openclaw.json if not already set (idempotent)
+              node -e "
+                const fs = require('fs');
+                const d = JSON.parse(fs.readFileSync(process.env.HOME + '/.openclaw/openclaw.json', 'utf8'));
+
+                // Gateway token — must be in openclaw.json for channel auth to work
+                if (!d.gateway) d.gateway = {};
+                if (!d.gateway.token) d.gateway.token = process.env.OPENCLAW_GATEWAY_TOKEN;
+
+                // Hooks token
+                if (!d.hooks) d.hooks = {};
+                if (!d.hooks.token) {
                   d.hooks.token = process.env.HOOKS_TOKEN;
                   d.hooks.enabled = true;
                   d.hooks.path = '/hooks';
@@ -57,10 +63,18 @@ spec:
                       timeoutSeconds: 60
                     });
                   }
-                  fs.writeFileSync(process.env.HOME + '/.openclaw/openclaw.json', JSON.stringify(d, null, 2));
-                  console.log('hooks.token patched from HOOKS_TOKEN env var');
-                "
-              fi
+                }
+
+                // Telegram bot token
+                d.channels = d.channels || {};
+                d.channels.telegram = d.channels.telegram || {};
+                if (!d.channels.telegram.botToken) {
+                  d.channels.telegram.botToken = process.env.TELEGRAM_BOT_TOKEN;
+                }
+
+                fs.writeFileSync(process.env.HOME + '/.openclaw/openclaw.json', JSON.stringify(d, null, 2));
+                console.log('Tokens patched from OCP env vars');
+              "
               exec node /app/openclaw.mjs gateway --port 18789 --bind lan
           ports:
             - name: gateway