From 9145f137dff5703102621fb20140cdea418cd5ea Mon Sep 17 00:00:00 2001
From: stevef <stevef@omen.home>
Date: Sat, 28 Mar 2026 16:19:13 +0100
Subject: [PATCH] Hardening: Finalized K3s deployment with relative secret
 paths and agi namespace

---
 k3s/configmap.yaml  | 8 ++++----
 k3s/deployment.yaml | 2 +-
 k3s/secrets.yaml    | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/k3s/configmap.yaml b/k3s/configmap.yaml
index 4a3b759db..5fe5fff46 100644
--- a/k3s/configmap.yaml
+++ b/k3s/configmap.yaml
@@ -12,7 +12,7 @@ data:
       "version": 1,
       "agents": {
         "defaults": {
-          "workspace": "",
+          "workspace": "/home/picoclaw/.picoclaw",
           "restrict_to_workspace": true,
           "allow_read_outside_workspace": false,
           "provider": "",
@@ -46,7 +46,7 @@ data:
         },
         "telegram": {
           "enabled": true,
-          "token": "file:///etc/picoclaw/secrets/telegram-token",
+          "token": "file://secrets/telegram-token",
           "base_url": "",
           "proxy": "",
           "allow_from": [
@@ -285,13 +285,13 @@ data:
           "model_name": "nemotron-3-super-120b-a12b",
           "model": "nvidia/nemotron-3-super-120b-a12b",
           "api_base": "https://integrate.api.nvidia.com/v1",
-          "api_key": "file:///etc/picoclaw/secrets/nvidia-api-key"
+          "api_key": "file://secrets/nvidia-api-key"
         },
         {
           "model_name": "azure-grok",
           "model": "openai/grok-4-fast-non-reasoning",
           "api_base": "https://TestSJF.openai.azure.com/openai/v1/",
-          "api_key": "file:///etc/picoclaw/secrets/azure-api-key"
+          "api_key": "file://secrets/azure-api-key"
         },
         {
           "model_name": "cerebras-llama-3.3-70b",
diff --git a/k3s/deployment.yaml b/k3s/deployment.yaml
index 5af999b4c..aaa1a8ef7 100644
--- a/k3s/deployment.yaml
+++ b/k3s/deployment.yaml
@@ -47,7 +47,7 @@ spec:
         - name: picoclaw-data
           mountPath: /home/picoclaw/.picoclaw
         - name: picoclaw-secrets
-          mountPath: /etc/picoclaw/secrets
+          mountPath: /home/picoclaw/.picoclaw/secrets
           readOnly: true
       volumes:
       - name: picoclaw-data
diff --git a/k3s/secrets.yaml b/k3s/secrets.yaml
index 328926b2e..217cc0d95 100644
--- a/k3s/secrets.yaml
+++ b/k3s/secrets.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   name: picoclaw-secrets
-  namespace: default
+  namespace: agi
 type: Opaque
 stringData:
   # Base64 encoding is handled automatically by K8s when using stringData