feat: this estate's n8n deployment

The values that infra-n8n deliberately does not carry: our hostname, issuer, Vault path and images, plus the two things that are ours alone — the lab CA the workflows need to verify internal TLS, and the agents' Keycloak client secrets, read from the realm's own Vault entry so there is one source per secret. Self-managing after three applies, like the rest of the estate. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-29 13:10:10 +02:00
parent d9c376facf
commit f9511fd15d
7 changed files with 154 additions and 0 deletions
@@ -0,0 +1,45 @@
+# This estate's n8n: the template from infra-n8n, with our values.
+#
+# Everything specific lives here rather than in that repo, so the same template
+# deploys somebody else's n8n without carrying ours.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: n8n
+  namespace: n8n
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: infra-n8n
+  path: ./k8s
+  prune: true
+  wait: true
+  timeout: 5m
+  postBuild:
+    substitute:
+      NAMESPACE: n8n
+      N8N_HOSTNAME: n8n.sttlab.local
+      N8N_IMAGE: docker.n8n.io/n8nio/n8n:2.37.4
+      POSTGRES_IMAGE: postgres:16.10-alpine
+      N8N_STORAGE: 2Gi
+      POSTGRES_STORAGE: 5Gi
+      TIMEZONE: Europe/Paris
+      INGRESS_CLASS: nginx
+      INGRESS_BODY_SIZE: "50m"
+      TLS_ISSUER_NAME: sttlab-local-ca
+      TLS_ISSUER_KIND: ClusterIssuer
+      VAULT_SERVER: https://vault.sttlab.eu
+      VAULT_MOUNT: secrets
+      VAULT_SECRET_PATH: n8n/instance
+      VAULT_STORE_NAME: vault-n8n
+      VAULT_APPROLE_SECRET: vault-approle-n8n
+      # The agents' Keycloak client secrets, so a workflow can exchange tokens
+      # as the agent it represents. Created by agent-secrets.yaml beside this.
+      EXTRA_ENV_SECRET: n8n-agent-secrets
+      EXTRA_CA_CONFIGMAP: sttlab-ca
+      # "false" so a workflow can read $env.<AGENT>_CLIENT_SECRET. It means any
+      # workflow on this instance can read any variable in the pod — acceptable
+      # while it runs only this estate's agents, and not a moment longer.
+      BLOCK_ENV_ACCESS: "false"
+      EXECUTIONS_MAX_AGE_HOURS: "336"