# This estate's n8n: the template from infra-n8n, with our values.
#
# Everything specific lives here rather than in that repo, so the same template
# deploys somebody else's n8n without carrying ours.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: n8n
  namespace: n8n
spec:
  interval: 10m
  sourceRef:
    kind: GitRepository
    name: infra-n8n
  path: ./k8s
  prune: true
  wait: true
  timeout: 5m
  postBuild:
    substitute:
      NAMESPACE: n8n
      N8N_HOSTNAME: n8n.sttlab.local
      N8N_IMAGE: docker.n8n.io/n8nio/n8n:2.37.4
      POSTGRES_IMAGE: postgres:16.10-alpine
      N8N_STORAGE: 2Gi
      POSTGRES_STORAGE: 5Gi
      TIMEZONE: Europe/Paris
      INGRESS_CLASS: nginx
      INGRESS_BODY_SIZE: "50m"
      TLS_ISSUER_NAME: sttlab-local-ca
      TLS_ISSUER_KIND: ClusterIssuer
      VAULT_SERVER: https://vault.sttlab.eu
      VAULT_MOUNT: secrets
      VAULT_SECRET_PATH: n8n/instance
      VAULT_STORE_NAME: vault-n8n
      VAULT_APPROLE_SECRET: vault-approle-n8n
      # The agents' Keycloak client secrets, so a workflow can exchange tokens
      # as the agent it represents. Created by agent-secrets.yaml beside this.
      EXTRA_ENV_SECRET: n8n-agent-secrets
      EXTRA_CA_CONFIGMAP: sttlab-ca
      # "false" so a workflow can read $env.<AGENT>_CLIENT_SECRET. It means any
      # workflow on this instance can read any variable in the pod — acceptable
      # while it runs only this estate's agents, and not a moment longer.
      BLOCK_ENV_ACCESS: "false"
      EXECUTIONS_MAX_AGE_HOURS: "336"