# This estate's n8n: the template from infra-n8n, with our values.
#
# Everything specific lives here rather than in that repo, so the same template
# deploys somebody else's n8n without carrying ours.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: n8n
  namespace: n8n
spec:
  interval: 10m
  sourceRef:
    kind: GitRepository
    name: infra-n8n
  path: ./k8s
  prune: true
  wait: true
  timeout: 5m
  postBuild:
    substitute:
      NAMESPACE: n8n
      N8N_HOSTNAME: n8n.sttlab.local
      N8N_IMAGE: docker.n8n.io/n8nio/n8n:2.37.4
      POSTGRES_IMAGE: postgres:16.10-alpine
      N8N_STORAGE: 2Gi
      POSTGRES_STORAGE: 5Gi
      TIMEZONE: Europe/Paris
      INGRESS_CLASS: nginx
      INGRESS_BODY_SIZE: "50m"
      # Every trigger endpoint is gated by this. Keycloak's userinfo answers 200
      # for a valid bearer in the realm and 401 otherwise, which is exactly the
      # auth-request contract, so nothing had to be built for it. In-cluster,
      # over http: the subrequest never leaves the cluster and needs no CA.
      #
      # It authenticates, it does not authorise: any token this realm issued
      # gets through, including an agent's own service account. The finer grain
      # belongs to the workflow, which exchanges the caller's token and is
      # refused by the domain if the caller may not read it.
      N8N_WEBHOOK_AUTH_URL: http://keycloak.keycloak.svc.cluster.local:8080/realms/classic-models/protocol/openid-connect/userinfo
      TLS_ISSUER_NAME: sttlab-local-ca
      TLS_ISSUER_KIND: ClusterIssuer
      VAULT_SERVER: https://vault.sttlab.eu
      VAULT_MOUNT: secrets
      VAULT_SECRET_PATH: n8n/instance
      VAULT_STORE_NAME: vault-n8n
      VAULT_APPROLE_SECRET: vault-approle-n8n
      # The agents' Keycloak client secrets, so a workflow can exchange tokens
      # as the agent it represents. Created by agent-secrets.yaml beside this.
      EXTRA_ENV_SECRET: n8n-agent-secrets
      EXTRA_CA_CONFIGMAP: sttlab-ca
      # "false" so a workflow can read $env.<AGENT>_CLIENT_SECRET. It means any
      # workflow on this instance can read any variable in the pod — acceptable
      # while it runs only this estate's agents, and not a moment longer.
      BLOCK_ENV_ACCESS: '"false"'
      # Quoted inside the value on purpose: these land in a ConfigMap, whose
      # values must be strings, and the template cannot force it — kustomize
      # strips quotes before substitution runs. Without the inner quotes the
      # apply fails on the type.
      EXECUTIONS_MAX_AGE_HOURS: '"336"'