feat: deploy n8n on the cluster

The runtime for the estate's autonomous agents. Postgres as a StatefulSet with
its own claim, n8n behind a cert-manager certificate and the nginx ingress, and
both secrets in Vault behind an AppRole scoped to n8n/* alone.

The certificate is issued into the cluster rather than copied into the repo, so
the private key never reaches git. The CA certificate is committed and mounted
as NODE_EXTRA_CA_CERTS, so a workflow can reach keycloak and the domain
gateways without anyone disabling verification to make it work.

One replica and strategy: Recreate, both deliberate — n8n needs Redis and queue
mode before a second scheduler is safe, and a ReadWriteOnce volume deadlocks a
rolling update.

N8N_ENCRYPTION_KEY is generated once and kept in Vault. Regenerating it does not
re-encrypt the stored credentials, it orphans them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/n8n/configmap.yaml

@@ -0,0 +1,35 @@
+# Nothing here is sensitive. The two values that are — the database password and
+# the credential encryption key — arrive through n8n-secrets.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: n8n-config
+  namespace: n8n
+data:
+  GENERIC_TIMEZONE: Europe/Paris
+  TZ: Europe/Paris
+  NODE_ENV: production
+
+  # What n8n believes it is reachable at. It goes into the webhook URLs it
+  # generates and into the links it puts in its own UI, so it must be the
+  # ingress host and not the Service — a webhook advertised as `n8n` inside the
+  # cluster is a webhook nothing outside can call.
+  N8N_HOST: n8n.sttlab.local
+  N8N_PORT: "5678"
+  N8N_PROTOCOL: https
+  WEBHOOK_URL: https://n8n.sttlab.local/
+  N8N_EDITOR_BASE_URL: https://n8n.sttlab.local/
+
+  # TLS terminates at the ingress, so n8n itself serves plain HTTP and must be
+  # told it is behind a proxy — otherwise it reads the hop's address instead of
+  # the caller's.
+  N8N_PROXY_HOPS: "1"
+
+  # The default is to keep every execution for ever, which turns the database
+  # into a log. Two weeks is long enough to debug a failed run.
+  EXECUTIONS_DATA_PRUNE: "true"
+  EXECUTIONS_DATA_MAX_AGE: "336"
+
+  N8N_DIAGNOSTICS_ENABLED: "false"
+  N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
+  N8N_RUNNERS_ENABLED: "true"

k8s/n8n/deployment.yaml

@@ -0,0 +1,110 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: n8n
+  namespace: n8n
+spec:
+  # One replica. n8n's queue mode splits the editor from workers and needs Redis
+  # to do it; without that, a second replica is two schedulers racing over the
+  # same cron triggers. See the README before scaling this.
+  replicas: 1
+  strategy:
+    # The volume is ReadWriteOnce, so a rolling update deadlocks: the new pod
+    # waits for a volume the old pod has not released.
+    type: Recreate
+  selector:
+    matchLabels:
+      app: n8n
+  template:
+    metadata:
+      labels:
+        app: n8n
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      initContainers:
+        - name: wait-for-postgres
+          image: postgres:16.10-alpine
+          command:
+            - sh
+            - -c
+            - |
+              until pg_isready -h n8n-postgres -U n8n -d n8n; do
+                echo "waiting for postgres..."; sleep 3
+              done
+      containers:
+        - name: n8n
+          image: docker.n8n.io/n8nio/n8n:1.128.2
+          ports:
+            - name: http
+              containerPort: 5678
+          env:
+            - name: DB_TYPE
+              value: postgresdb
+            - name: DB_POSTGRESDB_HOST
+              value: n8n-postgres
+            - name: DB_POSTGRESDB_PORT
+              value: "5432"
+            - name: DB_POSTGRESDB_DATABASE
+              value: n8n
+            - name: DB_POSTGRESDB_USER
+              value: n8n
+            - name: DB_POSTGRESDB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: n8n-secrets
+                  key: DB_PASSWORD
+            # Encrypts stored credentials. Held in Vault, never regenerated —
+            # a new key does not re-encrypt, it orphans everything already
+            # stored.
+            - name: N8N_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: n8n-secrets
+                  key: N8N_ENCRYPTION_KEY
+            # The lab CA, so a workflow can call keycloak.sttlab.local and the
+            # domain gateways without disabling verification. n8n is Node, hence
+            # this variable rather than a trust store.
+            - name: NODE_EXTRA_CA_CERTS
+              value: /etc/sttlab-ca/ca.crt
+          envFrom:
+            - configMapRef:
+                name: n8n-config
+          volumeMounts:
+            - name: data
+              mountPath: /home/node/.n8n
+            - name: sttlab-ca
+              mountPath: /etc/sttlab-ca
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: n8n-data
+        - name: sttlab-ca
+          configMap:
+            name: sttlab-ca

k8s/n8n/pvc.yaml

@@ -0,0 +1,13 @@
+# n8n keeps its own state here — including the SQLite of an unconfigured
+# install, which is not used since the database is Postgres, but also binary
+# data and anything a node writes. Small, and it must survive a restart.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-data
+  namespace: n8n
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 2Gi

k8s/n8n/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: n8n
+  namespace: n8n
+spec:
+  selector:
+    app: n8n
+  ports:
+    - name: http
+      port: 80
+      targetPort: http