# Nothing here is sensitive. The two values that are — the database password and
# the credential encryption key — arrive through n8n-secrets.
apiVersion: v1
kind: ConfigMap
metadata:
  name: n8n-config
  namespace: n8n
data:
  GENERIC_TIMEZONE: Europe/Paris
  TZ: Europe/Paris
  NODE_ENV: production

  # What n8n believes it is reachable at. It goes into the webhook URLs it
  # generates and into the links it puts in its own UI, so it must be the
  # ingress host and not the Service — a webhook advertised as `n8n` inside the
  # cluster is a webhook nothing outside can call.
  N8N_HOST: n8n.sttlab.local
  N8N_PORT: "5678"
  N8N_PROTOCOL: https
  WEBHOOK_URL: https://n8n.sttlab.local/
  N8N_EDITOR_BASE_URL: https://n8n.sttlab.local/

  # TLS terminates at the ingress, so n8n itself serves plain HTTP and must be
  # told it is behind a proxy — otherwise it reads the hop's address instead of
  # the caller's.
  N8N_PROXY_HOPS: "1"

  # The default is to keep every execution for ever, which turns the database
  # into a log. Two weeks is long enough to debug a failed run.
  EXECUTIONS_DATA_PRUNE: "true"
  EXECUTIONS_DATA_MAX_AGE: "336"

  N8N_DIAGNOSTICS_ENABLED: "false"
  N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
  N8N_RUNNERS_ENABLED: "true"

  # Lets a workflow read `$env.<NAME>`. n8n blocks this by default, which is the
  # right default for an instance where anyone can write a workflow — here it is
  # how an agent's client secret reaches the workflow that acts as that agent,
  # without the secret being stored in the workflow JSON and committed.
  #
  # It does mean any workflow can read any variable in the pod. That is
  # acceptable while the instance runs this estate's own agents and nothing
  # else; it stops being acceptable the moment it is shared.
  N8N_BLOCK_ENV_ACCESS_IN_NODE: "false"