# Webhook endpoints, authenticated.
#
# n8n serves a workflow's trigger endpoints on the same host as the editor, and
# they carry **no authentication of their own** — a workflow behind one answers
# anybody who can reach the host. That is not a detail: for an automation
# platform, those endpoints are the platform. Anything a workflow can read or
# change is reachable by an unauthenticated request unless something in front
# says otherwise.
#
# So this Ingress puts every trigger path behind an authentication subrequest.
# `${N8N_WEBHOOK_AUTH_URL}` must answer 2xx for an authorised request and
# 401/403 otherwise; an OIDC provider's userinfo endpoint has exactly that
# behaviour and needs nothing built. nginx forwards the caller's own headers to
# it, so a bearer on the original request is what gets checked.
#
# The editor keeps its own path (`/`) on the main Ingress and its own session
# login. Callers inside the cluster reach the Service directly and never pass
# through here — which is how an A2A facade in front of a workflow keeps working
# while the outside door is closed.
#
# Every trigger prefix n8n can serve is listed. One left out is the whole hole
# again, and the list is configurable per deployment
# (N8N_ENDPOINT_WEBHOOK and friends) — if you rename one, rename it here too.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: n8n-webhooks
  namespace: ${NAMESPACE}
  annotations:
    nginx.ingress.kubernetes.io/auth-url: ${N8N_WEBHOOK_AUTH_URL}
    nginx.ingress.kubernetes.io/proxy-body-size: ${INGRESS_BODY_SIZE}
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-buffering: "off"
    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
spec:
  ingressClassName: ${INGRESS_CLASS}
  tls:
    - hosts:
        - ${N8N_HOSTNAME}
      secretName: n8n-tls
  rules:
    - host: ${N8N_HOSTNAME}
      http:
        paths:
          - path: /webhook
            pathType: Prefix
            backend: &n8n
              service:
                name: n8n
                port:
                  number: 80
          - path: /webhook-test
            pathType: Prefix
            backend: *n8n
          - path: /webhook-waiting
            pathType: Prefix
            backend: *n8n
          - path: /form
            pathType: Prefix
            backend: *n8n
          - path: /form-test
            pathType: Prefix
            backend: *n8n
          - path: /form-waiting
            pathType: Prefix
            backend: *n8n
          - path: /mcp
            pathType: Prefix
            backend: *n8n
          - path: /mcp-test
            pathType: Prefix
            backend: *n8n