Stéphane Tailland
a658976f45
The agents' Keycloak client secrets reach the pod through the keycloak store, naming the one property each workflow needs rather than copying it into n8n's own Vault path — one source for a client secret, so rotating it in Vault rotates it everywhere. N8N_BLOCK_ENV_ACCESS_IN_NODE=false so a workflow can read them as $env, which keeps them out of the committed workflow JSON. The trade-off is written down in the ConfigMap: any workflow can then read any variable in the pod, which is acceptable while this instance runs only this estate's agents. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
46 lines
1.8 KiB
YAML
46 lines
1.8 KiB
YAML
# Nothing here is sensitive. The two values that are — the database password and
|
|
# the credential encryption key — arrive through n8n-secrets.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: n8n-config
|
|
namespace: n8n
|
|
data:
|
|
GENERIC_TIMEZONE: Europe/Paris
|
|
TZ: Europe/Paris
|
|
NODE_ENV: production
|
|
|
|
# What n8n believes it is reachable at. It goes into the webhook URLs it
|
|
# generates and into the links it puts in its own UI, so it must be the
|
|
# ingress host and not the Service — a webhook advertised as `n8n` inside the
|
|
# cluster is a webhook nothing outside can call.
|
|
N8N_HOST: n8n.sttlab.local
|
|
N8N_PORT: "5678"
|
|
N8N_PROTOCOL: https
|
|
WEBHOOK_URL: https://n8n.sttlab.local/
|
|
N8N_EDITOR_BASE_URL: https://n8n.sttlab.local/
|
|
|
|
# TLS terminates at the ingress, so n8n itself serves plain HTTP and must be
|
|
# told it is behind a proxy — otherwise it reads the hop's address instead of
|
|
# the caller's.
|
|
N8N_PROXY_HOPS: "1"
|
|
|
|
# The default is to keep every execution for ever, which turns the database
|
|
# into a log. Two weeks is long enough to debug a failed run.
|
|
EXECUTIONS_DATA_PRUNE: "true"
|
|
EXECUTIONS_DATA_MAX_AGE: "336"
|
|
|
|
N8N_DIAGNOSTICS_ENABLED: "false"
|
|
N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
|
|
N8N_RUNNERS_ENABLED: "true"
|
|
|
|
# Lets a workflow read `$env.<NAME>`. n8n blocks this by default, which is the
|
|
# right default for an instance where anyone can write a workflow — here it is
|
|
# how an agent's client secret reaches the workflow that acts as that agent,
|
|
# without the secret being stored in the workflow JSON and committed.
|
|
#
|
|
# It does mean any workflow can read any variable in the pod. That is
|
|
# acceptable while the instance runs this estate's own agents and nothing
|
|
# else; it stops being acceptable the moment it is shared.
|
|
N8N_BLOCK_ENV_ACCESS_IN_NODE: "false"
|