Stéphane Tailland
dc13738e86
The runtime for the estate's autonomous agents. Postgres as a StatefulSet with its own claim, n8n behind a cert-manager certificate and the nginx ingress, and both secrets in Vault behind an AppRole scoped to n8n/* alone. The certificate is issued into the cluster rather than copied into the repo, so the private key never reaches git. The CA certificate is committed and mounted as NODE_EXTRA_CA_CERTS, so a workflow can reach keycloak and the domain gateways without anyone disabling verification to make it work. One replica and strategy: Recreate, both deliberate — n8n needs Redis and queue mode before a second scheduler is safe, and a ReadWriteOnce volume deadlocks a rolling update. N8N_ENCRYPTION_KEY is generated once and kept in Vault. Regenerating it does not re-encrypt the stored credentials, it orphans them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
36 lines
1.2 KiB
YAML
36 lines
1.2 KiB
YAML
# Nothing here is sensitive. The two values that are — the database password and
|
|
# the credential encryption key — arrive through n8n-secrets.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: n8n-config
|
|
namespace: n8n
|
|
data:
|
|
GENERIC_TIMEZONE: Europe/Paris
|
|
TZ: Europe/Paris
|
|
NODE_ENV: production
|
|
|
|
# What n8n believes it is reachable at. It goes into the webhook URLs it
|
|
# generates and into the links it puts in its own UI, so it must be the
|
|
# ingress host and not the Service — a webhook advertised as `n8n` inside the
|
|
# cluster is a webhook nothing outside can call.
|
|
N8N_HOST: n8n.sttlab.local
|
|
N8N_PORT: "5678"
|
|
N8N_PROTOCOL: https
|
|
WEBHOOK_URL: https://n8n.sttlab.local/
|
|
N8N_EDITOR_BASE_URL: https://n8n.sttlab.local/
|
|
|
|
# TLS terminates at the ingress, so n8n itself serves plain HTTP and must be
|
|
# told it is behind a proxy — otherwise it reads the hop's address instead of
|
|
# the caller's.
|
|
N8N_PROXY_HOPS: "1"
|
|
|
|
# The default is to keep every execution for ever, which turns the database
|
|
# into a log. Two weeks is long enough to debug a failed run.
|
|
EXECUTIONS_DATA_PRUNE: "true"
|
|
EXECUTIONS_DATA_MAX_AGE: "336"
|
|
|
|
N8N_DIAGNOSTICS_ENABLED: "false"
|
|
N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
|
|
N8N_RUNNERS_ENABLED: "true"
|