apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n
  namespace: watch
  labels:
    app.kubernetes.io/name: n8n
spec:
  replicas: 1
  strategy:
    type: Recreate # single ReadWriteOnce PVC, avoid two pods mounting it at once
  selector:
    matchLabels:
      app.kubernetes.io/name: n8n
  template:
    metadata:
      labels:
        app.kubernetes.io/name: n8n
    spec:
      securityContext:
        fsGroup: 1000 # matches the "node" user baked into the n8n image
      containers:
        - name: n8n
          image: n8nio/n8n:latest
          ports:
            - name: http
              containerPort: 5678
          envFrom:
            - secretRef:
                name: n8n-credentials
          env:
            - name: DB_TYPE
              value: postgresdb
            - name: DB_POSTGRESDB_HOST
              value: postgres-postgresql.postgres.svc.cluster.local
            - name: DB_POSTGRESDB_PORT
              value: "5432"
            - name: DB_POSTGRESDB_DATABASE
              value: n8n
            - name: N8N_HOST
              value: n8n.sttlab.pc
            - name: N8N_PORT
              value: "5678"
            - name: N8N_PROTOCOL
              value: https
            - name: N8N_WEBHOOK_URL
              value: https://n8n.sttlab.pc/
            - name: GENERIC_TIMEZONE
              value: Europe/Paris
            - name: TZ
              value: Europe/Paris
            - name: N8N_RESTRICT_FILE_ACCESS_TO
              value: "/data" # single path only (no list support)
          volumeMounts:
            - name: data
              mountPath: /home/node/.n8n
            - name: digest-workspace
              mountPath: /data # dedicated volume for Read/Write File nodes, separate from n8n's own
              # internal directory (which n8n always blocks file-node access to, regardless of
              # N8N_RESTRICT_FILE_ACCESS_TO, via N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES)
            - name: digest-prompt
              mountPath: /data/prompts/digest.md
              subPath: digest.md # avoids the ConfigMap symlink indirection, which trips n8n's file-access allowlist check
              readOnly: true
            - name: digest-prompt
              mountPath: /data/prompts/editorial.md
              subPath: editorial.md
              readOnly: true
          resources:
            requests:
              cpu: 200m
              memory: 512Mi
            limits:
              cpu: 1000m
              memory: 2Gi
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            initialDelaySeconds: 30
            periodSeconds: 20
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: n8n-data
        - name: digest-workspace
          persistentVolumeClaim:
            claimName: n8n-digest-workspace
        - name: digest-prompt
          configMap:
            name: n8n-digest-prompt