# n8n workflow automation. Public (own auth, webhook URLs are secret-tokened)
# — intentionally NOT behind the Authelia SSO gate, so external services
# can trigger webhook automations.
apiVersion: v1
kind: Namespace
metadata:
  name: automation
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: n8n-data
  namespace: automation
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: nfs-synology
  resources:
    requests: {storage: 10Gi}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n
  namespace: automation
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels: {app: n8n}
  template:
    metadata:
      labels: {app: n8n}
    spec:
      containers:
        - name: n8n
          image: n8nio/n8n:latest
          env:
            - {name: N8N_HOST, value: n8n.carr.pub}
            - {name: N8N_PROTOCOL, value: https}
            - {name: WEBHOOK_URL, value: "https://n8n.carr.pub/"}
            - {name: GENERIC_TIMEZONE, value: America/Los_Angeles}
            - {name: N8N_SECURE_COOKIE, value: "false"}
          ports: [{containerPort: 5678}]
          resources:
            requests: {cpu: 100m, memory: 256Mi}
            limits: {memory: 1Gi}
          volumeMounts:
            - {name: data, mountPath: /home/node/.n8n}
      volumes:
        - name: data
          persistentVolumeClaim: {claimName: n8n-data}
---
apiVersion: v1
kind: Service
metadata:
  name: n8n
  namespace: automation
spec:
  selector: {app: n8n}
  ports:
    - port: 5678
      targetPort: 5678
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: n8n
  namespace: automation
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts: [n8n.carr.pub]
      secretName: n8n-carr-pub-tls
  rules:
    - host: n8n.carr.pub
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service: {name: n8n, port: {number: 5678}}