infrapuzzle/k8s/n8n/n8n.secret.yml

#small deployment with nodeport for local testing or small deployments
image:
  repository: n8nio/n8n
  tag: 2.13.4
  pullPolicy: Always
  # Overrides the image tag whose default is the chart appVersion.
  #tag: "stable"


main:
  config:
    generic:
      timezone: Europe/Berlin
      # Maintain access to env vars in Code nodes (v2.0 blocks this by default)
      block_env_access_in_node: false
    n8n:
      editor_base_url: https://n8n.moritzgraf.de
    webhook_url: https://n8n.moritzgraf.de
    extra:
      node_modules:
      - axios
    node:
      function_allow_builtin: '*'
      function_allow_external: '*'
    db:
      type: postgresdb
      postgresdb:
        host: db-rw
        user: n8n
#        password: password is read from cnpg db-app secretKeyRef
# Moritz: Assuming the db-app secret is created by cnpg operator
        pool:
          size: 10
        ssl:
          enabled: true
          reject_Unauthorized: true
          ca_file: "/home/ssl/certs/postgresql/ca.crt"
  secret:
    n8n:
      encryption_key: "iHiquee6joibooK1aj9doh8wieliehua5ni6oSheix4oopheiz"
  extraEnv:
    DB_POSTGRESDB_PASSWORD:
      valueFrom:
        secretKeyRef:
          name: db-app
          key: password
    N8N_METRICS:
      value: "true"
    N8N_METRICS_INCLUDE_DEFAULT_METRICS:
      value: "true"
  # Mount the CNPG CA Cert into N8N container
  extraVolumeMounts:
    - name: db-ca-cert
      mountPath: /home/ssl/certs/postgresql
      readOnly: true

  extraVolumes:
    - name: db-ca-cert
      secret:
        secretName: db-ca
        items:
          - key: ca.crt
            path: ca.crt
  resources:
    limits:
      memory: 2048Mi
    requests:
      memory: 512Mi
  service:
    type: NodePort
    port: 5678


ingress:
  # Enable ingress for home assistant
  enabled: true
  className: "nginx"
  annotations:
    kubernetes.io/ingress.class: "nginx"    
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-buffering: "off"
    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
  hosts:
    - host: n8n.moritzgraf.de
      paths:
        - path: /
          pathType: Prefix
  tls:
  - hosts:
    - "n8n.moritzgraf.de"
    secretName: n8n-moritzgraf-de

# cnpg DB cluster request
extraManifests:
  - apiVersion: postgresql.cnpg.io/v1
    kind: Cluster
    metadata:
      name: db
    spec:
      instances: 1
      bootstrap:
        initdb:
          database: n8n
          owner: n8n
      postgresql:
        parameters:
          shared_buffers: "64MB"
      resources:
        requests:
          memory: "512Mi"
        limits:
          memory: "512Mi"
      storage:
        size: 1Gi
  - apiVersion: monitoring.coreos.com/v1
    kind: ServiceMonitor
    metadata:
      name: mop-n8n
      labels:
        release: prometheus-operator
    spec:
      selector:
        matchLabels:
          app.kubernetes.io/instance: mop-n8n
          app.kubernetes.io/name: n8n
      namespaceSelector:
        matchNames:
          - n8n
      endpoints:
        - port: http
          interval: 30s
          path: /metrics
  - apiVersion: monitoring.coreos.com/v1
    kind: PrometheusRule
    metadata:
      name: mop-n8n-alerts
      labels:
        release: prometheus-operator
    spec:
      groups:
        - name: n8n.rules
          rules:
            - alert: n8nInstanceDown
              expr: up{job="mop-n8n"} == 0
              for: 5m
              labels:
                severity: critical
              annotations:
                summary: "n8n instance is down or unresponsive"
                description: "n8n scraper has failed for the last 5 minutes. The application might be frozen or crashed."
            - alert: n8nPodRestarts
              expr: rate(kube_pod_container_status_restarts_total{container="n8n"}[15m]) * 900 > 1
              for: 5m
              labels:
                severity: warning
              annotations:
                summary: "n8n pod is restarting frequently"
                description: "n8n has restarted in the last 15 minutes. This might indicate liveness probe failures due to database issues or memory limit exhaustion."
            - alert: n8nNodeEventLoopLag
              expr: n8n_nodejs_eventloop_lag_seconds{job="mop-n8n"} > 1
              for: 5m
              labels:
                severity: warning
              annotations:
                summary: "n8n event loop lag is high"
                description: "n8n Node.js event loop lag has exceeded 1 second for the last 5 minutes. This can make the UI unresponsive and logins fail."
            - alert: n8nPodNotReady
              expr: kube_pod_status_ready{condition="true", pod=~"mop-n8n-.*"} == 0
              for: 5m
              labels:
                severity: critical
              annotations:
                summary: "n8n pod is not ready"
                description: "n8n pod has been in non-ready state for more than 5 minutes. This is likely due to failing readiness probes (/healthz check failing, possibly database connection issues)."