From 5c7323c5335a9af118e784c018e1216b2d704b0f Mon Sep 17 00:00:00 2001 From: chemavx Date: Mon, 22 Jun 2026 11:30:28 +0000 Subject: [PATCH] n8n: add InfisicalStaticSecret for n8n-secret (centralize N8N_ENCRYPTION_KEY) Out-of-band Secret -> Infisical homelab/prod /n8n. Parallel-name target n8n-secret-infisical (Owner), passthrough of the single key encryption-key (n8n's irrecoverable credentials-encryption root, lifted byte-identical). Old secret stays live until decommission. ArgoCD-managed -> git->sync. Co-Authored-By: Claude Opus 4.8 --- n8n/infisical-n8n-secret.yaml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 n8n/infisical-n8n-secret.yaml diff --git a/n8n/infisical-n8n-secret.yaml b/n8n/infisical-n8n-secret.yaml new file mode 100644 index 0000000..d84acb6 --- /dev/null +++ b/n8n/infisical-n8n-secret.yaml @@ -0,0 +1,28 @@ +apiVersion: secrets.infisical.com/v1beta1 +kind: InfisicalStaticSecret +metadata: + name: n8n-secret + namespace: n8n +spec: + # Shared, read-only machine identity (no write grant, no PushSecret). + # Source is the /n8n folder, single key encryption-key = N8N_ENCRYPTION_KEY. + # This is n8n's IRRECOVERABLE credentials-encryption root: it decrypts every + # credential stored in database.sqlite. Lifted BYTE-IDENTICAL (sha8 1fdb7832, + # len 32) — never regenerated. Also persisted verbatim in ~/.n8n/config on the + # PVC and backed up in the user's password manager (4-way redundancy). + # secretKeyRef.key is already 'encryption-key' -> straight passthrough. + infisicalAuthRef: + name: infisical-auth + namespace: infisical-operator + sources: + - projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab" + environmentSlug: prod + secretPath: /n8n + syncOptions: + refreshInterval: 60s + targets: + - kind: Secret + name: n8n-secret-infisical # parallel name — old secret stays live until 3c + namespace: n8n + creationPolicy: Owner + # key passthrough: synced Secret carries encryption-key verbatim