From 77f55fb100f1d1c8c2756ff2c3fb76d5719335aa Mon Sep 17 00:00:00 2001
From: chemavx <chemavx@git.chemavx.xyz>
Date: Mon, 22 Jun 2026 11:31:10 +0000
Subject: [PATCH] n8n: repoint encryption-key secretKeyRef to
 n8n-secret-infisical + Recreate

Cut n8n over to the Infisical-synced encryption key (byte-identical, key never
changes -> credentials stay decryptable) and switch RollingUpdate -> Recreate
(485MB SQLite + WAL on RWO must not have two writers during a roll).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 n8n/deployment-n8n.yaml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/n8n/deployment-n8n.yaml b/n8n/deployment-n8n.yaml
index e41c09c..40c6f5d 100644
--- a/n8n/deployment-n8n.yaml
+++ b/n8n/deployment-n8n.yaml
@@ -8,11 +8,12 @@ spec:
   selector:
     matchLabels:
       app: n8n
+  # Single-replica n8n with a 485MB SQLite DB (+ active WAL) on a RWO local-path
+  # PVC: Recreate fully terminates the old pod (releasing the PVC and closing the
+  # SQLite-WAL) before the new pod starts — avoids two writers racing one DB file
+  # (RollingUpdate would surge a 2nd pod first).
   strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
+    type: Recreate
   template:
     metadata:
       labels:
@@ -31,7 +32,7 @@ spec:
             - name: N8N_ENCRYPTION_KEY
               valueFrom:
                 secretKeyRef:
-                  name: n8n-secret
+                  name: n8n-secret-infisical
                   key: encryption-key
             - name: N8N_HOST
               value: n8n.chemavx.xyz