apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n
  namespace: n8n
  annotations:
    # El operator de Infisical redespliega este Deployment cuando cambia
    # n8n-secret-infisical (p.ej. rotación de GETXAPI_TOKEN) — sin kubectl manual.
    secrets.infisical.com/auto-reload: "true"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: n8n
  # Single-replica n8n with a 485MB SQLite DB (+ active WAL) on a RWO local-path
  # PVC: Recreate fully terminates the old pod (releasing the PVC and closing the
  # SQLite-WAL) before the new pod starts — avoids two writers racing one DB file
  # (RollingUpdate would surge a 2nd pod first).
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: n8n
    spec:
      securityContext:
        fsGroup: 1000
        runAsUser: 1000
      containers:
        - name: n8n
          image: git.chemavx.xyz/chemavx/n8n:01d60680
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 5678
          env:
            - name: N8N_ENCRYPTION_KEY
              valueFrom:
                secretKeyRef:
                  name: n8n-secret-infisical
                  key: encryption-key
            # Token getxapi (X autopost) — rotado 2026-07-09; el workflow lo lee
            # con la expresión {{ $env.GETXAPI_TOKEN }}, nunca inline en el nodo.
            - name: GETXAPI_TOKEN
              valueFrom:
                secretKeyRef:
                  name: n8n-secret-infisical
                  key: GETXAPI_TOKEN
            # n8n ≥1.x bloquea $env en expresiones por defecto; sin esto el nodo
            # HTTP del autopost no puede leer GETXAPI_TOKEN. Instancia single-user.
            - name: N8N_BLOCK_ENV_ACCESS_IN_NODE
              value: "false"
            - name: N8N_HOST
              value: n8n.chemavx.xyz
            - name: N8N_PORT
              value: "5678"
            - name: N8N_PROTOCOL
              value: https
            - name: WEBHOOK_URL
              value: https://n8n.chemavx.xyz/
            - name: N8N_USER_FOLDER
              value: /home/node/.n8n
            - name: NODE_FUNCTION_ALLOW_EXTERNAL
              value: "*"
            - name: GENERIC_TIMEZONE
              value: Europe/Madrid
            - name: DB_TYPE
              value: sqlite
            - name: DB_SQLITE_DATABASE
              value: /home/node/.n8n/database.sqlite
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: 500m
              memory: 1Gi
          volumeMounts:
            - name: n8n-data
              mountPath: /home/node/.n8n
      volumes:
        - name: n8n-data
          persistentVolumeClaim:
            claimName: n8n-pvc