mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
43e09ebf0d
n8n accepts the owner password only at /rest/owner/setup, which answers 400 "Instance owner already setup" once an owner exists. After the CI rotated owner_password between the passes, the probe got 401, setup got 400, the assert accepted "already setup", and the owner kept the old password: the Playwright owner login failed in n8n#1 and the AI gateway login in n8n#0 got 401 and 429 (run 34615516009, jobs 103327034581 and 103327034619). Only in exactly that state, probe 401/403 plus "already setup", a node script now runs inside the n8n container with n8n's own modules and DB_POSTGRESDB_* settings: it compares the stored bcrypt hash with the deployed password, writes a fresh bcryptjs hash when they differ, and prints CHANGED or OK. A single confirming login then requires 200, so a failed write stops the deploy with a clear status. Fresh hosts and deploys whose password already matches never run the script. The pattern follows web-app-flowise's identity_password.js. The module path was measured in n8nio/n8n:1.100.1: bcryptjs and pg resolve from /usr/local/lib/node_modules/n8n/node_modules, pg's transitive modules load, and bcryptjs hashes as $2a$ like n8n. no_log moves from the bootstrap include's apply to the four tasks that carry the password, so the setup assert and the host and container resolution stay readable when they fail. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
36 lines
1.9 KiB
YAML
36 lines
1.9 KiB
YAML
---
|
|
application_id: "web-app-n8n"
|
|
entity_name: "{{ application_id | get_entity_name }}"
|
|
|
|
N8N_CONTAINER: "{{ lookup('config', application_id, 'services.n8n.name') }}"
|
|
N8N_HTTP_PORT: "{{ lookup('config', application_id, 'services.n8n.ports.local.http') }}"
|
|
N8N_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.n8n.ports.internal.http') }}"
|
|
|
|
N8N_HOSTNAME: "{{ lookup('domain', application_id) }}"
|
|
N8N_WEB_PROTOCOL: "{{ lookup('tls', application_id, 'protocols.web') }}"
|
|
N8N_ENCRYPTION_KEY: "{{ lookup('config', application_id, 'secrets.credentials.encryption_key') }}"
|
|
N8N_OWNER_PASSWORD: "{{ lookup('config', application_id, 'secrets.credentials.owner_password') }}"
|
|
N8N_NODE_MODULES: /usr/local/lib/node_modules/n8n/node_modules
|
|
|
|
N8N_INTERNAL_API_URL: "http://{{ DOCKER_REACH_HOST }}:{{ N8N_HTTP_PORT }}"
|
|
|
|
N8N_SSO_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') | bool }}"
|
|
|
|
N8N_MCP_ENABLED: "{{ lookup('config', application_id, 'mcp.enabled') | bool }}"
|
|
N8N_OWNER_EMAIL: "{{ lookup('users', 'administrator').email }}"
|
|
N8N_MCP_TOKEN: "{{ lookup('config', application_id, 'secrets.credentials.mcp_token') }}"
|
|
N8N_MCP_API_KEY_NAME: "infinito:mcp"
|
|
N8N_MCP_WORKFLOW_NAME: "infinito:mcp-server"
|
|
N8N_MCP_CREDENTIAL_NAME: "infinito:mcp-bearer"
|
|
N8N_MCP_WEBHOOK_PATH: "infinito-mcp"
|
|
N8N_MCP_CLIENT_WORKFLOW_NAME: "infinito:mcp-agent"
|
|
N8N_MCP_PROVIDERS: "{{ MCP_DISCOVERED_SERVERS if N8N_MCP_ENABLED else [] }}"
|
|
|
|
N8N_LITELLM_ENABLED: "{{ lookup('config', application_id, 'services.litellm.enabled') | bool }}"
|
|
N8N_LITELLM_BASE_URL: "{{ LITELLM_OPENAI_BASE_LOCAL_URL }}"
|
|
N8N_LITELLM_API_KEY: "{{ lookup('config', application_id, 'secrets.credentials.litellm_api_key') }}"
|
|
N8N_LITELLM_CREDENTIAL_NAME: "infinito:litellm"
|
|
|
|
N8N_HOOKS_FILE_HOST: "{{ [ lookup('container', application_id, 'directories.instance'), 'hooks.js' ] | path_join }}"
|
|
N8N_HOOKS_FILE_CONTAINER: "{{ lookup('volume', 'web-app-n8n', 'hooks').target }}" # nocheck: container-var-name-lookup
|