Merge 352bfbe3bc into 87439d47b8

.github/workflows/validate-caddyfile.yml

@@ -29,5 +29,4 @@ jobs:
           # fail loudly on an HTTP error instead of saving an error page.
           curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=amd64" -o caddy
           chmod +x caddy
-          ./caddy add-package github.com/caddy-dns/hetzner@v2.0.0
           ./caddy validate --config ansible/services/caddy/Caddyfile --adapter caddyfile

Makefile

@@ -4,5 +4,6 @@
 decrypt:
 	@find . -name "*.enc.*" ! -name "*.example" -not -path "./.git/*" | while read f; do \
 		out=$$(echo "$$f" | sed 's/\.enc\././'); \
+		echo "Decrypting $$f -> $$out"; \
 		sops -d "$$f" > "$$out"; \
 	done

ansible/inventory/host_vars/nuremberg-a.yml

@@ -7,7 +7,6 @@ ansible_python_interpreter: /usr/bin/python3
 
 docker_services:
   - poste-io
-  - n8n
 
 # Mail ports (25,80,110,143,443,465,587,993,995) exposed via Docker
 # port mappings in ansible/services/poste-io/docker-compose.yml.

ansible/services/README.md

@@ -25,7 +25,6 @@ There is **no** per-host subdirectory — services are named by what they are, a
 | bitwarden | Docker | helsinki-a | Vaultwarden + MariaDB |
 | forgejo | Docker | helsinki-a | Git forge |
 | poste-io | Docker | nuremberg-a | Mail |
-| n8n | Docker | nuremberg-a | Workflow automation |
 | jellyseerr | Docker | london-b | Plex request manager |
 | navidrome | Docker | london-b | Music streaming |
 | bookshelf | Docker | london-b | Ebook/audiobook manager (Readarr revival) |

ansible/services/caddy/Caddyfile

@@ -26,16 +26,6 @@ london-a.pez.sh {
         }
 }
 
-*.k8s.pez.sh {
-        tls {
-            dns hetzner {env.HETZNER_DNS_API_TOKEN}
-        }
-        tracing {
-                span k8s
-        }
-        reverse_proxy 100.123.97.26:80
-}
-
 ## LONDON-B SERVICES ##
 
 # Jellyfin
@@ -165,14 +155,6 @@ music.pez.sh {
 
 ## NUREMBERG-A SERVICES ##
 
-# n8n (own auth)
-n8n.pez.sh {
-        tracing {
-                span n8n
-        }
-        reverse_proxy 100.70.180.24:5678
-}
-
 ## HELSINKI-A SERVICES ##
 
 # Bitwarden (requires HTTPS tweaking)

ansible/services/n8n/README.md

@@ -1,10 +0,0 @@
-# n8n
-
-Workflow automation / orchestration.
-
-- **Host:** nuremberg-a
-- **URL:** https://n8n.pez.sh
-- **Port:** 5678 (bound to the Tailscale IP `100.70.180.24` only; exposed publicly via Caddy on helsinki-a)
-- **Auth:** n8n's own user management (login on first run)
-- **Data:** `n8n_data` named volume (`/home/node/.n8n`)
-- **Files:** `./local-files` mounted at `/files` inside the container

ansible/services/n8n/docker-compose.yml

@@ -1,28 +0,0 @@
----
-# n8n - Workflow automation
-# Host: nuremberg-a (100.70.180.24)
-# Port bound to the Tailscale IP only; public access is via Caddy on helsinki-a.
-# n8n manages its own auth (user management / login).
-
-services:
-  n8n:
-    image: docker.n8n.io/n8nio/n8n
-    container_name: n8n
-    restart: always
-    ports:
-      - "100.70.180.24:5678:5678"
-    environment:
-      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
-      - N8N_HOST=n8n.pez.sh
-      - N8N_PORT=5678
-      - N8N_PROTOCOL=http
-      - NODE_ENV=production
-      - WEBHOOK_URL=https://n8n.pez.sh/
-      - GENERIC_TIMEZONE=Europe/London
-      - TZ=Europe/London
-    volumes:
-      - n8n_data:/home/node/.n8n
-      - ./local-files:/files
-
-volumes:
-  n8n_data:

docs/services.md

@@ -89,12 +89,9 @@ Dedicated mail server on Hetzner Cloud. Isolated to protect IP reputation.
 | Service | Port | Deployment | Auth | URL |
 |---------|------|-----------|------|-----|
 | poste.io | 25, 80, 110, 143, 443, 465, 587, 993, 995 | Docker | Own auth | (webmail via direct host access) |
-| n8n | 5678 | Docker | Own auth | https://n8n.pez.sh |
 
 poste.io bundles everything — postfix, dovecot, rspamd, webmail — into a single container. Makes updates straightforward.
 
-n8n (workflow automation) binds 5678 to the Tailscale IP only; public access is proxied by Caddy on helsinki-a. It manages its own user auth.
-
 ## copenhagen-a — Gaming
 
 Game servers. Not publicly exposed via Caddy — accessed directly over the public IP/Tailscale.

terraform/hetzner/dns.tf

@@ -14,8 +14,8 @@ locals {
 resource "hcloud_zone_rrset" "A_helsinki_a" {
   for_each = toset([
     "@", "apps", "auth", "bitwarden", "download", "git", "helsinki-a",
-    "jellyfin", "jellyfin-requests", "*.k8s", "ldap", "lidarr", "london-a", "music", "naveen",
-    "n8n", "plex", "prowlarr", "radarr", "readarr", "request",
+    "jellyfin", "jellyfin-requests", "ldap", "lidarr", "london-a", "music", "naveen",
+    "plex", "prowlarr", "radarr", "readarr", "request",
     "sonarr", "soulseek", "status",
   ])
   zone    = hcloud_zone.pezsh.name