Merge 352bfbe3bc into d9c0d3abde

* fix: add *.k8s endpoint

* fix failing workflow

.github/workflows/validate-caddyfile.yml

@@ -29,4 +29,5 @@ jobs:
           # fail loudly on an HTTP error instead of saving an error page.
           curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=amd64" -o caddy
           chmod +x caddy
+          ./caddy add-package github.com/caddy-dns/hetzner@v2.0.0
           ./caddy validate --config ansible/services/caddy/Caddyfile --adapter caddyfile

Makefile

@@ -4,6 +4,5 @@
 decrypt:
 	@find . -name "*.enc.*" ! -name "*.example" -not -path "./.git/*" | while read f; do \
 		out=$$(echo "$$f" | sed 's/\.enc\././'); \
-		echo "Decrypting $$f -> $$out"; \
 		sops -d "$$f" > "$$out"; \
 	done

ansible/inventory/host_vars/nuremberg-a.yml

@@ -7,6 +7,7 @@ ansible_python_interpreter: /usr/bin/python3
 
 docker_services:
   - poste-io
+  - n8n
 
 # Mail ports (25,80,110,143,443,465,587,993,995) exposed via Docker
 # port mappings in ansible/services/poste-io/docker-compose.yml.

ansible/services/README.md

@@ -25,6 +25,7 @@ There is **no** per-host subdirectory — services are named by what they are, a
 | bitwarden | Docker | helsinki-a | Vaultwarden + MariaDB |
 | forgejo | Docker | helsinki-a | Git forge |
 | poste-io | Docker | nuremberg-a | Mail |
+| n8n | Docker | nuremberg-a | Workflow automation |
 | jellyseerr | Docker | london-b | Plex request manager |
 | navidrome | Docker | london-b | Music streaming |
 | bookshelf | Docker | london-b | Ebook/audiobook manager (Readarr revival) |

ansible/services/caddy/Caddyfile

@@ -26,6 +26,16 @@ london-a.pez.sh {
         }
 }
 
+*.k8s.pez.sh {
+        tls {
+            dns hetzner {env.HETZNER_DNS_API_TOKEN}
+        }
+        tracing {
+                span k8s
+        }
+        reverse_proxy 100.123.97.26:80
+}
+
 ## LONDON-B SERVICES ##
 
 # Jellyfin
@@ -155,6 +165,14 @@ music.pez.sh {
 
 ## NUREMBERG-A SERVICES ##
 
+# n8n (own auth)
+n8n.pez.sh {
+        tracing {
+                span n8n
+        }
+        reverse_proxy 100.70.180.24:5678
+}
+
 ## HELSINKI-A SERVICES ##
 
 # Bitwarden (requires HTTPS tweaking)

ansible/services/n8n/README.md

@@ -0,0 +1,10 @@
+# n8n
+
+Workflow automation / orchestration.
+
+- **Host:** nuremberg-a
+- **URL:** https://n8n.pez.sh
+- **Port:** 5678 (bound to the Tailscale IP `100.70.180.24` only; exposed publicly via Caddy on helsinki-a)
+- **Auth:** n8n's own user management (login on first run)
+- **Data:** `n8n_data` named volume (`/home/node/.n8n`)
+- **Files:** `./local-files` mounted at `/files` inside the container

ansible/services/n8n/docker-compose.yml

@@ -0,0 +1,28 @@
+---
+# n8n - Workflow automation
+# Host: nuremberg-a (100.70.180.24)
+# Port bound to the Tailscale IP only; public access is via Caddy on helsinki-a.
+# n8n manages its own auth (user management / login).
+
+services:
+  n8n:
+    image: docker.n8n.io/n8nio/n8n
+    container_name: n8n
+    restart: always
+    ports:
+      - "100.70.180.24:5678:5678"
+    environment:
+      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
+      - N8N_HOST=n8n.pez.sh
+      - N8N_PORT=5678
+      - N8N_PROTOCOL=http
+      - NODE_ENV=production
+      - WEBHOOK_URL=https://n8n.pez.sh/
+      - GENERIC_TIMEZONE=Europe/London
+      - TZ=Europe/London
+    volumes:
+      - n8n_data:/home/node/.n8n
+      - ./local-files:/files
+
+volumes:
+  n8n_data:

docs/services.md

@@ -89,9 +89,12 @@ Dedicated mail server on Hetzner Cloud. Isolated to protect IP reputation.
 | Service | Port | Deployment | Auth | URL |
 |---------|------|-----------|------|-----|
 | poste.io | 25, 80, 110, 143, 443, 465, 587, 993, 995 | Docker | Own auth | (webmail via direct host access) |
+| n8n | 5678 | Docker | Own auth | https://n8n.pez.sh |
 
 poste.io bundles everything — postfix, dovecot, rspamd, webmail — into a single container. Makes updates straightforward.
 
+n8n (workflow automation) binds 5678 to the Tailscale IP only; public access is proxied by Caddy on helsinki-a. It manages its own user auth.
+
 ## copenhagen-a — Gaming
 
 Game servers. Not publicly exposed via Caddy — accessed directly over the public IP/Tailscale.

terraform/hetzner/dns.tf

@@ -14,8 +14,8 @@ locals {
 resource "hcloud_zone_rrset" "A_helsinki_a" {
   for_each = toset([
     "@", "apps", "auth", "bitwarden", "download", "git", "helsinki-a",
-    "jellyfin", "jellyfin-requests", "ldap", "lidarr", "london-a", "music", "naveen",
+    "jellyfin", "jellyfin-requests", "*.k8s", "ldap", "lidarr", "london-a", "music", "naveen",
-    "plex", "prowlarr", "radarr", "readarr", "request",
+    "n8n", "plex", "prowlarr", "radarr", "readarr", "request",
     "sonarr", "soulseek", "status",
   ])
   zone    = hcloud_zone.pezsh.name