services:
  n8n:
    image: n8nio/n8n:2.20.11  # pinned 2026-05-19 — unpinned :latest drifted 2.7→2.20.11 and broke the OIDC hooks.js
    environment:
        - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
        - N8N_PORT=5678
        - N8N_PROTOCOL=https  
        - NODE_ENV=production
        - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/
        - DB_TYPE=postgresdb
        - DB_POSTGRESDB_HOST=192.168.1.6
        - DB_POSTGRESDB_PORT=5432
        - DB_POSTGRESDB_DATABASE=n8n
        - DB_POSTGRESDB_USER=n8n
        - DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD}
        - N8N_DIAGNOSTICS_ENABLED=false
        - N8N_PERSONALIZATION_ENABLED=false
        - N8N_ENCRYPTION_KEY
        - N8N_USER_MANAGEMENT_JWT_SECRET
        - N8N_SECURE_COOKIE=false
        # Trust proxy for rate limiting (fixes X-Forwarded-For header issue)
        - N8N_TRUST_PROXY=true
        # OIDC bolt-on re-enabled 2026-05-19: paths patched for 2.20.11 pnpm layout
        - EXTERNAL_HOOK_FILES=/home/node/hooks.js
        - OIDC_ISSUER_URL=https://id.nuclide.systems
        - OIDC_CLIENT_ID=33135ad4-a3ed-45d3-938f-639abd2b9663
        - OIDC_CLIENT_SECRET=aYtWoZ5Wrqxs7kwyI1is1rLY0UATJaW391-3bzNALv0
        - OIDC_REDIRECT_URI=https://n8n.nuclide.systems/auth/oidc/callback
        - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js
        - N8N_ADDITIONAL_NON_UI_ROUTES=auth
        - EXTERNAL_FRONTEND_HOOKS_URLS=/assets/oidc-frontend-hook.js
    hostname: n8n
    container_name: n8n
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 2G
        reservations:
          cpus: "0.5"
          memory: 1G
    ports:
    - 16000:5678
    healthcheck:
      test: ['CMD-SHELL', 'wget --spider -q http://n8n:5678/healthz || exit 1']
      interval: 5s
      timeout: 5s
      retries: 10
    volumes:
      - /opt/stacks/n8n/data:/home/node/.n8n
      - /opt/stacks/n8n/hooks.js:/home/node/hooks.js:ro
    labels:
      - "homepage.group=productivity"
      - "homepage.name=n8n"
      - "homepage.icon=sh-n8n"
      - "homepage.href=https://n8n.nuclide.systems"
      - "homepage.instance.internal.href=http://192.168.1.40:16000"
      - "homepage.instance.public.href=https://n8n.nuclide.systems"
      - "homepage.widget.type=n8n"
      - "homepage.widget.url=http://n8n:5678"
networks:
  default:
    external: true
    name: shared_backend