services:
  n8n:
    image: docker.n8n.io/n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    environment:
      - N8N_HOST=us-test-authy.taila7f44e.ts.net
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - N8N_PATH=/n8n/
      - GENERIC_TIMEZONE=America/New_York
      - N8N_SECURE_COOKIE=true
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=herby
      - N8N_BASIC_AUTH_PASSWORD=pass
      - WEBHOOK_URL=https://us-test-authy.taila7f44e.ts.net/n8n/
      - PBS_GOOGLE_CHAT_WEBHOOK_URL=PLACEHOLDER_REPLACE_ME
      - PBS_HEALER_WEBHOOK_URL=PLACEHOLDER_REPLACE_ME
      - PBS_MONITOR_BASE_URL=http://172.17.0.1:9100
      - PBS_PORTAINER_BASE_URL=PLACEHOLDER_REPLACE_ME
      - PBS_PORTAINER_ENDPOINT_ID=PLACEHOLDER_REPLACE_ME
      - PBS_PORTAINER_API_KEY=PLACEHOLDER_REPLACE_ME
    volumes:
      - n8n_data:/home/node/.n8n
    networks:
      - traefik
    labels:
      - "traefik.enable=true"
      # Main router — UI and webhooks (behind Authelia)
      - "traefik.http.routers.n8n.rule=Host(`us-test-authy.taila7f44e.ts.net`) && PathPrefix(`/n8n`)"
      - "traefik.http.routers.n8n.entrypoints=https"
      - "traefik.http.routers.n8n.tls.certresolver=tailscale"
      - "traefik.http.routers.n8n.priority=1"
      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
      - "traefik.http.middlewares.n8n-strip.stripprefix.prefixes=/n8n"
      - "traefik.http.routers.n8n.middlewares=n8n-strip"
      # API router — bypasses Authelia (n8n API key provides auth)
      - "traefik.http.routers.n8n-api.rule=Host(`us-test-authy.taila7f44e.ts.net`) && PathPrefix(`/n8n/api`)"
      - "traefik.http.routers.n8n-api.entrypoints=https"
      - "traefik.http.routers.n8n-api.tls.certresolver=tailscale"
      - "traefik.http.routers.n8n-api.priority=2"
      - "traefik.http.routers.n8n-api.service=n8n"
      - "traefik.http.routers.n8n-api.middlewares=n8n-strip"

volumes:
  n8n_data:
    name: n8n_server_n8n_data
    external: true

networks:
  traefik:
    external: true