services:
  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    environment:
      # Base de données
      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_PORT: 5432
      DB_POSTGRESDB_DATABASE: n8n
      DB_POSTGRESDB_USER: n8n
      DB_POSTGRESDB_PASSWORD: ${N8N_DB_PASSWORD}
      # ⚠️ Critique : sans cette clé on perd accès aux credentials chiffrés
      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
      # Config serveur
      N8N_HOST: n8n.seizeconsulting.com
      N8N_PORT: 5678
      N8N_PROTOCOL: https
      WEBHOOK_URL: https://n8n.seizeconsulting.com/
      # Désactiver le sign-up : SSO uniquement
      N8N_USER_MANAGEMENT_DISABLED: "false"
    volumes:
      - n8n_data:/home/node/.n8n
    networks:
      - web
      - backend
    # ⚠️ Pas de labels Traefik : OAuth2-Proxy est exposé devant
    depends_on:
      - postgres

volumes:
  n8n_data:

networks:
  web:
    external: true
  backend:
    external: true