feat: add n8n

hosts/fw/modules/web/default.nix

@@ -11,6 +11,9 @@ in {
             # needed for matrix
             "olm-3.2.16"
           ];
+          allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+            "n8n"
+          ];
         };
       };
       config = {
@@ -30,6 +33,18 @@ in {
               tag = "persist";
               proto = "virtiofs";
             }
+            {
+              source = "/run/secrets/n8n-env";
+              mountPoint = "/run/secrets-host/n8n-env";
+              tag = "n8n-secret";
+              proto = "virtiofs";
+            }
+            {
+              source = "/run/secrets/n8n-git-key";
+              mountPoint = "/run/secrets-host/n8n-git-key";
+              tag = "n8n-git-key";
+              proto = "virtiofs";
+            }
           ];
           volumes = [
             {
@@ -58,6 +73,7 @@ in {
           ./zammad.nix
           ./proxies.nix
           ./matrix.nix
+          ./n8n.nix
         ];
 
         networkPrefix = config.networkPrefix;
@@ -79,6 +95,7 @@ in {
           directories = [
             "/var/lib/zammad"
             "/var/lib/postgresql"
+            "/var/lib/n8n"
             "/var/log"
             "/var/lib/systemd/coredump"
           ];
@@ -130,4 +147,12 @@ in {
       };
     };
   };
+
+  # Secrets defined at fw host level, mounted into microvm
+  sops.secrets.n8n-env = {
+    mode = "0400";
+  };
+  sops.secrets.n8n-git-key = {
+    mode = "0400";
+  };
 }