From 1e13943cffb2da8a328b5b1ea5e9b1fe73fdd774 Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Sun, 2 Aug 2026 01:55:33 +0200
Subject: [PATCH] chore(deploy): automate private n8n bootstrap

---
 deploy/unraid/README.md    | 17 +++++++++++++----
 deploy/unraid/setup-n8n.sh | 30 ++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 4 deletions(-)
 create mode 100755 deploy/unraid/setup-n8n.sh

diff --git a/deploy/unraid/README.md b/deploy/unraid/README.md
index eedf7b1..85c1e5c 100644
--- a/deploy/unraid/README.md
+++ b/deploy/unraid/README.md
@@ -27,10 +27,19 @@ docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec api \
   python -m app.cli seed --reset
 ```
 
-Migrations run automatically in the API entrypoint. For the one-time n8n owner setup,
-forward a local port over SSH to server loopback, open that local URL, then run the
-documented workflow import/publish commands from `docs/17-runbook.md` with both Compose
-files supplied.
+Migrations run automatically in the API entrypoint. Complete the one-time n8n owner
+setup without exposing its editor to the LAN, then import and publish the workflow:
+
+```bash
+./deploy/unraid/setup-n8n.sh http://127.0.0.1:15678
+docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec n8n \
+  n8n import:workflow --input=//imports/mobilityops-return-processing.json
+docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec n8n \
+  n8n publish:workflow --id=mobilityops-return-processing
+docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml restart n8n
+```
+
+The generated n8n owner credentials remain only in the mode-`0600` server `.env`.
 
 ## Operate
 
diff --git a/deploy/unraid/setup-n8n.sh b/deploy/unraid/setup-n8n.sh
new file mode 100755
index 0000000..d54b2f0
--- /dev/null
+++ b/deploy/unraid/setup-n8n.sh
@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+
+n8n_url="${1:-http://127.0.0.1:15678}"
+
+if ! curl -fsS "${n8n_url}/rest/settings" | grep -q '"showSetupOnFirstLoad":true'; then
+  echo "n8n owner setup is already complete"
+  exit 0
+fi
+
+owner_email="mobilityops-admin@northstar.invalid"
+owner_password="MobilityOps9-$(openssl rand -hex 16)"
+payload="$(printf '{"email":"%s","firstName":"MobilityOps","lastName":"Admin","password":"%s"}' \
+  "${owner_email}" "${owner_password}")"
+
+curl -fsS \
+  -X POST \
+  -H "Content-Type: application/json" \
+  --data-binary "${payload}" \
+  "${n8n_url}/rest/owner/setup" >/dev/null
+
+{
+  printf '\n# Server-only n8n owner access\n'
+  printf 'N8N_OWNER_EMAIL=%s\n' "${owner_email}"
+  printf 'N8N_OWNER_PASSWORD=%s\n' "${owner_password}"
+} >>.env
+chmod 0600 .env
+
+unset owner_password payload
+echo "n8n owner setup completed; server-only credentials stored in .env"