chore(deploy): automate private n8n bootstrap

deploy/unraid/README.md

@@ -27,10 +27,19 @@ docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec api \
   python -m app.cli seed --reset
 ```
 
-Migrations run automatically in the API entrypoint. For the one-time n8n owner setup,
+Migrations run automatically in the API entrypoint. Complete the one-time n8n owner
-forward a local port over SSH to server loopback, open that local URL, then run the
+setup without exposing its editor to the LAN, then import and publish the workflow:
-documented workflow import/publish commands from `docs/17-runbook.md` with both Compose
+
-files supplied.
+```bash
+./deploy/unraid/setup-n8n.sh http://127.0.0.1:15678
+docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec n8n \
+  n8n import:workflow --input=//imports/mobilityops-return-processing.json
+docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml exec n8n \
+  n8n publish:workflow --id=mobilityops-return-processing
+docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml restart n8n
+```
+
+The generated n8n owner credentials remain only in the mode-`0600` server `.env`.
 
 ## Operate
 

deploy/unraid/setup-n8n.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+
+n8n_url="${1:-http://127.0.0.1:15678}"
+
+if ! curl -fsS "${n8n_url}/rest/settings" | grep -q '"showSetupOnFirstLoad":true'; then
+  echo "n8n owner setup is already complete"
+  exit 0
+fi
+
+owner_email="mobilityops-admin@northstar.invalid"
+owner_password="MobilityOps9-$(openssl rand -hex 16)"
+payload="$(printf '{"email":"%s","firstName":"MobilityOps","lastName":"Admin","password":"%s"}' \
+  "${owner_email}" "${owner_password}")"
+
+curl -fsS \
+  -X POST \
+  -H "Content-Type: application/json" \
+  --data-binary "${payload}" \
+  "${n8n_url}/rest/owner/setup" >/dev/null
+
+{
+  printf '\n# Server-only n8n owner access\n'
+  printf 'N8N_OWNER_EMAIL=%s\n' "${owner_email}"
+  printf 'N8N_OWNER_PASSWORD=%s\n' "${owner_password}"
+} >>.env
+chmod 0600 .env
+
+unset owner_password payload
+echo "n8n owner setup completed; server-only credentials stored in .env"