NuklearRabbit
b79d485ef1
Inspected the shared n8n instance (n8n.itworx.tech) live: both existing Fleet Ops workflows are genuinely active and structurally match the repo, but the shared X-Service-Token secret was stored as plaintext literal text in both HTTP Request nodes (exportable in the clear), and the production return webhook had n8n-level Authentication set to "None" (publicly callable by anyone who discovered the URL). Findings recorded in docs/live-ai-integration/n8n-current-state.md. Fixed on the n8n side (both workflows published): the shared token now lives in a single Header Auth credential instead of two literal copies; the return webhook now requires a second, distinct Header Auth credential. Fixed on the Fleet Ops side to match: the outbox dispatcher now sends the new X-Fleet-Ops-Trigger-Token header (new MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN setting) when calling the webhook. Live-verified against the real webhook: a request with no header is now rejected (403); a request with the correct header passes n8n's auth and reaches Fleet Ops's own business logic. That same live test also surfaced a real robustness gap: an n8n execution that errors before its "Respond to Webhook" node runs can still answer with a 2xx status and an empty body, which made response.json() raise an uncaught exception, potentially leaving the outbox event stuck in "delivering". Now treated as an explicit, retryable failure (error_code=malformedResponse), with a regression test reproducing the exact case.
51 lines
2.0 KiB
Bash
51 lines
2.0 KiB
Bash
COMPOSE_PROJECT_NAME=mobilityops
|
|
MOBILITYOPS_ENV=development
|
|
MOBILITYOPS_DEMO_MODE=true
|
|
MOBILITYOPS_PUBLIC_URL=http://localhost:1228
|
|
MOBILITYOPS_API_URL=http://localhost:8128
|
|
DATABASE_URL=postgresql+psycopg://mobilityops:mobilityops@db:5432/mobilityops
|
|
POSTGRES_DB=mobilityops
|
|
POSTGRES_USER=mobilityops
|
|
POSTGRES_PASSWORD=mobilityops
|
|
APP_SECRET=replace-in-production
|
|
TZ=Europe/Brussels
|
|
# Session cookie Secure flag. Keep false for LAN/plain-HTTP deployments (including the
|
|
# current Unraid review environment); set true only once MobilityOps is served over HTTPS,
|
|
# otherwise browsers will silently drop the cookie and no one can log in.
|
|
SESSION_COOKIE_SECURE=false
|
|
|
|
# Demo presentation (fictional org identity, badge/manifest, reset safety valve).
|
|
# DEMO_ALLOW_RESET=false permanently disables POST /api/v1/demo/reset (403), independent
|
|
# of role -- a safety valve for any environment where the dataset must not be rebuildable.
|
|
DEMO_ORGANIZATION_NAME=Northstar Mobility
|
|
DEMO_TIMEZONE=Europe/Brussels
|
|
DEMO_ALLOW_RESET=true
|
|
|
|
# n8n
|
|
N8N_BASE_URL=http://n8n:5678
|
|
N8N_WEBHOOK_URL=http://n8n:5678/webhook/mobilityops-return
|
|
N8N_ENCRYPTION_KEY=replace-me
|
|
N8N_BASIC_AUTH_ACTIVE=true
|
|
N8N_BASIC_AUTH_USER=admin
|
|
N8N_BASIC_AUTH_PASSWORD=change-me
|
|
MOBILITYOPS_CALLBACK_TOKEN=replace-me-n8n-callback-token
|
|
# Sent as the X-Fleet-Ops-Trigger-Token header when Fleet Ops calls the n8n return-
|
|
# processing webhook, so the webhook trigger can require Header Auth instead of being
|
|
# publicly callable by anyone who discovers the URL. Must match the value stored in
|
|
# n8n's "Fleet Ops Webhook Trigger Token" Header Auth credential.
|
|
MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN=replace-me-n8n-webhook-trigger-token
|
|
|
|
# RAGcore integration
|
|
KNOWLEDGE_PROVIDER=demo
|
|
RAGCORE_BASE_URL=http://ragcore-api:8000
|
|
RAGCORE_TENANT=northstar-mobility-demo
|
|
RAGCORE_WORKSPACE=mobilityops
|
|
RAGCORE_COLLECTION=internal-procedures
|
|
RAGCORE_API_TOKEN=
|
|
|
|
# ITWorx MCP Hub integration
|
|
MCP_HUB_REGISTRATION_ENABLED=false
|
|
MCP_HUB_BASE_URL=http://itworx-mcp-hub:8000
|
|
MCP_HUB_SERVICE_TOKEN=replace-me-mcp-hub-token
|
|
MCP_PROVIDER_ID=mobilityops
|