NuklearRabbit
b79d485ef1
Inspected the shared n8n instance (n8n.itworx.tech) live: both existing Fleet Ops workflows are genuinely active and structurally match the repo, but the shared X-Service-Token secret was stored as plaintext literal text in both HTTP Request nodes (exportable in the clear), and the production return webhook had n8n-level Authentication set to "None" (publicly callable by anyone who discovered the URL). Findings recorded in docs/live-ai-integration/n8n-current-state.md. Fixed on the n8n side (both workflows published): the shared token now lives in a single Header Auth credential instead of two literal copies; the return webhook now requires a second, distinct Header Auth credential. Fixed on the Fleet Ops side to match: the outbox dispatcher now sends the new X-Fleet-Ops-Trigger-Token header (new MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN setting) when calling the webhook. Live-verified against the real webhook: a request with no header is now rejected (403); a request with the correct header passes n8n's auth and reaches Fleet Ops's own business logic. That same live test also surfaced a real robustness gap: an n8n execution that errors before its "Respond to Webhook" node runs can still answer with a 2xx status and an empty body, which made response.json() raise an uncaught exception, potentially leaving the outbox event stuck in "delivering". Now treated as an explicit, retryable failure (error_code=malformedResponse), with a regression test reproducing the exact case.
89 lines
3.1 KiB
YAML
89 lines
3.1 KiB
YAML
services:
|
|
db:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_DB: ${POSTGRES_DB:-mobilityops}
|
|
POSTGRES_USER: ${POSTGRES_USER:-mobilityops}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-mobilityops}
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-mobilityops} -d ${POSTGRES_DB:-mobilityops}"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 20
|
|
volumes:
|
|
- mobilityops-db:/var/lib/postgresql/data
|
|
networks: [mobilityops]
|
|
|
|
api:
|
|
build:
|
|
context: .
|
|
dockerfile: backend/Dockerfile
|
|
environment:
|
|
MOBILITYOPS_ENV: ${MOBILITYOPS_ENV:-development}
|
|
MOBILITYOPS_DEMO_MODE: ${MOBILITYOPS_DEMO_MODE:-true}
|
|
DATABASE_URL: ${DATABASE_URL:-postgresql+psycopg://mobilityops:mobilityops@db:5432/mobilityops}
|
|
TZ: ${TZ:-Europe/Brussels}
|
|
APP_SECRET: ${APP_SECRET:-replace-in-production}
|
|
CORS_ALLOW_ORIGINS: ${MOBILITYOPS_PUBLIC_URL:-http://localhost:1228}
|
|
KNOWLEDGE_PROVIDER: ${KNOWLEDGE_PROVIDER:-demo}
|
|
RAGCORE_BASE_URL: ${RAGCORE_BASE_URL:-http://ragcore-api:8000}
|
|
RAGCORE_TENANT: ${RAGCORE_TENANT:-northstar-mobility-demo}
|
|
RAGCORE_WORKSPACE: ${RAGCORE_WORKSPACE:-mobilityops}
|
|
RAGCORE_COLLECTION: ${RAGCORE_COLLECTION:-internal-procedures}
|
|
RAGCORE_API_TOKEN: ${RAGCORE_API_TOKEN:-}
|
|
N8N_WEBHOOK_URL: ${N8N_WEBHOOK_URL:-http://n8n:5678/webhook/mobilityops-return}
|
|
N8N_WEBHOOK_TRIGGER_TOKEN: ${MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN:-replace-me-n8n-webhook-trigger-token}
|
|
N8N_CALLBACK_TOKEN: ${MOBILITYOPS_CALLBACK_TOKEN:-replace-me-n8n-callback-token}
|
|
MCP_HUB_SERVICE_TOKEN: ${MCP_HUB_SERVICE_TOKEN:-replace-me-mcp-hub-token}
|
|
DEMO_ORGANIZATION_NAME: ${DEMO_ORGANIZATION_NAME:-Northstar Mobility}
|
|
DEMO_TIMEZONE: ${DEMO_TIMEZONE:-Europe/Brussels}
|
|
DEMO_ALLOW_RESET: ${DEMO_ALLOW_RESET:-true}
|
|
ports:
|
|
- "8128:8000"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
networks: [mobilityops]
|
|
|
|
web:
|
|
build: ./frontend
|
|
environment:
|
|
VITE_API_BASE_URL: ${MOBILITYOPS_API_URL:-http://localhost:8128}
|
|
ports:
|
|
- "1228:80"
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
networks: [mobilityops]
|
|
|
|
n8n:
|
|
image: n8nio/n8n:latest
|
|
environment:
|
|
TZ: ${TZ:-Europe/Brussels}
|
|
GENERIC_TIMEZONE: ${TZ:-Europe/Brussels}
|
|
N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY:-replace-me}
|
|
N8N_BASIC_AUTH_ACTIVE: ${N8N_BASIC_AUTH_ACTIVE:-true}
|
|
N8N_BASIC_AUTH_USER: ${N8N_BASIC_AUTH_USER:-admin}
|
|
N8N_BASIC_AUTH_PASSWORD: ${N8N_BASIC_AUTH_PASSWORD:-change-me}
|
|
N8N_SECURE_COOKIE: "false"
|
|
N8N_BLOCK_ENV_ACCESS_IN_NODE: "false"
|
|
MOBILITYOPS_CALLBACK_TOKEN: ${MOBILITYOPS_CALLBACK_TOKEN:-replace-me-n8n-callback-token}
|
|
ports:
|
|
- "5678:5678"
|
|
volumes:
|
|
- mobilityops-n8n:/home/node/.n8n
|
|
- ./n8n:/imports:ro
|
|
networks: [mobilityops]
|
|
|
|
networks:
|
|
mobilityops:
|
|
|
|
volumes:
|
|
mobilityops-db:
|
|
mobilityops-n8n:
|