---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-runner
  labels:
    app: n8n
    component: runner
spec:
  replicas: 2
  selector:
    matchLabels:
      app: n8n
      component: runner
  template:
    metadata:
      labels:
        app: n8n
        component: runner
    spec:
      serviceAccountName: n8n
      containers:
      - name: n8n-runner
        image: docker.n8n.io/n8nio/runners:latest
        ports:
        - containerPort: 5680
          name: health
        env:
        - name: PATH
          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
        - name: HOME
          value: "/home/node"
        - name: N8N_RUNNERS_TASK_BROKER_URI
          value: "http://n8n:5679"
        - name: N8N_RUNNERS_LAUNCHER_LOG_LEVEL
          value: "info"
        - name: N8N_RUNNERS_MAX_CONCURRENCY
          value: "10"
        - name: GENERIC_TIMEZONE
          value: "Europe/Moscow"
        - name: TZ
          value: "Europe/Moscow"
        - name: N8N_RUNNERS_AUTH_TOKEN
          valueFrom:
            secretKeyRef:
              name: credentials
              key: runnertoken
        volumeMounts:
        - name: n8n-data
          mountPath: /home/node/.n8n
        - name: tools
          mountPath: /opt/tools
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 2000m
            memory: 2048Mi
        livenessProbe:
          httpGet:
            path: /healthz
            port: 5680
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /healthz
            port: 5680
          initialDelaySeconds: 15
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
      volumes:
      - name: n8n-data
        persistentVolumeClaim:
          claimName: n8n-data
      - name: tools
        persistentVolumeClaim:
          claimName: n8n-tools
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        fsGroup: 1000