n8n Cloud Run 部署脚本生成器

cat << 'EOF' > deploy-n8n.sh
#!/bin/bash
set -e
 
# ================= 1. 请修改以下 7 个配置变量 =================
export PROJECT_ID="你的-gcp-项目-id"
export REGION="asia-east1"                  # 台湾 彰化
export SERVICE_NAME="n8n"
 
# 填入第一步获取的 Neon 数据库连接信息 (务必带 -pooler)
export NEON_HOST="ep-xxx-pooler.ap-southeast-1.aws.neon.tech"
export NEON_DB="neondb"
export NEON_USER="neondb_owner"
export NEON_PASS="你的Neon数据库密码"
 
# 填入第二步获取的 Gmail 信息
export GMAIL_USER="你的邮箱@gmail.com"
export GMAIL_APP_PASS="你的16位应用专用密码(无空格)"
# ===============================================================
 
# ============ 2. 本次部署随机标识（每次生成都不同）============
# Secret 名称会带上这个后缀；重复执行同一份脚本仍然安全（只会新增版本）
export DEPLOY_ID="pending"
export SECRET_ENCRYPTION_KEY="n8n-encryption-key${DEPLOY_ID}"
export SECRET_DB_PASSWORD="n8n-db-password${DEPLOY_ID}"
export SECRET_SMTP_PASSWORD="n8n-smtp-password${DEPLOY_ID}"
# ⚠️ 加密密钥随标识变化：要沿用已有 n8n 数据（里面存着加密后的凭证），
#    请继续用同一份脚本，或把 SECRET_ENCRYPTION_KEY 改成上一套脚本用过的名字
# ===============================================================
 
echo "🚀 [1/4] 设置 GCP 项目并启用必要 API..."
gcloud config set project $PROJECT_ID
gcloud services enable run.googleapis.com secretmanager.googleapis.com
 
echo "🔐 [2/4] 创建并配置 Secret Manager 敏感密钥..."
# 生成固定的 n8n 凭证加密密钥（若已存在则跳过，切勿轻易覆盖）
if ! gcloud secrets describe $SECRET_ENCRYPTION_KEY >/dev/null 2>&1; then
  openssl rand -base64 32 | gcloud secrets create $SECRET_ENCRYPTION_KEY --data-file=-
fi
 
# 写入或更新数据库密码
if ! gcloud secrets describe $SECRET_DB_PASSWORD >/dev/null 2>&1; then
  echo -n "$NEON_PASS" | gcloud secrets create $SECRET_DB_PASSWORD --data-file=-
else
  echo -n "$NEON_PASS" | gcloud secrets versions add $SECRET_DB_PASSWORD --data-file=-
fi
 
# 写入或更新 Gmail App Password
if ! gcloud secrets describe $SECRET_SMTP_PASSWORD >/dev/null 2>&1; then
  echo -n "$GMAIL_APP_PASS" | gcloud secrets create $SECRET_SMTP_PASSWORD --data-file=-
else
  echo -n "$GMAIL_APP_PASS" | gcloud secrets versions add $SECRET_SMTP_PASSWORD --data-file=-
fi
 
# 授予 Cloud Run 运行时服务账号读取 Secret 的权限
PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format="value(projectNumber)")
SA_EMAIL="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
 
# 新版 GCP 项目不再预置默认计算服务账号：启用 Compute Engine API 会自动创建
if ! gcloud iam service-accounts describe "$SA_EMAIL" >/dev/null 2>&1; then
  echo "⚠️ 未找到默认计算服务账号，启用 Compute Engine API 以自动创建..."
  gcloud services enable compute.googleapis.com
fi
 
for _ in $(seq 1 12); do
  if gcloud iam service-accounts describe "$SA_EMAIL" >/dev/null 2>&1; then
    break
  fi
  sleep 5
done
 
# 等待后仍不存在时改用专用服务账号，并在部署时显式指定
DEPLOY_SA_FLAG=""
if ! gcloud iam service-accounts describe "$SA_EMAIL" >/dev/null 2>&1; then
  SA_EMAIL="n8n-run@${PROJECT_ID}.iam.gserviceaccount.com"
  DEPLOY_SA_FLAG="--service-account=${SA_EMAIL}"
  echo "⚠️ 默认计算服务账号仍不可用，改用专用服务账号：$SA_EMAIL"
  gcloud services enable iam.googleapis.com
  gcloud iam service-accounts create n8n-run \
    --display-name="n8n Cloud Run runtime" >/dev/null 2>&1 || true
fi
 
echo "🛡️ 运行时服务账号：$SA_EMAIL"
for SECRET in $SECRET_ENCRYPTION_KEY $SECRET_DB_PASSWORD $SECRET_SMTP_PASSWORD; do
  gcloud secrets add-iam-policy-binding $SECRET \
    --member="serviceAccount:${SA_EMAIL}" \
    --role="roles/secretmanager.secretAccessor" >/dev/null
done
 
echo "📦 [3/4] 部署 n8n 容器到 Google Cloud Run..."
gcloud run deploy $SERVICE_NAME \
  --image=n8nio/n8n:latest \
  --region=$REGION \
  $DEPLOY_SA_FLAG \
  --allow-unauthenticated \
  --port=5678 \
  --memory=2Gi \
  --cpu=1 \
  --min-instances=0 \
  --max-instances=2 \
  --no-cpu-throttling \
  --set-secrets="N8N_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY}:latest,DB_POSTGRESDB_PASSWORD=${SECRET_DB_PASSWORD}:latest,N8N_SMTP_PASS=${SECRET_SMTP_PASSWORD}:latest" \
  --set-env-vars="N8N_PORT=5678,N8N_PROTOCOL=https,NODE_ENV=production" \
  --set-env-vars="GENERIC_TIMEZONE=Asia/Shanghai,TZ=Asia/Shanghai" \
  --set-env-vars="N8N_ENDPOINT_HEALTH=health" \
  --set-env-vars="DB_TYPE=postgresdb" \
  --set-env-vars="DB_POSTGRESDB_HOST=${NEON_HOST}" \
  --set-env-vars="DB_POSTGRESDB_PORT=5432" \
  --set-env-vars="DB_POSTGRESDB_DATABASE=${NEON_DB}" \
  --set-env-vars="DB_POSTGRESDB_USER=${NEON_USER}" \
  --set-env-vars="DB_POSTGRESDB_SSL=true" \
  --set-env-vars="DB_POSTGRESDB_SSL_REJECT_UNAUTHORIZED=false" \
  --set-env-vars="N8N_EMAIL_MODE=smtp" \
  --set-env-vars="N8N_SMTP_HOST=smtp.gmail.com" \
  --set-env-vars="N8N_SMTP_PORT=465" \
  --set-env-vars="N8N_SMTP_SSL=true" \
  --set-env-vars="N8N_SMTP_USER=${GMAIL_USER}" \
  --set-env-vars="N8N_SMTP_SENDER=${GMAIL_USER}"
 
echo "🔗 [4/4] 自动提取 Cloud Run 域名并回填 Webhook 环境变量..."
export SERVICE_URL=$(gcloud run services describe $SERVICE_NAME --region=$REGION --format='value(status.url)')
export SERVICE_HOST=${SERVICE_URL#https://}
 
gcloud run services update $SERVICE_NAME \
  --region=$REGION \
  --update-env-vars="WEBHOOK_URL=${SERVICE_URL}/,N8N_HOST=${SERVICE_HOST},N8N_EDITOR_BASE_URL=${SERVICE_URL}/"
 
echo "============================================================"
echo "🎉 部署大功告成！请点击以下链接访问并初始化你的 n8n："
echo "$SERVICE_URL"
echo "============================================================"
EOF