nixos/n8n: use env vars instead of config file

nixos/modules/services/misc/n8n.nix

@@ -6,10 +6,17 @@
 }:
 let
   cfg = config.services.n8n;
-  format = pkgs.formats.json { };
-  configFile = format.generate "n8n.json" cfg.settings;
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "n8n" "settings" ] "Use services.n8n.environment instead.")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "n8n"
+      "webhookUrl"
+    ] "Use services.n8n.environment.WEBHOOK_URL instead.")
+  ];
+
   options.services.n8n = {
     enable = lib.mkEnableOption "n8n server";
 
@@ -19,47 +26,66 @@ in
       description = "Open ports in the firewall for the n8n web interface.";
     };
 
-    settings = lib.mkOption {
-      type = format.type;
+    environment = lib.mkOption {
+      description = ''
+        Environment variables to pass to the n8n service.
+        See <https://docs.n8n.io/hosting/configuration/environment-variables/> for available options.
+      '';
+      type = lib.types.submodule {
+        freeformType = with lib.types; attrsOf str;
+        options = {
+          GENERIC_TIMEZONE = lib.mkOption {
+            type = with lib.types; nullOr str;
+            default = config.time.timeZone;
+            defaultText = lib.literalExpression "config.time.timeZone";
+            description = ''
+              The n8n instance timezone. Important for schedule nodes (such as Cron).
+            '';
+          };
+          N8N_PORT = lib.mkOption {
+            type = with lib.types; coercedTo port toString str;
+            default = 5678;
+            description = "The HTTP port n8n runs on.";
+          };
+          N8N_USER_FOLDER = lib.mkOption {
+            type = lib.types.path;
+            # This folder must be writeable as the application is storing
+            # its data in it, so the StateDirectory is a good choice
+            default = "/var/lib/n8n";
+            description = ''
+              Provide the path where n8n will create the .n8n folder.
+              This directory stores user-specific data, such as database file and encryption key.
+            '';
+            readOnly = true;
+          };
+          N8N_DIAGNOSTICS_ENABLED = lib.mkOption {
+            type = with lib.types; coercedTo bool toString str;
+            default = false;
+            description = ''
+              Whether to share selected, anonymous telemetry with n8n.
+              Note that if you set this to false, you can't enable Ask AI in the Code node.
+            '';
+          };
+          N8N_VERSION_NOTIFICATIONS_ENABLED = lib.mkOption {
+            type = with lib.types; coercedTo bool toString str;
+            default = false;
+            description = ''
+              When enabled, n8n sends notifications of new versions and security updates.
+            '';
+          };
+        };
+      };
       default = { };
-      description = ''
-        Configuration for n8n, see <https://docs.n8n.io/hosting/environment-variables/configuration-methods/>
-        for supported values.
-      '';
     };
-
-    webhookUrl = lib.mkOption {
-      type = lib.types.str;
-      default = "";
-      description = ''
-        WEBHOOK_URL for n8n, in case we're running behind a reverse proxy.
-        This cannot be set through configuration and must reside in an environment variable.
-      '';
-    };
-
   };
 
   config = lib.mkIf cfg.enable {
-    services.n8n.settings = {
-      # We use this to open the firewall, so we need to know about the default at eval time
-      port = lib.mkDefault 5678;
-    };
-
     systemd.services.n8n = {
-      description = "N8N service";
+      description = "n8n service";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      environment = {
-        # This folder must be writeable as the application is storing
-        # its data in it, so the StateDirectory is a good choice
-        N8N_USER_FOLDER = "/var/lib/n8n";
-        HOME = "/var/lib/n8n";
-        N8N_CONFIG_FILES = "${configFile}";
-        WEBHOOK_URL = "${cfg.webhookUrl}";
-
-        # Don't phone home
-        N8N_DIAGNOSTICS_ENABLED = "false";
-        N8N_VERSION_NOTIFICATIONS_ENABLED = "false";
+      environment = cfg.environment // {
+        HOME = config.services.n8n.environment.N8N_USER_FOLDER;
       };
       serviceConfig = {
         Type = "simple";
@@ -88,7 +114,7 @@ in
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
-      allowedTCPPorts = [ cfg.settings.port ];
+      allowedTCPPorts = [ (lib.toInt cfg.environment.N8N_PORT) ];
     };
   };
 }

nixos/tests/n8n.nix

@@ -23,7 +23,7 @@ in
 
       services.n8n = {
         enable = true;
-        webhookUrl = webhookUrl;
+        environment.WEBHOOK_URL = webhookUrl;
       };
     };
 
@@ -32,5 +32,7 @@ in
     machine.wait_for_console_text("Editor is now accessible via")
     machine.succeed("curl --fail -vvv http://localhost:${toString port}/")
     machine.succeed("grep -qF ${webhookUrl} /etc/systemd/system/n8n.service")
+    machine.succeed("grep -qF 'HOME=/var/lib/n8n' /etc/systemd/system/n8n.service")
+    machine.fail("grep -qF 'GENERIC_TIMEZONE=' /etc/systemd/system/n8n.service")
   '';
 }