TODO

• Owner account: the owner signs in with the role secret owner_password, not with lookup('users', 'administrator').password (measured on 2.42.3: POST /rest/login with the administrator password answers 401 “Wrong username or password”). Until tasks/01_bootstrap.yml runs, /setup lets any visitor create the owner, and the password converge at tasks/01_bootstrap.yml:82 passes N8N_OWNER_PASSWORD in argv. n8n 2.42.3 seeds and overwrites the owner before the server starts from N8N_INSTANCE_OWNER_MANAGED_BY_ENV=true with N8N_INSTANCE_OWNER_EMAIL, N8N_INSTANCE_OWNER_FIRST_NAME, N8N_INSTANCE_OWNER_LAST_NAME and a bcrypt N8N_INSTANCE_OWNER_PASSWORD_HASH, which removes the window, the converge task and the secret. Blocker: Ansible’s password_hash('bcrypt') fails on the controller, because passlib 1.7.4 with bcrypt 5.0.0 in /opt/venvs/infinito raises ValueError: password cannot be longer than 72 bytes in passlib’s wrap-bug self-test. Options: pin bcrypt<4.1 in the controller environment, or compute the hash with bcrypt.hashpw in a controller task that reads the password from its environment (a fixed salt needs its 22nd character in .Oeu, otherwise pyca bcrypt answers “Invalid salt”).

• External calls: every signed-in page requests https://api.n8n.io/api/banners, /api/versions/<running version> and /api/whats-new; the CSP blocks all three (measured on 2.42.3 as failed requests, no page error). Set N8N_VERSION_NOTIFICATIONS_ENABLED=false in templates/env.j2.