Skip to main content

07-n8n.md

kstack: book: Centerpoint Home Lab chapter: AI & Automation page: N8N tags: [n8n, automation, workflows, integration]

Overview

N8N is the workflow automation platform for the homelab. It connects services together through visual, node-based workflows — handling tasks such as document pipeline automation, audio transcription orchestration (Minuspod), API integrations, scheduled jobs, and webhook-triggered processing.

N8N is the glue layer that ties together Whisper, Ollama, Paperless, and external APIs into end-to-end automated pipelines.

Access

Type URL Notes
Internal https://n8n.home.local LAN access via Step-CA TLS — basic auth

No external (internet-facing) Traefik route. Remote access via Tailscale.

Webhooks are received at https://n8n.home.local/webhook/... — internal and Tailscale-reachable only.

Configuration

Image: n8nio/n8n:latest Compose project: Standalone (managed via Portainer)

Ports

Port Protocol Purpose
5678 TCP N8N web UI and API (host-bound)

Traefik Labels

traefik.enable: "true"
traefik.docker.network: traefik-net
traefik.http.routers.n8n.rule: Host(`n8n.home.local`)
traefik.http.routers.n8n.entrypoints: websecure
traefik.http.routers.n8n.tls.certresolver: step-ca
traefik.http.services.n8n.loadbalancer.server.port: 5678

Internal-only route.

Environment Variables

Variable Value / Notes
N8N_HOST n8n.home.local
N8N_PROTOCOL https
N8N_PORT 5678
N8N_EDITOR_BASE_URL https://n8n.home.local
WEBHOOK_URL https://n8n.home.local
N8N_BASIC_AUTH_ACTIVE true
N8N_BASIC_AUTH_USER jeeves
N8N_BASIC_AUTH_PASSWORD REDACTED
N8N_ENCRYPTION_KEY REDACTED — encrypts stored credentials
N8N_PAYLOAD_SIZE_MAX 16 (MB)
EXECUTIONS_PROCESS main
GENERIC_TIMEZONE America/Toronto

N8N_ENCRYPTION_KEY encrypts all stored credentials (API keys, passwords) in the N8N database. This key must remain constant — changing it invalidates all stored credentials and they must be re-entered.

Volumes / Bind Mounts

Host Path Container Path Purpose
/home/jeeves/docker/n8n/data /home/node/.n8n Workflows, credentials, execution history

All workflow definitions, credentials, and execution logs are stored in this bind-mounted directory. Back up before upgrades.

Networks

Network Purpose
traefik-net Exposes N8N UI and webhook endpoint

N8N calls other services by hostname (e.g. http://ollama.home.local:11434, https://whisper.home.local) — it must be on traefik-net or have DNS resolution for these names.

Dependencies

  • AdGuard Home for *.home.local DNS resolution (N8N calls other services by name)
  • Step-CA / Traefik for the n8n.home.local route
  • Services called by workflows: Ollama, Faster-Whisper, Paperless-NGX, external APIs

Notes / Gotchas

  • N8N stores all credentials encrypted with N8N_ENCRYPTION_KEY. If this key is lost or rotated, all stored API keys and passwords must be re-entered manually.
  • EXECUTIONS_PROCESS=main runs workflow executions in the main process. For high concurrency, consider EXECUTIONS_PROCESS=own with worker processes, but this requires additional setup.
  • Webhook URLs are internal only (https://n8n.home.local/webhook/...). External webhooks (e.g. from GitHub, Stripe) will not reach N8N unless a Tailscale exit node or Traefik external route is configured.
  • N8N_PAYLOAD_SIZE_MAX=16 limits incoming webhook payload size to 16 MB. Increase this if processing large audio or document payloads via webhook.
  • The latest tag may introduce breaking changes between workflow schema versions. Pin to a specific N8N version before any significant workflow investments.

Last Updated: 2026-06-16

Back to top