n8n

A self-hosted workflow automation platform with a visual node editor.

n8n is an open-source workflow automation tool that connects hundreds of apps and services via a visual drag-and-drop editor. It supports custom JavaScript/Python code nodes, webhooks, and scheduled triggers. Self-hosting means unlimited workflows, no per-execution pricing, and full data privacy.

Alternatives considered

Cloud Hosted

Tool	Open Source	Free Tier	Monthly Cost
Zapier	No	Limited	From $19.99/mo
Make	No	Limited	From $9/mo
Pipedream	No	Limited	From $29/mo

Installation

Architecture

• Deployment: Single n8n deployment in the n8n namespace
• Image: docker.io/n8nio/n8n, pinned by tag and digest via Renovate
• Database: CNPG PostgreSQL cluster for workflow definitions and execution history
• Storage: Longhorn PVC (n8n-data) for workflow data; emptyDir for cache
• Networking: ClusterIP service on port 5678, HTTPRoute via internal gateway

Security

• Runs as runAsUser: 1000, runAsNonRoot: true, readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, capabilities dropped
• Longhorn PVC encrypted at rest via SOPS-managed keys

Updates

Managed by Renovate. Image is digest-pinned.

Data Management

• Database: CNPG PostgreSQL cluster (Longhorn-encrypted PVCs)
• PVC: n8n-data (Longhorn-encrypted, k8up.io/backup: "true") for workflow data
• Backups: k8up Schedules to Hetzner and Backblaze via restic, covering the data PVC and the database dump from the backups-cnpg PreBackupPod.

User Management

No OIDC configured. User accounts managed through the n8n admin UI. N8N_RUNNERS_ENABLED configured for workflow execution.

Configuration Management

• DB_TYPE, N8N_RUNNERS_ENABLED, base URL from ConfigMap env vars
• Database credentials injected from CNPG-generated secret
• Longhorn encryption key from SOPS-encrypted secret

Usage

Build automation workflows by connecting nodes (triggers, actions, transformations) in the visual editor. Use webhook nodes to trigger workflows from external services. Schedule recurring tasks with the cron trigger. The PostgreSQL backend stores workflow definitions and execution history.

Cluster-specific deviations from the above live in the per-cluster README — see k8s/apps/n8n/talos/README.md.

Cluster Deployment

App URLs

• n8n.web.kueber.eu

Depends on

• CloudNative-PG
• Envoy Gateway
• k8up backups
• Longhorn

n8n — Talos cluster

Kubernetes Metadata

• Image: docker.io/n8nio/n8n:2.44.3@sha256:5032941f437e1daa421cad0cc3ea57cd054f0d44a7256b38a0a3fca1b460834a

Rendered manifests (kustomize build)

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    kustomize.toolkit.fluxcd.io/force: enabled
  labels:
    app.kubernetes.io/name: n8n
  name: n8n
  namespace: n8n
spec:
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: n8n
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: n8n
    spec:
      automountServiceAccountToken: false
      containers:
        - env:
            - name: N8N_RUNNERS_ENABLED
              value: 'true'
            - name: VUE_APP_URL_BASE_API
              value: https://n8n.web.kueber.e/
            - name: DB_TYPE
              value: postgres
            - name: DB_POSTGRESDB_HOST
              valueFrom:
                secretKeyRef:
                  key: host
                  name: cnpg-app
            - name: DB_POSTGRESDB_DATABASE
              valueFrom:
                secretKeyRef:
                  key: dbname
                  name: cnpg-app
            - name: DB_POSTGRESDB_USER
              valueFrom:
                secretKeyRef:
                  key: user
                  name: cnpg-app
            - name: DB_POSTGRESDB_PASSWORD
              valueFrom:
                secretKeyRef:
                  key: password
                  name: cnpg-app
            - name: N8N_EMAIL_MODE
              value: smtp
            - name: N8N_SMTP_HOST
              valueFrom:
                secretKeyRef:
                  key: host
                  name: allinkl-smtp-credentials
            - name: N8N_SMTP_PORT
              valueFrom:
                secretKeyRef:
                  key: port
                  name: allinkl-smtp-credentials
            - name: N8N_SMTP_SSL
              value: 'false'
            - name: N8N_SMTP_USER
              valueFrom:
                secretKeyRef:
                  key: username
                  name: allinkl-smtp-credentials
            - name: N8N_SMTP_PASS
              valueFrom:
                secretKeyRef:
                  key: password
                  name: allinkl-smtp-credentials
            - name: N8N_SMTP_SENDER
              valueFrom:
                secretKeyRef:
                  key: from
                  name: allinkl-smtp-credentials
          image: docker.io/n8nio/n8n:2.44.3@sha256:5032941f437e1daa421cad0cc3ea57cd054f0d44a7256b38a0a3fca1b460834a
          name: n8n
          ports:
            - containerPort: 5678
              name: web
              protocol: TCP
          readinessProbe:
            failureThreshold: 1
            httpGet:
              path: /
              port: 5678
            initialDelaySeconds: 2
            periodSeconds: 3
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            limits:
              memory: 768Mi
            requests:
              cpu: 25m
              memory: 384Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            privileged: false
            readOnlyRootFilesystem: true
          volumeMounts:
            - mountPath: /home/node/.n8n
              name: n8n-data
            - mountPath: /home/node/.cache
              name: n8n-cache
      priorityClassName: tier-2
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: OnRootMismatch
        runAsGroup: 1000
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
      volumes:
        - name: n8n-data
          persistentVolumeClaim:
            claimName: n8n-data
        - emptyDir: {}
          name: n8n-cache