Episode 8: n8n as the automation hub, with the editor kept off the public internet

Three workflows that connect the services from episodes 1 to 7: a Forgejo push
becomes a phone notification, an Uptime Kuma outage writes and closes its own
incident page in Outline, and a nightly schedule writes one ops digest.

The point of the episode is the split between webhooks and the editor. Caddy
publishes only the webhook path prefixes under the n8n host and answers an
empty 404 for everything else, so the editor stays reachable over the mesh from
episode 5 and never gets a login page on the open internet.

Also in here:
- n8n pinned to a version instead of :latest, after episode 7 showed that every
  restore is otherwise an upgrade
- the 2.x environment that actually matters, including the file access
  restriction pointed at one directory rather than the root
- the Forgejo allowed host list, without which a webhook to a private address
  is silently dropped
- fixed subnets for both docker networks, after a restore handed them out in
  the other order and quietly broke the mesh route
- a note on the encryption key: it decrypts every stored credential, it lives in
  the n8n volume, and a backup without it restores a hub that cannot log in

Claude-Session: https://claude.ai/code/session_01Md8yhBKp5e7xMmCyxoEgdm

Caddyfile

@@ -26,7 +26,19 @@ ntfy.{$DOMAIN} {
 	reverse_proxy ntfy:80
 }
 
-# n8n has no public route any more - it is reachable over the mesh only (episode 5)
+# Automation (episode 8). The editor never becomes public: only the webhook
+# paths are served, everything else under this host answers an empty 404.
+# A webhook sender out on the internet cannot join your mesh, so this is the
+# one door that has to stay open - and it is exactly one door wide.
+n8n.{$DOMAIN} {
+	@webhooks path /webhook/* /webhook-test/* /webhook-waiting/*
+	handle @webhooks {
+		reverse_proxy n8n:5678
+	}
+	handle {
+		respond 404
+	}
+}
 
 # NetBird control plane (episode 5) - dashboard, API, gRPC, relay, built-in IdP
 vpn.{$DOMAIN} {