Episode 8: n8n as the automation hub, with the editor kept off the public internet

Three workflows that connect the services from episodes 1 to 7: a Forgejo push
becomes a phone notification, an Uptime Kuma outage writes and closes its own
incident page in Outline, and a nightly schedule writes one ops digest.

The point of the episode is the split between webhooks and the editor. Caddy
publishes only the webhook path prefixes under the n8n host and answers an
empty 404 for everything else, so the editor stays reachable over the mesh from
episode 5 and never gets a login page on the open internet.

Also in here:
- n8n pinned to a version instead of :latest, after episode 7 showed that every
  restore is otherwise an upgrade
- the 2.x environment that actually matters, including the file access
  restriction pointed at one directory rather than the root
- the Forgejo allowed host list, without which a webhook to a private address
  is silently dropped
- fixed subnets for both docker networks, after a restore handed them out in
  the other order and quietly broke the mesh route
- a note on the encryption key: it decrypts every stored credential, it lives in
  the n8n volume, and a backup without it restores a hub that cannot log in

Claude-Session: https://claude.ai/code/session_01Md8yhBKp5e7xMmCyxoEgdm

HARDENING.md

@@ -138,3 +138,58 @@ it — the example in `examples/deploy-hello-ops.sh` strips everything that is n
 hex character, because it only ever expects an image tag. The deploy user needs
 Docker access, so the forced command is the thing containing it; without the forced
 command, membership in the `docker` group is equivalent to root.
+
+## Automation: the small door and the one file (episode 8)
+
+**Publish paths, not hosts.** n8n needs a public address for webhooks that come
+from outside, and for nothing else. The site block in `Caddyfile` serves
+`/webhook/*`, `/webhook-test/*` and `/webhook-waiting/*` and answers an empty
+404 for every other path, so the editor, the login page and the REST API are not
+part of the public surface. The check is one line:
+
+```bash
+curl -o /dev/null -w '%{http_code}\n' https://n8n.<DOMAIN>/rest/settings   # 404
+curl -o /dev/null -w '%{http_code}\n' -X POST https://n8n.<DOMAIN>/webhook/<path>   # 200
+```
+
+`/webhook-test/*` only does anything while somebody has "Test workflow" open in
+the editor. If you never test against an outside sender, drop it from the
+matcher and the surface gets smaller again.
+
+**Senders inside the box should stay inside the box.** Forgejo and Uptime Kuma
+reach `http://n8n:5678/webhook/...` over the docker network. No certificate, no
+published port, no trip through the public IP. Forgejo blocks private targets by
+default; `FORGEJO__webhook__ALLOWED_HOST_LIST: "external,n8n"` allows exactly
+that one name and leaves the rest of the block in place.
+
+**`/home/node/.n8n/config` is the whole credential store.** It contains
+`encryptionKey`, and every credential in `database.sqlite` is encrypted with it.
+Lose the file and the database is landfill: n8n starts, writes a fresh key, the
+workflows still look fine, and the first run fails with
+
+```
+Credentials could not be decrypted. The likely reason is that a different
+"encryptionKey" was used to encrypt the data.
+```
+
+The episode 7 backup covers the whole volume, so the key is in the snapshot.
+Confirm it instead of assuming:
+
+```bash
+restic ls latest | grep n8n_data/_data/config
+```
+
+If you set `N8N_ENCRYPTION_KEY` in the environment, that value wins, the file is
+never written, and the key then has to live in your password manager and survive
+the box.
+
+**Keep the file nodes on a leash.** `N8N_RESTRICT_FILE_ACCESS_TO: /backup` lets
+the digest workflow read the backup log and nothing else. Left unset or widened
+to `/`, a workflow, or anyone who can edit one, can read the encryption key from
+inside n8n itself.
+
+**Pin the image, pin the subnets.** `docker.n8n.io/n8nio/n8n:latest` turns every
+restore into an unplanned upgrade. The `ipam` blocks under `networks:` do the
+same job for addresses: Compose hands subnets out in creation order, so a
+restore onto a fresh box can renumber them, and every mesh route that points at
+the old range stops working without an error anywhere.