Episode 8: n8n as the automation hub, with the editor kept off the public internet

Three workflows that connect the services from episodes 1 to 7: a Forgejo push
becomes a phone notification, an Uptime Kuma outage writes and closes its own
incident page in Outline, and a nightly schedule writes one ops digest.

The point of the episode is the split between webhooks and the editor. Caddy
publishes only the webhook path prefixes under the n8n host and answers an
empty 404 for everything else, so the editor stays reachable over the mesh from
episode 5 and never gets a login page on the open internet.

Also in here:
- n8n pinned to a version instead of :latest, after episode 7 showed that every
  restore is otherwise an upgrade
- the 2.x environment that actually matters, including the file access
  restriction pointed at one directory rather than the root
- the Forgejo allowed host list, without which a webhook to a private address
  is silently dropped
- fixed subnets for both docker networks, after a restore handed them out in
  the other order and quietly broke the mesh route
- a note on the encryption key: it decrypts every stored credential, it lives in
  the n8n volume, and a backup without it restores a hub that cannot log in

Claude-Session: https://claude.ai/code/session_01Md8yhBKp5e7xMmCyxoEgdm

README.md

@@ -27,7 +27,7 @@ From the video: **[Self-Hosted Company Stack for €15/Month (Full Setup)](https
 | [Outline](https://www.getoutline.com) | `wiki.…` | Notion | $10/user/mo |
 | [Vaultwarden](https://github.com/dani-garcia/vaultwarden) | `vault.…` | 1Password | $8/user/mo |
 | [Uptime Kuma](https://github.com/louislam/uptime-kuma) | `status.…` | Pingdom & co. | $20+/mo |
-| [n8n](https://n8n.io) | `n8n.…` | Zapier | $30+/mo |
+| [n8n](https://n8n.io) | `n8n.…` (webhooks only, episode 8) | Zapier | €26+/mo |
 | [wg-easy](https://github.com/wg-easy/wg-easy) | `vpn.…` | Tailscale | $6/user/mo |
 
 All images are multi-arch (amd64 + arm64) — a €14 ARM cloud box (e.g. Hetzner
@@ -207,6 +207,37 @@ docker compose exec ntfy ntfy access kuma alerts write-only
 The full walkthrough, the second-eye compose file and the gotchas are in
 **[monitoring/README.md](monitoring/README.md)**.
 
+## Automation that connects the rest (Episode 8)
+
+n8n is the piece that makes the other six talk to each other. A push becomes a
+notification, a monitor going red becomes an incident document, and every
+morning one document says what the box did overnight.
+
+The interesting part is the address. Automation needs webhooks, webhooks look
+like they need a public host, and the editor still has no business being on the
+internet. So the Caddyfile publishes **paths, not a host**:
+
+```
+n8n.{$DOMAIN} {
+	@webhooks path /webhook/* /webhook-test/* /webhook-waiting/*
+	handle @webhooks {
+		reverse_proxy n8n:5678
+	}
+	handle {
+		respond 404
+	}
+}
+```
+
+Everything else under `n8n.<DOMAIN>` answers an empty 404: the editor, the login
+page, the REST API. You open the editor over the mesh from episode 5. Senders
+that live on the box (Forgejo, Uptime Kuma) skip the public address entirely and
+call `http://n8n:5678/webhook/...` over the docker network.
+
+The three workflows, the credentials they need, the two settings that make
+Forgejo and n8n cooperate, and the one file whose loss makes every credential
+worthless are in **[automation/README.md](automation/README.md)**.
+
 ## Hardening
 
 Before you put real company data on this box, read **[HARDENING.md](HARDENING.md)**.