Episode 8: n8n as the automation hub, with the editor kept off the public internet

Three workflows that connect the services from episodes 1 to 7: a Forgejo push
becomes a phone notification, an Uptime Kuma outage writes and closes its own
incident page in Outline, and a nightly schedule writes one ops digest.

The point of the episode is the split between webhooks and the editor. Caddy
publishes only the webhook path prefixes under the n8n host and answers an
empty 404 for everything else, so the editor stays reachable over the mesh from
episode 5 and never gets a login page on the open internet.

Also in here:
- n8n pinned to a version instead of :latest, after episode 7 showed that every
  restore is otherwise an upgrade
- the 2.x environment that actually matters, including the file access
  restriction pointed at one directory rather than the root
- the Forgejo allowed host list, without which a webhook to a private address
  is silently dropped
- fixed subnets for both docker networks, after a restore handed them out in
  the other order and quietly broke the mesh route
- a note on the encryption key: it decrypts every stored credential, it lives in
  the n8n volume, and a backup without it restores a hub that cannot log in

Claude-Session: https://claude.ai/code/session_01Md8yhBKp5e7xMmCyxoEgdm

compose.yml

@@ -23,6 +23,12 @@ name: selfhostedops-stack
 
 networks:
   proxy:
+    # Pinned on purpose. Compose hands the subnets out in creation order, so a
+    # restore onto a fresh box can renumber them - and every NetBird route that
+    # points at the old range stops working, silently (episode 8).
+    ipam:
+      config:
+        - subnet: 172.18.0.0/16
     driver_opts:
       # Docker 28+ firewalls direct access to container IPs from other
       # interfaces (raw PREROUTING drop per container). This lets the NetBird
@@ -30,6 +36,9 @@ networks:
       com.docker.network.bridge.trusted_host_interfaces: "wt0"
   ci:
   internal:
+    ipam:
+      config:
+        - subnet: 172.19.0.0/16
 
 volumes:
   caddy_data:
@@ -77,6 +86,11 @@ services:
       FORGEJO__openid__ENABLE_OPENID_SIGNIN: "false"
       FORGEJO__actions__ENABLED: "true"
       FORGEJO__repository__DEFAULT_REPO_UNITS: "repo.code,repo.issues,repo.pulls,repo.releases,repo.packages,repo.actions"
+      # Forgejo refuses to deliver a webhook to a private address by default.
+      # Calling the automation hub over the docker network is exactly that, so
+      # the container name has to be listed. "external" keeps ordinary public
+      # webhook targets working (episode 8).
+      FORGEJO__webhook__ALLOWED_HOST_LIST: "external,n8n"
     ports:
       - "2222:22"       # git over SSH
     volumes:
@@ -182,18 +196,50 @@ services:
       - ntfy_cache:/var/cache/ntfy
     networks: [proxy]
 
+  # The automation hub (episode 8). The editor stays on the mesh (episode 5);
+  # Caddy publishes nothing but the webhook paths. Internal senders (forgejo,
+  # uptime-kuma) call http://n8n:5678/webhook/... over the docker network and
+  # never leave the box at all.
   n8n:
-    image: docker.n8n.io/n8nio/n8n:latest
+    # Pinned. With :latest every restore from backup is silently an upgrade,
+    # and an upgrade is a thing you schedule, not a thing a restore does to you.
+    image: docker.n8n.io/n8nio/n8n:2.37.7
     restart: unless-stopped
     environment:
       N8N_HOST: n8n.${DOMAIN}
       N8N_PORT: "5678"
       N8N_PROTOCOL: https
-      WEBHOOK_URL: https://n8n.${DOMAIN}/
+      # The address n8n prints under every webhook node. It must be the public
+      # one, otherwise you hand your senders a URL that resolves nowhere.
+      # (2.x renamed WEBHOOK_URL to this. The old name still works and prints a
+      # deprecation line on every boot.)
+      N8N_WEBHOOK_URL: https://n8n.${DOMAIN}/
       GENERIC_TIMEZONE: ${TZ:-Europe/Berlin}
       TZ: ${TZ:-Europe/Berlin}
+      # The editor is opened over the mesh on plain http://<container-ip>:5678.
+      # With secure cookies on, the browser never sends the session cookie back
+      # and the login screen just reappears, with no error anywhere.
+      N8N_SECURE_COOKIE: "false"
+      # Do not let anyone install unverified community node packages here.
+      # The default flips to false in a later version anyway.
+      N8N_UNVERIFIED_PACKAGES_ENABLED: "false"
+      # File nodes may read exactly one directory and nothing else. Left wide
+      # open, a workflow could read /home/node/.n8n/config - the file that
+      # decrypts every credential in the instance.
+      N8N_RESTRICT_FILE_ACCESS_TO: /backup
+      # Optional: pin the credential encryption key yourself instead of letting
+      # n8n write one into the volume. See .env.example before you set this.
+      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY:-}
+      # A company box does not need to phone home.
+      N8N_DIAGNOSTICS_ENABLED: "false"
+      N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
+      N8N_HIRING_BANNER_ENABLED: "false"
     volumes:
       - n8n_data:/home/node/.n8n
+      # Read-only view of the nightly backup log (episode 7) so the digest
+      # workflow can report the last restic snapshot. Optional: drop this line
+      # and the digest says "no backup log found" instead of failing.
+      - ./backup/backup.log:/backup/backup.log:ro
     networks: [proxy]
 
   # Optional starter VPN — enable with:  docker compose --profile vpn up -d