# docker-compose.yml for secure n8n deployment
 
version: '3.8'
 
services:
  n8n:
    image: n8nio/n8n:latest
    restart: always
    ports:
      - "127.0.0.1:5678:5678"  # Only localhost, use reverse proxy
    environment:
      # Database (use PostgreSQL for production)
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=${DB_USER}
      - DB_POSTGRESDB_PASSWORD=${DB_PASSWORD}
 
      # Encryption
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
 
      # Security settings
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=${N8N_USER}
      - N8N_BASIC_AUTH_PASSWORD=${N8N_PASSWORD}
 
      # Webhook security
      - WEBHOOK_URL=https://n8n.yourdomain.com/
 
      # Execution settings
      - EXECUTIONS_DATA_SAVE_ON_ERROR=all
      - EXECUTIONS_DATA_SAVE_ON_SUCCESS=all
      - EXECUTIONS_DATA_SAVE_MANUAL_EXECUTIONS=true
 
      # Disable telemetry
      - N8N_DIAGNOSTICS_ENABLED=false
 
      # Logging
      - N8N_LOG_LEVEL=info
      - N8N_LOG_OUTPUT=console,file
      - N8N_LOG_FILE_LOCATION=/home/node/.n8n/logs/
 
    volumes:
      - n8n_data:/home/node/.n8n
      - n8n_logs:/home/node/.n8n/logs
 
    networks:
      - n8n_network
 
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: '1.0'
 
  postgres:
    image: postgres:15-alpine
    restart: always
    environment:
      - POSTGRES_USER=${DB_USER}
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - POSTGRES_DB=n8n
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - n8n_network
 
networks:
  n8n_network:
    driver: bridge
 
volumes:
  n8n_data:
  n8n_logs:
  postgres_data:

# /etc/nginx/sites-available/n8n
 
server {
    listen 443 ssl http2;
    server_name n8n.yourdomain.com;
 
    # SSL Configuration
    ssl_certificate /etc/letsencrypt/live/n8n.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/n8n.yourdomain.com/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
 
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
 
    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'self';" always;
 
    # Rate limiting
    limit_req_zone $binary_remote_addr zone=n8n_limit:10m rate=10r/s;
 
    location / {
        limit_req zone=n8n_limit burst=20 nodelay;
 
        proxy_pass http://127.0.0.1:5678;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
 
        # Timeouts for long-running workflows
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;
    }
 
    # Webhook path with additional validation
    location /webhook/ {
        limit_req zone=n8n_limit burst=50 nodelay;
 
        # Optional: IP allowlist for webhooks
        # allow 192.168.1.0/24;
        # deny all;
 
        proxy_pass http://127.0.0.1:5678;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

// Example: Credential validation workflow node
 
// Custom code node to validate credentials before use
const validateCredentials = async (credentialType, credentialId) => {
  // Check credential hasn't expired
  const credential = await this.getCredentials(credentialType);
 
  if (credential.expiresAt && new Date(credential.expiresAt) < new Date()) {
    throw new Error(`Credential ${credentialId} has expired`);
  }
 
  // Check credential is still valid with service
  // (implementation depends on credential type)
 
  return true;
};
 
// Usage in workflow
try {
  await validateCredentials('httpBasicAuth', 'my-api-credential');
  // Proceed with API call
} catch (error) {
  // Log and handle credential issue
  console.error('Credential validation failed:', error.message);
  // Trigger alert workflow
}

{
  "name": "Credential Rotation Monitor",
  "nodes": [
    {
      "name": "Schedule Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [{"field": "days", "daysInterval": 1}]
        }
      }
    },
    {
      "name": "Check Credential Age",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "// Check all credentials for age\nconst credentials = await this.getCredentials('all');\nconst maxAgeDays = 90;\nconst now = new Date();\n\nconst expiring = [];\nfor (const cred of credentials) {\n  const age = (now - new Date(cred.createdAt)) / (1000 * 60 * 60 * 24);\n  if (age > maxAgeDays - 14) {\n    expiring.push({\n      name: cred.name,\n      type: cred.type,\n      ageDays: Math.round(age),\n      daysUntilExpiry: maxAgeDays - Math.round(age)\n    });\n  }\n}\n\nreturn { credentials: expiring };"
      }
    },
    {
      "name": "Send Alert",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#security-alerts",
        "text": "Credentials expiring soon: {{ $json.credentials }}"
      }
    }
  ]
}

// Secure OAuth token handling
 
// Store tokens with encryption
const storeOAuthTokens = async (userId, tokens) => {
  const encryptedTokens = {
    access_token: encrypt(tokens.access_token),
    refresh_token: encrypt(tokens.refresh_token),
    expires_at: tokens.expires_at,
    scope: tokens.scope
  };
 
  await saveToSecureStorage(userId, encryptedTokens);
};
 
// Refresh tokens before expiry
const refreshTokenIfNeeded = async (userId) => {
  const tokens = await getFromSecureStorage(userId);
  const expiresAt = new Date(tokens.expires_at);
  const now = new Date();
 
  // Refresh if expires within 5 minutes
  if (expiresAt - now < 5 * 60 * 1000) {
    const newTokens = await refreshOAuthToken(decrypt(tokens.refresh_token));
    await storeOAuthTokens(userId, newTokens);
    return newTokens.access_token;
  }
 
  return decrypt(tokens.access_token);
};

// Code node for webhook signature validation
 
const crypto = require('crypto');
 
const validateWebhookSignature = (payload, signature, secret) => {
  // HMAC-SHA256 signature validation
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');
 
  // Timing-safe comparison
  const signatureBuffer = Buffer.from(signature || '', 'utf8');
  const expectedBuffer = Buffer.from(`sha256=${expectedSignature}`, 'utf8');
 
  if (signatureBuffer.length !== expectedBuffer.length) {
    return false;
  }
 
  return crypto.timingSafeEqual(signatureBuffer, expectedBuffer);
};
 
// Usage in webhook workflow
const signature = $input.first().headers['x-hub-signature-256'];
const secret = await this.getCredentials('webhookSecret');
 
if (!validateWebhookSignature($input.first().body, signature, secret.value)) {
  throw new Error('Invalid webhook signature');
}
 
return $input.all();

// Rate limiting for webhook endpoints
 
const rateLimiter = {
  requests: new Map(),
  windowMs: 60000, // 1 minute
  maxRequests: 100,
 
  check: function(clientId) {
    const now = Date.now();
    const clientData = this.requests.get(clientId) || { count: 0, resetTime: now + this.windowMs };
 
    // Reset window if expired
    if (now > clientData.resetTime) {
      clientData.count = 0;
      clientData.resetTime = now + this.windowMs;
    }
 
    clientData.count++;
    this.requests.set(clientId, clientData);
 
    if (clientData.count > this.maxRequests) {
      return {
        allowed: false,
        retryAfter: Math.ceil((clientData.resetTime - now) / 1000)
      };
    }
 
    return { allowed: true };
  }
};
 
// Usage
const clientIp = $input.first().headers['x-forwarded-for'] || 'unknown';
const rateCheck = rateLimiter.check(clientIp);
 
if (!rateCheck.allowed) {
  throw new Error(`Rate limit exceeded. Retry after ${rateCheck.retryAfter} seconds`);
}

// Input sanitization code node
 
const sanitizeInput = (input) => {
  if (typeof input === 'string') {
    // Remove potential injection patterns
    return input
      .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
      .replace(/javascript:/gi, '')
      .replace(/on\w+=/gi, '')
      .trim();
  }
 
  if (typeof input === 'object' && input !== null) {
    const sanitized = {};
    for (const [key, value] of Object.entries(input)) {
      // Sanitize keys and values
      const safeKey = key.replace(/[^\w.-]/g, '');
      sanitized[safeKey] = sanitizeInput(value);
    }
    return sanitized;
  }
 
  return input;
};
 
// Validate expected structure
const validateWebhookPayload = (payload, schema) => {
  const errors = [];
 
  for (const [field, rules] of Object.entries(schema)) {
    const value = payload[field];
 
    if (rules.required && (value === undefined || value === null)) {
      errors.push(`Missing required field: ${field}`);
      continue;
    }
 
    if (value !== undefined) {
      if (rules.type && typeof value !== rules.type) {
        errors.push(`Invalid type for ${field}: expected ${rules.type}`);
      }
 
      if (rules.maxLength && value.length > rules.maxLength) {
        errors.push(`${field} exceeds maximum length of ${rules.maxLength}`);
      }
 
      if (rules.pattern && !rules.pattern.test(value)) {
        errors.push(`${field} doesn't match required pattern`);
      }
    }
  }
 
  return {
    valid: errors.length === 0,
    errors
  };
};
 
// Usage
const schema = {
  email: { required: true, type: 'string', pattern: /^[^\s@]+@[^\s@]+\.[^\s@]+$/ },
  name: { required: true, type: 'string', maxLength: 100 },
  message: { required: false, type: 'string', maxLength: 1000 }
};
 
const sanitizedInput = sanitizeInput($input.first().json);
const validation = validateWebhookPayload(sanitizedInput, schema);
 
if (!validation.valid) {
  throw new Error(`Validation failed: ${validation.errors.join(', ')}`);
}
 
return [{ json: sanitizedInput }];

// Workflow access control implementation
 
const workflowPermissions = {
  admin: ['create', 'read', 'update', 'delete', 'execute'],
  developer: ['create', 'read', 'update', 'execute'],
  operator: ['read', 'execute'],
  viewer: ['read']
};
 
const workflowACL = {
  'production-workflows': {
    allowedRoles: ['admin', 'operator'],
    requireApproval: true
  },
  'development-workflows': {
    allowedRoles: ['admin', 'developer'],
    requireApproval: false
  }
};
 
const checkPermission = (userId, userRole, workflowCategory, action) => {
  // Check role has action permission
  const rolePermissions = workflowPermissions[userRole] || [];
  if (!rolePermissions.includes(action)) {
    return { allowed: false, reason: 'Role does not have this permission' };
  }
 
  // Check workflow category ACL
  const categoryACL = workflowACL[workflowCategory];
  if (categoryACL && !categoryACL.allowedRoles.includes(userRole)) {
    return { allowed: false, reason: 'Role not allowed for this workflow category' };
  }
 
  // Check if approval required
  if (categoryACL?.requireApproval && action !== 'read') {
    return { allowed: true, requiresApproval: true };
  }
 
  return { allowed: true };
};

// Comprehensive execution logging
 
const logWorkflowExecution = async (executionData) => {
  const logEntry = {
    timestamp: new Date().toISOString(),
    workflowId: executionData.workflowId,
    workflowName: executionData.workflowName,
    executionId: executionData.executionId,
    triggeredBy: executionData.triggeredBy,
    triggerType: executionData.triggerType,
    status: executionData.status,
    duration: executionData.duration,
    nodesExecuted: executionData.nodesExecuted,
    errors: executionData.errors || [],
 
    // Security-relevant data
    ipAddress: executionData.ipAddress,
    userAgent: executionData.userAgent,
    credentialsUsed: executionData.credentialsUsed.map(c => c.name), // Don't log values
 
    // Sanitized input/output summary (no sensitive data)
    inputSummary: summarizeData(executionData.input),
    outputSummary: summarizeData(executionData.output)
  };
 
  // Send to logging system
  await sendToLoggingService(logEntry);
 
  // Alert on suspicious patterns
  if (executionData.status === 'error' || executionData.duration > 60000) {
    await sendAlert(logEntry);
  }
};
 
const summarizeData = (data) => {
  return {
    size: JSON.stringify(data).length,
    keys: Object.keys(data || {}),
    containsPII: detectPII(data)
  };
};

{
  "name": "Security Monitoring Dashboard",
  "nodes": [
    {
      "name": "Aggregate Executions",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "// Aggregate last 24h of executions\nconst executions = await getExecutions({ lastNHours: 24 });\n\nconst metrics = {\n  totalExecutions: executions.length,\n  failedExecutions: executions.filter(e => e.status === 'error').length,\n  webhookTriggers: executions.filter(e => e.triggerType === 'webhook').length,\n  uniqueIPs: new Set(executions.map(e => e.ipAddress)).size,\n  credentialUsage: countCredentialUsage(executions),\n  suspiciousPatterns: detectSuspiciousPatterns(executions)\n};\n\nreturn { metrics };"
      }
    },
    {
      "name": "Check Thresholds",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{ $json.metrics.failedExecutions / $json.metrics.totalExecutions > 0.1 }}",
              "value2": true
            }
          ]
        }
      }
    },
    {
      "name": "Send Alert",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#n8n-security",
        "text": "Security Alert: High failure rate detected\n{{ $json.metrics }}"
      }
    }
  ]
}

## n8n Security Checklist
 
### Deployment
- [ ] Use PostgreSQL for production (not SQLite)
- [ ] Set strong N8N_ENCRYPTION_KEY
- [ ] Enable authentication
- [ ] Use reverse proxy with TLS
- [ ] Apply security headers
- [ ] Implement rate limiting
- [ ] Disable telemetry if required
- [ ] Keep n8n updated
 
### Credentials
- [ ] Use credential encryption
- [ ] Implement credential rotation
- [ ] Audit credential usage
- [ ] Use OAuth where possible
- [ ] Never log credential values
 
### Webhooks
- [ ] Validate webhook signatures
- [ ] Implement rate limiting
- [ ] Sanitize all inputs
- [ ] Use webhook authentication
- [ ] IP allowlisting for sensitive webhooks
 
### Access Control
- [ ] Implement role-based access
- [ ] Require approval for production changes
- [ ] Audit user actions
- [ ] Regular access reviews
 
### Monitoring
- [ ] Log all executions
- [ ] Monitor for anomalies
- [ ] Set up alerts
- [ ] Regular security audits