N8n Für DevOps-Teams: Enterprise-Deployment Und Production-Integration

[Trigger Node] → [Processing Node] → [Transform Node] → [Action Node]
	   ↓               ↓                    ↓                ↓
   Event Input    Data Processing      Data Transform   External API

┌─────────────────┐     ┌──────────────┐     ┌─────────────────┐
│   Webhook       │     │              │     │  HTTP Request   │
│   Trigger       │───▶ │  Event Bus   │───▶ │  Node           │
│   (Publisher)   │     │              │     │  (Subscriber)   │
└─────────────────┘     └──────────────┘     └─────────────────┘
							  │
							  ▼
				       ┌──────────────┐
			           │  Queue       │
				       │  Management  │
				       └──────────────┘

// Standard n8n Item Format
{
  json: {

// Haupt-Datenstruktur
	id: 123,
	name: "example",
	metadata: {
	  timestamp: "2025-01-01T12:00:00Z"
	}
  },
  binary: {

// Binäre Daten (optional)
	file: {
	  data: "base64-encoded-content",
	  mimeType: "application/pdf",
	  fileName: "document.pdf"
	}
  }
}

// Webhook Input Processing
const payload = $input.all()[0].json;

// Branch-basierte Routing-Logik
if (payload.ref === 'refs/heads/main') {
  return [
	{
	  json: {
		action: 'deploy_production',
		commit: payload.head_commit.id,
		message: payload.head_commit.message,
		author: payload.head_commit.author.name,
		environment: 'production'
	  }
	}
  ];
} else if (payload.ref.startsWith('refs/heads/develop')) {
  return [
	{
	  json: {
		action: 'deploy_staging',
		commit: payload.head_commit.id,
		branch: payload.ref.replace('refs/heads/', ''),
		environment: 'staging'
	  }
	}
  ];
}

// Feature-Branch: Nur Tests ausführen
return [
  {
	json: {
	  action: 'run_tests',
	  commit: payload.head_commit.id,
	  branch: payload.ref.replace('refs/heads/', '')
	}
  }
];

// Error Handling im Code Node
try {
  const response = await fetch('https://api.example.com/data');
  if (!response.ok) {
	throw new Error(`API Error: ${response.status} - ${response.statusText}`);
  }
  return response.json();
} catch (error) {
 
 // Custom Error mit Context
  throw new Error(`External API failed: ${error.message}`);
}

// Batch Processing Beispiel
const batchSize = 100;
const items = $input.all();
const batches = [];

for (let i = 0; i < items.length; i += batchSize) {
  const batch = items.slice(i, i + batchSize);
  batches.push({
	json: {
	  batch_id: Math.floor(i / batchSize),
	  items: batch.map(item => item.json),
	  total_batches: Math.ceil(items.length / batchSize)
	}
  });
}

return batches;

┌─────────────────────────────────────────────────────────────────┐
│                         Main Process                            │
│  ┌─────────────────┐  ┌──────────────────┐  ┌─────────────────┐ │
│  │   Web Server    │  │  Queue Manager   │  │  DB Connection  │ │
│  │  (REST API)     │  │ (Redis/Memory)   │  │     Pool        │ │
│  │   Port 5678     │  │                  │  │                 │ │
│  └─────────────────┘  └──────────────────┘  └─────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
								  │
								  │ Job Distribution via Queue
								  ▼
┌────────────────────────────────────────────────────────┐
│                      Worker Processes                  │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  │
│  │   Worker 1   │  │   Worker 2   │  │   Worker 3   │  │
│  │              │  │              │  │              │  │
│  │ Execution    │  │ Execution    │  │ Execution    │  │
│  │ Context A    │  │ Context B    │  │ Context C    │  │
│  │ Context D    │  │ Context E    │  │              │  │
│  └──────────────┘  └──────────────┘  └──────────────┘  │
└────────────────────────────────────────────────────────┘

┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
│   Idle      │───▶│  Receiving  │───▶│ Executing   │───▶│ Reporting   │
│   State     │    │    Job      │    │  Workflow   │    │   Result    │
└─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘
	    ▲                                                       │
	    │                                                       ▼
┌─────────────┐                                          ┌─────────────┐
│  Cleanup    │◄─────────────────────────────────────────│  Completed  │
│   Memory    │                                          │    State    │
└─────────────┘                                          └─────────────┘

# Worker-spezifische Konfiguration
export N8N_WORKERS_ENABLED=true
export N8N_WORKERS_MAX_CONCURRENCY=10
export N8N_WORKERS_TIMEOUT=3600
export N8N_WORKERS_MAX_MEMORY_MB=2048

# Queue-Konfiguration für Worker-Communication
export QUEUE_BULL_REDIS_HOST=redis.internal
export QUEUE_BULL_REDIS_PORT=6379
export QUEUE_BULL_REDIS_DB=2
export QUEUE_BULL_REDIS_PASSWORD=secure_redis_password

# Einzelner Worker (Standard-Modus)
n8n worker

# Mehrere Worker auf einem System
for i in {1..4}; do
N8N_WORKER_ID=worker_$i n8n worker &
done

# Distributed Workers (Kubernetes Deployment)
kubectl scale deployment n8n-worker --replicas=10

# PostgreSQL Connection Pool Optimization
export N8N_DATABASE_POSTGRESDB_POOL_SIZE=20
export N8N_DATABASE_POSTGRESDB_MAX_CONNECTIONS=100
export N8N_DATABASE_POSTGRESDB_IDLE_TIMEOUT=30000

// Memory-effiziente Binary Data Verarbeitung
const binaryData = $input.binary.file;

// Streaming statt vollständiges Laden
const stream = require('stream');
const { pipeline } = require('stream/promises');
await pipeline(
createReadStream(binaryData.data),
transformStream,
createWriteStream(outputPath)
);

// Memory explizit freigeben
delete $input.binary.file;

# Worker mit automatischem Restart
while true; do
n8n worker
echo "Worker crashed, restarting in 5 seconds..."
sleep 5
done

# Systemd Service für Production
cat << 'EOF' > /etc/systemd/system/n8n-worker.service
[Unit]
Description=n8n Worker Process
After=network.target
[Service]
Type=simple
User=n8n
WorkingDirectory=/opt/n8n
ExecStart=/usr/local/bin/n8n worker
Restart=always
RestartSec=5
Environment=NODE_ENV=production
[Install]
WantedBy=multi-user.target
EOF

┌─────────────────┐    ┌──────────────┐    ┌─────────────────┐
│                 │    │              │    │                 │
│   Main Process  │───▶│  Job Queue   │───▶│  Worker Pool    │
│   (Scheduler)   │    │   (Redis)    │    │  (Consumers)    │
│                 │    │              │    │                 │
└─────────────────┘    └──────────────┘    └─────────────────┘
						 │
						 ▼
			    ┌──────────────────┐
			    │  Dead Letter     │
			    │     Queue        │
			    │  (Failed Jobs)   │
			    └──────────────────┘

# Worker-Health-Check Skript
#!/bin/bash
WORKER_PID=$(pgrep -f "n8n worker")
if [ -z "$WORKER_PID" ]; then
  echo "CRITICAL: n8n worker not running"
  exit 2
fi

# Memory Usage prüfen
MEMORY_MB=$(ps -p $WORKER_PID -o rss= | awk '{print int($1/1024)}')
if [ $MEMORY_MB -gt 4096 ]; then
  echo "WARNING: Worker using ${MEMORY_MB}MB memory"
  exit 1
fi

echo "OK: Worker running with ${MEMORY_MB}MB memory"
exit 0

# 1. Workflow aus Git-Repository laden
git clone https://github.com/company/n8n-workflows.git
cd n8n-workflows/production/

# 2. Workflow-Definition validieren
jq empty production-deploy.json || {
  echo "Invalid JSON in workflow definition"
  exit 1
}

# 3. Workflow via API erstellen/updaten
WORKFLOW_ID=$(curl -s -X POST https://n8n.company.com/api/v1/workflows \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" \
  -d @production-deploy.json | jq -r '.id')

# 4. Workflow aktivieren
curl -X POST https://n8n.company.com/api/v1/workflows/${WORKFLOW_ID}/activate \
  -H "Authorization: Bearer ${N8N_API_TOKEN}"

# 5. Webhook-URL abrufen und in CI/CD registrieren
WEBHOOK_URL=$(curl -s https://n8n.company.com/api/v1/workflows/${WORKFLOW_ID} \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" | \
  jq -r '.nodes[] | select(.type == "n8n-nodes-base.webhook") | .webhookUrl')

echo "Webhook URL: ${WEBHOOK_URL}"

# Headless Start ohne Web-UI
export N8N_DISABLE_UI=true
export N8N_ENDPOINTS_REST_AUTH=bearer
export N8N_API_KEY=n8n_api_production_token_12345

# Mit externem Database Backend für Skalierbarkeit
export N8N_DATABASE_TYPE=postgresdb
export N8N_DATABASE_HOST=postgres.internal.company.com
export N8N_DATABASE_PORT=5432
export N8N_DATABASE_NAME=n8n_production
export N8N_DATABASE_USER=n8n_app_user
export N8N_DATABASE_PASSWORD=secure_production_password
export N8N_DATABASE_SSL_ENABLED=true

# Worker-Mode für horizontale Skalierung
n8n worker

# 1. API Token Authentication (Empfohlen für Automation)
curl -H "Authorization: Bearer n8n_api_production_token_12345" \
https://n8n.company.com/api/v1/workflows

# 2. Basic Authentication (Legacy-Support)
curl -u "service-account:complex_password_123" \
https://n8n.company.com/api/v1/workflows

# 3. Session-based Authentication (UI-basiert)
curl -b "n8n-auth=SESSION_COOKIE_VALUE" \
https://n8n.company.com/api/v1/workflows

# 4. JWT Token (Enterprise Edition)
curl -H "Authorization: JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
https://n8n.company.com/api/v1/workflows

# Service Account für CI/CD mit read-only Rechten

curl -X POST https://n8n.company.com/api/v1/users \
-H "Authorization: Bearer ${ADMIN_TOKEN}" \
-d '{
	"email": "ci-cd@company.com",
	"firstName": "CI/CD",
	"lastName": "Service",
	"role": "editor",
	"permissions": {
	 "workflows": ["read", "execute"],
	 "executions": ["read"],
	 "credentials": ["read"]
	}
}'

// Advanced Webhook Response mit Custom Headers
const startTime = Date.now();

// Payload-Validation
if (!$input.first().json.repository || !$input.first().json.commits) {
  $response.statusCode = 400;
  return {
	error: "Invalid webhook payload",
	expected: ["repository", "commits"]
  };
}

// Asynchrone Verarbeitung triggern
const processingId = generateUUID();
await queue.add('deployment-pipeline', {
  id: processingId,
  payload: $input.first().json,
  timestamp: new Date().toISOString()
});

// Sofortige Response mit Tracking-Information
return {
  json: { 
	status: "accepted", 
	processing_id: processingId,
	estimated_completion: new Date(Date.now() + 300000).toISOString()
  },
  headers: {
	"X-Processing-Time": Date.now() - startTime,
	"X-Workflow-ID": $workflow.id,
	"X-Processing-ID": processingId,
	"Location": `/api/v1/executions/${processingId}`
  },
  statusCode: 202
};

# .github/workflows/n8n-deploy.yml
name: Deploy n8n Workflows
on:
push:
	paths: ['workflows/**']
jobs:
deploy:
	runs-on: ubuntu-latest
	steps:
	 - uses: actions/checkout@v3
	 - name: Validate Workflow Definitions
		run: |
		 for workflow in workflows/*.json; do
			jq empty "$workflow" || exit 1
		 done
	 - name: Deploy to n8n
		run: |
		 for workflow in workflows/*.json; do
			curl -X POST $N8N_API_URL/api/v1/workflows \
			 -H "Authorization: Bearer $N8N_API_TOKEN" \
			 -H "Content-Type: application/json" \
			 -d @"$workflow"
		 done
		env:
		 N8N_API_URL: ${{ secrets.N8N_API_URL }}
		 N8N_API_TOKEN: ${{ secrets.N8N_API_TOKEN }}

# terraform/n8n-workflows.tf
resource "null_resource" "n8n_workflow" {
for_each = fileset(path.module, "workflows/*.json")
provisioner "local-exec" {
	command = <<-EOT
	 curl -X POST ${var.n8n_api_url}/api/v1/workflows \
		-H "Authorization: Bearer ${var.n8n_api_token}" \
		-H "Content-Type: application/json" \
		-d @${each.value}
	EOT
}
triggers = {
	workflow_hash = filemd5(each.value)
}
}

# n8n-exporter.sh - Custom Prometheus Exporter

#!/bin/bash
while true; do

# Workflow-Metriken sammeln
ACTIVE_WORKFLOWS=$(curl -s -H "Authorization: Bearer $N8N_API_TOKEN" \
	"$N8N_API_URL/api/v1/workflows?active=true" | jq '. | length')
FAILED_EXECUTIONS=$(curl -s -H "Authorization: Bearer $N8N_API_TOKEN" \
	"$N8N_API_URL/api/v1/executions?status=error&limit=1000" | jq '. | length')
echo "n8n_active_workflows $ACTIVE_WORKFLOWS" > /tmp/n8n-metrics.prom
echo "n8n_failed_executions_total $FAILED_EXECUTIONS" >> /tmp/n8n-metrics.prom
sleep 30
done

# API Rate Limits für Production erhöhen
export N8N_API_RATE_LIMIT_ENABLED=true
export N8N_API_RATE_LIMIT_MAX_REQUESTS=10000
export N8N_API_RATE_LIMIT_WINDOW_MS=60000
export N8N_API_RATE_LIMIT_TRUST_PROXY=true

# Bulk-Operations für große Workflow-Sets
curl -X POST https://n8n.company.com/api/v1/workflows/bulk \
-H "Authorization: Bearer $N8N_API_TOKEN" \
-d '{
	"operation": "activate",
	"workflow_ids": ["1", "2", "3", "4", "5"],
	"options": {
	 "validate": true,
	 "dry_run": false
	}
}'

# Workflow-Templates für standardisierte Deployments
curl -X POST https://n8n.company.com/api/v1/workflows/from-template \
-H "Authorization: Bearer $N8N_API_TOKEN" \
-d '{
	"template_id": "git-ci-cd-pipeline",
	"parameters": {
	 "repository_url": "https://github.com/company/app.git",
	 "deploy_environment": "production",
	 "notification_slack_channel": "#deployments"
	}
}'

# docker-compose.production.yml
version: '3.8'

services:
  postgres:
	image: postgres:15-alpine
	restart: unless-stopped
	environment:
	  POSTGRES_DB: n8n_production
	  POSTGRES_USER: n8n_user
	  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
	  POSTGRES_NON_ROOT_USER: n8n_app
	  POSTGRES_NON_ROOT_PASSWORD: ${POSTGRES_APP_PASSWORD}
	volumes:
	  - postgres_data:/var/lib/postgresql/data
	  - ./init-scripts:/docker-entrypoint-initdb.d:ro
	healthcheck:
	  test: ["CMD-SHELL", "pg_isready -U n8n_user -d n8n_production"]
	  interval: 10s
	  timeout: 5s
	  retries: 5
	networks:
	  - n8n-internal

  redis:
	image: redis:7-alpine
	restart: unless-stopped
	command: redis-server --requirepass ${REDIS_PASSWORD} --maxmemory 512mb --maxmemory-policy allkeys-lru
	volumes:
	  - redis_data:/data
	healthcheck:
	  test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
	  interval: 10s
	  timeout: 3s
	  retries: 5
	networks:
	  - n8n-internal

  n8n-main:
	image: n8nio/n8n:latest
	restart: unless-stopped
	environment:
	  # Database Configuration
	  DB_TYPE: postgresdb
	  DB_POSTGRESDB_HOST: postgres
	  DB_POSTGRESDB_PORT: 5432
	  DB_POSTGRESDB_DATABASE: n8n_production
	  DB_POSTGRESDB_USER: n8n_app
	  DB_POSTGRESDB_PASSWORD: ${POSTGRES_APP_PASSWORD}
	  
	  # Queue Configuration
	  EXECUTIONS_MODE: queue
	  QUEUE_BULL_REDIS_HOST: redis
	  QUEUE_BULL_REDIS_PASSWORD: ${REDIS_PASSWORD}
	  QUEUE_BULL_REDIS_PORT: 6379
	  QUEUE_BULL_REDIS_DB: 0
	  
	  # Security & Performance
	  N8N_SECURE_COOKIE: true
	  N8N_PROTOCOL: https
	  N8N_HOST: ${N8N_DOMAIN}
	  N8N_PORT: 5678
	  N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
	  
	  # Webhook Configuration
	  WEBHOOK_URL: https://${N8N_DOMAIN}/
	  
	  # Disable execution in main process
	  EXECUTIONS_PROCESS: main
	ports:
	  - "127.0.0.1:5678:5678"
	volumes:
	  - n8n_data:/home/node/.n8n
	  - ./custom-nodes:/home/node/.n8n/custom
	depends_on:
	  postgres:
		condition: service_healthy
	  redis:
		condition: service_healthy
	networks:
	  - n8n-internal
	  - web-proxy
	labels:
	  - "traefik.enable=true"
	  - "traefik.http.routers.n8n.rule=Host(`${N8N_DOMAIN}`)"
	  - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"

  n8n-worker:
	image: n8nio/n8n:latest
	restart: unless-stopped
	command: n8n worker
	environment:
	  # Database Configuration (same as main)
	  DB_TYPE: postgresdb
	  DB_POSTGRESDB_HOST: postgres
	  DB_POSTGRESDB_PORT: 5432
	  DB_POSTGRESDB_DATABASE: n8n_production
	  DB_POSTGRESDB_USER: n8n_app
	  DB_POSTGRESDB_PASSWORD: ${POSTGRES_APP_PASSWORD}
	  
	  # Queue Configuration
	  QUEUE_BULL_REDIS_HOST: redis
	  QUEUE_BULL_REDIS_PASSWORD: ${REDIS_PASSWORD}
	  QUEUE_BULL_REDIS_PORT: 6379
	  QUEUE_BULL_REDIS_DB: 0
	  
	  # Worker-specific Configuration
	  N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
	  EXECUTIONS_PROCESS: own
	  
	  # Performance Tuning
	  N8N_WORKERS_CONCURRENCY: 10
	  N8N_WORKERS_TIMEOUT: 3600
	volumes:
	  - n8n_data:/home/node/.n8n
	  - ./custom-nodes:/home/node/.n8n/custom
	depends_on:
	  postgres:
		condition: service_healthy
	  redis:
		condition: service_healthy
	networks:
	  - n8n-internal
	deploy:
	  replicas: 3
	  resources:
		limits:
		  memory: 2G
		  cpus: "1.0"
		reservations:
		  memory: 512M
		  cpus: "0.5"

volumes:
  postgres_data:
	driver: local
	driver_opts:
	  type: none
	  o: bind
	  device: /opt/n8n/postgres-data
  redis_data:
	driver: local
  n8n_data:
	driver: local
	driver_opts:
	  type: none
	  o: bind
	  device: /opt/n8n/app-data

networks:
  n8n-internal:
	driver: bridge
	internal: true
  web-proxy:
	external: true

# Environment-Datei erstellen
cat << 'EOF' > .env.production
POSTGRES_PASSWORD=secure_postgres_root_password_123
POSTGRES_APP_PASSWORD=secure_app_user_password_456
REDIS_PASSWORD=secure_redis_password_789
N8N_DOMAIN=n8n.company.com
N8N_ENCRYPTION_KEY=$(openssl rand -hex 32)
EOF

# Produktions-Verzeichnisse erstellen
sudo mkdir -p /opt/n8n/{postgres-data,app-data,backups,custom-nodes}
sudo chown -R 1000:1000 /opt/n8n/app-data
sudo chmod 700 /opt/n8n/postgres-data

# SSL-Zertifikate via Let's Encrypt (Traefik)
docker run -d \
  --name traefik \
  --restart unless-stopped \
  -p 80:80 -p 443:443 \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /opt/traefik/acme.json:/acme.json \
  -v /opt/traefik/traefik.yml:/etc/traefik/traefik.yml:ro \
  traefik:v2.10

# n8n Deployment starten
docker-compose -f docker-compose.production.yml up -d

# n8n-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: n8n-production
  labels:
	name: n8n-production

---
# n8n-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: n8n-config
  namespace: n8n-production
data:
  N8N_HOST: "n8n.company.com"
  N8N_PROTOCOL: "https"
  N8N_PORT: "5678"
  DB_TYPE: "postgresdb"
  DB_POSTGRESDB_HOST: "postgres-service.n8n-production.svc.cluster.local"
  DB_POSTGRESDB_PORT: "5432"
  DB_POSTGRESDB_DATABASE: "n8n_production"
  EXECUTIONS_MODE: "queue"
  QUEUE_BULL_REDIS_HOST: "redis-service.n8n-production.svc.cluster.local"
  QUEUE_BULL_REDIS_PORT: "6379"
  QUEUE_BULL_REDIS_DB: "0"
  WEBHOOK_URL: "https://n8n.company.com/"
  N8N_METRICS: "true"
  N8N_DIAGNOSTICS_ENABLED: "false"

---
# n8n-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: n8n-secrets
  namespace: n8n-production
type: Opaque
data:
  N8N_ENCRYPTION_KEY: # base64 encoded
  DB_POSTGRESDB_PASSWORD: # base64 encoded
  QUEUE_BULL_REDIS_PASSWORD: # base64 encoded

---
# n8n-main-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-main
  namespace: n8n-production
  labels:
	app: n8n-main
spec:
  replicas: 2
  strategy:
	type: RollingUpdate
	rollingUpdate:
	  maxUnavailable: 1
	  maxSurge: 1
  selector:
	matchLabels:
	  app: n8n-main
  template:
	metadata:
	  labels:
		app: n8n-main
	spec:
	  affinity:
		podAntiAffinity:
		  preferredDuringSchedulingIgnoredDuringExecution:
		  - weight: 100
			podAffinityTerm:
			  labelSelector:
				matchExpressions:
				- key: app
				  operator: In
				  values:
				  - n8n-main
			  topologyKey: kubernetes.io/hostname
	  containers:
	  - name: n8n-main
		image: n8nio/n8n:latest
		ports:
		- containerPort: 5678
		  name: http
		envFrom:
		- configMapRef:
			name: n8n-config
		- secretRef:
			name: n8n-secrets
		env:
		- name: DB_POSTGRESDB_USER
		  value: "n8n_app"
		resources:
		  requests:
			memory: "1Gi"
			cpu: "500m"
		  limits:
			memory: "2Gi"
			cpu: "1000m"
		livenessProbe:
		  httpGet:
			path: /healthz
			port: 5678
		  initialDelaySeconds: 30
		  periodSeconds: 10
		  timeoutSeconds: 5
		  failureThreshold: 3
		readinessProbe:
		  httpGet:
			path: /healthz
			port: 5678
		  initialDelaySeconds: 10
		  periodSeconds: 5
		  timeoutSeconds: 3
		  failureThreshold: 3
		volumeMounts:
		- name: n8n-data
		  mountPath: /home/node/.n8n
		- name: custom-nodes
		  mountPath: /home/node/.n8n/custom
	  volumes:
	  - name: n8n-data
		persistentVolumeClaim:
		  claimName: n8n-main-pvc
	  - name: custom-nodes
		configMap:
		  name: n8n-custom-nodes

---
# n8n-worker-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-worker
  namespace: n8n-production
  labels:
	app: n8n-worker
spec:
  replicas: 5
  strategy:
	type: RollingUpdate
	rollingUpdate:
	  maxUnavailable: 1
	  maxSurge: 2
  selector:
	matchLabels:
	  app: n8n-worker
  template:
	metadata:
	  labels:
		app: n8n-worker
	spec:
	  affinity:
		podAntiAffinity:
		  preferredDuringSchedulingIgnoredDuringExecution:
		  - weight: 50
			podAffinityTerm:
			  labelSelector:
				matchExpressions:
				- key: app
				  operator: In
				  values:
				  - n8n-worker
			  topologyKey: kubernetes.io/hostname
	  containers:
	  - name: n8n-worker
		image: n8nio/n8n:latest
		command: ["n8n", "worker"]
		envFrom:
		- configMapRef:
			name: n8n-config
		- secretRef:
			name: n8n-secrets
		env:
		- name: DB_POSTGRESDB_USER
		  value: "n8n_app"
		- name: EXECUTIONS_PROCESS
		  value: "own"
		- name: N8N_WORKERS_CONCURRENCY
		  value: "10"
		- name: N8N_WORKERS_TIMEOUT
		  value: "3600"
		resources:
		  requests:
			memory: "512Mi"
			cpu: "250m"
		  limits:
			memory: "2Gi"
			cpu: "1000m"
		volumeMounts:
		- name: n8n-data
		  mountPath: /home/node/.n8n
		  readOnly: true
		- name: custom-nodes
		  mountPath: /home/node/.n8n/custom
		  readOnly: true
	  volumes:
	  - name: n8n-data
		persistentVolumeClaim:
		  claimName: n8n-shared-pvc
	  - name: custom-nodes
		configMap:
		  name: n8n-custom-nodes

---
# n8n-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: n8n-worker-hpa
  namespace: n8n-production
spec:
  scaleTargetRef:
	apiVersion: apps/v1
	kind: Deployment
	name: n8n-worker
  minReplicas: 3
  maxReplicas: 20
  metrics:
  - type: Resource
	resource:
	  name: cpu
	  target:
		type: Utilization
		averageUtilization: 70
  - type: Resource
	resource:
	  name: memory
	  target:
		type: Utilization
		averageUtilization: 80
  behavior:
	scaleUp:
	  stabilizationWindowSeconds: 60
	  policies:
	  - type: Percent
		value: 100
		periodSeconds: 60
	scaleDown:
	  stabilizationWindowSeconds: 300
	  policies:
	  - type: Percent
		value: 50
		periodSeconds: 60

# values.production.yaml
replicaCount:
  main: 2
  worker: 5

image:
  repository: n8nio/n8n
  tag: "latest"
  pullPolicy: IfNotPresent

service:
  type: ClusterIP
  port: 5678

ingress:
  enabled: true
  className: "nginx"
  annotations:
	cert-manager.io/cluster-issuer: "letsencrypt-prod"
	nginx.ingress.kubernetes.io/ssl-redirect: "true"
	nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
  hosts:
	- host: n8n.company.com
	  paths:
		- path: /
		  pathType: Prefix
  tls:
	- secretName: n8n-tls
	  hosts:
		- n8n.company.com

postgresql:
  enabled: true
  auth:
	postgresPassword: "secure_root_password"
	username: "n8n_app"
	password: "secure_app_password"
	database: "n8n_production"
  primary:
	persistence:
	  enabled: true
	  size: 100Gi
	  storageClass: "fast-ssd"

redis:
  enabled: true
  auth:
	enabled: true
	password: "secure_redis_password"
  master:
	persistence:
	  enabled: true
	  size: 10Gi

autoscaling:
  enabled: true
  minReplicas: 3
  maxReplicas: 20
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 80

resources:
  main:
	limits:
	  cpu: 1000m
	  memory: 2Gi
	requests:
	  cpu: 500m
	  memory: 1Gi
  worker:
	limits:
	  cpu: 1000m
	  memory: 2Gi
	requests:
	  cpu: 250m
	  memory: 512Mi

monitoring:
  enabled: true
  serviceMonitor:
	enabled: true
	namespace: monitoring

# Helm Repository hinzufügen
helm repo add n8n https://8gears.container-registry.com/chartrepo/library
helm repo update

# Custom Values für Production
helm install n8n-production n8n/n8n \
  --namespace n8n-production \
  --create-namespace \
  --values values.production.yaml \
  --wait --timeout=300s

# Deployment-Status überwachen
kubectl get pods -n n8n-production -w
kubectl logs -n n8n-production deployment/n8n-main -f

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│                 │    │                  │    │                 │
│  Webhook/Timer  │───▶│   Main Process   │───▶│   Redis Queue   │
│   (Triggers)    │    │  (Orchestrator)  │    │  (Job Storage)  │
│                 │    │                  │    │                 │
└─────────────────┘    └──────────────────┘    └─────────────────┘
														 │
						   ┌─────────────────────────────┼─────────────────────────────┐
						   │                             │                             │
						   ▼                             ▼                             ▼
				  ┌─────────────────┐          ┌─────────────────┐          ┌─────────────────┐
				  │                 │          │                 │          │                 │
				  │   Worker 1      │          │   Worker 2      │          │   Worker N      │
				  │ (Execution)     │          │ (Execution)     │          │ (Execution)     │
				  │                 │          │                 │          │                 │
				  └─────────────────┘          └─────────────────┘          └─────────────────┘
						   │                             │                             │
						   └─────────────────────────────┼─────────────────────────────┘
														 ▼
												┌─────────────────┐
												│                 │
												│   PostgreSQL    │
												│   (Results)     │
												│                 │
												└─────────────────┘

# redis.production.conf
# Memory Management
maxmemory 4gb
maxmemory-policy allkeys-lru
maxmemory-samples 10

# Persistence für Job-Queue Reliability
save 900 1
save 300 10
save 60 10000
rdbcompression yes
rdbchecksum yes

# Network & Performance
tcp-keepalive 300
timeout 0
tcp-backlog 511
databases 16

# Security
requirepass secure_redis_password_production_123
rename-command FLUSHDB ""
rename-command FLUSHALL ""
rename-command DEBUG ""

# Logging
loglevel notice
syslog-enabled yes
syslog-ident redis-n8n-queue

# Client Connection Limits
maxclients 10000

# Queue-specific Settings
notify-keyspace-events Ex

# /etc/haproxy/haproxy.cfg
global
	daemon
	user haproxy
	group haproxy
	log stdout local0
	maxconn 4096
	ssl-default-bind-options ssl-min-ver TLSv1.2
	ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384

defaults
	mode http
	timeout connect 10s
	timeout client 30s
	timeout server 30s
	option httplog
	option dontlognull
	retries 3

frontend n8n_frontend
	bind *:443 ssl crt /etc/ssl/certs/n8n.company.com.pem
	redirect scheme https if !{ ssl_fc }
	
	# Rate Limiting
	stick-table type ip size 100k expire 30s store http_req_rate(10s)
	http-request track-sc0 src
	http-request reject if { sc_http_req_rate(0) gt 20 }
	
	# Health Check Endpoint
	acl health_check path_beg /healthz
	use_backend n8n_health if health_check
	
	# Main Application
	default_backend n8n_main

backend n8n_main
	balance leastconn
	option httpchk GET /healthz
	http-check expect status 200
	
	server n8n-main-1 10.0.1.10:5678 check inter 10s rise 2 fall 3 weight 100
	server n8n-main-2 10.0.1.11:5678 check inter 10s rise 2 fall 3 weight 100
	
backend n8n_health
	http-request return status 200 content-type text/plain string "OK"

listen stats
	bind *:8404
	stats enable
	stats uri /stats
	stats refresh 30s
	stats admin if TRUE

# CPU-intensive Workflows (weniger Concurrency)
export N8N_WORKERS_CONCURRENCY=5
export N8N_WORKERS_TIMEOUT=7200
export NODE_OPTIONS="--max-old-space-size=4096"

# I/O-intensive Workflows (mehr Concurrency)
export N8N_WORKERS_CONCURRENCY=20
export N8N_WORKERS_TIMEOUT=1800
export NODE_OPTIONS="--max-old-space-size=2048"

# Mixed Workloads (balanced)
export N8N_WORKERS_CONCURRENCY=10
export N8N_WORKERS_TIMEOUT=3600
export NODE_OPTIONS="--max-old-space-size=3072"

# Worker mit optimierten Settings starten
n8n worker

# custom-metrics-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: n8n-worker-queue-hpa
  namespace: n8n-production
spec:
  scaleTargetRef:
	apiVersion: apps/v1
	kind: Deployment
	name: n8n-worker
  minReplicas: 3
  maxReplicas: 50
  metrics:
  - type: External
	external:
	  metric:
		name: redis_queue_length
		selector:
		  matchLabels:
			queue_name: "bull:queue:default"
	  target:
		type: AverageValue
		averageValue: "10"
  behavior:
	scaleUp:
	  stabilizationWindowSeconds: 60
	  policies:
	  - type: Pods
		value: 5
		periodSeconds: 60
	scaleDown:
	  stabilizationWindowSeconds: 300
	  policies:
	  - type: Pods
		value: 2
		periodSeconds: 60

┌─────────────────────────────────────────────────────────────┐
│                    Application Layer                        │
│  ┌─────────────────┐  ┌─────────────────┐  ┌──────────────┐ │
│  │   Workflows     │  │   Credentials   │  │   Executions │ │
│  │   (JSON Defs)   │  │  (Encrypted)    │  │   (History)  │ │
│  └─────────────────┘  └─────────────────┘  └──────────────┘ │
└─────────────────────────────────────────────────────────────┘
				                │
						        ▼
┌─────────────────────────────────────────────────────────────┐
│                   Database Layer (PostgreSQL)               │
│  ┌─────────────────┐  ┌─────────────────┐  ┌──────────────┐ │
│  │    Primary      │  │   Read Replica  │  │   Backup     │ │
│  │    Master       │  │   (Optional)    │  │   Server     │ │
│  └─────────────────┘  └─────────────────┘  └──────────────┘ │
└─────────────────────────────────────────────────────────────┘
							    │
							    ▼
┌─────────────────────────────────────────────────────────────┐
│                    Storage Layer                            │
│  ┌─────────────────┐  ┌─────────────────┐  ┌──────────────┐ │
│  │  Local SSD      │  │   Network NAS   │  │  Cloud S3    │ │
│  │  (Hot Data)     │  │  (Warm Backup)  │  │ (Cold Arch.) │ │
│  └─────────────────┘  └─────────────────┘  └──────────────┘ │
└─────────────────────────────────────────────────────────────┘

# postgres-ha-deployment.yaml
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: postgres-n8n-ha
namespace: n8n-production
spec:
instances: 3
postgresql:
	parameters:
	 max_connections: "200"
	 shared_buffers: "256MB"
	 effective_cache_size: "1GB"
	 maintenance_work_mem: "64MB"
	 checkpoint_completion_target: "0.9"
	 wal_buffers: "16MB"
	 default_statistics_target: "100"
	 random_page_cost: "1.1"
	 effective_io_concurrency: "200"
	 work_mem: "4MB"
	 min_wal_size: "1GB"
	 max_wal_size: "4GB"
bootstrap:
	initdb:
	 database: n8n_production
	 owner: n8n_user
	 secret:
		name: postgres-credentials
	 dataChecksums: true
storage:
	size: 500Gi
	storageClass: fast-ssd
monitoring:
	enabled: true
	customMetrics:
	 - name: "pg_stat_user_tables"
		query: "SELECT schemaname, tablename, n_tup_ins, n_tup_upd, n_tup_del FROM pg_stat_user_tables"
backup:
	target: prefer-standby
	retentionPolicy: "30d"
	data:
	 compression: gzip
	 encryption: AES256
	 immediateCheckpoint: true
	wal:
	 retention: "7d"
	 compression: gzip
	s3:
	 bucket: "n8n-database-backups"
	 path: "/postgres-backups"
	 region: "eu-central-1"
	 credentials:
		accessKeyId:
		 name: s3-credentials
		 key: ACCESS_KEY_ID
		secretAccessKey:
		 name: s3-credentials
		 key: SECRET_ACCESS_KEY
failoverDelay: 0
switchoverDelay: 60

#!/bin/bash
# backup-n8n-complete.sh
set -euo pipefail
BACKUP_DIR="/opt/backups/n8n"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
RETENTION_DAYS=30
S3_BUCKET="company-n8n-backups"

# Logging Setup
exec 1> >(logger -s -t n8n-backup)
exec 2>&1
echo "Starting n8n backup at $(date)"

# 1. Database Backup (PostgreSQL)
echo "Creating database backup..."
PGPASSWORD="${DB_PASSWORD}" pg_dump \
-h postgres.n8n-production.svc.cluster.local \
-U n8n_user \
-d n8n_production \
--verbose \
--compress=9 \
--format=custom \
--file="${BACKUP_DIR}/database_${TIMESTAMP}.pgdump"

# 2. Workflow Export via n8n API
echo "Exporting workflows via API..."
mkdir -p "${BACKUP_DIR}/workflows_${TIMESTAMP}"

# Get all workflow IDs
WORKFLOW_IDS=$(curl -s \
-H "Authorization: Bearer ${N8N_API_TOKEN}" \
"${N8N_API_URL}/api/v1/workflows" | \
jq -r '.data[].id')

# Export each workflow
for workflow_id in ${WORKFLOW_IDS}; do
curl -s \
	-H "Authorization: Bearer ${N8N_API_TOKEN}" \
	"${N8N_API_URL}/api/v1/workflows/${workflow_id}" | \
	jq '.' > "${BACKUP_DIR}/workflows_${TIMESTAMP}/workflow_${workflow_id}.json"
done

# 3. Credentials Backup (encrypted by n8n)
echo "Creating credentials backup..."
PGPASSWORD="${DB_PASSWORD}" pg_dump \
-h postgres.n8n-production.svc.cluster.local \
-U n8n_user \
-d n8n_production \
--table=credentials_entity \
--format=custom \
--file="${BACKUP_DIR}/credentials_${TIMESTAMP}.pgdump"

# 4. Configuration Files Backup
echo "Backing up configuration files..."
kubectl get configmaps -n n8n-production -o yaml > "${BACKUP_DIR}/configmaps_${TIMESTAMP}.yaml"
kubectl get secrets -n n8n-production -o yaml > "${BACKUP_DIR}/secrets_${TIMESTAMP}.yaml"

# 5. Create Consolidated Archive
echo "Creating consolidated backup archive..."
tar -czf "${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
-C "${BACKUP_DIR}" \
"database_${TIMESTAMP}.pgdump" \
"workflows_${TIMESTAMP}/" \
"credentials_${TIMESTAMP}.pgdump" \
"configmaps_${TIMESTAMP}.yaml" \
"secrets_${TIMESTAMP}.yaml"

# 6. Upload to S3 with encryption
echo "Uploading to S3..."
aws s3 cp "${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
"s3://${S3_BUCKET}/daily/${TIMESTAMP}/" \
--server-side-encryption AES256 \
--storage-class STANDARD_IA

# 7. Verify backup integrity
echo "Verifying backup integrity..."
aws s3api head-object \
--bucket "${S3_BUCKET}" \
--key "daily/${TIMESTAMP}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
--query 'ContentLength' --output text > /dev/null

# 8. Cleanup old local backups
echo "Cleaning up old local backups..."
find "${BACKUP_DIR}" -type f -name "*.tar.gz" -mtime +${RETENTION_DAYS} -delete
find "${BACKUP_DIR}" -type f -name "*.pgdump" -mtime +${RETENTION_DAYS} -delete
find "${BACKUP_DIR}" -type d -name "workflows_*" -mtime +${RETENTION_DAYS} -exec rm -rf {} +

# 9. Update backup log
echo "Backup completed successfully at $(date)"
echo "Backup size: $(du -h ${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz | cut -f1)"
echo "S3 location: s3://${S3_BUCKET}/daily/${TIMESTAMP}/"

# 10. Send notification (optional)
if command -v curl &> /dev/null && [[ -n "${SLACK_WEBHOOK_URL:-}" ]]; then
curl -X POST -H 'Content-type: application/json' \
	--data "{\"text\":\"✅ n8n backup completed successfully - ${TIMESTAMP}\"}" \
	"${SLACK_WEBHOOK_URL}"
fi

# n8n-backup-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
name: n8n-backup
namespace: n8n-production
spec:
schedule: "0 2 * * *" # Daily at 2 AM
timeZone: "Europe/Berlin"
concurrencyPolicy: Forbid
successfulJobsHistoryLimit: 3
failedJobsHistoryLimit: 5
jobTemplate:
	spec:
	 activeDeadlineSeconds: 3600 # 1 hour timeout
	 template:
		spec:
		 restartPolicy: OnFailure
		 containers:
		 - name: backup
			image: company-registry.com/n8n-backup:latest
			command: ["/scripts/backup-n8n-complete.sh"]
			env:
			- name: DB_PASSWORD
			 valueFrom:
				secretKeyRef:
				 name: postgres-credentials
				 key: password
			- name: N8N_API_TOKEN
			 valueFrom:
				secretKeyRef:
				 name: n8n-secrets
				 key: api-token
			- name: N8N_API_URL
			 value: "https://n8n.company.com"
			volumeMounts:
			- name: backup-storage
			 mountPath: /opt/backups
			- name: scripts
			 mountPath: /scripts
			resources:
			 requests:
				memory: "512Mi"
				cpu: "250m"
			 limits:
				memory: "2Gi"
				cpu: "1000m"
		 volumes:
		 - name: backup-storage
			persistentVolumeClaim:
			 claimName: backup-storage-pvc
		 - name: scripts
			configMap:
			 name: backup-scripts
			 defaultMode: 0755

#!/bin/bash
# restore-n8n-disaster-recovery.sh
set -euo pipefail
BACKUP_TIMESTAMP="${1:-}"
if [[ -z "$BACKUP_TIMESTAMP" ]]; then
echo "Usage: $0 <backup_timestamp>"
echo "Available backups:"
aws s3 ls s3://company-n8n-backups/daily/ | grep -o '[0-9]\{8\}_[0-9]\{6\}'
exit 1
fi
RESTORE_DIR="/tmp/n8n-restore-${BACKUP_TIMESTAMP}"
S3_BUCKET="company-n8n-backups"
echo "Starting disaster recovery for backup: ${BACKUP_TIMESTAMP}"

# 1. Download and extract backup
echo "Downloading backup from S3..."
mkdir -p "${RESTORE_DIR}"
aws s3 cp "s3://${S3_BUCKET}/daily/${BACKUP_TIMESTAMP}/n8n_complete_backup_${BACKUP_TIMESTAMP}.tar.gz" \
"${RESTORE_DIR}/"
cd "${RESTORE_DIR}"
tar -xzf "n8n_complete_backup_${BACKUP_TIMESTAMP}.tar.gz"

# 2. Scale down n8n deployment
echo "Scaling down n8n deployment..."
kubectl scale deployment n8n-main --replicas=0 -n n8n-production
kubectl scale deployment n8n-worker --replicas=0 -n n8n-production

# 3. Restore PostgreSQL database
echo "Restoring PostgreSQL database..."
kubectl exec -n n8n-production postgres-n8n-ha-1 -- psql -U postgres -c "DROP DATABASE IF EXISTS n8n_production;"
kubectl exec -n n8n-production postgres-n8n-ha-1 -- psql -U postgres -c "CREATE DATABASE n8n_production OWNER n8n_user;"
kubectl cp "database_${BACKUP_TIMESTAMP}.pgdump" n8n-production/postgres-n8n-ha-1:/tmp/
kubectl exec -n n8n-production postgres-n8n-ha-1 -- pg_restore \
-U n8n_user -d n8n_production \
--verbose --clean --if-exists \
"/tmp/database_${BACKUP_TIMESTAMP}.pgdump"

# 4. Restore Kubernetes configurations
echo "Restoring Kubernetes configurations..."
kubectl apply -f "configmaps_${BACKUP_TIMESTAMP}.yaml"
kubectl apply -f "secrets_${BACKUP_TIMESTAMP}.yaml"

 5. Scale up n8n deployment
echo "Scaling up n8n deployment..."
kubectl scale deployment n8n-main --replicas=2 -n n8n-production
kubectl scale deployment n8n-worker --replicas=5 -n n8n-production

# 6. Wait for deployment to be ready
echo "Waiting for pods to be ready..."
kubectl wait --for=condition=ready pod -l app=n8n-main -n n8n-production --timeout=300s
kubectl wait --for=condition=ready pod -l app=n8n-worker -n n8n-production --timeout=300s

# 7. Verify restoration
echo "Verifying restoration..."
WORKFLOW_COUNT=$(curl -s \
-H "Authorization: Bearer ${N8N_API_TOKEN}" \
"${N8N_API_URL}/api/v1/workflows" | \
jq '.data | length')
echo "✅ Disaster recovery completed!"
echo "Restored ${WORKFLOW_COUNT} workflows from backup ${BACKUP_TIMESTAMP}"
echo "n8n is available at: ${N8N_API_URL}"