N8n Für DevOps-Teams: Enterprise-Deployment Und Production-Integration

Du hast genug von manuellen Prozessen, die deine DevOps-Workflows verlangsamen? Du suchst nach einer Automatisierungslösung, die mehr kann als einfache Skripte, aber weniger Overhead hat als komplexe Enterprise-Plattformen? Dann ist n8n genau das, was du gesucht hast.

n8n ist eine Open-Source-Workflow-Automatisierungsplattform, die speziell für technische Teams entwickelt wurde, die Kontrolle über ihre Automatisierung behalten wollen. Im Gegensatz zu Cloud-basierten „Black Box“-Lösungen läuft n8n auf deiner eigenen Infrastruktur und gibt dir vollständige Transparenz über jeden Workflow-Schritt.

Stell dir vor, du könntest CI/CD-Pipelines triggern, Infrastructure-as-Code-Deployments orchestrieren, Monitoring-Alerts intelligent verarbeiten und komplexe API-Integrationen aufbauen – alles mit einer einzigen, selbst-gehosteten Plattform, die sich nahtlos in deine bestehende DevOps-Toolchain integriert.

Das ist genau das, was n8n ermöglicht. Mit seiner Node-basierten Architektur und event-driven Execution Engine verwandelt es sich von einem einfachen Automatisierungs-Tool in das zentrale Nervensystem deiner Infrastruktur-Workflows.

Warum n8n für DevOps-Teams?

Als erfahrener DevOps Engineer kennst du das Problem:

Jedes Tool in deiner Toolchain spricht seine eigene Sprache. Kubernetes-Events müssen mit Slack kommunizieren, Git-Webhooks sollen Terraform-Runs auslösen, und Monitoring-Alerts brauchen intelligente Eskalation. Die meisten Lösungen zwingen dich in ihre Cloud-Ökosysteme oder kosten ein Vermögen.

n8n ist anders. Es läuft dort, wo du es brauchst – in deinem Kubernetes-Cluster, auf deinen VMs oder in deiner Container-Infrastruktur. Du behältst die Kontrolle über deine Daten, deine Sicherheit und deine Compliance-Anforderungen.

⚠️ Wichtige Hinweise: Dieser Artikel richtet sich an erfahrene Linux-Administratoren, Senior DevOps Engineers und IT Automation Specialists, die n8n nicht nur "mal ausprobieren", sondern strategisch und nachhaltig einsetzen wollen. Du solltest bereits CLI-Routine, Linux-Systemverständnis, API-Erfahrung und YAML/JSON-Kenntnisse mitbringen. Wenn du mit Docker, Kubernetes, CI/CD-Pipelines und Infrastructure-as-Code vertraut bist, wirst du den maximalen Nutzen aus diesem Artikel ziehen.

Was dich in diesem Artikel erwartet:

Du bekommst hier keine oberflächliche „Klick-dich-durch“-Anleitung. Stattdessen erhältst du ein tiefes technisches Verständnis der n8n-Architektur und lernst, wie du es produktiv und skalierbar in Enterprise-Umgebungen einsetzt.

Wir schauen unter die Haube der Event-driven Workflow-Engine, verstehen die Worker-Prozesse und Queue-Mechanismen, und zeigen dir, wie du n8n container-orchestriert deployed und high-available betreibst.

Du lernst, eigene Custom Nodes mit TypeScript zu entwickeln, n8n in GitOps-Workflows zu integrieren und professionelle Monitoring- und Observability-Strategien umzusetzen. Außerdem behandeln wir Enterprise-Security, Multi-Tenancy und Compliance-Considerations – alles, was du brauchst, um n8n verantwortungsvoll in kritischen Infrastrukturen zu betreiben.

Der Unterschied zu anderen Automatisierungs-Plattformen:

Während Zapier und ähnliche Dienste auf einfache SaaS-Integrationen abzielen, ist n8n für technische Tiefe konzipiert. Du kannst komplexe JavaScript-Logik einbauen, HTTP-Requests mit vollständiger Kontrolle senden, Datenbanken direkt ansprechen und Shell-Commands ausführen.

Die selbst-gehostete Natur bedeutet: Keine Vendor-Lock-ins, keine Daten-Lecks an Third-Party-Services, keine monatlichen Per-User-Kosten, die bei wachsenden Teams explodieren.

Gleichzeitig bietet n8n die Benutzerfreundlichkeit einer grafischen Oberfläche mit der Flexibilität von Code. Das macht es zum perfekten Tool für DevOps-Teams, die sowohl schnelle Prototyping als auch enterprise-grade Stabilität benötigen.

Was n8n zu einem Game-Changer macht:

Die wahre Stärke von n8n liegt in seiner API-first Architektur. Jeder Workflow kann über REST-APIs gesteuert werden. Das bedeutet: Du kannst n8n-Workflows aus Terraform-Modulen heraus triggern, sie in Kubernetes-Jobs integrieren oder über GitLab CI/CD orchestrieren.

Die Queue-basierte Skalierung ermöglicht es, Tausende von Workflows parallel zu verarbeiten, während die Worker-Prozesse nahtlos horizontal skalieren. Das macht n8n production-ready für Umgebungen, in denen Reliability und Performance kritisch sind.

Mit Custom Node Development kannst du n8n exakt an deine Infrastruktur anpassen. Brauchst du eine Integration mit deinem internen CMDB? Eine spezielle Authentifizierung gegen dein Identity-Management? Komplexe Datenverarbeitung mit deinen proprietären APIs? Alles möglich.

Ready für den Deep-Dive?

In den folgenden Kapiteln tauchst du tief in die Architektur-Details ein, lernst Production-Deployment-Strategien kennen und entwickelst das Know-how, um n8n als strategisches Automatisierungs-Backbone in deiner Infrastruktur zu etablieren.

Vergiss alles, was du über „einfache Automatisierungs-Tools“ zu wissen glaubst. n8n wird deine Sicht auf Workflow-Automatisierung fundamental ändern – von einem „Nice-to-have“ zu einer unverzichtbaren Infrastrukturkomponente.

Architektur und Grundkonzepte

Du wirst n8n erst dann produktiv einsetzen können, wenn du seine fundamentalen Architekturprinzipien verstehst. n8n ist weit mehr als ein einfaches Automation-Tool – es ist eine event-driven Workflow-Engine mit einer durchdachten, skalierbaren Architektur, die speziell für Enterprise-Umgebungen konzipiert wurde.

Die Komplexität moderner DevOps-Umgebungen erfordert Automatisierungslösungen, die nicht nur funktionieren, sondern auch skalieren, überwachen und debuggen lassen. n8n’s Architektur wurde genau für diese Anforderungen entwickelt und unterscheidet sich fundamental von traditionellen Script-basierten oder Cloud-SaaS-Lösungen.

Event-driven Workflow-Engine und Node-basierte Verarbeitung

n8n basiert auf einem event-driven Architekturmodell, das sich grundlegend von traditionellen cron-basierten Automatisierungen unterscheidet. Jeder Workflow besteht aus Nodes (Knoten), die als diskrete Verarbeitungseinheiten fungieren und über Connections (Verbindungen) miteinander kommunizieren.

Die Node-basierte Verarbeitung folgt einem Directed Acyclic Graph (DAG) Muster:

[Trigger Node] → [Processing Node] → [Transform Node] → [Action Node]
	   ↓               ↓                 ↓              ↓
   Event Input    Data Processing    Data Transform   External API

[Trigger Node] → [Processing Node] → [Transform Node] → [Action Node]
	   ↓               ↓                 ↓              ↓
   Event Input    Data Processing    Data Transform   External API

Markdown

Jeder Node erhält Input-Daten im JSON-Format, verarbeitet diese nach seiner spezifischen Logik und gibt Output-Daten an nachgelagerte Nodes weiter. Diese Architektur ermöglicht es dir, komplexe Datenverarbeitungspipelines zu erstellen, ohne monolithische Skripte zu schreiben.

Event-driven Processing im Detail:

Das Event-System von n8n funktioniert über ein Publisher-Subscriber-Pattern. Trigger-Nodes agieren als Publisher und senden Events an den Event Bus, während nachgelagerte Nodes als Subscriber diese Events konsumieren und weiterverarbeiten.

┌─────────────────┐    ┌──────────────┐    ┌─────────────────┐
│   Webhook       │    │              │    │  HTTP Request   │
│   Trigger       │───▶│  Event Bus   │───▶│  Node           │
│   (Publisher)   │    │              │    │  (Subscriber)   │
└─────────────────┘    └──────────────┘    └─────────────────┘
							  │
							  ▼
				┌──────────────┐
			  │  Queue       │
				│  Management  │
				└──────────────┘

┌─────────────────┐    ┌──────────────┐    ┌─────────────────┐
│   Webhook       │    │              │    │  HTTP Request   │
│   Trigger       │───▶│  Event Bus   │───▶│  Node           │
│   (Publisher)   │    │              │    │  (Subscriber)   │
└─────────────────┘    └──────────────┘    └─────────────────┘
							  │
							  ▼
				┌──────────────┐
			  │  Queue       │
				│  Management  │
				└──────────────┘

Markdown

Warum ist das relevant für dich? Diese Architektur erlaubt horizontale Skalierung und Fehlerinsulation. Wenn ein Node fehlschlägt, beeinflusst das nicht die gesamte Pipeline – du kannst gezielt einzelne Verarbeitungsschritte debuggen und optimieren.

Node-Typen und ihre Rollen:

n8n unterscheidet zwischen verschiedenen Node-Kategorien, die jeweils spezifische Funktionen in der Workflow-Pipeline erfüllen:

Node-Kategorie	Funktion	Beispiele	Verwendungszweck
Trigger Nodes	Workflow-Initiierung	Webhook, Cron, File Watcher	Event-Empfang
Regular Nodes	Datenverarbeitung	HTTP Request, Database, Transform	API-Calls, DB-Operationen
Control Nodes	Flow-Kontrolle	IF, Switch, Merge, Split	Bedingte Logik
Utility Nodes	Hilfsfunktionen	Code, Function, Wait	Custom Logic

💡 Tipp: n8n speichert zwischen jedem Node-Übergang den kompletten Datenzustand. Das bedeutet: Du kannst Workflows an jedem Punkt pausieren, debuggen und von dort aus fortsetzen – ein enormer Vorteil gegenüber traditionellen Skript-basierten Ansätzen.

Datenflow und Transformation:

Der Datenfluss in n8n folgt einem strikten Schema. Jeder Node erhält ein Array von Items, wobei jedes Item ein JSON-Objekt mit json und optional binary Properties enthält:

// Standard n8n Item Format
{
  json: {
	// Haupt-Datenstruktur
	id: 123,
	name: "example",
	metadata: {
	  timestamp: "2025-01-01T12:00:00Z"
	}
  },
  binary: {
	// Binäre Daten (optional)
	file: {
	  data: "base64-encoded-content",
	  mimeType: "application/pdf",
	  fileName: "document.pdf"
	}
  }
}

// Standard n8n Item Format
{
  json: {
	// Haupt-Datenstruktur
	id: 123,
	name: "example",
	metadata: {
	  timestamp: "2025-01-01T12:00:00Z"
	}
  },
  binary: {
	// Binäre Daten (optional)
	file: {
	  data: "base64-encoded-content",
	  mimeType: "application/pdf",
	  fileName: "document.pdf"
	}
  }
}

JavaScript

Die Event-Architektur unterstützt verschiedene Trigger-Mechanismen:

Trigger-Typ	Beschreibung	Use Case	Konfiguration
Webhook	HTTP-Endpoints für externe Events	Git-Hooks, API-Callbacks	POST/GET/PUT/DELETE
Schedule	Cron-basierte Ausführung	Periodische Backups, Reports	Cron-Expression
File Watcher	Dateisystem-Events	Log-Processing, Config-Changes	Pfad + Event-Type
Queue	Message-Queue-Integration	Asynchrone Task-Verarbeitung	Redis/RabbitMQ
Email	IMAP/POP3-basiert	Email-Automation	Mail-Server Config

🔧 Praktisches Beispiel – Komplexer Git-Webhook-Flow:

// Webhook Input Processing
const payload = $input.all()[0].json;

// Branch-basierte Routing-Logik
if (payload.ref === 'refs/heads/main') {
  return [
	{
	  json: {
		action: 'deploy_production',
		commit: payload.head_commit.id,
		message: payload.head_commit.message,
		author: payload.head_commit.author.name,
		environment: 'production'
	  }
	}
  ];
} else if (payload.ref.startsWith('refs/heads/develop')) {
  return [
	{
	  json: {
		action: 'deploy_staging',
		commit: payload.head_commit.id,
		branch: payload.ref.replace('refs/heads/', ''),
		environment: 'staging'
	  }
	}
  ];
}

// Feature-Branch: Nur Tests ausführen
return [
  {
	json: {
	  action: 'run_tests',
	  commit: payload.head_commit.id,
	  branch: payload.ref.replace('refs/heads/', '')
	}
  }
];

// Webhook Input Processing
const payload = $input.all()[0].json;

// Branch-basierte Routing-Logik
if (payload.ref === 'refs/heads/main') {
  return [
	{
	  json: {
		action: 'deploy_production',
		commit: payload.head_commit.id,
		message: payload.head_commit.message,
		author: payload.head_commit.author.name,
		environment: 'production'
	  }
	}
  ];
} else if (payload.ref.startsWith('refs/heads/develop')) {
  return [
	{
	  json: {
		action: 'deploy_staging',
		commit: payload.head_commit.id,
		branch: payload.ref.replace('refs/heads/', ''),
		environment: 'staging'
	  }
	}
  ];
}

// Feature-Branch: Nur Tests ausführen
return [
  {
	json: {
	  action: 'run_tests',
	  commit: payload.head_commit.id,
	  branch: payload.ref.replace('refs/heads/', '')
	}
  }
];

JavaScript

Error Handling und Retry Logic:

n8n implementiert ein mehrstufiges Error-Handling-System:

Node-Level Errors: Fehler innerhalb einzelner Nodes
Workflow-Level Errors: Fehler, die den gesamten Workflow betreffen
System-Level Errors: Infrastructure-Fehler (DB-Connection, Memory)

// Error Handling im Code Node
try {
  const response = await fetch('https://api.example.com/data');
  if (!response.ok) {
	throw new Error(`API Error: ${response.status} - ${response.statusText}`);
  }
  return response.json();
} catch (error) {
  // Custom Error mit Context
  throw new Error(`External API failed: ${error.message}`);
}

// Error Handling im Code Node
try {
  const response = await fetch('https://api.example.com/data');
  if (!response.ok) {
	throw new Error(`API Error: ${response.status} - ${response.statusText}`);
  }
  return response.json();
} catch (error) {
  // Custom Error mit Context
  throw new Error(`External API failed: ${error.message}`);
}

JavaScript

⚠️ Wichtig: n8n ist single-threaded per Workflow-Execution. Das bedeutet: Ein Workflow kann nicht parallel zu sich selbst laufen. Für High-Throughput-Szenarien musst du Queue-basierte Architektur implementieren.

Performance-Optimierung bei Node-Processing:

Für optimale Performance solltest du folgende Prinzipien beachten:

┌ Batch Processing: Verarbeite mehrere Items gleichzeitig
├ Memory Management: Verwende Streaming für große Datenmengen
├ Connection Pooling: Wiederverwendung von HTTP/DB-Connections
└ Caching: Zwischenspeicherung häufig genutzter Daten

// Batch Processing Beispiel
const batchSize = 100;
const items = $input.all();
const batches = [];

for (let i = 0; i < items.length; i += batchSize) {
  const batch = items.slice(i, i + batchSize);
  batches.push({
	json: {
	  batch_id: Math.floor(i / batchSize),
	  items: batch.map(item => item.json),
	  total_batches: Math.ceil(items.length / batchSize)
	}
  });
}

return batches;

// Batch Processing Beispiel
const batchSize = 100;
const items = $input.all();
const batches = [];

for (let i = 0; i < items.length; i += batchSize) {
  const batch = items.slice(i, i + batchSize);
  batches.push({
	json: {
	  batch_id: Math.floor(i / batchSize),
	  items: batch.map(item => item.json),
	  total_batches: Math.ceil(items.length / batchSize)
	}
  });
}

return batches;

JavaScript

Execution Context und Worker-Prozesse

Der Execution Context ist das Herzstück der n8n-Workflow-Verarbeitung. Jede Workflow-Ausführung läuft in einem isolierten Kontext, der folgende Komponenten umfasst:

Main Process: Der Hauptprozess orchestriert Workflow-Starts, verwaltet die Datenbank-Verbindungen und koordiniert Worker-Prozesse. Er ist nicht für die eigentliche Workflow-Ausführung verantwortlich.

Worker Processes: Diese separaten Prozesse führen die tatsächliche Workflow-Logik aus. Jeder Worker kann mehrere Workflows parallel verarbeiten, ist aber von anderen Workern isoliert.

┌─────────────────────────────────────────────────────────────────┐
│                         Main Process                            │
│  ┌─────────────────┐  ┌──────────────────┐  ┌─────────────────┐ │
│  │   Web Server    │  │  Queue Manager   │  │  DB Connection  │ │
│  │  (REST API)     │  │ (Redis/Memory)   │  │     Pool        │ │
│  │   Port 5678     │  │                  │  │                 │ │
│  └─────────────────┘  └──────────────────┘  └─────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
								  │
								  │ Job Distribution via Queue
								  ▼
┌────────────────────────────────────────────────────────┐
│                      Worker Processes                  │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  │
│  │   Worker 1   │  │   Worker 2   │  │   Worker 3   │  │
│  │              │  │              │  │              │  │
│  │ Execution    │  │ Execution    │  │ Execution    │  │
│  │ Context A    │  │ Context B    │  │ Context C    │  │
│  │ Context D    │  │ Context E    │  │              │  │
│  └──────────────┘  └──────────────┘  └──────────────┘  │
└────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────┐
│                         Main Process                            │
│  ┌─────────────────┐  ┌──────────────────┐  ┌─────────────────┐ │
│  │   Web Server    │  │  Queue Manager   │  │  DB Connection  │ │
│  │  (REST API)     │  │ (Redis/Memory)   │  │     Pool        │ │
│  │   Port 5678     │  │                  │  │                 │ │
│  └─────────────────┘  └──────────────────┘  └─────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
								  │
								  │ Job Distribution via Queue
								  ▼
┌────────────────────────────────────────────────────────┐
│                      Worker Processes                  │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐  │
│  │   Worker 1   │  │   Worker 2   │  │   Worker 3   │  │
│  │              │  │              │  │              │  │
│  │ Execution    │  │ Execution    │  │ Execution    │  │
│  │ Context A    │  │ Context B    │  │ Context C    │  │
│  │ Context D    │  │ Context E    │  │              │  │
│  └──────────────┘  └──────────────┘  └──────────────┘  │
└────────────────────────────────────────────────────────┘

Markdown

Execution Context Details:

Jeder Execution Context ist eine vollständig isolierte Umgebung, die folgende Komponenten enthält:

┌ Workflow Definition: Complete JSON-basierte Workflow-Struktur mit allen Node-Konfigurationen
├ Input Data: Eingangsdaten für den aktuellen Workflow-Run inklusive Metadaten
├ Credentials: Verschlüsselte API-Keys und Authentifizierungs-Token mit Scope-Management
├ Environment Variables: Workflow-spezifische und globale Umgebungsvariablen
├ Error State: Fehlerbehandlung, Retry-Logic und Rollback-Mechanismen
└ Execution History: Vollständiger Audit-Trail aller Node-Durchläufe

Worker-Process-Lifecycle:

┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
│   Idle      │───▶│  Receiving  │───▶│ Executing   │───▶│ Reporting   │
│   State     │    │    Job      │    │  Workflow   │    │   Result    │
└─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘
	    ▲                                                          │
	    │                                                          ▼
┌─────────────┐                                          ┌─────────────┐
│  Cleanup    │◄─────────────────────────────────────────│  Completed  │
│   Memory    │                                          │    State    │
└─────────────┘                                          └─────────────┘

┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
│   Idle      │───▶│  Receiving  │───▶│ Executing   │───▶│ Reporting   │
│   State     │    │    Job      │    │  Workflow   │    │   Result    │
└─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘
	    ▲                                                          │
	    │                                                          ▼
┌─────────────┐                                          ┌─────────────┐
│  Cleanup    │◄─────────────────────────────────────────│  Completed  │
│   Memory    │                                          │    State    │
└─────────────┘                                          └─────────────┘

Markdown

🔧 Praktisches Beispiel: Wenn du einen Webhook-Trigger für Git-Events konfigurierst, erstellt n8n für jeden eingehenden Webhook einen separaten Execution Context. Das ermöglicht es, hunderte Git-Events parallel zu verarbeiten, ohne dass sich die Workflows gegenseitig beeinflussen.

Worker-Konfiguration und Skalierung:

Die Worker-Konfiguration erfolgt über Umgebungsvariablen und bestimmt das Verhalten der gesamten n8n-Installation:

# Worker-spezifische Konfiguration
export N8N_WORKERS_ENABLED=true
export N8N_WORKERS_MAX_CONCURRENCY=10
export N8N_WORKERS_TIMEOUT=3600
export N8N_WORKERS_MAX_MEMORY_MB=2048

# Queue-Konfiguration für Worker-Communication
export QUEUE_BULL_REDIS_HOST=redis.internal
export QUEUE_BULL_REDIS_PORT=6379
export QUEUE_BULL_REDIS_DB=2
export QUEUE_BULL_REDIS_PASSWORD=secure_redis_password

# Einzelner Worker (Standard-Modus)
n8n worker

# Mehrere Worker auf einem System
for i in {1..4}; do
  N8N_WORKER_ID=worker_$i n8n worker &
done

# Distributed Workers (Kubernetes Deployment)
kubectl scale deployment n8n-worker --replicas=10

# Worker-spezifische Konfiguration
export N8N_WORKERS_ENABLED=true
export N8N_WORKERS_MAX_CONCURRENCY=10
export N8N_WORKERS_TIMEOUT=3600
export N8N_WORKERS_MAX_MEMORY_MB=2048

# Queue-Konfiguration für Worker-Communication
export QUEUE_BULL_REDIS_HOST=redis.internal
export QUEUE_BULL_REDIS_PORT=6379
export QUEUE_BULL_REDIS_DB=2
export QUEUE_BULL_REDIS_PASSWORD=secure_redis_password

# Einzelner Worker (Standard-Modus)
n8n worker

# Mehrere Worker auf einem System
for i in {1..4}; do
  N8N_WORKER_ID=worker_$i n8n worker &
done

# Distributed Workers (Kubernetes Deployment)
kubectl scale deployment n8n-worker --replicas=10

Bash

Worker-Performance-Tuning:

Für optimale Worker-Performance musst du verschiedene Parameter abstimmen:

Parameter	Beschreibung	Empfohlener Wert	Impact
`MAX_CONCURRENCY`	Parallel ausführbare Workflows	10-50	CPU/Memory Usage
`TIMEOUT`	Max. Workflow-Laufzeit	3600s	Hanging-Workflow-Prevention
`MAX_MEMORY_MB`	Memory-Limit pro Worker	2048-8192 MB	OOM-Prevention
`HEARTBEAT_INTERVAL`	Worker-Health-Check	30s	Failure Detection

⚠️ Stolperfalle: Worker-Prozesse teilen sich die gleiche Datenbank. Bei hoher Parallelität können Database Lock Contentions auftreten. Verwende PostgreSQL statt SQLite für Production-Deployments und optimiere deine Connection-Pools entsprechend:

# PostgreSQL Connection Pool Optimization
export N8N_DATABASE_POSTGRESDB_POOL_SIZE=20
export N8N_DATABASE_POSTGRESDB_MAX_CONNECTIONS=100
export N8N_DATABASE_POSTGRESDB_IDLE_TIMEOUT=30000

# PostgreSQL Connection Pool Optimization
export N8N_DATABASE_POSTGRESDB_POOL_SIZE=20
export N8N_DATABASE_POSTGRESDB_MAX_CONNECTIONS=100
export N8N_DATABASE_POSTGRESDB_IDLE_TIMEOUT=30000

Bash

Memory Management und Garbage Collection:

Jeder Execution Context alloziert Memory für verschiedene Zwecke:

┌ Node Input/Output Data:  JSON-Strukturen zwischen Nodes (meist 1-10 MB)
├ Binary Data:  Dateien, Bilder, Documents (kann GB-Größe erreichen)
├ Credential Cache: Entschlüsselte API-Keys (temporär, <1 MB)
└ Execution History: Audit-Trail und Debug-Informationen (10-100 MB)

// Memory-effiziente Binary Data Verarbeitung
const binaryData = $input.binary.file;

// Streaming statt vollständiges Laden
const stream = require('stream');
const { pipeline } = require('stream/promises');

await pipeline(
  createReadStream(binaryData.data),
  transformStream,
  createWriteStream(outputPath)
);

// Memory explizit freigeben
delete $input.binary.file;

// Memory-effiziente Binary Data Verarbeitung
const binaryData = $input.binary.file;

// Streaming statt vollständiges Laden
const stream = require('stream');
const { pipeline } = require('stream/promises');

await pipeline(
  createReadStream(binaryData.data),
  transformStream,
  createWriteStream(outputPath)
);

// Memory explizit freigeben
delete $input.binary.file;

JavaScript

💡 Memory Optimization: n8n lädt nur die benötigten Node-Daten in den Memory. Bei großen Workflows mit Binary Data solltest du Streaming Nodes verwenden, um Memory-Verbrauch zu begrenzen.

Error Recovery und Worker-Resilience:

Worker-Prozesse können aus verschiedenen Gründen fehlschlagen. n8n implementiert mehrere Recovery-Mechanismen:

# Worker mit automatischem Restart
while true; do
  n8n worker
  echo "Worker crashed, restarting in 5 seconds..."
  sleep 5
done

# Systemd Service für Production
cat << 'EOF' > /etc/systemd/system/n8n-worker.service
[Unit]
Description=n8n Worker Process
After=network.target

[Service]
Type=simple
User=n8n
WorkingDirectory=/opt/n8n
ExecStart=/usr/local/bin/n8n worker
Restart=always
RestartSec=5
Environment=NODE_ENV=production

[Install]
WantedBy=multi-user.target
EOF

# Worker mit automatischem Restart
while true; do
  n8n worker
  echo "Worker crashed, restarting in 5 seconds..."
  sleep 5
done

# Systemd Service für Production
cat << 'EOF' > /etc/systemd/system/n8n-worker.service
[Unit]
Description=n8n Worker Process
After=network.target

[Service]
Type=simple
User=n8n
WorkingDirectory=/opt/n8n
ExecStart=/usr/local/bin/n8n worker
Restart=always
RestartSec=5
Environment=NODE_ENV=production

[Install]
WantedBy=multi-user.target
EOF

Bash

Queue-basierte Load Distribution:

n8n verwendet ein Queue-System (standardmäßig Redis-basiert) für die Verteilung von Workflow-Executions auf Worker:

┌─────────────────┐    ┌──────────────┐    ┌─────────────────┐
│                 │    │              │    │                 │
│   Main Process  │───▶│  Job Queue   │───▶│  Worker Pool    │
│   (Scheduler)   │    │   (Redis)    │    │  (Consumers)    │
│                 │    │              │    │                 │
└─────────────────┘    └──────────────┘    └─────────────────┘
						 │
						 ▼
			┌──────────────────┐
			│  Dead Letter     │
			│     Queue        │
			│  (Failed Jobs)   │
			└──────────────────┘

┌─────────────────┐    ┌──────────────┐    ┌─────────────────┐
│                 │    │              │    │                 │
│   Main Process  │───▶│  Job Queue   │───▶│  Worker Pool    │
│   (Scheduler)   │    │   (Redis)    │    │  (Consumers)    │
│                 │    │              │    │                 │
└─────────────────┘    └──────────────┘    └─────────────────┘
						 │
						 ▼
			┌──────────────────┐
			│  Dead Letter     │
			│     Queue        │
			│  (Failed Jobs)   │
			└──────────────────┘

Markdown

Monitoring Worker-Health:

Für Production-Umgebungen solltest du Worker-Health kontinuierlich überwachen:

# Worker-Health-Check Skript
#!/bin/bash
WORKER_PID=$(pgrep -f "n8n worker")
if [ -z "$WORKER_PID" ]; then
  echo "CRITICAL: n8n worker not running"
  exit 2
fi

# Memory Usage prüfen
MEMORY_MB=$(ps -p $WORKER_PID -o rss= | awk '{print int($1/1024)}')
if [ $MEMORY_MB -gt 4096 ]; then
  echo "WARNING: Worker using ${MEMORY_MB}MB memory"
  exit 1
fi

echo "OK: Worker running with ${MEMORY_MB}MB memory"
exit 0

# Worker-Health-Check Skript
#!/bin/bash
WORKER_PID=$(pgrep -f "n8n worker")
if [ -z "$WORKER_PID" ]; then
  echo "CRITICAL: n8n worker not running"
  exit 2
fi

# Memory Usage prüfen
MEMORY_MB=$(ps -p $WORKER_PID -o rss= | awk '{print int($1/1024)}')
if [ $MEMORY_MB -gt 4096 ]; then
  echo "WARNING: Worker using ${MEMORY_MB}MB memory"
  exit 1
fi

echo "OK: Worker running with ${MEMORY_MB}MB memory"
exit 0

Bash

API-First-Ansatz und Headless-Betrieb

n8n wurde von Grund auf als API-First-Platform entwickelt. Das bedeutet: Alles, was du in der Web-UI machen kannst, ist auch über die REST-API verfügbar – und oft sogar mehr. Diese Architektur-Entscheidung macht n8n zu einer Infrastructure-as-Code-fähigen Plattform.

Warum API-First für DevOps relevant ist:

In modernen DevOps-Umgebungen müssen Automatisierungs-Plattformen nahtlos in bestehende Toolchains integriert werden. Die API-First-Architektur ermöglicht es dir:

┌ GitOps-Workflows: Workflow-Definitionen als Code verwalten
├ CI/CD-Integration: Automatisierte Tests und Deployments
├ Infrastructure Automation: Workflow-Management via Terraform/Ansible
└ Monitoring Integration: Metriken und Alerts in bestehende Tools

Core APIs im Detail:

n8n’s REST-API folgt OpenAPI 3.0 Standards und bietet vollständige CRUD-Operationen für alle Ressourcen:

API Endpoint	Funktionalität	HTTP Methods	Authentifizierung
`/api/v1/workflows`	Workflow-Management	GET, POST, PUT, DELETE	Bearer Token
`/api/v1/executions`	Execution-Monitoring	GET, POST, DELETE	Bearer Token
`/api/v1/credentials`	Credential-Management	GET, POST, PUT, DELETE	Bearer Token
`/api/v1/webhooks/{path}`	Webhook-Endpoints	GET, POST, PUT	Optional
`/api/v1/nodes`	Node-Information	GET	Bearer Token
`/api/v1/users`	User-Management	GET, POST, PUT, DELETE	Admin Token

🔧 Praktisches Beispiel – Workflow-Lifecycle via API:

# 1. Workflow aus Git-Repository laden
git clone https://github.com/company/n8n-workflows.git
cd n8n-workflows/production/

# 2. Workflow-Definition validieren
jq empty production-deploy.json || {
  echo "Invalid JSON in workflow definition"
  exit 1
}

# 3. Workflow via API erstellen/updaten
WORKFLOW_ID=$(curl -s -X POST https://n8n.company.com/api/v1/workflows \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" \
  -d @production-deploy.json | jq -r '.id')

# 4. Workflow aktivieren
curl -X POST https://n8n.company.com/api/v1/workflows/${WORKFLOW_ID}/activate \
  -H "Authorization: Bearer ${N8N_API_TOKEN}"

# 5. Webhook-URL abrufen und in CI/CD registrieren
WEBHOOK_URL=$(curl -s https://n8n.company.com/api/v1/workflows/${WORKFLOW_ID} \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" | \
  jq -r '.nodes[] | select(.type == "n8n-nodes-base.webhook") | .webhookUrl')

echo "Webhook URL: ${WEBHOOK_URL}"

# 1. Workflow aus Git-Repository laden
git clone https://github.com/company/n8n-workflows.git
cd n8n-workflows/production/

# 2. Workflow-Definition validieren
jq empty production-deploy.json || {
  echo "Invalid JSON in workflow definition"
  exit 1
}

# 3. Workflow via API erstellen/updaten
WORKFLOW_ID=$(curl -s -X POST https://n8n.company.com/api/v1/workflows \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" \
  -d @production-deploy.json | jq -r '.id')

# 4. Workflow aktivieren
curl -X POST https://n8n.company.com/api/v1/workflows/${WORKFLOW_ID}/activate \
  -H "Authorization: Bearer ${N8N_API_TOKEN}"

# 5. Webhook-URL abrufen und in CI/CD registrieren
WEBHOOK_URL=$(curl -s https://n8n.company.com/api/v1/workflows/${WORKFLOW_ID} \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" | \
  jq -r '.nodes[] | select(.type == "n8n-nodes-base.webhook") | .webhookUrl')

echo "Webhook URL: ${WEBHOOK_URL}"

Bash

Headless-Betrieb für Production:

n8n kann komplett ohne Web-UI betrieben werden. Das ist besonders relevant für:

┌ Container-Deployments** in Production-Umgebungen
├ CI/CD-Integration** ohne UI-Dependencies
├ High-Security-Environments** ohne Web-Interfaces
└ Resource-optimierte Deployments** (geringerer Memory-Footprint)

# Headless Start ohne Web-UI
export N8N_DISABLE_UI=true
export N8N_ENDPOINTS_REST_AUTH=bearer
export N8N_API_KEY=n8n_api_production_token_12345

# Mit externem Database Backend für Skalierbarkeit
export N8N_DATABASE_TYPE=postgresdb
export N8N_DATABASE_HOST=postgres.internal.company.com
export N8N_DATABASE_PORT=5432
export N8N_DATABASE_NAME=n8n_production
export N8N_DATABASE_USER=n8n_app_user
export N8N_DATABASE_PASSWORD=secure_production_password
export N8N_DATABASE_SSL_ENABLED=true

# Worker-Mode für horizontale Skalierung
n8n worker

# Headless Start ohne Web-UI
export N8N_DISABLE_UI=true
export N8N_ENDPOINTS_REST_AUTH=bearer
export N8N_API_KEY=n8n_api_production_token_12345

# Mit externem Database Backend für Skalierbarkeit
export N8N_DATABASE_TYPE=postgresdb
export N8N_DATABASE_HOST=postgres.internal.company.com
export N8N_DATABASE_PORT=5432
export N8N_DATABASE_NAME=n8n_production
export N8N_DATABASE_USER=n8n_app_user
export N8N_DATABASE_PASSWORD=secure_production_password
export N8N_DATABASE_SSL_ENABLED=true

# Worker-Mode für horizontale Skalierung
n8n worker

Bash

API Authentication und Security:

n8n unterstützt verschiedene Authentication-Mechanismen, die für verschiedene Use Cases optimiert sind:

# 1. API Token Authentication (Empfohlen für Automation)
curl -H "Authorization: Bearer n8n_api_production_token_12345" \
  https://n8n.company.com/api/v1/workflows

# 2. Basic Authentication (Legacy-Support)
curl -u "service-account:complex_password_123" \
  https://n8n.company.com/api/v1/workflows

# 3. Session-based Authentication (UI-basiert)
curl -b "n8n-auth=SESSION_COOKIE_VALUE" \
  https://n8n.company.com/api/v1/workflows

# 4. JWT Token (Enterprise Edition)
curl -H "Authorization: JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  https://n8n.company.com/api/v1/workflows

# 1. API Token Authentication (Empfohlen für Automation)
curl -H "Authorization: Bearer n8n_api_production_token_12345" \
  https://n8n.company.com/api/v1/workflows

# 2. Basic Authentication (Legacy-Support)
curl -u "service-account:complex_password_123" \
  https://n8n.company.com/api/v1/workflows

# 3. Session-based Authentication (UI-basiert)
curl -b "n8n-auth=SESSION_COOKIE_VALUE" \
  https://n8n.company.com/api/v1/workflows

# 4. JWT Token (Enterprise Edition)
curl -H "Authorization: JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  https://n8n.company.com/api/v1/workflows

Bash

❗ Security Best Practices: API-Token haben die gleichen Rechte wie der User, der sie erstellt hat. In Production solltest du Service Accounts mit minimalen Berechtigungen für API-Access verwenden:

# Service Account für CI/CD mit read-only Rechten
curl -X POST https://n8n.company.com/api/v1/users \
  -H "Authorization: Bearer ${ADMIN_TOKEN}" \
  -d '{
	"email": "ci-cd@company.com",
	"firstName": "CI/CD",
	"lastName": "Service",
	"role": "editor",
	"permissions": {
	  "workflows": ["read", "execute"],
	  "executions": ["read"],
	  "credentials": ["read"]
	}
  }'

# Service Account für CI/CD mit read-only Rechten
curl -X POST https://n8n.company.com/api/v1/users \
  -H "Authorization: Bearer ${ADMIN_TOKEN}" \
  -d '{
	"email": "ci-cd@company.com",
	"firstName": "CI/CD",
	"lastName": "Service",
	"role": "editor",
	"permissions": {
	  "workflows": ["read", "execute"],
	  "executions": ["read"],
	  "credentials": ["read"]
	}
  }'

Bash

Webhook-Architecture für High-Performance:

n8n’s Webhook-System ist hochperformant und unterstützt Enterprise-Features:

┌ Synchrone Webhooks:** Sofortige Response an den Caller (< 100ms)
├ Asynchrone Webhooks: Verarbeitung in Worker-Queue
├ Webhook Validation: HMAC-Signature-Verification für Security
├ Rate Limiting: Pro-IP und Pro-Webhook Limits
└ Load Balancing: Multiple Webhook-Endpoints für HA

// Advanced Webhook Response mit Custom Headers
const startTime = Date.now();

// Payload-Validation
if (!$input.first().json.repository || !$input.first().json.commits) {
  $response.statusCode = 400;
  return {
	error: "Invalid webhook payload",
	expected: ["repository", "commits"]
  };
}

// Asynchrone Verarbeitung triggern
const processingId = generateUUID();
await queue.add('deployment-pipeline', {
  id: processingId,
  payload: $input.first().json,
  timestamp: new Date().toISOString()
});

// Sofortige Response mit Tracking-Information
return {
  json: { 
	status: "accepted", 
	processing_id: processingId,
	estimated_completion: new Date(Date.now() + 300000).toISOString()
  },
  headers: {
	"X-Processing-Time": Date.now() - startTime,
	"X-Workflow-ID": $workflow.id,
	"X-Processing-ID": processingId,
	"Location": `/api/v1/executions/${processingId}`
  },
  statusCode: 202
};

// Advanced Webhook Response mit Custom Headers
const startTime = Date.now();

// Payload-Validation
if (!$input.first().json.repository || !$input.first().json.commits) {
  $response.statusCode = 400;
  return {
	error: "Invalid webhook payload",
	expected: ["repository", "commits"]
  };
}

// Asynchrone Verarbeitung triggern
const processingId = generateUUID();
await queue.add('deployment-pipeline', {
  id: processingId,
  payload: $input.first().json,
  timestamp: new Date().toISOString()
});

// Sofortige Response mit Tracking-Information
return {
  json: { 
	status: "accepted", 
	processing_id: processingId,
	estimated_completion: new Date(Date.now() + 300000).toISOString()
  },
  headers: {
	"X-Processing-Time": Date.now() - startTime,
	"X-Workflow-ID": $workflow.id,
	"X-Processing-ID": processingId,
	"Location": `/api/v1/executions/${processingId}`
  },
  statusCode: 202
};

JavaScript

💡 Advanced Use Case: Du kannst n8n-Webhooks als Event Gateway für Microservices verwenden. Eingehende Events werden validiert, transformiert und an verschiedene Backend-Services geroutet – alles ohne Custom Code.

Integration Patterns für Enterprise-Umgebungen:

Der API-First-Ansatz ermöglicht elegante Integration-Patterns, die in professionellen DevOps-Umgebungen Standard sind:

1. GitOps Integration Pattern:

# .github/workflows/n8n-deploy.yml
name: Deploy n8n Workflows
on:
  push:
	paths: ['workflows/**']
  
jobs:
  deploy:
	runs-on: ubuntu-latest
	steps:
	  - uses: actions/checkout@v3
	  
	  - name: Validate Workflow Definitions
		run: |
		  for workflow in workflows/*.json; do
			jq empty "$workflow" || exit 1
		  done
	  
	  - name: Deploy to n8n
		run: |
		  for workflow in workflows/*.json; do
			curl -X POST $N8N_API_URL/api/v1/workflows \
			  -H "Authorization: Bearer $N8N_API_TOKEN" \
			  -H "Content-Type: application/json" \
			  -d @"$workflow"
		  done
		env:
		  N8N_API_URL: ${{ secrets.N8N_API_URL }}
		  N8N_API_TOKEN: ${{ secrets.N8N_API_TOKEN }}

# .github/workflows/n8n-deploy.yml
name: Deploy n8n Workflows
on:
  push:
	paths: ['workflows/**']
  
jobs:
  deploy:
	runs-on: ubuntu-latest
	steps:
	  - uses: actions/checkout@v3
	  
	  - name: Validate Workflow Definitions
		run: |
		  for workflow in workflows/*.json; do
			jq empty "$workflow" || exit 1
		  done
	  
	  - name: Deploy to n8n
		run: |
		  for workflow in workflows/*.json; do
			curl -X POST $N8N_API_URL/api/v1/workflows \
			  -H "Authorization: Bearer $N8N_API_TOKEN" \
			  -H "Content-Type: application/json" \
			  -d @"$workflow"
		  done
		env:
		  N8N_API_URL: ${{ secrets.N8N_API_URL }}
		  N8N_API_TOKEN: ${{ secrets.N8N_API_TOKEN }}

Bash

2. Infrastructure as Code with Terraform:

# terraform/n8n-workflows.tf
resource "null_resource" "n8n_workflow" {
  for_each = fileset(path.module, "workflows/*.json")
  
  provisioner "local-exec" {
	command = <<-EOT
	  curl -X POST ${var.n8n_api_url}/api/v1/workflows \
		-H "Authorization: Bearer ${var.n8n_api_token}" \
		-H "Content-Type: application/json" \
		-d @${each.value}
	EOT
  }
  
  triggers = {
	workflow_hash = filemd5(each.value)
  }
}

# terraform/n8n-workflows.tf
resource "null_resource" "n8n_workflow" {
  for_each = fileset(path.module, "workflows/*.json")
  
  provisioner "local-exec" {
	command = <<-EOT
	  curl -X POST ${var.n8n_api_url}/api/v1/workflows \
		-H "Authorization: Bearer ${var.n8n_api_token}" \
		-H "Content-Type: application/json" \
		-d @${each.value}
	EOT
  }
  
  triggers = {
	workflow_hash = filemd5(each.value)
  }
}

Bash

3. Monitoring Integration mit Prometheus:

# n8n-exporter.sh - Custom Prometheus Exporter
#!/bin/bash

while true; do
  # Workflow-Metriken sammeln
  ACTIVE_WORKFLOWS=$(curl -s -H "Authorization: Bearer $N8N_API_TOKEN" \
	"$N8N_API_URL/api/v1/workflows?active=true" | jq '. | length')
  
  FAILED_EXECUTIONS=$(curl -s -H "Authorization: Bearer $N8N_API_TOKEN" \
	"$N8N_API_URL/api/v1/executions?status=error&limit=1000" | jq '. | length')
  
  echo "n8n_active_workflows $ACTIVE_WORKFLOWS" > /tmp/n8n-metrics.prom
  echo "n8n_failed_executions_total $FAILED_EXECUTIONS" >> /tmp/n8n-metrics.prom
  
  sleep 30
done

# n8n-exporter.sh - Custom Prometheus Exporter
#!/bin/bash

while true; do
  # Workflow-Metriken sammeln
  ACTIVE_WORKFLOWS=$(curl -s -H "Authorization: Bearer $N8N_API_TOKEN" \
	"$N8N_API_URL/api/v1/workflows?active=true" | jq '. | length')
  
  FAILED_EXECUTIONS=$(curl -s -H "Authorization: Bearer $N8N_API_TOKEN" \
	"$N8N_API_URL/api/v1/executions?status=error&limit=1000" | jq '. | length')
  
  echo "n8n_active_workflows $ACTIVE_WORKFLOWS" > /tmp/n8n-metrics.prom
  echo "n8n_failed_executions_total $FAILED_EXECUTIONS" >> /tmp/n8n-metrics.prom
  
  sleep 30
done

Bash

⚠️ Rate Limiting Considerations: n8n's APIs haben standardmäßig Rate Limits. Für High-Throughput-Szenarien musst du diese entsprechend konfigurieren.

# API Rate Limits für Production erhöhen
export N8N_API_RATE_LIMIT_ENABLED=true
export N8N_API_RATE_LIMIT_MAX_REQUESTS=10000
export N8N_API_RATE_LIMIT_WINDOW_MS=60000
export N8N_API_RATE_LIMIT_TRUST_PROXY=true
```

**Advanced API Features für Enterprise-Use:**

```bash
# Bulk-Operations für große Workflow-Sets
curl -X POST https://n8n.company.com/api/v1/workflows/bulk \
  -H "Authorization: Bearer $N8N_API_TOKEN" \
  -d '{
	"operation": "activate",
	"workflow_ids": ["1", "2", "3", "4", "5"],
	"options": {
	  "validate": true,
	  "dry_run": false
	}
  }'

# Workflow-Templates für standardisierte Deployments
curl -X POST https://n8n.company.com/api/v1/workflows/from-template \
  -H "Authorization: Bearer $N8N_API_TOKEN" \
  -d '{
	"template_id": "git-ci-cd-pipeline",
	"parameters": {
	  "repository_url": "https://github.com/company/app.git",
	  "deploy_environment": "production",
	  "notification_slack_channel": "#deployments"
	}
  }'

# API Rate Limits für Production erhöhen
export N8N_API_RATE_LIMIT_ENABLED=true
export N8N_API_RATE_LIMIT_MAX_REQUESTS=10000
export N8N_API_RATE_LIMIT_WINDOW_MS=60000
export N8N_API_RATE_LIMIT_TRUST_PROXY=true
```

**Advanced API Features für Enterprise-Use:**

```bash
# Bulk-Operations für große Workflow-Sets
curl -X POST https://n8n.company.com/api/v1/workflows/bulk \
  -H "Authorization: Bearer $N8N_API_TOKEN" \
  -d '{
	"operation": "activate",
	"workflow_ids": ["1", "2", "3", "4", "5"],
	"options": {
	  "validate": true,
	  "dry_run": false
	}
  }'

# Workflow-Templates für standardisierte Deployments
curl -X POST https://n8n.company.com/api/v1/workflows/from-template \
  -H "Authorization: Bearer $N8N_API_TOKEN" \
  -d '{
	"template_id": "git-ci-cd-pipeline",
	"parameters": {
	  "repository_url": "https://github.com/company/app.git",
	  "deploy_environment": "production",
	  "notification_slack_channel": "#deployments"
	}
  }'

Bash

Die Architektur von n8n ist darauf ausgelegt, produktive Enterprise-Workloads zu bewältigen. Die Kombination aus event-driven Processing, isolierten Execution Contexts und API-first Design macht es zu einer robusten Plattform für kritische Automatisierungsprozesse in deiner Infrastruktur. Mit den hier beschriebenen Konzepten hast du das Fundament gelegt, um n8n professionell und skalierbar einzusetzen.

Deployment-Strategien

Architektur-Grundlagen verstanden – Zeit für produktionsreife Deployments. Die Wahl der richtigen Deployment-Strategie entscheidet über Skalierbarkeit, Verfügbarkeit und Wartbarkeit deiner n8n-Installation. In diesem Abschnitt behandeln wir die wichtigsten Deployment-Ansätze für Enterprise-Umgebungen.

Warum sind professionelle Deployment-Strategien kritisch? In Produktionsumgebungen reicht es nicht aus, n8n einfach zu „starten“. Du benötigst Strategien für automatische Skalierung, Disaster Recovery, Zero-Downtime-Updates und Multi-Environment-Deployments. Die hier beschriebenen Ansätze sind das Fundament für eine stabile, wartbare Automatisierungsplattform.

Container-orchestrierte Installation mit Docker/Kubernetes

Die Container-orchestrierte Installation ist der de-facto Standard für n8n-Deployments in professionellen Umgebungen. Container bieten Isolation, Portabilität und vereinfachen das Management von Dependencies – kritische Faktoren für eine stabile Automatisierungsplattform.

Docker-Compose für mittlere Deployments:

Docker Compose eignet sich perfekt für Teams, die n8n auf einer einzelnen Machine oder einem kleinen Cluster betreiben wollen. Diese Konfiguration bietet bereits professionelle Features wie Persistierung, externe Datenbanken und Load Balancing.

# docker-compose.production.yml
version: '3.8'

services:
  postgres:
	image: postgres:15-alpine
	restart: unless-stopped
	environment:
	  POSTGRES_DB: n8n_production
	  POSTGRES_USER: n8n_user
	  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
	  POSTGRES_NON_ROOT_USER: n8n_app
	  POSTGRES_NON_ROOT_PASSWORD: ${POSTGRES_APP_PASSWORD}
	volumes:
	  - postgres_data:/var/lib/postgresql/data
	  - ./init-scripts:/docker-entrypoint-initdb.d:ro
	healthcheck:
	  test: ["CMD-SHELL", "pg_isready -U n8n_user -d n8n_production"]
	  interval: 10s
	  timeout: 5s
	  retries: 5
	networks:
	  - n8n-internal

  redis:
	image: redis:7-alpine
	restart: unless-stopped
	command: redis-server --requirepass ${REDIS_PASSWORD} --maxmemory 512mb --maxmemory-policy allkeys-lru
	volumes:
	  - redis_data:/data
	healthcheck:
	  test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
	  interval: 10s
	  timeout: 3s
	  retries: 5
	networks:
	  - n8n-internal

  n8n-main:
	image: n8nio/n8n:latest
	restart: unless-stopped
	environment:
	  # Database Configuration
	  DB_TYPE: postgresdb
	  DB_POSTGRESDB_HOST: postgres
	  DB_POSTGRESDB_PORT: 5432
	  DB_POSTGRESDB_DATABASE: n8n_production
	  DB_POSTGRESDB_USER: n8n_app
	  DB_POSTGRESDB_PASSWORD: ${POSTGRES_APP_PASSWORD}
	  
	  # Queue Configuration
	  EXECUTIONS_MODE: queue
	  QUEUE_BULL_REDIS_HOST: redis
	  QUEUE_BULL_REDIS_PASSWORD: ${REDIS_PASSWORD}
	  QUEUE_BULL_REDIS_PORT: 6379
	  QUEUE_BULL_REDIS_DB: 0
	  
	  # Security & Performance
	  N8N_SECURE_COOKIE: true
	  N8N_PROTOCOL: https
	  N8N_HOST: ${N8N_DOMAIN}
	  N8N_PORT: 5678
	  N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
	  
	  # Webhook Configuration
	  WEBHOOK_URL: https://${N8N_DOMAIN}/
	  
	  # Disable execution in main process
	  EXECUTIONS_PROCESS: main
	ports:
	  - "127.0.0.1:5678:5678"
	volumes:
	  - n8n_data:/home/node/.n8n
	  - ./custom-nodes:/home/node/.n8n/custom
	depends_on:
	  postgres:
		condition: service_healthy
	  redis:
		condition: service_healthy
	networks:
	  - n8n-internal
	  - web-proxy
	labels:
	  - "traefik.enable=true"
	  - "traefik.http.routers.n8n.rule=Host(`${N8N_DOMAIN}`)"
	  - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"

  n8n-worker:
	image: n8nio/n8n:latest
	restart: unless-stopped
	command: n8n worker
	environment:
	  # Database Configuration (same as main)
	  DB_TYPE: postgresdb
	  DB_POSTGRESDB_HOST: postgres
	  DB_POSTGRESDB_PORT: 5432
	  DB_POSTGRESDB_DATABASE: n8n_production
	  DB_POSTGRESDB_USER: n8n_app
	  DB_POSTGRESDB_PASSWORD: ${POSTGRES_APP_PASSWORD}
	  
	  # Queue Configuration
	  QUEUE_BULL_REDIS_HOST: redis
	  QUEUE_BULL_REDIS_PASSWORD: ${REDIS_PASSWORD}
	  QUEUE_BULL_REDIS_PORT: 6379
	  QUEUE_BULL_REDIS_DB: 0
	  
	  # Worker-specific Configuration
	  N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
	  EXECUTIONS_PROCESS: own
	  
	  # Performance Tuning
	  N8N_WORKERS_CONCURRENCY: 10
	  N8N_WORKERS_TIMEOUT: 3600
	volumes:
	  - n8n_data:/home/node/.n8n
	  - ./custom-nodes:/home/node/.n8n/custom
	depends_on:
	  postgres:
		condition: service_healthy
	  redis:
		condition: service_healthy
	networks:
	  - n8n-internal
	deploy:
	  replicas: 3
	  resources:
		limits:
		  memory: 2G
		  cpus: "1.0"
		reservations:
		  memory: 512M
		  cpus: "0.5"

volumes:
  postgres_data:
	driver: local
	driver_opts:
	  type: none
	  o: bind
	  device: /opt/n8n/postgres-data
  redis_data:
	driver: local
  n8n_data:
	driver: local
	driver_opts:
	  type: none
	  o: bind
	  device: /opt/n8n/app-data

networks:
  n8n-internal:
	driver: bridge
	internal: true
  web-proxy:
	external: true

# docker-compose.production.yml
version: '3.8'

services:
  postgres:
	image: postgres:15-alpine
	restart: unless-stopped
	environment:
	  POSTGRES_DB: n8n_production
	  POSTGRES_USER: n8n_user
	  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
	  POSTGRES_NON_ROOT_USER: n8n_app
	  POSTGRES_NON_ROOT_PASSWORD: ${POSTGRES_APP_PASSWORD}
	volumes:
	  - postgres_data:/var/lib/postgresql/data
	  - ./init-scripts:/docker-entrypoint-initdb.d:ro
	healthcheck:
	  test: ["CMD-SHELL", "pg_isready -U n8n_user -d n8n_production"]
	  interval: 10s
	  timeout: 5s
	  retries: 5
	networks:
	  - n8n-internal

  redis:
	image: redis:7-alpine
	restart: unless-stopped
	command: redis-server --requirepass ${REDIS_PASSWORD} --maxmemory 512mb --maxmemory-policy allkeys-lru
	volumes:
	  - redis_data:/data
	healthcheck:
	  test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
	  interval: 10s
	  timeout: 3s
	  retries: 5
	networks:
	  - n8n-internal

  n8n-main:
	image: n8nio/n8n:latest
	restart: unless-stopped
	environment:
	  # Database Configuration
	  DB_TYPE: postgresdb
	  DB_POSTGRESDB_HOST: postgres
	  DB_POSTGRESDB_PORT: 5432
	  DB_POSTGRESDB_DATABASE: n8n_production
	  DB_POSTGRESDB_USER: n8n_app
	  DB_POSTGRESDB_PASSWORD: ${POSTGRES_APP_PASSWORD}
	  
	  # Queue Configuration
	  EXECUTIONS_MODE: queue
	  QUEUE_BULL_REDIS_HOST: redis
	  QUEUE_BULL_REDIS_PASSWORD: ${REDIS_PASSWORD}
	  QUEUE_BULL_REDIS_PORT: 6379
	  QUEUE_BULL_REDIS_DB: 0
	  
	  # Security & Performance
	  N8N_SECURE_COOKIE: true
	  N8N_PROTOCOL: https
	  N8N_HOST: ${N8N_DOMAIN}
	  N8N_PORT: 5678
	  N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
	  
	  # Webhook Configuration
	  WEBHOOK_URL: https://${N8N_DOMAIN}/
	  
	  # Disable execution in main process
	  EXECUTIONS_PROCESS: main
	ports:
	  - "127.0.0.1:5678:5678"
	volumes:
	  - n8n_data:/home/node/.n8n
	  - ./custom-nodes:/home/node/.n8n/custom
	depends_on:
	  postgres:
		condition: service_healthy
	  redis:
		condition: service_healthy
	networks:
	  - n8n-internal
	  - web-proxy
	labels:
	  - "traefik.enable=true"
	  - "traefik.http.routers.n8n.rule=Host(`${N8N_DOMAIN}`)"
	  - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"

  n8n-worker:
	image: n8nio/n8n:latest
	restart: unless-stopped
	command: n8n worker
	environment:
	  # Database Configuration (same as main)
	  DB_TYPE: postgresdb
	  DB_POSTGRESDB_HOST: postgres
	  DB_POSTGRESDB_PORT: 5432
	  DB_POSTGRESDB_DATABASE: n8n_production
	  DB_POSTGRESDB_USER: n8n_app
	  DB_POSTGRESDB_PASSWORD: ${POSTGRES_APP_PASSWORD}
	  
	  # Queue Configuration
	  QUEUE_BULL_REDIS_HOST: redis
	  QUEUE_BULL_REDIS_PASSWORD: ${REDIS_PASSWORD}
	  QUEUE_BULL_REDIS_PORT: 6379
	  QUEUE_BULL_REDIS_DB: 0
	  
	  # Worker-specific Configuration
	  N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
	  EXECUTIONS_PROCESS: own
	  
	  # Performance Tuning
	  N8N_WORKERS_CONCURRENCY: 10
	  N8N_WORKERS_TIMEOUT: 3600
	volumes:
	  - n8n_data:/home/node/.n8n
	  - ./custom-nodes:/home/node/.n8n/custom
	depends_on:
	  postgres:
		condition: service_healthy
	  redis:
		condition: service_healthy
	networks:
	  - n8n-internal
	deploy:
	  replicas: 3
	  resources:
		limits:
		  memory: 2G
		  cpus: "1.0"
		reservations:
		  memory: 512M
		  cpus: "0.5"

volumes:
  postgres_data:
	driver: local
	driver_opts:
	  type: none
	  o: bind
	  device: /opt/n8n/postgres-data
  redis_data:
	driver: local
  n8n_data:
	driver: local
	driver_opts:
	  type: none
	  o: bind
	  device: /opt/n8n/app-data

networks:
  n8n-internal:
	driver: bridge
	internal: true
  web-proxy:
	external: true

YAML

🔧 Praktische Deployment-Vorbereitung:

# Environment-Datei erstellen
cat << 'EOF' > .env.production
POSTGRES_PASSWORD=secure_postgres_root_password_123
POSTGRES_APP_PASSWORD=secure_app_user_password_456
REDIS_PASSWORD=secure_redis_password_789
N8N_DOMAIN=n8n.company.com
N8N_ENCRYPTION_KEY=$(openssl rand -hex 32)
EOF

# Produktions-Verzeichnisse erstellen
sudo mkdir -p /opt/n8n/{postgres-data,app-data,backups,custom-nodes}
sudo chown -R 1000:1000 /opt/n8n/app-data
sudo chmod 700 /opt/n8n/postgres-data

# SSL-Zertifikate via Let's Encrypt (Traefik)
docker run -d \
  --name traefik \
  --restart unless-stopped \
  -p 80:80 -p 443:443 \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /opt/traefik/acme.json:/acme.json \
  -v /opt/traefik/traefik.yml:/etc/traefik/traefik.yml:ro \
  traefik:v2.10

# n8n Deployment starten
docker-compose -f docker-compose.production.yml up -d

# Environment-Datei erstellen
cat << 'EOF' > .env.production
POSTGRES_PASSWORD=secure_postgres_root_password_123
POSTGRES_APP_PASSWORD=secure_app_user_password_456
REDIS_PASSWORD=secure_redis_password_789
N8N_DOMAIN=n8n.company.com
N8N_ENCRYPTION_KEY=$(openssl rand -hex 32)
EOF

# Produktions-Verzeichnisse erstellen
sudo mkdir -p /opt/n8n/{postgres-data,app-data,backups,custom-nodes}
sudo chown -R 1000:1000 /opt/n8n/app-data
sudo chmod 700 /opt/n8n/postgres-data

# SSL-Zertifikate via Let's Encrypt (Traefik)
docker run -d \
  --name traefik \
  --restart unless-stopped \
  -p 80:80 -p 443:443 \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /opt/traefik/acme.json:/acme.json \
  -v /opt/traefik/traefik.yml:/etc/traefik/traefik.yml:ro \
  traefik:v2.10

# n8n Deployment starten
docker-compose -f docker-compose.production.yml up -d

Bash

💡 Tipp: Nutze Docker Compose Profiles für verschiedene Umgebungen. Mit docker-compose --profile production up -d kannst du produktions-spezifische Services aktivieren, während Entwicklungs-Tools ausgeschaltet bleiben.

Kubernetes für Enterprise-Skalierung:

Kubernetes ist die erste Wahl für n8n-Deployments, die hohe Verfügbarkeit, automatische Skalierung und integrierte Observability benötigen. Die folgende Konfiguration zeigt einen produktionsreifen Setup:

# n8n-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: n8n-production
  labels:
	name: n8n-production

---
# n8n-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: n8n-config
  namespace: n8n-production
data:
  N8N_HOST: "n8n.company.com"
  N8N_PROTOCOL: "https"
  N8N_PORT: "5678"
  DB_TYPE: "postgresdb"
  DB_POSTGRESDB_HOST: "postgres-service.n8n-production.svc.cluster.local"
  DB_POSTGRESDB_PORT: "5432"
  DB_POSTGRESDB_DATABASE: "n8n_production"
  EXECUTIONS_MODE: "queue"
  QUEUE_BULL_REDIS_HOST: "redis-service.n8n-production.svc.cluster.local"
  QUEUE_BULL_REDIS_PORT: "6379"
  QUEUE_BULL_REDIS_DB: "0"
  WEBHOOK_URL: "https://n8n.company.com/"
  N8N_METRICS: "true"
  N8N_DIAGNOSTICS_ENABLED: "false"

---
# n8n-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: n8n-secrets
  namespace: n8n-production
type: Opaque
data:
  N8N_ENCRYPTION_KEY: # base64 encoded
  DB_POSTGRESDB_PASSWORD: # base64 encoded
  QUEUE_BULL_REDIS_PASSWORD: # base64 encoded

---
# n8n-main-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-main
  namespace: n8n-production
  labels:
	app: n8n-main
spec:
  replicas: 2
  strategy:
	type: RollingUpdate
	rollingUpdate:
	  maxUnavailable: 1
	  maxSurge: 1
  selector:
	matchLabels:
	  app: n8n-main
  template:
	metadata:
	  labels:
		app: n8n-main
	spec:
	  affinity:
		podAntiAffinity:
		  preferredDuringSchedulingIgnoredDuringExecution:
		  - weight: 100
			podAffinityTerm:
			  labelSelector:
				matchExpressions:
				- key: app
				  operator: In
				  values:
				  - n8n-main
			  topologyKey: kubernetes.io/hostname
	  containers:
	  - name: n8n-main
		image: n8nio/n8n:latest
		ports:
		- containerPort: 5678
		  name: http
		envFrom:
		- configMapRef:
			name: n8n-config
		- secretRef:
			name: n8n-secrets
		env:
		- name: DB_POSTGRESDB_USER
		  value: "n8n_app"
		resources:
		  requests:
			memory: "1Gi"
			cpu: "500m"
		  limits:
			memory: "2Gi"
			cpu: "1000m"
		livenessProbe:
		  httpGet:
			path: /healthz
			port: 5678
		  initialDelaySeconds: 30
		  periodSeconds: 10
		  timeoutSeconds: 5
		  failureThreshold: 3
		readinessProbe:
		  httpGet:
			path: /healthz
			port: 5678
		  initialDelaySeconds: 10
		  periodSeconds: 5
		  timeoutSeconds: 3
		  failureThreshold: 3
		volumeMounts:
		- name: n8n-data
		  mountPath: /home/node/.n8n
		- name: custom-nodes
		  mountPath: /home/node/.n8n/custom
	  volumes:
	  - name: n8n-data
		persistentVolumeClaim:
		  claimName: n8n-main-pvc
	  - name: custom-nodes
		configMap:
		  name: n8n-custom-nodes

---
# n8n-worker-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-worker
  namespace: n8n-production
  labels:
	app: n8n-worker
spec:
  replicas: 5
  strategy:
	type: RollingUpdate
	rollingUpdate:
	  maxUnavailable: 1
	  maxSurge: 2
  selector:
	matchLabels:
	  app: n8n-worker
  template:
	metadata:
	  labels:
		app: n8n-worker
	spec:
	  affinity:
		podAntiAffinity:
		  preferredDuringSchedulingIgnoredDuringExecution:
		  - weight: 50
			podAffinityTerm:
			  labelSelector:
				matchExpressions:
				- key: app
				  operator: In
				  values:
				  - n8n-worker
			  topologyKey: kubernetes.io/hostname
	  containers:
	  - name: n8n-worker
		image: n8nio/n8n:latest
		command: ["n8n", "worker"]
		envFrom:
		- configMapRef:
			name: n8n-config
		- secretRef:
			name: n8n-secrets
		env:
		- name: DB_POSTGRESDB_USER
		  value: "n8n_app"
		- name: EXECUTIONS_PROCESS
		  value: "own"
		- name: N8N_WORKERS_CONCURRENCY
		  value: "10"
		- name: N8N_WORKERS_TIMEOUT
		  value: "3600"
		resources:
		  requests:
			memory: "512Mi"
			cpu: "250m"
		  limits:
			memory: "2Gi"
			cpu: "1000m"
		volumeMounts:
		- name: n8n-data
		  mountPath: /home/node/.n8n
		  readOnly: true
		- name: custom-nodes
		  mountPath: /home/node/.n8n/custom
		  readOnly: true
	  volumes:
	  - name: n8n-data
		persistentVolumeClaim:
		  claimName: n8n-shared-pvc
	  - name: custom-nodes
		configMap:
		  name: n8n-custom-nodes

---
# n8n-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: n8n-worker-hpa
  namespace: n8n-production
spec:
  scaleTargetRef:
	apiVersion: apps/v1
	kind: Deployment
	name: n8n-worker
  minReplicas: 3
  maxReplicas: 20
  metrics:
  - type: Resource
	resource:
	  name: cpu
	  target:
		type: Utilization
		averageUtilization: 70
  - type: Resource
	resource:
	  name: memory
	  target:
		type: Utilization
		averageUtilization: 80
  behavior:
	scaleUp:
	  stabilizationWindowSeconds: 60
	  policies:
	  - type: Percent
		value: 100
		periodSeconds: 60
	scaleDown:
	  stabilizationWindowSeconds: 300
	  policies:
	  - type: Percent
		value: 50
		periodSeconds: 60

# n8n-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: n8n-production
  labels:
	name: n8n-production

---
# n8n-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: n8n-config
  namespace: n8n-production
data:
  N8N_HOST: "n8n.company.com"
  N8N_PROTOCOL: "https"
  N8N_PORT: "5678"
  DB_TYPE: "postgresdb"
  DB_POSTGRESDB_HOST: "postgres-service.n8n-production.svc.cluster.local"
  DB_POSTGRESDB_PORT: "5432"
  DB_POSTGRESDB_DATABASE: "n8n_production"
  EXECUTIONS_MODE: "queue"
  QUEUE_BULL_REDIS_HOST: "redis-service.n8n-production.svc.cluster.local"
  QUEUE_BULL_REDIS_PORT: "6379"
  QUEUE_BULL_REDIS_DB: "0"
  WEBHOOK_URL: "https://n8n.company.com/"
  N8N_METRICS: "true"
  N8N_DIAGNOSTICS_ENABLED: "false"

---
# n8n-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: n8n-secrets
  namespace: n8n-production
type: Opaque
data:
  N8N_ENCRYPTION_KEY: # base64 encoded
  DB_POSTGRESDB_PASSWORD: # base64 encoded
  QUEUE_BULL_REDIS_PASSWORD: # base64 encoded

---
# n8n-main-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-main
  namespace: n8n-production
  labels:
	app: n8n-main
spec:
  replicas: 2
  strategy:
	type: RollingUpdate
	rollingUpdate:
	  maxUnavailable: 1
	  maxSurge: 1
  selector:
	matchLabels:
	  app: n8n-main
  template:
	metadata:
	  labels:
		app: n8n-main
	spec:
	  affinity:
		podAntiAffinity:
		  preferredDuringSchedulingIgnoredDuringExecution:
		  - weight: 100
			podAffinityTerm:
			  labelSelector:
				matchExpressions:
				- key: app
				  operator: In
				  values:
				  - n8n-main
			  topologyKey: kubernetes.io/hostname
	  containers:
	  - name: n8n-main
		image: n8nio/n8n:latest
		ports:
		- containerPort: 5678
		  name: http
		envFrom:
		- configMapRef:
			name: n8n-config
		- secretRef:
			name: n8n-secrets
		env:
		- name: DB_POSTGRESDB_USER
		  value: "n8n_app"
		resources:
		  requests:
			memory: "1Gi"
			cpu: "500m"
		  limits:
			memory: "2Gi"
			cpu: "1000m"
		livenessProbe:
		  httpGet:
			path: /healthz
			port: 5678
		  initialDelaySeconds: 30
		  periodSeconds: 10
		  timeoutSeconds: 5
		  failureThreshold: 3
		readinessProbe:
		  httpGet:
			path: /healthz
			port: 5678
		  initialDelaySeconds: 10
		  periodSeconds: 5
		  timeoutSeconds: 3
		  failureThreshold: 3
		volumeMounts:
		- name: n8n-data
		  mountPath: /home/node/.n8n
		- name: custom-nodes
		  mountPath: /home/node/.n8n/custom
	  volumes:
	  - name: n8n-data
		persistentVolumeClaim:
		  claimName: n8n-main-pvc
	  - name: custom-nodes
		configMap:
		  name: n8n-custom-nodes

---
# n8n-worker-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-worker
  namespace: n8n-production
  labels:
	app: n8n-worker
spec:
  replicas: 5
  strategy:
	type: RollingUpdate
	rollingUpdate:
	  maxUnavailable: 1
	  maxSurge: 2
  selector:
	matchLabels:
	  app: n8n-worker
  template:
	metadata:
	  labels:
		app: n8n-worker
	spec:
	  affinity:
		podAntiAffinity:
		  preferredDuringSchedulingIgnoredDuringExecution:
		  - weight: 50
			podAffinityTerm:
			  labelSelector:
				matchExpressions:
				- key: app
				  operator: In
				  values:
				  - n8n-worker
			  topologyKey: kubernetes.io/hostname
	  containers:
	  - name: n8n-worker
		image: n8nio/n8n:latest
		command: ["n8n", "worker"]
		envFrom:
		- configMapRef:
			name: n8n-config
		- secretRef:
			name: n8n-secrets
		env:
		- name: DB_POSTGRESDB_USER
		  value: "n8n_app"
		- name: EXECUTIONS_PROCESS
		  value: "own"
		- name: N8N_WORKERS_CONCURRENCY
		  value: "10"
		- name: N8N_WORKERS_TIMEOUT
		  value: "3600"
		resources:
		  requests:
			memory: "512Mi"
			cpu: "250m"
		  limits:
			memory: "2Gi"
			cpu: "1000m"
		volumeMounts:
		- name: n8n-data
		  mountPath: /home/node/.n8n
		  readOnly: true
		- name: custom-nodes
		  mountPath: /home/node/.n8n/custom
		  readOnly: true
	  volumes:
	  - name: n8n-data
		persistentVolumeClaim:
		  claimName: n8n-shared-pvc
	  - name: custom-nodes
		configMap:
		  name: n8n-custom-nodes

---
# n8n-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: n8n-worker-hpa
  namespace: n8n-production
spec:
  scaleTargetRef:
	apiVersion: apps/v1
	kind: Deployment
	name: n8n-worker
  minReplicas: 3
  maxReplicas: 20
  metrics:
  - type: Resource
	resource:
	  name: cpu
	  target:
		type: Utilization
		averageUtilization: 70
  - type: Resource
	resource:
	  name: memory
	  target:
		type: Utilization
		averageUtilization: 80
  behavior:
	scaleUp:
	  stabilizationWindowSeconds: 60
	  policies:
	  - type: Percent
		value: 100
		periodSeconds: 60
	scaleDown:
	  stabilizationWindowSeconds: 300
	  policies:
	  - type: Percent
		value: 50
		periodSeconds: 60

YAML

⚠️ Kubernetes-spezifische Überlegungen: n8n in Kubernetes erfordert besondere Aufmerksamkeit bei der Persistierung. Die Main-Instance benötigt ReadWriteOnce-Volumes, während Worker ReadOnlyMany-Volumes für Custom Nodes verwenden können. Stelle sicher, dass dein Storage-Provider diese Access Modes unterstützt.

Helm Chart für wiederverwendbare Deployments:

# values.production.yaml
replicaCount:
  main: 2
  worker: 5

image:
  repository: n8nio/n8n
  tag: "latest"
  pullPolicy: IfNotPresent

service:
  type: ClusterIP
  port: 5678

ingress:
  enabled: true
  className: "nginx"
  annotations:
	cert-manager.io/cluster-issuer: "letsencrypt-prod"
	nginx.ingress.kubernetes.io/ssl-redirect: "true"
	nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
  hosts:
	- host: n8n.company.com
	  paths:
		- path: /
		  pathType: Prefix
  tls:
	- secretName: n8n-tls
	  hosts:
		- n8n.company.com

postgresql:
  enabled: true
  auth:
	postgresPassword: "secure_root_password"
	username: "n8n_app"
	password: "secure_app_password"
	database: "n8n_production"
  primary:
	persistence:
	  enabled: true
	  size: 100Gi
	  storageClass: "fast-ssd"

redis:
  enabled: true
  auth:
	enabled: true
	password: "secure_redis_password"
  master:
	persistence:
	  enabled: true
	  size: 10Gi

autoscaling:
  enabled: true
  minReplicas: 3
  maxReplicas: 20
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 80

resources:
  main:
	limits:
	  cpu: 1000m
	  memory: 2Gi
	requests:
	  cpu: 500m
	  memory: 1Gi
  worker:
	limits:
	  cpu: 1000m
	  memory: 2Gi
	requests:
	  cpu: 250m
	  memory: 512Mi

monitoring:
  enabled: true
  serviceMonitor:
	enabled: true
	namespace: monitoring

# values.production.yaml
replicaCount:
  main: 2
  worker: 5

image:
  repository: n8nio/n8n
  tag: "latest"
  pullPolicy: IfNotPresent

service:
  type: ClusterIP
  port: 5678

ingress:
  enabled: true
  className: "nginx"
  annotations:
	cert-manager.io/cluster-issuer: "letsencrypt-prod"
	nginx.ingress.kubernetes.io/ssl-redirect: "true"
	nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
  hosts:
	- host: n8n.company.com
	  paths:
		- path: /
		  pathType: Prefix
  tls:
	- secretName: n8n-tls
	  hosts:
		- n8n.company.com

postgresql:
  enabled: true
  auth:
	postgresPassword: "secure_root_password"
	username: "n8n_app"
	password: "secure_app_password"
	database: "n8n_production"
  primary:
	persistence:
	  enabled: true
	  size: 100Gi
	  storageClass: "fast-ssd"

redis:
  enabled: true
  auth:
	enabled: true
	password: "secure_redis_password"
  master:
	persistence:
	  enabled: true
	  size: 10Gi

autoscaling:
  enabled: true
  minReplicas: 3
  maxReplicas: 20
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 80

resources:
  main:
	limits:
	  cpu: 1000m
	  memory: 2Gi
	requests:
	  cpu: 500m
	  memory: 1Gi
  worker:
	limits:
	  cpu: 1000m
	  memory: 2Gi
	requests:
	  cpu: 250m
	  memory: 512Mi

monitoring:
  enabled: true
  serviceMonitor:
	enabled: true
	namespace: monitoring

YAML

🔧 Helm-Deployment:

# Helm Repository hinzufügen
helm repo add n8n https://8gears.container-registry.com/chartrepo/library
helm repo update

# Custom Values für Production
helm install n8n-production n8n/n8n \
  --namespace n8n-production \
  --create-namespace \
  --values values.production.yaml \
  --wait --timeout=300s

# Deployment-Status überwachen
kubectl get pods -n n8n-production -w
kubectl logs -n n8n-production deployment/n8n-main -f

# Helm Repository hinzufügen
helm repo add n8n https://8gears.container-registry.com/chartrepo/library
helm repo update

# Custom Values für Production
helm install n8n-production n8n/n8n \
  --namespace n8n-production \
  --create-namespace \
  --values values.production.yaml \
  --wait --timeout=300s

# Deployment-Status überwachen
kubectl get pods -n n8n-production -w
kubectl logs -n n8n-production deployment/n8n-main -f

Bash

Queue-basierte Skalierung und Load Balancing

Die Queue-basierte Architektur ist der Schlüssel für horizontale Skalierung in n8n. Sie entkoppelt die Webhook-/Trigger-Verarbeitung von der eigentlichen Workflow-Ausführung und ermöglicht es, Worker dynamisch zu skalieren.

Wie Queue Mode funktioniert:

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│                 │    │                  │    │                 │
│  Webhook/Timer  │───▶│   Main Process   │───▶│   Redis Queue   │
│   (Triggers)    │    │  (Orchestrator)  │    │  (Job Storage)  │
│                 │    │                  │    │                 │
└─────────────────┘    └──────────────────┘    └─────────────────┘
														 │
						   ┌─────────────────────────────┼─────────────────────────────┐
						   │                             │                             │
						   ▼                             ▼                             ▼
				  ┌─────────────────┐          ┌─────────────────┐          ┌─────────────────┐
				  │                 │          │                 │          │                 │
				  │   Worker 1      │          │   Worker 2      │          │   Worker N      │
				  │ (Execution)     │          │ (Execution)     │          │ (Execution)     │
				  │                 │          │                 │          │                 │
				  └─────────────────┘          └─────────────────┘          └─────────────────┘
						   │                             │                             │
						   └─────────────────────────────┼─────────────────────────────┘
														 ▼
												┌─────────────────┐
												│                 │
												│   PostgreSQL    │
												│   (Results)     │
												│                 │
												└─────────────────┘

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│                 │    │                  │    │                 │
│  Webhook/Timer  │───▶│   Main Process   │───▶│   Redis Queue   │
│   (Triggers)    │    │  (Orchestrator)  │    │  (Job Storage)  │
│                 │    │                  │    │                 │
└─────────────────┘    └──────────────────┘    └─────────────────┘
														 │
						   ┌─────────────────────────────┼─────────────────────────────┐
						   │                             │                             │
						   ▼                             ▼                             ▼
				  ┌─────────────────┐          ┌─────────────────┐          ┌─────────────────┐
				  │                 │          │                 │          │                 │
				  │   Worker 1      │          │   Worker 2      │          │   Worker N      │
				  │ (Execution)     │          │ (Execution)     │          │ (Execution)     │
				  │                 │          │                 │          │                 │
				  └─────────────────┘          └─────────────────┘          └─────────────────┘
						   │                             │                             │
						   └─────────────────────────────┼─────────────────────────────┘
														 ▼
												┌─────────────────┐
												│                 │
												│   PostgreSQL    │
												│   (Results)     │
												│                 │
												└─────────────────┘

Markdown

Redis-Konfiguration für High-Performance:

# redis.production.conf
# Memory Management
maxmemory 4gb
maxmemory-policy allkeys-lru
maxmemory-samples 10

# Persistence für Job-Queue Reliability
save 900 1
save 300 10
save 60 10000
rdbcompression yes
rdbchecksum yes

# Network & Performance
tcp-keepalive 300
timeout 0
tcp-backlog 511
databases 16

# Security
requirepass secure_redis_password_production_123
rename-command FLUSHDB ""
rename-command FLUSHALL ""
rename-command DEBUG ""

# Logging
loglevel notice
syslog-enabled yes
syslog-ident redis-n8n-queue

# Client Connection Limits
maxclients 10000

# Queue-specific Settings
notify-keyspace-events Ex

# redis.production.conf
# Memory Management
maxmemory 4gb
maxmemory-policy allkeys-lru
maxmemory-samples 10

# Persistence für Job-Queue Reliability
save 900 1
save 300 10
save 60 10000
rdbcompression yes
rdbchecksum yes

# Network & Performance
tcp-keepalive 300
timeout 0
tcp-backlog 511
databases 16

# Security
requirepass secure_redis_password_production_123
rename-command FLUSHDB ""
rename-command FLUSHALL ""
rename-command DEBUG ""

# Logging
loglevel notice
syslog-enabled yes
syslog-ident redis-n8n-queue

# Client Connection Limits
maxclients 10000

# Queue-specific Settings
notify-keyspace-events Ex

Bash

Load Balancing Strategien:

n8n unterstützt verschiedene Load Balancing Ansätze, abhängig von deiner Infrastruktur:

Strategie	Use Case	Implementierung	Vor-/Nachteile
Round Robin	Gleichmäßige Verteilung	HAProxy, Nginx	Simple, aber keine Job-Affinität
Least Connections	Unterschiedliche Job-Komplexität	HAProxy mit balance leastconn	Berücksichtigt Worker-Load
Weighted Round Robin	Heterogene Worker-Hardware	Nginx mit weight-Parameter	Flexibel für verschiedene Node-Types
IP Hash	Session-abhängige Workflows	Nginx mit ip_hash	Konsistenz für stateful Workflows

🔧 HAProxy-Konfiguration für n8n:

# /etc/haproxy/haproxy.cfg
global
	daemon
	user haproxy
	group haproxy
	log stdout local0
	maxconn 4096
	ssl-default-bind-options ssl-min-ver TLSv1.2
	ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384

defaults
	mode http
	timeout connect 10s
	timeout client 30s
	timeout server 30s
	option httplog
	option dontlognull
	retries 3

frontend n8n_frontend
	bind *:443 ssl crt /etc/ssl/certs/n8n.company.com.pem
	redirect scheme https if !{ ssl_fc }
	
	# Rate Limiting
	stick-table type ip size 100k expire 30s store http_req_rate(10s)
	http-request track-sc0 src
	http-request reject if { sc_http_req_rate(0) gt 20 }
	
	# Health Check Endpoint
	acl health_check path_beg /healthz
	use_backend n8n_health if health_check
	
	# Main Application
	default_backend n8n_main

backend n8n_main
	balance leastconn
	option httpchk GET /healthz
	http-check expect status 200
	
	server n8n-main-1 10.0.1.10:5678 check inter 10s rise 2 fall 3 weight 100
	server n8n-main-2 10.0.1.11:5678 check inter 10s rise 2 fall 3 weight 100
	
backend n8n_health
	http-request return status 200 content-type text/plain string "OK"

listen stats
	bind *:8404
	stats enable
	stats uri /stats
	stats refresh 30s
	stats admin if TRUE

# /etc/haproxy/haproxy.cfg
global
	daemon
	user haproxy
	group haproxy
	log stdout local0
	maxconn 4096
	ssl-default-bind-options ssl-min-ver TLSv1.2
	ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384

defaults
	mode http
	timeout connect 10s
	timeout client 30s
	timeout server 30s
	option httplog
	option dontlognull
	retries 3

frontend n8n_frontend
	bind *:443 ssl crt /etc/ssl/certs/n8n.company.com.pem
	redirect scheme https if !{ ssl_fc }
	
	# Rate Limiting
	stick-table type ip size 100k expire 30s store http_req_rate(10s)
	http-request track-sc0 src
	http-request reject if { sc_http_req_rate(0) gt 20 }
	
	# Health Check Endpoint
	acl health_check path_beg /healthz
	use_backend n8n_health if health_check
	
	# Main Application
	default_backend n8n_main

backend n8n_main
	balance leastconn
	option httpchk GET /healthz
	http-check expect status 200
	
	server n8n-main-1 10.0.1.10:5678 check inter 10s rise 2 fall 3 weight 100
	server n8n-main-2 10.0.1.11:5678 check inter 10s rise 2 fall 3 weight 100
	
backend n8n_health
	http-request return status 200 content-type text/plain string "OK"

listen stats
	bind *:8404
	stats enable
	stats uri /stats
	stats refresh 30s
	stats admin if TRUE

Bash

Worker Concurrency Tuning:

Die optimale Worker-Konfiguration hängt von deinen Workflow-Patterns ab:

# CPU-intensive Workflows (weniger Concurrency)
export N8N_WORKERS_CONCURRENCY=5
export N8N_WORKERS_TIMEOUT=7200
export NODE_OPTIONS="--max-old-space-size=4096"

# I/O-intensive Workflows (mehr Concurrency)
export N8N_WORKERS_CONCURRENCY=20
export N8N_WORKERS_TIMEOUT=1800
export NODE_OPTIONS="--max-old-space-size=2048"

# Mixed Workloads (balanced)
export N8N_WORKERS_CONCURRENCY=10
export N8N_WORKERS_TIMEOUT=3600
export NODE_OPTIONS="--max-old-space-size=3072"

# Worker mit optimierten Settings starten
n8n worker

# CPU-intensive Workflows (weniger Concurrency)
export N8N_WORKERS_CONCURRENCY=5
export N8N_WORKERS_TIMEOUT=7200
export NODE_OPTIONS="--max-old-space-size=4096"

# I/O-intensive Workflows (mehr Concurrency)
export N8N_WORKERS_CONCURRENCY=20
export N8N_WORKERS_TIMEOUT=1800
export NODE_OPTIONS="--max-old-space-size=2048"

# Mixed Workloads (balanced)
export N8N_WORKERS_CONCURRENCY=10
export N8N_WORKERS_TIMEOUT=3600
export NODE_OPTIONS="--max-old-space-size=3072"

# Worker mit optimierten Settings starten
n8n worker

Bash

💡 Performance Monitoring: Überwache die Queue-Länge in Redis mit redis-cli llen bull:queue:default. Lange Warteschlangen deuten auf zu wenig Worker oder zu komplexe Workflows hin.

Auto-Scaling basierend auf Queue-Metriken:

# custom-metrics-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: n8n-worker-queue-hpa
  namespace: n8n-production
spec:
  scaleTargetRef:
	apiVersion: apps/v1
	kind: Deployment
	name: n8n-worker
  minReplicas: 3
  maxReplicas: 50
  metrics:
  - type: External
	external:
	  metric:
		name: redis_queue_length
		selector:
		  matchLabels:
			queue_name: "bull:queue:default"
	  target:
		type: AverageValue
		averageValue: "10"
  behavior:
	scaleUp:
	  stabilizationWindowSeconds: 60
	  policies:
	  - type: Pods
		value: 5
		periodSeconds: 60
	scaleDown:
	  stabilizationWindowSeconds: 300
	  policies:
	  - type: Pods
		value: 2
		periodSeconds: 60

# custom-metrics-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: n8n-worker-queue-hpa
  namespace: n8n-production
spec:
  scaleTargetRef:
	apiVersion: apps/v1
	kind: Deployment
	name: n8n-worker
  minReplicas: 3
  maxReplicas: 50
  metrics:
  - type: External
	external:
	  metric:
		name: redis_queue_length
		selector:
		  matchLabels:
			queue_name: "bull:queue:default"
	  target:
		type: AverageValue
		averageValue: "10"
  behavior:
	scaleUp:
	  stabilizationWindowSeconds: 60
	  policies:
	  - type: Pods
		value: 5
		periodSeconds: 60
	scaleDown:
	  stabilizationWindowSeconds: 300
	  policies:
	  - type: Pods
		value: 2
		periodSeconds: 60

Bash

❗ Häufiger Fehler: Viele Teams vergessen, das EXECUTIONS_MODE=queue Environment-Variable in allen n8n-Instanzen zu setzen. Ohne diese Einstellung läuft n8n im Standard-Modus und ignoriert die Redis-Queue komplett.

Persistierung, Backup und High Availability

Daten sind das wertvollste Asset deiner n8n-Installation. Ein durchdachtes Persistierung- und Backup-Konzept schützt vor Datenverlust und ermöglicht schnelle Disaster Recovery.

Multi-Layer Persistence Strategy:

┌─────────────────────────────────────────────────────────────┐
│                    Application Layer                        │
│  ┌─────────────────┐  ┌─────────────────┐  ┌──────────────┐ │
│  │   Workflows     │  │   Credentials   │  │   Executions │ │
│  │   (JSON Defs)   │  │  (Encrypted)    │  │   (History)  │ │
│  └─────────────────┘  └─────────────────┘  └──────────────┘ │
└─────────────────────────────────────────────────────────────┘
								              │
															▼
┌─────────────────────────────────────────────────────────────┐
│                   Database Layer (PostgreSQL)               │
│  ┌─────────────────┐  ┌─────────────────┐  ┌──────────────┐ │
│  │    Primary      │  │   Read Replica  │  │   Backup     │ │
│  │    Master       │  │   (Optional)    │  │   Server     │ │
│  └─────────────────┘  └─────────────────┘  └──────────────┘ │
└─────────────────────────────────────────────────────────────┘
															│
															▼
┌─────────────────────────────────────────────────────────────┐
│                    Storage Layer                            │
│  ┌─────────────────┐  ┌─────────────────┐  ┌──────────────┐ │
│  │  Local SSD      │  │   Network NAS   │  │  Cloud S3    │ │
│  │  (Hot Data)     │  │  (Warm Backup)  │  │ (Cold Arch.) │ │
│  └─────────────────┘  └─────────────────┘  └──────────────┘ │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│                    Application Layer                        │
│  ┌─────────────────┐  ┌─────────────────┐  ┌──────────────┐ │
│  │   Workflows     │  │   Credentials   │  │   Executions │ │
│  │   (JSON Defs)   │  │  (Encrypted)    │  │   (History)  │ │
│  └─────────────────┘  └─────────────────┘  └──────────────┘ │
└─────────────────────────────────────────────────────────────┘
								              │
															▼
┌─────────────────────────────────────────────────────────────┐
│                   Database Layer (PostgreSQL)               │
│  ┌─────────────────┐  ┌─────────────────┐  ┌──────────────┐ │
│  │    Primary      │  │   Read Replica  │  │   Backup     │ │
│  │    Master       │  │   (Optional)    │  │   Server     │ │
│  └─────────────────┘  └─────────────────┘  └──────────────┘ │
└─────────────────────────────────────────────────────────────┘
															│
															▼
┌─────────────────────────────────────────────────────────────┐
│                    Storage Layer                            │
│  ┌─────────────────┐  ┌─────────────────┐  ┌──────────────┐ │
│  │  Local SSD      │  │   Network NAS   │  │  Cloud S3    │ │
│  │  (Hot Data)     │  │  (Warm Backup)  │  │ (Cold Arch.) │ │
│  └─────────────────┘  └─────────────────┘  └──────────────┘ │
└─────────────────────────────────────────────────────────────┘

Markdown

PostgreSQL High Availability Setup:

# postgres-ha-deployment.yaml
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: postgres-n8n-ha
  namespace: n8n-production
spec:
  instances: 3
  
  postgresql:
	parameters:
	  max_connections: "200"
	  shared_buffers: "256MB"
	  effective_cache_size: "1GB"
	  maintenance_work_mem: "64MB"
	  checkpoint_completion_target: "0.9"
	  wal_buffers: "16MB"
	  default_statistics_target: "100"
	  random_page_cost: "1.1"
	  effective_io_concurrency: "200"
	  work_mem: "4MB"
	  min_wal_size: "1GB"
	  max_wal_size: "4GB"
	  
  bootstrap:
	initdb:
	  database: n8n_production
	  owner: n8n_user
	  secret:
		name: postgres-credentials
	  dataChecksums: true
	  
  storage:
	size: 500Gi
	storageClass: fast-ssd
	
  monitoring:
	enabled: true
	customMetrics:
	  - name: "pg_stat_user_tables"
		query: "SELECT schemaname, tablename, n_tup_ins, n_tup_upd, n_tup_del FROM pg_stat_user_tables"
		
  backup:
	target: prefer-standby
	retentionPolicy: "30d"
	data:
	  compression: gzip
	  encryption: AES256
	  immediateCheckpoint: true
	wal:
	  retention: "7d"
	  compression: gzip
	s3:
	  bucket: "n8n-database-backups"
	  path: "/postgres-backups"
	  region: "eu-central-1"
	  credentials:
		accessKeyId:
		  name: s3-credentials
		  key: ACCESS_KEY_ID
		secretAccessKey:
		  name: s3-credentials
		  key: SECRET_ACCESS_KEY

  failoverDelay: 0
  switchoverDelay: 60

# postgres-ha-deployment.yaml
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: postgres-n8n-ha
  namespace: n8n-production
spec:
  instances: 3
  
  postgresql:
	parameters:
	  max_connections: "200"
	  shared_buffers: "256MB"
	  effective_cache_size: "1GB"
	  maintenance_work_mem: "64MB"
	  checkpoint_completion_target: "0.9"
	  wal_buffers: "16MB"
	  default_statistics_target: "100"
	  random_page_cost: "1.1"
	  effective_io_concurrency: "200"
	  work_mem: "4MB"
	  min_wal_size: "1GB"
	  max_wal_size: "4GB"
	  
  bootstrap:
	initdb:
	  database: n8n_production
	  owner: n8n_user
	  secret:
		name: postgres-credentials
	  dataChecksums: true
	  
  storage:
	size: 500Gi
	storageClass: fast-ssd
	
  monitoring:
	enabled: true
	customMetrics:
	  - name: "pg_stat_user_tables"
		query: "SELECT schemaname, tablename, n_tup_ins, n_tup_upd, n_tup_del FROM pg_stat_user_tables"
		
  backup:
	target: prefer-standby
	retentionPolicy: "30d"
	data:
	  compression: gzip
	  encryption: AES256
	  immediateCheckpoint: true
	wal:
	  retention: "7d"
	  compression: gzip
	s3:
	  bucket: "n8n-database-backups"
	  path: "/postgres-backups"
	  region: "eu-central-1"
	  credentials:
		accessKeyId:
		  name: s3-credentials
		  key: ACCESS_KEY_ID
		secretAccessKey:
		  name: s3-credentials
		  key: SECRET_ACCESS_KEY

  failoverDelay: 0
  switchoverDelay: 60

YAML

Automatisierte Backup-Pipeline:

#!/bin/bash
# backup-n8n-complete.sh

set -euo pipefail

BACKUP_DIR="/opt/backups/n8n"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
RETENTION_DAYS=30
S3_BUCKET="company-n8n-backups"

# Logging Setup
exec 1> >(logger -s -t n8n-backup)
exec 2>&1

echo "Starting n8n backup at $(date)"

# 1. Database Backup (PostgreSQL)
echo "Creating database backup..."
PGPASSWORD="${DB_PASSWORD}" pg_dump \
  -h postgres.n8n-production.svc.cluster.local \
  -U n8n_user \
  -d n8n_production \
  --verbose \
  --compress=9 \
  --format=custom \
  --file="${BACKUP_DIR}/database_${TIMESTAMP}.pgdump"

# 2. Workflow Export via n8n API
echo "Exporting workflows via API..."
mkdir -p "${BACKUP_DIR}/workflows_${TIMESTAMP}"

# Get all workflow IDs
WORKFLOW_IDS=$(curl -s \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" \
  "${N8N_API_URL}/api/v1/workflows" | \
  jq -r '.data[].id')

# Export each workflow
for workflow_id in ${WORKFLOW_IDS}; do
  curl -s \
	-H "Authorization: Bearer ${N8N_API_TOKEN}" \
	"${N8N_API_URL}/api/v1/workflows/${workflow_id}" | \
	jq '.' > "${BACKUP_DIR}/workflows_${TIMESTAMP}/workflow_${workflow_id}.json"
done

# 3. Credentials Backup (encrypted by n8n)
echo "Creating credentials backup..."
PGPASSWORD="${DB_PASSWORD}" pg_dump \
  -h postgres.n8n-production.svc.cluster.local \
  -U n8n_user \
  -d n8n_production \
  --table=credentials_entity \
  --format=custom \
  --file="${BACKUP_DIR}/credentials_${TIMESTAMP}.pgdump"

# 4. Configuration Files Backup
echo "Backing up configuration files..."
kubectl get configmaps -n n8n-production -o yaml > "${BACKUP_DIR}/configmaps_${TIMESTAMP}.yaml"
kubectl get secrets -n n8n-production -o yaml > "${BACKUP_DIR}/secrets_${TIMESTAMP}.yaml"

# 5. Create Consolidated Archive
echo "Creating consolidated backup archive..."
tar -czf "${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
  -C "${BACKUP_DIR}" \
  "database_${TIMESTAMP}.pgdump" \
  "workflows_${TIMESTAMP}/" \
  "credentials_${TIMESTAMP}.pgdump" \
  "configmaps_${TIMESTAMP}.yaml" \
  "secrets_${TIMESTAMP}.yaml"

# 6. Upload to S3 with encryption
echo "Uploading to S3..."
aws s3 cp "${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
  "s3://${S3_BUCKET}/daily/${TIMESTAMP}/" \
  --server-side-encryption AES256 \
  --storage-class STANDARD_IA

# 7. Verify backup integrity
echo "Verifying backup integrity..."
aws s3api head-object \
  --bucket "${S3_BUCKET}" \
  --key "daily/${TIMESTAMP}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
  --query 'ContentLength' --output text > /dev/null

# 8. Cleanup old local backups
echo "Cleaning up old local backups..."
find "${BACKUP_DIR}" -type f -name "*.tar.gz" -mtime +${RETENTION_DAYS} -delete
find "${BACKUP_DIR}" -type f -name "*.pgdump" -mtime +${RETENTION_DAYS} -delete
find "${BACKUP_DIR}" -type d -name "workflows_*" -mtime +${RETENTION_DAYS} -exec rm -rf {} +

# 9. Update backup log
echo "Backup completed successfully at $(date)"
echo "Backup size: $(du -h ${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz | cut -f1)"
echo "S3 location: s3://${S3_BUCKET}/daily/${TIMESTAMP}/"

# 10. Send notification (optional)
if command -v curl &> /dev/null && [[ -n "${SLACK_WEBHOOK_URL:-}" ]]; then
  curl -X POST -H 'Content-type: application/json' \
	--data "{\"text\":\"✅ n8n backup completed successfully - ${TIMESTAMP}\"}" \
	"${SLACK_WEBHOOK_URL}"
fi

#!/bin/bash
# backup-n8n-complete.sh

set -euo pipefail

BACKUP_DIR="/opt/backups/n8n"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
RETENTION_DAYS=30
S3_BUCKET="company-n8n-backups"

# Logging Setup
exec 1> >(logger -s -t n8n-backup)
exec 2>&1

echo "Starting n8n backup at $(date)"

# 1. Database Backup (PostgreSQL)
echo "Creating database backup..."
PGPASSWORD="${DB_PASSWORD}" pg_dump \
  -h postgres.n8n-production.svc.cluster.local \
  -U n8n_user \
  -d n8n_production \
  --verbose \
  --compress=9 \
  --format=custom \
  --file="${BACKUP_DIR}/database_${TIMESTAMP}.pgdump"

# 2. Workflow Export via n8n API
echo "Exporting workflows via API..."
mkdir -p "${BACKUP_DIR}/workflows_${TIMESTAMP}"

# Get all workflow IDs
WORKFLOW_IDS=$(curl -s \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" \
  "${N8N_API_URL}/api/v1/workflows" | \
  jq -r '.data[].id')

# Export each workflow
for workflow_id in ${WORKFLOW_IDS}; do
  curl -s \
	-H "Authorization: Bearer ${N8N_API_TOKEN}" \
	"${N8N_API_URL}/api/v1/workflows/${workflow_id}" | \
	jq '.' > "${BACKUP_DIR}/workflows_${TIMESTAMP}/workflow_${workflow_id}.json"
done

# 3. Credentials Backup (encrypted by n8n)
echo "Creating credentials backup..."
PGPASSWORD="${DB_PASSWORD}" pg_dump \
  -h postgres.n8n-production.svc.cluster.local \
  -U n8n_user \
  -d n8n_production \
  --table=credentials_entity \
  --format=custom \
  --file="${BACKUP_DIR}/credentials_${TIMESTAMP}.pgdump"

# 4. Configuration Files Backup
echo "Backing up configuration files..."
kubectl get configmaps -n n8n-production -o yaml > "${BACKUP_DIR}/configmaps_${TIMESTAMP}.yaml"
kubectl get secrets -n n8n-production -o yaml > "${BACKUP_DIR}/secrets_${TIMESTAMP}.yaml"

# 5. Create Consolidated Archive
echo "Creating consolidated backup archive..."
tar -czf "${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
  -C "${BACKUP_DIR}" \
  "database_${TIMESTAMP}.pgdump" \
  "workflows_${TIMESTAMP}/" \
  "credentials_${TIMESTAMP}.pgdump" \
  "configmaps_${TIMESTAMP}.yaml" \
  "secrets_${TIMESTAMP}.yaml"

# 6. Upload to S3 with encryption
echo "Uploading to S3..."
aws s3 cp "${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
  "s3://${S3_BUCKET}/daily/${TIMESTAMP}/" \
  --server-side-encryption AES256 \
  --storage-class STANDARD_IA

# 7. Verify backup integrity
echo "Verifying backup integrity..."
aws s3api head-object \
  --bucket "${S3_BUCKET}" \
  --key "daily/${TIMESTAMP}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
  --query 'ContentLength' --output text > /dev/null

# 8. Cleanup old local backups
echo "Cleaning up old local backups..."
find "${BACKUP_DIR}" -type f -name "*.tar.gz" -mtime +${RETENTION_DAYS} -delete
find "${BACKUP_DIR}" -type f -name "*.pgdump" -mtime +${RETENTION_DAYS} -delete
find "${BACKUP_DIR}" -type d -name "workflows_*" -mtime +${RETENTION_DAYS} -exec rm -rf {} +

# 9. Update backup log
echo "Backup completed successfully at $(date)"
echo "Backup size: $(du -h ${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz | cut -f1)"
echo "S3 location: s3://${S3_BUCKET}/daily/${TIMESTAMP}/"

# 10. Send notification (optional)
if command -v curl &> /dev/null && [[ -n "${SLACK_WEBHOOK_URL:-}" ]]; then
  curl -X POST -H 'Content-type: application/json' \
	--data "{\"text\":\"✅ n8n backup completed successfully - ${TIMESTAMP}\"}" \
	"${SLACK_WEBHOOK_URL}"
fi

Bash

🔧 Automated Backup Scheduling (Kubernetes CronJob):

# n8n-backup-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: n8n-backup
  namespace: n8n-production
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM
  timeZone: "Europe/Berlin"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 5
  jobTemplate:
	spec:
	  activeDeadlineSeconds: 3600  # 1 hour timeout
	  template:
		spec:
		  restartPolicy: OnFailure
		  containers:
		  - name: backup
			image: company-registry.com/n8n-backup:latest
			command: ["/scripts/backup-n8n-complete.sh"]
			env:
			- name: DB_PASSWORD
			  valueFrom:
				secretKeyRef:
				  name: postgres-credentials
				  key: password
			- name: N8N_API_TOKEN
			  valueFrom:
				secretKeyRef:
				  name: n8n-secrets
				  key: api-token
			- name: N8N_API_URL
			  value: "https://n8n.company.com"
			volumeMounts:
			- name: backup-storage
			  mountPath: /opt/backups
			- name: scripts
			  mountPath: /scripts
			resources:
			  requests:
				memory: "512Mi"
				cpu: "250m"
			  limits:
				memory: "2Gi"
				cpu: "1000m"
		  volumes:
		  - name: backup-storage
			persistentVolumeClaim:
			  claimName: backup-storage-pvc
		  - name: scripts
			configMap:
			  name: backup-scripts
			  defaultMode: 0755

# n8n-backup-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: n8n-backup
  namespace: n8n-production
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM
  timeZone: "Europe/Berlin"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 5
  jobTemplate:
	spec:
	  activeDeadlineSeconds: 3600  # 1 hour timeout
	  template:
		spec:
		  restartPolicy: OnFailure
		  containers:
		  - name: backup
			image: company-registry.com/n8n-backup:latest
			command: ["/scripts/backup-n8n-complete.sh"]
			env:
			- name: DB_PASSWORD
			  valueFrom:
				secretKeyRef:
				  name: postgres-credentials
				  key: password
			- name: N8N_API_TOKEN
			  valueFrom:
				secretKeyRef:
				  name: n8n-secrets
				  key: api-token
			- name: N8N_API_URL
			  value: "https://n8n.company.com"
			volumeMounts:
			- name: backup-storage
			  mountPath: /opt/backups
			- name: scripts
			  mountPath: /scripts
			resources:
			  requests:
				memory: "512Mi"
				cpu: "250m"
			  limits:
				memory: "2Gi"
				cpu: "1000m"
		  volumes:
		  - name: backup-storage
			persistentVolumeClaim:
			  claimName: backup-storage-pvc
		  - name: scripts
			configMap:
			  name: backup-scripts
			  defaultMode: 0755

YAML

Disaster Recovery Procedure:

#!/bin/bash
# restore-n8n-disaster-recovery.sh

set -euo pipefail

BACKUP_TIMESTAMP="${1:-}"
if [[ -z "$BACKUP_TIMESTAMP" ]]; then
  echo "Usage: $0 <backup_timestamp>"
  echo "Available backups:"
  aws s3 ls s3://company-n8n-backups/daily/ | grep -o '[0-9]\{8\}_[0-9]\{6\}'
  exit 1
fi

RESTORE_DIR="/tmp/n8n-restore-${BACKUP_TIMESTAMP}"
S3_BUCKET="company-n8n-backups"

echo "Starting disaster recovery for backup: ${BACKUP_TIMESTAMP}"

# 1. Download and extract backup
echo "Downloading backup from S3..."
mkdir -p "${RESTORE_DIR}"
aws s3 cp "s3://${S3_BUCKET}/daily/${BACKUP_TIMESTAMP}/n8n_complete_backup_${BACKUP_TIMESTAMP}.tar.gz" \
  "${RESTORE_DIR}/"

cd "${RESTORE_DIR}"
tar -xzf "n8n_complete_backup_${BACKUP_TIMESTAMP}.tar.gz"

# 2. Scale down n8n deployment
echo "Scaling down n8n deployment..."
kubectl scale deployment n8n-main --replicas=0 -n n8n-production
kubectl scale deployment n8n-worker --replicas=0 -n n8n-production

# 3. Restore PostgreSQL database
echo "Restoring PostgreSQL database..."
kubectl exec -n n8n-production postgres-n8n-ha-1 -- psql -U postgres -c "DROP DATABASE IF EXISTS n8n_production;"
kubectl exec -n n8n-production postgres-n8n-ha-1 -- psql -U postgres -c "CREATE DATABASE n8n_production OWNER n8n_user;"

kubectl cp "database_${BACKUP_TIMESTAMP}.pgdump" n8n-production/postgres-n8n-ha-1:/tmp/
kubectl exec -n n8n-production postgres-n8n-ha-1 -- pg_restore \
  -U n8n_user -d n8n_production \
  --verbose --clean --if-exists \
  "/tmp/database_${BACKUP_TIMESTAMP}.pgdump"

# 4. Restore Kubernetes configurations
echo "Restoring Kubernetes configurations..."
kubectl apply -f "configmaps_${BACKUP_TIMESTAMP}.yaml"
kubectl apply -f "secrets_${BACKUP_TIMESTAMP}.yaml"

# 5. Scale up n8n deployment
echo "Scaling up n8n deployment..."
kubectl scale deployment n8n-main --replicas=2 -n n8n-production
kubectl scale deployment n8n-worker --replicas=5 -n n8n-production

# 6. Wait for deployment to be ready
echo "Waiting for pods to be ready..."
kubectl wait --for=condition=ready pod -l app=n8n-main -n n8n-production --timeout=300s
kubectl wait --for=condition=ready pod -l app=n8n-worker -n n8n-production --timeout=300s

# 7. Verify restoration
echo "Verifying restoration..."
WORKFLOW_COUNT=$(curl -s \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" \
  "${N8N_API_URL}/api/v1/workflows" | \
  jq '.data | length')

echo "✅ Disaster recovery completed!"
echo "Restored ${WORKFLOW_COUNT} workflows from backup ${BACKUP_TIMESTAMP}"
echo "n8n is available at: ${N8N_API_URL}"

#!/bin/bash
# restore-n8n-disaster-recovery.sh

set -euo pipefail

BACKUP_TIMESTAMP="${1:-}"
if [[ -z "$BACKUP_TIMESTAMP" ]]; then
  echo "Usage: $0 <backup_timestamp>"
  echo "Available backups:"
  aws s3 ls s3://company-n8n-backups/daily/ | grep -o '[0-9]\{8\}_[0-9]\{6\}'
  exit 1
fi

RESTORE_DIR="/tmp/n8n-restore-${BACKUP_TIMESTAMP}"
S3_BUCKET="company-n8n-backups"

echo "Starting disaster recovery for backup: ${BACKUP_TIMESTAMP}"

# 1. Download and extract backup
echo "Downloading backup from S3..."
mkdir -p "${RESTORE_DIR}"
aws s3 cp "s3://${S3_BUCKET}/daily/${BACKUP_TIMESTAMP}/n8n_complete_backup_${BACKUP_TIMESTAMP}.tar.gz" \
  "${RESTORE_DIR}/"

cd "${RESTORE_DIR}"
tar -xzf "n8n_complete_backup_${BACKUP_TIMESTAMP}.tar.gz"

# 2. Scale down n8n deployment
echo "Scaling down n8n deployment..."
kubectl scale deployment n8n-main --replicas=0 -n n8n-production
kubectl scale deployment n8n-worker --replicas=0 -n n8n-production

# 3. Restore PostgreSQL database
echo "Restoring PostgreSQL database..."
kubectl exec -n n8n-production postgres-n8n-ha-1 -- psql -U postgres -c "DROP DATABASE IF EXISTS n8n_production;"
kubectl exec -n n8n-production postgres-n8n-ha-1 -- psql -U postgres -c "CREATE DATABASE n8n_production OWNER n8n_user;"

kubectl cp "database_${BACKUP_TIMESTAMP}.pgdump" n8n-production/postgres-n8n-ha-1:/tmp/
kubectl exec -n n8n-production postgres-n8n-ha-1 -- pg_restore \
  -U n8n_user -d n8n_production \
  --verbose --clean --if-exists \
  "/tmp/database_${BACKUP_TIMESTAMP}.pgdump"

# 4. Restore Kubernetes configurations
echo "Restoring Kubernetes configurations..."
kubectl apply -f "configmaps_${BACKUP_TIMESTAMP}.yaml"
kubectl apply -f "secrets_${BACKUP_TIMESTAMP}.yaml"

# 5. Scale up n8n deployment
echo "Scaling up n8n deployment..."
kubectl scale deployment n8n-main --replicas=2 -n n8n-production
kubectl scale deployment n8n-worker --replicas=5 -n n8n-production

# 6. Wait for deployment to be ready
echo "Waiting for pods to be ready..."
kubectl wait --for=condition=ready pod -l app=n8n-main -n n8n-production --timeout=300s
kubectl wait --for=condition=ready pod -l app=n8n-worker -n n8n-production --timeout=300s

# 7. Verify restoration
echo "Verifying restoration..."
WORKFLOW_COUNT=$(curl -s \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" \
  "${N8N_API_URL}/api/v1/workflows" | \
  jq '.data | length')

echo "✅ Disaster recovery completed!"
echo "Restored ${WORKFLOW_COUNT} workflows from backup ${BACKUP_TIMESTAMP}"
echo "n8n is available at: ${N8N_API_URL}"

Bash

⚠️ Critical Backup Considerations:

┌ n8n speichert Credentials verschlüsselt mit dem N8N_ENCRYPTION_KEY.
├ nOhne diesen Key sind Credentials nach einer Wiederherstellung unbrauchbar
├ Binary Data (Dateien, Attachments) werden standardmäßig im Filesystem gespeichert
└ Queue-State in Redis ist nicht persistent – laufende Workflows gehen bei Redis-Ausfall verloren

💡 High Availability Best Practice: Verwende PostgreSQL mit Streaming Replication und automatischem Failover. Tools wie Patroni oder Cloud Native PG Operator bieten robuste HA-Lösungen für Kubernetes-Umgebungen.

Die hier beschriebenen Deployment-Strategien bilden das Fundament für eine produktionsreife n8n-Installation. Mit Container-Orchestrierung, Queue-basierter Skalierung und durchdachter Persistierung schaffst du eine Automatisierungsplattform, die auch bei hoher Last und kritischen Ausfällen stabil funktioniert.

Workflow und Node

Jetzt geht es ans Eingemachte: die professionelle Entwicklung von n8n-Workflows. Dieser Abschnitt zeigt dir, wie du komplexe Automatisierungen entwickelst, die nicht nur funktionieren, sondern auch wartbar, testbar und skalierbar sind. Du lernst die JSON-basierte Workflow-Definition zu verstehen, eigene Custom Nodes zu programmieren und robuste Error-Handling-Strategien zu implementieren.

Warum ist professionelle Workflow-Entwicklung kritisch? In Produktionsumgebungen reichen schnell zusammengeklickte Workflows nicht aus. Du brauchst saubere, dokumentierte und versionierte Automatisierungen, die auch nach Monaten noch verstehen und erweitern kannst. Die hier vermittelten Techniken sind das Fundament für wartbare Enterprise-Automatisierungen.

JSON-basierte Workflow-Definition und Versionierung

n8n-Workflows sind im Kern JSON-Dokumente, die eine Directed Acyclic Graph (DAG)-Struktur beschreiben. Diese JSON-Definition ist der Schlüssel für Infrastructure-as-Code-Ansätze, Versionskontrolle und automatisierte Deployments. Als DevOps Engineer musst du diese Struktur verstehen, um Workflows programmatisch zu erstellen und zu modifizieren.

Anatomy einer n8n-Workflow-Definition:

Die JSON-Struktur folgt einem standardisierten Schema, das alle notwendigen Informationen für die Workflow-Ausführung enthält:

{
  "name": "DevOps CI/CD Pipeline",
  "nodes": [
	{
	  "parameters": {
		"path": "github-webhook",
		"options": {
		  "responseMode": "onReceived"
		}
	  },
	  "id": "webhook-trigger-001",
	  "name": "GitHub Webhook",
	  "type": "n8n-nodes-base.webhook",
	  "typeVersion": 1,
	  "position": [240, 300],
	  "webhookId": "github-ci-cd-trigger"
	},
	{
	  "parameters": {
		"jsCode": "// Git Event Processing Logic\nconst payload = $input.first().json;\nconst branch = payload.ref.replace('refs/heads/', '');\nconst isMainBranch = branch === 'main';\n\n// Environment determination\nlet environment = 'development';\nif (isMainBranch) {\n  environment = 'production';\n} else if (branch.startsWith('release/')) {\n  environment = 'staging';\n}\n\n// Build deployment context\nconst deploymentContext = {\n  repository: payload.repository.full_name,\n  commit_sha: payload.head_commit.id,\n  commit_message: payload.head_commit.message,\n  author: payload.head_commit.author.name,\n  branch: branch,\n  environment: environment,\n  timestamp: new Date().toISOString(),\n  workflow_run_id: generateUUID()\n};\n\n// Validation and enrichment\nif (!payload.head_commit || !payload.repository) {\n  throw new Error('Invalid webhook payload: missing required fields');\n}\n\nreturn [{\n  json: deploymentContext,\n  pairedItem: { item: 0 }\n}];\n\nfunction generateUUID() {\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {\n    const r = Math.random() * 16 | 0;\n    const v = c === 'x' ? r : (r & 0x3 | 0x8);\n    return v.toString(16);\n  });\n}"
	  },
	  "id": "code-processor-002",
	  "name": "Process Git Event",
	  "type": "n8n-nodes-base.code",
	  "typeVersion": 2,
	  "position": [460, 300]
	}
  ],
  "connections": {
	"GitHub Webhook": {
	  "main": [
		[
		  {
			"node": "Process Git Event",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	}
  },
  "active": false,
  "settings": {
	"executionOrder": "v1",
	"saveManualExecutions": true,
	"callerPolicy": "workflowsFromSameOwner",
	"errorWorkflow": "error-handling-workflow-id"
  },
  "staticData": {},
  "meta": {
	"templateCreatedBy": "devops-team",
	"templateId": "ci-cd-pipeline-v2.1",
	"instanceId": "production-instance-001"
  },
  "pinData": {},
  "versionId": "v2.1.0-20250121",
  "tags": ["devops", "ci-cd", "git", "automation"]
}

{
  "name": "DevOps CI/CD Pipeline",
  "nodes": [
	{
	  "parameters": {
		"path": "github-webhook",
		"options": {
		  "responseMode": "onReceived"
		}
	  },
	  "id": "webhook-trigger-001",
	  "name": "GitHub Webhook",
	  "type": "n8n-nodes-base.webhook",
	  "typeVersion": 1,
	  "position": [240, 300],
	  "webhookId": "github-ci-cd-trigger"
	},
	{
	  "parameters": {
		"jsCode": "// Git Event Processing Logic\nconst payload = $input.first().json;\nconst branch = payload.ref.replace('refs/heads/', '');\nconst isMainBranch = branch === 'main';\n\n// Environment determination\nlet environment = 'development';\nif (isMainBranch) {\n  environment = 'production';\n} else if (branch.startsWith('release/')) {\n  environment = 'staging';\n}\n\n// Build deployment context\nconst deploymentContext = {\n  repository: payload.repository.full_name,\n  commit_sha: payload.head_commit.id,\n  commit_message: payload.head_commit.message,\n  author: payload.head_commit.author.name,\n  branch: branch,\n  environment: environment,\n  timestamp: new Date().toISOString(),\n  workflow_run_id: generateUUID()\n};\n\n// Validation and enrichment\nif (!payload.head_commit || !payload.repository) {\n  throw new Error('Invalid webhook payload: missing required fields');\n}\n\nreturn [{\n  json: deploymentContext,\n  pairedItem: { item: 0 }\n}];\n\nfunction generateUUID() {\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {\n    const r = Math.random() * 16 | 0;\n    const v = c === 'x' ? r : (r & 0x3 | 0x8);\n    return v.toString(16);\n  });\n}"
	  },
	  "id": "code-processor-002",
	  "name": "Process Git Event",
	  "type": "n8n-nodes-base.code",
	  "typeVersion": 2,
	  "position": [460, 300]
	}
  ],
  "connections": {
	"GitHub Webhook": {
	  "main": [
		[
		  {
			"node": "Process Git Event",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	}
  },
  "active": false,
  "settings": {
	"executionOrder": "v1",
	"saveManualExecutions": true,
	"callerPolicy": "workflowsFromSameOwner",
	"errorWorkflow": "error-handling-workflow-id"
  },
  "staticData": {},
  "meta": {
	"templateCreatedBy": "devops-team",
	"templateId": "ci-cd-pipeline-v2.1",
	"instanceId": "production-instance-001"
  },
  "pinData": {},
  "versionId": "v2.1.0-20250121",
  "tags": ["devops", "ci-cd", "git", "automation"]
}

JSON

Warum JSON-basierte Workflows für DevOps relevant sind:

Die JSON-Struktur ermöglicht es dir, Workflows als Infrastructure as Code zu behandeln. Du kannst sie in Git-Repositories verwalten, Code-Reviews durchführen und automatisierte Tests implementieren.

🔧 Praktisches Beispiel – Workflow-Generierung via Script:

#!/bin/bash
# generate-n8n-workflow.sh - Workflow-Generator für CI/CD-Pipelines

set -euo pipefail

TEMPLATE_DIR="/opt/n8n-templates"
OUTPUT_DIR="/opt/n8n-workflows"
REPO_NAME="${1:-example-app}"
ENVIRONMENT="${2:-staging}"

# Workflow-Metadaten
WORKFLOW_ID="ci-cd-${REPO_NAME,,}-${ENVIRONMENT}"
WEBHOOK_PATH="webhook/${REPO_NAME,,}/${ENVIRONMENT}"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")

# JSON-Template mit envsubst verarbeiten
cat << EOF > "${OUTPUT_DIR}/${WORKFLOW_ID}.json"
{
  "name": "CI/CD Pipeline - ${REPO_NAME} (${ENVIRONMENT})",
  "nodes": [
	{
	  "parameters": {
		"path": "${WEBHOOK_PATH}",
		"options": {
		  "responseMode": "onReceived",
		  "responseData": "firstEntryJson"
		},
		"httpMethod": "POST"
	  },
	  "id": "webhook-${TIMESTAMP}",
	  "name": "Git Webhook - ${REPO_NAME}",
	  "type": "n8n-nodes-base.webhook",
	  "typeVersion": 1,
	  "position": [240, 300]
	},
	{
	  "parameters": {
		"resource": "repository",
		"operation": "getCommit",
		"owner": "\${{\$json.repository.owner.login}}",
		"repository": "${REPO_NAME}",
		"sha": "\${{\$json.head_commit.id}}"
	  },
	  "id": "github-api-${TIMESTAMP}",
	  "name": "Fetch Commit Details",
	  "type": "n8n-nodes-base.github",
	  "typeVersion": 1,
	  "position": [460, 300],
	  "credentials": {
		"githubApi": {
		  "id": "github-service-account",
		  "name": "GitHub Service Account"
		}
	  }
	},
	{
	  "parameters": {
		"url": "https://jenkins.company.com/job/${REPO_NAME}-${ENVIRONMENT}/buildWithParameters",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpBasicAuth",
		"sendQuery": true,
		"queryParameters": {
		  "parameters": [
			{
			  "name": "GIT_COMMIT",
			  "value": "\${{\$json.sha}}"
			},
			{
			  "name": "GIT_BRANCH", 
			  "value": "\${{\$json.ref.replace('refs/heads/', '')}}"
			},
			{
			  "name": "ENVIRONMENT",
			  "value": "${ENVIRONMENT}"
			},
			{
			  "name": "TRIGGERED_BY",
			  "value": "n8n-webhook"
			}
		  ]
		}
	  },
	  "id": "jenkins-trigger-${TIMESTAMP}",
	  "name": "Trigger Jenkins Build",
	  "type": "n8n-nodes-base.httpRequest",
	  "typeVersion": 4.1,
	  "position": [680, 300],
	  "credentials": {
		"httpBasicAuth": {
		  "id": "jenkins-service-account",
		  "name": "Jenkins Service Account"
		}
	  }
	}
  ],
  "connections": {
	"Git Webhook - ${REPO_NAME}": {
	  "main": [
		[
		  {
			"node": "Fetch Commit Details",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	},
	"Fetch Commit Details": {
	  "main": [
		[
		  {
			"node": "Trigger Jenkins Build",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	}
  },
  "active": false,
  "settings": {
	"executionOrder": "v1",
	"saveManualExecutions": true,
	"callerPolicy": "workflowsFromSameOwner"
  },
  "meta": {
	"templateCreatedBy": "$(whoami)",
	"generatedAt": "$(date -Iseconds)",
	"repository": "${REPO_NAME}",
	"environment": "${ENVIRONMENT}"
  },
  "tags": ["ci-cd", "${ENVIRONMENT}", "${REPO_NAME,,}", "auto-generated"]
}
EOF

echo "✅ Workflow generated: ${OUTPUT_DIR}/${WORKFLOW_ID}.json"
echo "📎 Webhook URL will be: https://n8n.company.com/webhook/${WEBHOOK_PATH}"

# Optional: Direkt in n8n importieren
if [[ "${3:-}" == "--deploy" ]]; then
  curl -X POST "https://n8n.company.com/api/v1/workflows" \
	-H "Authorization: Bearer ${N8N_API_TOKEN}" \
	-H "Content-Type: application/json" \
	-d @"${OUTPUT_DIR}/${WORKFLOW_ID}.json"
  echo "🚀 Workflow deployed to n8n"
fi

#!/bin/bash
# generate-n8n-workflow.sh - Workflow-Generator für CI/CD-Pipelines

set -euo pipefail

TEMPLATE_DIR="/opt/n8n-templates"
OUTPUT_DIR="/opt/n8n-workflows"
REPO_NAME="${1:-example-app}"
ENVIRONMENT="${2:-staging}"

# Workflow-Metadaten
WORKFLOW_ID="ci-cd-${REPO_NAME,,}-${ENVIRONMENT}"
WEBHOOK_PATH="webhook/${REPO_NAME,,}/${ENVIRONMENT}"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")

# JSON-Template mit envsubst verarbeiten
cat << EOF > "${OUTPUT_DIR}/${WORKFLOW_ID}.json"
{
  "name": "CI/CD Pipeline - ${REPO_NAME} (${ENVIRONMENT})",
  "nodes": [
	{
	  "parameters": {
		"path": "${WEBHOOK_PATH}",
		"options": {
		  "responseMode": "onReceived",
		  "responseData": "firstEntryJson"
		},
		"httpMethod": "POST"
	  },
	  "id": "webhook-${TIMESTAMP}",
	  "name": "Git Webhook - ${REPO_NAME}",
	  "type": "n8n-nodes-base.webhook",
	  "typeVersion": 1,
	  "position": [240, 300]
	},
	{
	  "parameters": {
		"resource": "repository",
		"operation": "getCommit",
		"owner": "\${{\$json.repository.owner.login}}",
		"repository": "${REPO_NAME}",
		"sha": "\${{\$json.head_commit.id}}"
	  },
	  "id": "github-api-${TIMESTAMP}",
	  "name": "Fetch Commit Details",
	  "type": "n8n-nodes-base.github",
	  "typeVersion": 1,
	  "position": [460, 300],
	  "credentials": {
		"githubApi": {
		  "id": "github-service-account",
		  "name": "GitHub Service Account"
		}
	  }
	},
	{
	  "parameters": {
		"url": "https://jenkins.company.com/job/${REPO_NAME}-${ENVIRONMENT}/buildWithParameters",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpBasicAuth",
		"sendQuery": true,
		"queryParameters": {
		  "parameters": [
			{
			  "name": "GIT_COMMIT",
			  "value": "\${{\$json.sha}}"
			},
			{
			  "name": "GIT_BRANCH", 
			  "value": "\${{\$json.ref.replace('refs/heads/', '')}}"
			},
			{
			  "name": "ENVIRONMENT",
			  "value": "${ENVIRONMENT}"
			},
			{
			  "name": "TRIGGERED_BY",
			  "value": "n8n-webhook"
			}
		  ]
		}
	  },
	  "id": "jenkins-trigger-${TIMESTAMP}",
	  "name": "Trigger Jenkins Build",
	  "type": "n8n-nodes-base.httpRequest",
	  "typeVersion": 4.1,
	  "position": [680, 300],
	  "credentials": {
		"httpBasicAuth": {
		  "id": "jenkins-service-account",
		  "name": "Jenkins Service Account"
		}
	  }
	}
  ],
  "connections": {
	"Git Webhook - ${REPO_NAME}": {
	  "main": [
		[
		  {
			"node": "Fetch Commit Details",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	},
	"Fetch Commit Details": {
	  "main": [
		[
		  {
			"node": "Trigger Jenkins Build",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	}
  },
  "active": false,
  "settings": {
	"executionOrder": "v1",
	"saveManualExecutions": true,
	"callerPolicy": "workflowsFromSameOwner"
  },
  "meta": {
	"templateCreatedBy": "$(whoami)",
	"generatedAt": "$(date -Iseconds)",
	"repository": "${REPO_NAME}",
	"environment": "${ENVIRONMENT}"
  },
  "tags": ["ci-cd", "${ENVIRONMENT}", "${REPO_NAME,,}", "auto-generated"]
}
EOF

echo "✅ Workflow generated: ${OUTPUT_DIR}/${WORKFLOW_ID}.json"
echo "📎 Webhook URL will be: https://n8n.company.com/webhook/${WEBHOOK_PATH}"

# Optional: Direkt in n8n importieren
if [[ "${3:-}" == "--deploy" ]]; then
  curl -X POST "https://n8n.company.com/api/v1/workflows" \
	-H "Authorization: Bearer ${N8N_API_TOKEN}" \
	-H "Content-Type: application/json" \
	-d @"${OUTPUT_DIR}/${WORKFLOW_ID}.json"
  echo "🚀 Workflow deployed to n8n"
fi

Bash

Git-basierte Workflow-Versionierung:

Behandle n8n-Workflows wie jeden anderen Code. Eine professionelle Verzeichnisstruktur könnte so aussehen:

n8n-workflows/
├── .github/
│   └── workflows/
│       ├── validate-workflows.yml
│       └── deploy-workflows.yml
├── environments/
│   ├── development/
│   ├── staging/
│   └── production/
├── templates/
│   ├── ci-cd-pipeline.template.json
│   ├── monitoring-alert.template.json
│   └── data-sync.template.json
├── shared/
│   ├── error-workflows/
│   └── utility-workflows/
└── tests/
	├── unit/
	└── integration/

n8n-workflows/
├── .github/
│   └── workflows/
│       ├── validate-workflows.yml
│       └── deploy-workflows.yml
├── environments/
│   ├── development/
│   ├── staging/
│   └── production/
├── templates/
│   ├── ci-cd-pipeline.template.json
│   ├── monitoring-alert.template.json
│   └── data-sync.template.json
├── shared/
│   ├── error-workflows/
│   └── utility-workflows/
└── tests/
	├── unit/
	└── integration/

Markdown

💡 Version Management Strategy: Verwende semantische Versionierung (SemVer) für deine Workflows. Major-Releases für Breaking Changes (neue Node-Inputs), Minor-Releases für neue Features, Patch-Releases für Bugfixes.

JSON Schema Validation:

Implementiere Schema-Validation für deine Workflows, um Fehler frühzeitig zu erkennen:

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "n8n Workflow Schema",
  "type": "object",
  "required": ["name", "nodes", "connections"],
  "properties": {
	"name": {
	  "type": "string",
	  "pattern": "^[A-Za-z0-9\\s\\-_]+$",
	  "maxLength": 100
	},
	"nodes": {
	  "type": "array",
	  "minItems": 1,
	  "items": {
		"type": "object",
		"required": ["id", "name", "type", "position"],
		"properties": {
		  "id": {
			"type": "string",
			"pattern": "^[a-zA-Z0-9\\-_]+$"
		  },
		  "type": {
			"type": "string",
			"enum": [
			  "n8n-nodes-base.webhook",
			  "n8n-nodes-base.httpRequest",
			  "n8n-nodes-base.code",
			  "n8n-nodes-base.if",
			  "n8n-nodes-base.github"
			]
		  },
		  "position": {
			"type": "array",
			"items": { "type": "number" },
			"minItems": 2,
			"maxItems": 2
		  }
		}
	  }
	}
  }
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "n8n Workflow Schema",
  "type": "object",
  "required": ["name", "nodes", "connections"],
  "properties": {
	"name": {
	  "type": "string",
	  "pattern": "^[A-Za-z0-9\\s\\-_]+$",
	  "maxLength": 100
	},
	"nodes": {
	  "type": "array",
	  "minItems": 1,
	  "items": {
		"type": "object",
		"required": ["id", "name", "type", "position"],
		"properties": {
		  "id": {
			"type": "string",
			"pattern": "^[a-zA-Z0-9\\-_]+$"
		  },
		  "type": {
			"type": "string",
			"enum": [
			  "n8n-nodes-base.webhook",
			  "n8n-nodes-base.httpRequest",
			  "n8n-nodes-base.code",
			  "n8n-nodes-base.if",
			  "n8n-nodes-base.github"
			]
		  },
		  "position": {
			"type": "array",
			"items": { "type": "number" },
			"minItems": 2,
			"maxItems": 2
		  }
		}
	  }
	}
  }
}

JSON

⚠️ JSON-Stolperfallen: n8n-JSON-Workflows enthalten oft escaped JavaScript-Code in String-Form. Achte auf korrekte JSON-Escaping bei Code-Nodes, da ungültiges Escaping zu Parse-Fehlern führt.

Custom Node Development mit TypeScript/JavaScript

Custom Nodes sind der Schlüssel, um n8n an deine spezifischen Infrastruktur-Anforderungen anzupassen. Mit TypeScript kannst du typisierte, testbare und wiederverwendbare Nodes entwickeln, die nahtlos in die n8n-Ökosystem integrieren.

Node-Entwicklung Grundlagen:

n8n Nodes bestehen aus zwei Hauptteilen: der Node-Definition (Metadata, Parameter, UI-Beschreibung) und der Execution-Logik (Datenverarbeitung). Beide werden in TypeScript geschrieben und folgen strikten Interfaces.

🔧 Praktisches Beispiel – Custom Kubernetes Node:

// KubernetesNode.ts - Custom Node für K8s-Operationen
import {
  IExecuteFunctions,
  INodeExecutionData,
  INodeType,
  INodeTypeDescription,
  NodeParameterValue,
  ICredentialType,
  ILoadOptionsFunctions,
  INodePropertyOptions,
} from 'n8n-workflow';

import { KubeConfig, CoreV1Api, AppsV1Api, BatchV1Api } from '@kubernetes/client-node';

export class KubernetesNode implements INodeType {
  description: INodeTypeDescription = {
	displayName: 'Kubernetes',
	name: 'kubernetes',
	icon: 'file:kubernetes.svg',
	group: ['DevOps'],
	version: 1,
	subtitle: '={{$parameter["operation"] + ": " + $parameter["resource"]}}',
	description: 'Execute Kubernetes operations via kubectl API',
	defaults: {
	  name: 'Kubernetes',
	  color: '#326CE5',
	},
	inputs: ['main'],
	outputs: ['main'],
	credentials: [
	  {
		name: 'kubernetesApi',
		required: true,
	  },
	],
	requestDefaults: {
	  headers: {
		'User-Agent': 'n8n-kubernetes-node/1.0.0',
	  },
	},
	properties: [
	  {
		displayName: 'Resource',
		name: 'resource',
		type: 'options',
		noDataExpression: true,
		options: [
		  {
			name: 'Pod',
			value: 'pod',
		  },
		  {
			name: 'Deployment',
			value: 'deployment',
		  },
		  {
			name: 'Service',
			value: 'service',
		  },
		  {
			name: 'Job',
			value: 'job',
		  },
		  {
			name: 'ConfigMap',
			value: 'configMap',
		  },
		],
		default: 'pod',
		required: true,
	  },
	  {
		displayName: 'Operation',
		name: 'operation',
		type: 'options',
		noDataExpression: true,
		displayOptions: {
		  show: {
			resource: ['pod'],
		  },
		},
		options: [
		  {
			name: 'Get',
			value: 'get',
			description: 'Get pod information',
		  },
		  {
			name: 'List',
			value: 'list',
			description: 'List pods in namespace',
		  },
		  {
			name: 'Delete',
			value: 'delete',
			description: 'Delete a pod',
		  },
		  {
			name: 'Get Logs',
			value: 'getLogs',
			description: 'Get pod logs',
		  },
		  {
			name: 'Execute',
			value: 'exec',
			description: 'Execute command in pod',
		  },
		],
		default: 'get',
		required: true,
	  },
	  {
		displayName: 'Namespace',
		name: 'namespace',
		type: 'string',
		default: 'default',
		placeholder: 'default',
		description: 'Kubernetes namespace',
		required: true,
	  },
	  {
		displayName: 'Pod Name',
		name: 'podName',
		type: 'string',
		displayOptions: {
		  show: {
			resource: ['pod'],
			operation: ['get', 'delete', 'getLogs', 'exec'],
		  },
		},
		default: '',
		placeholder: 'my-pod-name',
		description: 'Name of the pod',
		required: true,
	  },
	  {
		displayName: 'Container Name',
		name: 'containerName',
		type: 'string',
		displayOptions: {
		  show: {
			resource: ['pod'],
			operation: ['getLogs', 'exec'],
		  },
		},
		default: '',
		placeholder: 'main-container',
		description: 'Container name (optional for single-container pods)',
	  },
	  {
		displayName: 'Command',
		name: 'command',
		type: 'string',
		displayOptions: {
		  show: {
			resource: ['pod'],
			operation: ['exec'],
		  },
		},
		default: '/bin/bash',
		placeholder: '/bin/bash -c "ls -la"',
		description: 'Command to execute in the pod',
		required: true,
	  },
	  {
		displayName: 'Follow Logs',
		name: 'followLogs',
		type: 'boolean',
		displayOptions: {
		  show: {
			resource: ['pod'],
			operation: ['getLogs'],
		  },
		},
		default: false,
		description: 'Follow log output (stream)',
	  },
	],
  };

  async execute(this: IExecuteFunctions): Promise<INodeExecutionData[][]> {
	const items = this.getInputData();
	const returnData: INodeExecutionData[] = [];

	// Kubernetes Client Setup
	const credentials = await this.getCredentials('kubernetesApi');
	const kubeConfig = new KubeConfig();
	
	try {
	  // Load kubeconfig from credentials
	  if (credentials.kubeconfig) {
		kubeConfig.loadFromString(credentials.kubeconfig as string);
	  } else {
		kubeConfig.loadFromDefault();
	  }
	} catch (error) {
	  throw new Error(`Failed to load Kubernetes configuration: ${error.message}`);
	}

	const coreV1Api = kubeConfig.makeApiClient(CoreV1Api);
	const appsV1Api = kubeConfig.makeApiClient(AppsV1Api);
	const batchV1Api = kubeConfig.makeApiClient(BatchV1Api);

	// Process each input item
	for (let itemIndex = 0; itemIndex < items.length; itemIndex++) {
	  try {
		const resource = this.getNodeParameter('resource', itemIndex) as string;
		const operation = this.getNodeParameter('operation', itemIndex) as string;
		const namespace = this.getNodeParameter('namespace', itemIndex) as string;

		let responseData: any;

		if (resource === 'pod') {
		  responseData = await this.handlePodOperations(
			coreV1Api,
			operation,
			namespace,
			itemIndex
		  );
		} else if (resource === 'deployment') {
		  responseData = await this.handleDeploymentOperations(
			appsV1Api,
			operation,
			namespace,
			itemIndex
		  );
		}

		returnData.push({
		  json: {
			resource,
			operation,
			namespace,
			timestamp: new Date().toISOString(),
			success: true,
			data: responseData,
		  },
		  pairedItem: { item: itemIndex },
		});

	  } catch (error) {
		if (this.continueOnFail()) {
		  returnData.push({
			json: {
			  error: error.message,
			  success: false,
			  timestamp: new Date().toISOString(),
			},
			pairedItem: { item: itemIndex },
		  });
		  continue;
		}
		throw error;
	  }
	}

	return [returnData];
  }

  private async handlePodOperations(
	coreV1Api: CoreV1Api,
	operation: string,
	namespace: string,
	itemIndex: number
  ): Promise<any> {
	const podName = this.getNodeParameter('podName', itemIndex) as string;

	switch (operation) {
	  case 'get':
		const podResponse = await coreV1Api.readNamespacedPod(podName, namespace);
		return podResponse.body;

	  case 'list':
		const listResponse = await coreV1Api.listNamespacedPod(namespace);
		return listResponse.body.items;

	  case 'delete':
		const deleteResponse = await coreV1Api.deleteNamespacedPod(podName, namespace);
		return { deleted: true, podName, namespace };

	  case 'getLogs':
		const containerName = this.getNodeParameter('containerName', itemIndex, '') as string;
		const followLogs = this.getNodeParameter('followLogs', itemIndex, false) as boolean;
		
		const logsResponse = await coreV1Api.readNamespacedPodLog(
		  podName,
		  namespace,
		  containerName || undefined,
		  followLogs
		);
		return { logs: logsResponse.body };

	  case 'exec':
		const command = this.getNodeParameter('command', itemIndex) as string;
		// Kubernetes exec is complex - simplified implementation
		return { 
		  message: 'Exec operation initiated',
		  podName,
		  command,
		  namespace 
		};

	  default:
		throw new Error(`Unknown pod operation: ${operation}`);
	}
  }

  private async handleDeploymentOperations(
	appsV1Api: AppsV1Api,
	operation: string,
	namespace: string,
	itemIndex: number
  ): Promise<any> {
	// Implementation für Deployment-Operationen
	// ...
	return { message: 'Deployment operation placeholder' };
  }
}
```

**Credential-Typ für Kubernetes:**

```typescript
// KubernetesApi.credentials.ts
import {
  ICredentialType,
  INodeProperties,
} from 'n8n-workflow';

export class KubernetesApi implements ICredentialType {
  name = 'kubernetesApi';
  displayName = 'Kubernetes API';
  documentationUrl = 'https://kubernetes.io/docs/reference/access-authn-authz/authentication/';
  properties: INodeProperties[] = [
	{
	  displayName: 'Authentication Method',
	  name: 'authType',
	  type: 'options',
	  options: [
		{
		  name: 'Kubeconfig',
		  value: 'kubeconfig',
		},
		{
		  name: 'Service Account Token',
		  value: 'serviceAccount',
		},
		{
		  name: 'Certificate',
		  value: 'certificate',
		},
	  ],
	  default: 'kubeconfig',
	},
	{
	  displayName: 'Kubeconfig',
	  name: 'kubeconfig',
	  type: 'string',
	  typeOptions: {
		password: true,
		rows: 10,
	  },
	  displayOptions: {
		show: {
		  authType: ['kubeconfig'],
		},
	  },
	  default: '',
	  description: 'Complete kubeconfig file content',
	},
	{
	  displayName: 'API Server URL',
	  name: 'serverUrl',
	  type: 'string',
	  displayOptions: {
		show: {
		  authType: ['serviceAccount', 'certificate'],
		},
	  },
	  default: 'https://kubernetes.default.svc',
	  placeholder: 'https://kubernetes.default.svc',
	  description: 'Kubernetes API server URL',
	},
	{
	  displayName: 'Service Account Token',
	  name: 'token',
	  type: 'string',
	  typeOptions: {
		password: true,
	  },
	  displayOptions: {
		show: {
		  authType: ['serviceAccount'],
		},
	  },
	  default: '',
	  description: 'Service account bearer token',
	},
  ];
}

// KubernetesNode.ts - Custom Node für K8s-Operationen
import {
  IExecuteFunctions,
  INodeExecutionData,
  INodeType,
  INodeTypeDescription,
  NodeParameterValue,
  ICredentialType,
  ILoadOptionsFunctions,
  INodePropertyOptions,
} from 'n8n-workflow';

import { KubeConfig, CoreV1Api, AppsV1Api, BatchV1Api } from '@kubernetes/client-node';

export class KubernetesNode implements INodeType {
  description: INodeTypeDescription = {
	displayName: 'Kubernetes',
	name: 'kubernetes',
	icon: 'file:kubernetes.svg',
	group: ['DevOps'],
	version: 1,
	subtitle: '={{$parameter["operation"] + ": " + $parameter["resource"]}}',
	description: 'Execute Kubernetes operations via kubectl API',
	defaults: {
	  name: 'Kubernetes',
	  color: '#326CE5',
	},
	inputs: ['main'],
	outputs: ['main'],
	credentials: [
	  {
		name: 'kubernetesApi',
		required: true,
	  },
	],
	requestDefaults: {
	  headers: {
		'User-Agent': 'n8n-kubernetes-node/1.0.0',
	  },
	},
	properties: [
	  {
		displayName: 'Resource',
		name: 'resource',
		type: 'options',
		noDataExpression: true,
		options: [
		  {
			name: 'Pod',
			value: 'pod',
		  },
		  {
			name: 'Deployment',
			value: 'deployment',
		  },
		  {
			name: 'Service',
			value: 'service',
		  },
		  {
			name: 'Job',
			value: 'job',
		  },
		  {
			name: 'ConfigMap',
			value: 'configMap',
		  },
		],
		default: 'pod',
		required: true,
	  },
	  {
		displayName: 'Operation',
		name: 'operation',
		type: 'options',
		noDataExpression: true,
		displayOptions: {
		  show: {
			resource: ['pod'],
		  },
		},
		options: [
		  {
			name: 'Get',
			value: 'get',
			description: 'Get pod information',
		  },
		  {
			name: 'List',
			value: 'list',
			description: 'List pods in namespace',
		  },
		  {
			name: 'Delete',
			value: 'delete',
			description: 'Delete a pod',
		  },
		  {
			name: 'Get Logs',
			value: 'getLogs',
			description: 'Get pod logs',
		  },
		  {
			name: 'Execute',
			value: 'exec',
			description: 'Execute command in pod',
		  },
		],
		default: 'get',
		required: true,
	  },
	  {
		displayName: 'Namespace',
		name: 'namespace',
		type: 'string',
		default: 'default',
		placeholder: 'default',
		description: 'Kubernetes namespace',
		required: true,
	  },
	  {
		displayName: 'Pod Name',
		name: 'podName',
		type: 'string',
		displayOptions: {
		  show: {
			resource: ['pod'],
			operation: ['get', 'delete', 'getLogs', 'exec'],
		  },
		},
		default: '',
		placeholder: 'my-pod-name',
		description: 'Name of the pod',
		required: true,
	  },
	  {
		displayName: 'Container Name',
		name: 'containerName',
		type: 'string',
		displayOptions: {
		  show: {
			resource: ['pod'],
			operation: ['getLogs', 'exec'],
		  },
		},
		default: '',
		placeholder: 'main-container',
		description: 'Container name (optional for single-container pods)',
	  },
	  {
		displayName: 'Command',
		name: 'command',
		type: 'string',
		displayOptions: {
		  show: {
			resource: ['pod'],
			operation: ['exec'],
		  },
		},
		default: '/bin/bash',
		placeholder: '/bin/bash -c "ls -la"',
		description: 'Command to execute in the pod',
		required: true,
	  },
	  {
		displayName: 'Follow Logs',
		name: 'followLogs',
		type: 'boolean',
		displayOptions: {
		  show: {
			resource: ['pod'],
			operation: ['getLogs'],
		  },
		},
		default: false,
		description: 'Follow log output (stream)',
	  },
	],
  };

  async execute(this: IExecuteFunctions): Promise<INodeExecutionData[][]> {
	const items = this.getInputData();
	const returnData: INodeExecutionData[] = [];

	// Kubernetes Client Setup
	const credentials = await this.getCredentials('kubernetesApi');
	const kubeConfig = new KubeConfig();
	
	try {
	  // Load kubeconfig from credentials
	  if (credentials.kubeconfig) {
		kubeConfig.loadFromString(credentials.kubeconfig as string);
	  } else {
		kubeConfig.loadFromDefault();
	  }
	} catch (error) {
	  throw new Error(`Failed to load Kubernetes configuration: ${error.message}`);
	}

	const coreV1Api = kubeConfig.makeApiClient(CoreV1Api);
	const appsV1Api = kubeConfig.makeApiClient(AppsV1Api);
	const batchV1Api = kubeConfig.makeApiClient(BatchV1Api);

	// Process each input item
	for (let itemIndex = 0; itemIndex < items.length; itemIndex++) {
	  try {
		const resource = this.getNodeParameter('resource', itemIndex) as string;
		const operation = this.getNodeParameter('operation', itemIndex) as string;
		const namespace = this.getNodeParameter('namespace', itemIndex) as string;

		let responseData: any;

		if (resource === 'pod') {
		  responseData = await this.handlePodOperations(
			coreV1Api,
			operation,
			namespace,
			itemIndex
		  );
		} else if (resource === 'deployment') {
		  responseData = await this.handleDeploymentOperations(
			appsV1Api,
			operation,
			namespace,
			itemIndex
		  );
		}

		returnData.push({
		  json: {
			resource,
			operation,
			namespace,
			timestamp: new Date().toISOString(),
			success: true,
			data: responseData,
		  },
		  pairedItem: { item: itemIndex },
		});

	  } catch (error) {
		if (this.continueOnFail()) {
		  returnData.push({
			json: {
			  error: error.message,
			  success: false,
			  timestamp: new Date().toISOString(),
			},
			pairedItem: { item: itemIndex },
		  });
		  continue;
		}
		throw error;
	  }
	}

	return [returnData];
  }

  private async handlePodOperations(
	coreV1Api: CoreV1Api,
	operation: string,
	namespace: string,
	itemIndex: number
  ): Promise<any> {
	const podName = this.getNodeParameter('podName', itemIndex) as string;

	switch (operation) {
	  case 'get':
		const podResponse = await coreV1Api.readNamespacedPod(podName, namespace);
		return podResponse.body;

	  case 'list':
		const listResponse = await coreV1Api.listNamespacedPod(namespace);
		return listResponse.body.items;

	  case 'delete':
		const deleteResponse = await coreV1Api.deleteNamespacedPod(podName, namespace);
		return { deleted: true, podName, namespace };

	  case 'getLogs':
		const containerName = this.getNodeParameter('containerName', itemIndex, '') as string;
		const followLogs = this.getNodeParameter('followLogs', itemIndex, false) as boolean;
		
		const logsResponse = await coreV1Api.readNamespacedPodLog(
		  podName,
		  namespace,
		  containerName || undefined,
		  followLogs
		);
		return { logs: logsResponse.body };

	  case 'exec':
		const command = this.getNodeParameter('command', itemIndex) as string;
		// Kubernetes exec is complex - simplified implementation
		return { 
		  message: 'Exec operation initiated',
		  podName,
		  command,
		  namespace 
		};

	  default:
		throw new Error(`Unknown pod operation: ${operation}`);
	}
  }

  private async handleDeploymentOperations(
	appsV1Api: AppsV1Api,
	operation: string,
	namespace: string,
	itemIndex: number
  ): Promise<any> {
	// Implementation für Deployment-Operationen
	// ...
	return { message: 'Deployment operation placeholder' };
  }
}
```

**Credential-Typ für Kubernetes:**

```typescript
// KubernetesApi.credentials.ts
import {
  ICredentialType,
  INodeProperties,
} from 'n8n-workflow';

export class KubernetesApi implements ICredentialType {
  name = 'kubernetesApi';
  displayName = 'Kubernetes API';
  documentationUrl = 'https://kubernetes.io/docs/reference/access-authn-authz/authentication/';
  properties: INodeProperties[] = [
	{
	  displayName: 'Authentication Method',
	  name: 'authType',
	  type: 'options',
	  options: [
		{
		  name: 'Kubeconfig',
		  value: 'kubeconfig',
		},
		{
		  name: 'Service Account Token',
		  value: 'serviceAccount',
		},
		{
		  name: 'Certificate',
		  value: 'certificate',
		},
	  ],
	  default: 'kubeconfig',
	},
	{
	  displayName: 'Kubeconfig',
	  name: 'kubeconfig',
	  type: 'string',
	  typeOptions: {
		password: true,
		rows: 10,
	  },
	  displayOptions: {
		show: {
		  authType: ['kubeconfig'],
		},
	  },
	  default: '',
	  description: 'Complete kubeconfig file content',
	},
	{
	  displayName: 'API Server URL',
	  name: 'serverUrl',
	  type: 'string',
	  displayOptions: {
		show: {
		  authType: ['serviceAccount', 'certificate'],
		},
	  },
	  default: 'https://kubernetes.default.svc',
	  placeholder: 'https://kubernetes.default.svc',
	  description: 'Kubernetes API server URL',
	},
	{
	  displayName: 'Service Account Token',
	  name: 'token',
	  type: 'string',
	  typeOptions: {
		password: true,
	  },
	  displayOptions: {
		show: {
		  authType: ['serviceAccount'],
		},
	  },
	  default: '',
	  description: 'Service account bearer token',
	},
  ];
}

JavaScript

💡 Development Best Practices: Verwende das offizielle n8n Node Development Kit. Es bietet TypeScript-Templates, automatische Builds und lokale Testing-Umgebungen.

Testing Custom Nodes:

// tests/KubernetesNode.test.ts
import { KubernetesNode } from '../nodes/KubernetesNode';
import {
  IExecuteFunctions,
  INodeExecutionData,
  ICredentialsDecrypted,
  ICredentialDataDecryptedObject,
} from 'n8n-workflow';

// Mock Kubernetes Client
jest.mock('@kubernetes/client-node');

describe('KubernetesNode', () => {
  let kubernetesNode: KubernetesNode;
  let mockExecuteFunctions: Partial<IExecuteFunctions>;

  beforeEach(() => {
	kubernetesNode = new KubernetesNode();
	
	mockExecuteFunctions = {
	  getInputData: jest.fn(),
	  getNodeParameter: jest.fn(),
	  getCredentials: jest.fn(),
	  continueOnFail: jest.fn(),
	};
  });

  it('should handle pod get operation', async () => {
	// Mock input data
	(mockExecuteFunctions.getInputData as jest.Mock).mockReturnValue([
	  { json: { podName: 'test-pod' } }
	]);

	(mockExecuteFunctions.getNodeParameter as jest.Mock)
	  .mockReturnValueOnce('pod')      // resource
	  .mockReturnValueOnce('get')      // operation
	  .mockReturnValueOnce('default')  // namespace
	  .mockReturnValueOnce('test-pod'); // podName

	(mockExecuteFunctions.getCredentials as jest.Mock).mockResolvedValue({
	  kubeconfig: 'mock-kubeconfig-content'
	});

	// Execute node
	const result = await kubernetesNode.execute.call(
	  mockExecuteFunctions as IExecuteFunctions
	);

	// Assertions
	expect(result).toHaveLength(1);
	expect(result[0]).toHaveLength(1);
	expect(result[0][0].json.resource).toBe('pod');
	expect(result[0][0].json.operation).toBe('get');
  });
});

// tests/KubernetesNode.test.ts
import { KubernetesNode } from '../nodes/KubernetesNode';
import {
  IExecuteFunctions,
  INodeExecutionData,
  ICredentialsDecrypted,
  ICredentialDataDecryptedObject,
} from 'n8n-workflow';

// Mock Kubernetes Client
jest.mock('@kubernetes/client-node');

describe('KubernetesNode', () => {
  let kubernetesNode: KubernetesNode;
  let mockExecuteFunctions: Partial<IExecuteFunctions>;

  beforeEach(() => {
	kubernetesNode = new KubernetesNode();
	
	mockExecuteFunctions = {
	  getInputData: jest.fn(),
	  getNodeParameter: jest.fn(),
	  getCredentials: jest.fn(),
	  continueOnFail: jest.fn(),
	};
  });

  it('should handle pod get operation', async () => {
	// Mock input data
	(mockExecuteFunctions.getInputData as jest.Mock).mockReturnValue([
	  { json: { podName: 'test-pod' } }
	]);

	(mockExecuteFunctions.getNodeParameter as jest.Mock)
	  .mockReturnValueOnce('pod')      // resource
	  .mockReturnValueOnce('get')      // operation
	  .mockReturnValueOnce('default')  // namespace
	  .mockReturnValueOnce('test-pod'); // podName

	(mockExecuteFunctions.getCredentials as jest.Mock).mockResolvedValue({
	  kubeconfig: 'mock-kubeconfig-content'
	});

	// Execute node
	const result = await kubernetesNode.execute.call(
	  mockExecuteFunctions as IExecuteFunctions
	);

	// Assertions
	expect(result).toHaveLength(1);
	expect(result[0]).toHaveLength(1);
	expect(result[0][0].json.resource).toBe('pod');
	expect(result[0][0].json.operation).toBe('get');
  });
});

JavaScript

Deployment von Custom Nodes:

# build-and-deploy-node.sh
#!/bin/bash

NODE_NAME="n8n-nodes-kubernetes"
NODE_VERSION="1.0.0"
BUILD_DIR="/tmp/n8n-node-build"

echo "🔨 Building custom node: ${NODE_NAME}"

# Cleanup und Verzeichnis erstellen
rm -rf "${BUILD_DIR}"
mkdir -p "${BUILD_DIR}"

# Node-Dateien kopieren
cp -r nodes/ credentials/ package.json tsconfig.json "${BUILD_DIR}/"
cd "${BUILD_DIR}"

# Dependencies installieren und Build
npm install
npm run build

# Docker Image für Custom Node
cat << 'EOF' > Dockerfile
FROM n8nio/n8n:latest

USER root

# Custom Node installieren
COPY dist/ /home/node/.n8n/custom/
COPY package.json /home/node/.n8n/custom/

RUN cd /home/node/.n8n/custom && \
	npm install --only=production && \
	chown -R node:node /home/node/.n8n/

USER node
EOF

# Build und Push
docker build -t "company-registry.com/n8n-kubernetes:${NODE_VERSION}" .
docker push "company-registry.com/n8n-kubernetes:${NODE_VERSION}"

echo "✅ Custom node deployed: company-registry.com/n8n-kubernetes:${NODE_VERSION}"

# build-and-deploy-node.sh
#!/bin/bash

NODE_NAME="n8n-nodes-kubernetes"
NODE_VERSION="1.0.0"
BUILD_DIR="/tmp/n8n-node-build"

echo "🔨 Building custom node: ${NODE_NAME}"

# Cleanup und Verzeichnis erstellen
rm -rf "${BUILD_DIR}"
mkdir -p "${BUILD_DIR}"

# Node-Dateien kopieren
cp -r nodes/ credentials/ package.json tsconfig.json "${BUILD_DIR}/"
cd "${BUILD_DIR}"

# Dependencies installieren und Build
npm install
npm run build

# Docker Image für Custom Node
cat << 'EOF' > Dockerfile
FROM n8nio/n8n:latest

USER root

# Custom Node installieren
COPY dist/ /home/node/.n8n/custom/
COPY package.json /home/node/.n8n/custom/

RUN cd /home/node/.n8n/custom && \
	npm install --only=production && \
	chown -R node:node /home/node/.n8n/

USER node
EOF

# Build und Push
docker build -t "company-registry.com/n8n-kubernetes:${NODE_VERSION}" .
docker push "company-registry.com/n8n-kubernetes:${NODE_VERSION}"

echo "✅ Custom node deployed: company-registry.com/n8n-kubernetes:${NODE_VERSION}"

Bash

❗ Häufiger Fehler: Custom Nodes müssen die exakten n8n TypeScript-Interfaces implementieren. Achte besonders auf die pairedItem-Eigenschaft bei Rückgabewerten – ohne sie funktioniert die Node-Verkettung nicht korrekt.

Error Handling, Retry Logic und Debugging-Strategien

Robuste Error-Handling-Strategien sind entscheidend für produktive n8n-Workflows. Du brauchst systematische Ansätze für Fehlerbehandlung, automatische Wiederholungen und effizientes Debugging.

Multi-Level Error Handling Strategy:

n8n bietet verschiedene Ebenen der Fehlerbehandlung, die du kombinieren solltest:

┌──────────────────────────────────────────────────────┐
│                    Error Handling Levels             │
├──────────────────────────────────────────────────────┤
│  1. Node-Level Error Handling                        │
│     ├── Try/Catch in Code Nodes                      │
│     ├── Conditional Outputs (Continue on Fail)       │
│     └── Input Validation                             │
├──────────────────────────────────────────────────────┤
│  2. Workflow-Level Error Handling                    │
│     ├── Error Workflow Integration                   │
│     ├── IF Nodes for Error Routing                   │
│     └── Cleanup and Rollback Logic                   │
├──────────────────────────────────────────────────────┤
│  3. System-Level Error Handling                      │
│     ├── Infrastructure Monitoring                    │
│     ├── Dead Letter Queues                           │
│     └── Circuit Breaker Pattern                      │
└──────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────┐
│                    Error Handling Levels             │
├──────────────────────────────────────────────────────┤
│  1. Node-Level Error Handling                        │
│     ├── Try/Catch in Code Nodes                      │
│     ├── Conditional Outputs (Continue on Fail)       │
│     └── Input Validation                             │
├──────────────────────────────────────────────────────┤
│  2. Workflow-Level Error Handling                    │
│     ├── Error Workflow Integration                   │
│     ├── IF Nodes for Error Routing                   │
│     └── Cleanup and Rollback Logic                   │
├──────────────────────────────────────────────────────┤
│  3. System-Level Error Handling                      │
│     ├── Infrastructure Monitoring                    │
│     ├── Dead Letter Queues                           │
│     └── Circuit Breaker Pattern                      │
└──────────────────────────────────────────────────────┘

Markdown

🔧 Comprehensive Error Workflow:

{
  "name": "Production Error Handler",
  "nodes": [
	{
	  "parameters": {},
	  "id": "error-trigger",
	  "name": "Error Trigger",
	  "type": "n8n-nodes-base.errorTrigger",
	  "position": [240, 300]
	},
	{
	  "parameters": {
		"jsCode": "// Enhanced Error Processing and Classification\nconst errorData = $input.first().json;\nconst executionData = errorData.execution;\nconst workflowData = errorData.workflow;\n\n// Error Classification\nlet errorSeverity = 'low';\nlet errorCategory = 'unknown';\nlet autoRetry = false;\nlet escalationLevel = 1;\n\n// Analyze error type and context\nif (errorData.error) {\n  const errorMessage = errorData.error.message?.toLowerCase() || '';\n  const errorName = errorData.error.name?.toLowerCase() || '';\n  \n  // Network/API Errors (retriable)\n  if (errorMessage.includes('timeout') || \n      errorMessage.includes('connection') ||\n      errorMessage.includes('econnreset') ||\n      errorMessage.includes('socket hang up')) {\n    errorCategory = 'network';\n    errorSeverity = 'medium';\n    autoRetry = true;\n  }\n  \n  // Authentication Errors (critical)\n  else if (errorMessage.includes('unauthorized') ||\n           errorMessage.includes('forbidden') ||\n           errorMessage.includes('invalid token')) {\n    errorCategory = 'authentication';\n    errorSeverity = 'high';\n    escalationLevel = 2;\n  }\n  \n  // Data/Validation Errors\n  else if (errorMessage.includes('invalid') ||\n           errorMessage.includes('missing') ||\n           errorMessage.includes('required')) {\n    errorCategory = 'validation';\n    errorSeverity = 'medium';\n  }\n  \n  // Infrastructure Errors (critical)\n  else if (errorMessage.includes('database') ||\n           errorMessage.includes('redis') ||\n           errorMessage.includes('queue')) {\n    errorCategory = 'infrastructure';\n    errorSeverity = 'critical';\n    escalationLevel = 3;\n  }\n}\n\n// Workflow Context Analysis\nconst isProductionWorkflow = workflowData.tags?.includes('production') || false;\nconst isCriticalWorkflow = workflowData.tags?.includes('critical') || false;\n\nif (isProductionWorkflow) {\n  escalationLevel = Math.max(escalationLevel, 2);\n}\n\nif (isCriticalWorkflow) {\n  escalationLevel = 3;\n  errorSeverity = 'critical';\n}\n\n// Execution History Analysis\nlet recentFailures = 0;\nif (executionData.id) {\n  // This would require API call to get recent executions\n  // For now, we'll use a placeholder\n  recentFailures = Math.floor(Math.random() * 3);\n}\n\n// Create comprehensive error context\nconst errorContext = {\n  // Basic Error Information\n  timestamp: new Date().toISOString(),\n  executionId: executionData.id || 'unknown',\n  workflowId: workflowData.id || 'unknown',\n  workflowName: workflowData.name || 'Unknown Workflow',\n  \n  // Error Details\n  error: {\n    name: errorData.error?.name || 'Unknown Error',\n    message: errorData.error?.message || 'No error message',\n    stack: errorData.error?.stack || 'No stack trace',\n    nodeType: errorData.error?.node?.type || 'unknown',\n    nodeName: errorData.error?.node?.name || 'unknown',\n  },\n  \n  // Classification\n  classification: {\n    category: errorCategory,\n    severity: errorSeverity,\n    autoRetry: autoRetry,\n    escalationLevel: escalationLevel,\n    recentFailures: recentFailures\n  },\n  \n  // Context\n  context: {\n    isProduction: isProductionWorkflow,\n    isCritical: isCriticalWorkflow,\n    tags: workflowData.tags || [],\n    executionMode: executionData.mode || 'unknown'\n  },\n  \n  // URLs for quick access\n  urls: {\n    execution: `https://n8n.company.com/workflow/${workflowData.id}/executions/${executionData.id}`,\n    workflow: `https://n8n.company.com/workflow/${workflowData.id}`,\n    debugging: `https://n8n.company.com/workflow/${workflowData.id}/debug/${executionData.id}`\n  }\n};\n\nreturn [{ json: errorContext }];"
	  },
	  "id": "error-analysis",
	  "name": "Analyze Error",
	  "type": "n8n-nodes-base.code",
	  "position": [460, 300]
	},
	{
	  "parameters": {
		"conditions": {
		  "options": {
			"caseSensitive": true,
			"leftValue": "",
			"typeValidation": "strict"
		  },
		  "conditions": [
			{
			  "leftValue": "={{ $json.classification.autoRetry }}",
			  "rightValue": true,
			  "operator": {
				"type": "boolean"
			  }
			},
			{
			  "leftValue": "={{ $json.classification.recentFailures }}",
			  "rightValue": 3,
			  "operator": {
				"type": "number",
				"operation": "lt"
			  }
			}
		  ],
		  "combinator": "and"
		},
		"options": {}
	  },
	  "id": "retry-decision",
	  "name": "Should Retry?",
	  "type": "n8n-nodes-base.if",
	  "position": [680, 300]
	},
	{
	  "parameters": {
		"url": "https://n8n.company.com/api/v1/executions/{{ $json.executionId }}/retry",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpHeaderAuth",
		"sendHeaders": true,
		"headerParameters": {
		  "parameters": [
			{
			  "name": "Authorization",
			  "value": "Bearer {{ $credentials.n8nApi.token }}"
			}
		  ]
		},
		"options": {
		  "response": {
			"response": {
			  "responseFormat": "json"
			}
		  }
		}
	  },
	  "id": "retry-execution",
	  "name": "Retry Execution",
	  "type": "n8n-nodes-base.httpRequest",
	  "position": [900, 200]
	}
  ],
  "connections": {
	"Error Trigger": {
	  "main": [
		[
		  {
			"node": "Analyze Error",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	},
	"Analyze Error": {
	  "main": [
		[
		  {
			"node": "Should Retry?",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	},
	"Should Retry?": {
	  "main": [
		[
		  {
			"node": "Retry Execution",
			"type": "main",
			"index": 0
		  }
		],
		[
		  {
			"node": "Send Alert",
			"type": "main", 
			"index": 0
		  }
		]
	  ]
	}
  }
}

{
  "name": "Production Error Handler",
  "nodes": [
	{
	  "parameters": {},
	  "id": "error-trigger",
	  "name": "Error Trigger",
	  "type": "n8n-nodes-base.errorTrigger",
	  "position": [240, 300]
	},
	{
	  "parameters": {
		"jsCode": "// Enhanced Error Processing and Classification\nconst errorData = $input.first().json;\nconst executionData = errorData.execution;\nconst workflowData = errorData.workflow;\n\n// Error Classification\nlet errorSeverity = 'low';\nlet errorCategory = 'unknown';\nlet autoRetry = false;\nlet escalationLevel = 1;\n\n// Analyze error type and context\nif (errorData.error) {\n  const errorMessage = errorData.error.message?.toLowerCase() || '';\n  const errorName = errorData.error.name?.toLowerCase() || '';\n  \n  // Network/API Errors (retriable)\n  if (errorMessage.includes('timeout') || \n      errorMessage.includes('connection') ||\n      errorMessage.includes('econnreset') ||\n      errorMessage.includes('socket hang up')) {\n    errorCategory = 'network';\n    errorSeverity = 'medium';\n    autoRetry = true;\n  }\n  \n  // Authentication Errors (critical)\n  else if (errorMessage.includes('unauthorized') ||\n           errorMessage.includes('forbidden') ||\n           errorMessage.includes('invalid token')) {\n    errorCategory = 'authentication';\n    errorSeverity = 'high';\n    escalationLevel = 2;\n  }\n  \n  // Data/Validation Errors\n  else if (errorMessage.includes('invalid') ||\n           errorMessage.includes('missing') ||\n           errorMessage.includes('required')) {\n    errorCategory = 'validation';\n    errorSeverity = 'medium';\n  }\n  \n  // Infrastructure Errors (critical)\n  else if (errorMessage.includes('database') ||\n           errorMessage.includes('redis') ||\n           errorMessage.includes('queue')) {\n    errorCategory = 'infrastructure';\n    errorSeverity = 'critical';\n    escalationLevel = 3;\n  }\n}\n\n// Workflow Context Analysis\nconst isProductionWorkflow = workflowData.tags?.includes('production') || false;\nconst isCriticalWorkflow = workflowData.tags?.includes('critical') || false;\n\nif (isProductionWorkflow) {\n  escalationLevel = Math.max(escalationLevel, 2);\n}\n\nif (isCriticalWorkflow) {\n  escalationLevel = 3;\n  errorSeverity = 'critical';\n}\n\n// Execution History Analysis\nlet recentFailures = 0;\nif (executionData.id) {\n  // This would require API call to get recent executions\n  // For now, we'll use a placeholder\n  recentFailures = Math.floor(Math.random() * 3);\n}\n\n// Create comprehensive error context\nconst errorContext = {\n  // Basic Error Information\n  timestamp: new Date().toISOString(),\n  executionId: executionData.id || 'unknown',\n  workflowId: workflowData.id || 'unknown',\n  workflowName: workflowData.name || 'Unknown Workflow',\n  \n  // Error Details\n  error: {\n    name: errorData.error?.name || 'Unknown Error',\n    message: errorData.error?.message || 'No error message',\n    stack: errorData.error?.stack || 'No stack trace',\n    nodeType: errorData.error?.node?.type || 'unknown',\n    nodeName: errorData.error?.node?.name || 'unknown',\n  },\n  \n  // Classification\n  classification: {\n    category: errorCategory,\n    severity: errorSeverity,\n    autoRetry: autoRetry,\n    escalationLevel: escalationLevel,\n    recentFailures: recentFailures\n  },\n  \n  // Context\n  context: {\n    isProduction: isProductionWorkflow,\n    isCritical: isCriticalWorkflow,\n    tags: workflowData.tags || [],\n    executionMode: executionData.mode || 'unknown'\n  },\n  \n  // URLs for quick access\n  urls: {\n    execution: `https://n8n.company.com/workflow/${workflowData.id}/executions/${executionData.id}`,\n    workflow: `https://n8n.company.com/workflow/${workflowData.id}`,\n    debugging: `https://n8n.company.com/workflow/${workflowData.id}/debug/${executionData.id}`\n  }\n};\n\nreturn [{ json: errorContext }];"
	  },
	  "id": "error-analysis",
	  "name": "Analyze Error",
	  "type": "n8n-nodes-base.code",
	  "position": [460, 300]
	},
	{
	  "parameters": {
		"conditions": {
		  "options": {
			"caseSensitive": true,
			"leftValue": "",
			"typeValidation": "strict"
		  },
		  "conditions": [
			{
			  "leftValue": "={{ $json.classification.autoRetry }}",
			  "rightValue": true,
			  "operator": {
				"type": "boolean"
			  }
			},
			{
			  "leftValue": "={{ $json.classification.recentFailures }}",
			  "rightValue": 3,
			  "operator": {
				"type": "number",
				"operation": "lt"
			  }
			}
		  ],
		  "combinator": "and"
		},
		"options": {}
	  },
	  "id": "retry-decision",
	  "name": "Should Retry?",
	  "type": "n8n-nodes-base.if",
	  "position": [680, 300]
	},
	{
	  "parameters": {
		"url": "https://n8n.company.com/api/v1/executions/{{ $json.executionId }}/retry",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpHeaderAuth",
		"sendHeaders": true,
		"headerParameters": {
		  "parameters": [
			{
			  "name": "Authorization",
			  "value": "Bearer {{ $credentials.n8nApi.token }}"
			}
		  ]
		},
		"options": {
		  "response": {
			"response": {
			  "responseFormat": "json"
			}
		  }
		}
	  },
	  "id": "retry-execution",
	  "name": "Retry Execution",
	  "type": "n8n-nodes-base.httpRequest",
	  "position": [900, 200]
	}
  ],
  "connections": {
	"Error Trigger": {
	  "main": [
		[
		  {
			"node": "Analyze Error",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	},
	"Analyze Error": {
	  "main": [
		[
		  {
			"node": "Should Retry?",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	},
	"Should Retry?": {
	  "main": [
		[
		  {
			"node": "Retry Execution",
			"type": "main",
			"index": 0
		  }
		],
		[
		  {
			"node": "Send Alert",
			"type": "main", 
			"index": 0
		  }
		]
	  ]
	}
  }
}

JSON

Advanced Retry Logic Pattern:

```javascript
// Exponential Backoff Retry Logic
class RetryManager {
  constructor(maxRetries = 3, baseDelay = 1000, maxDelay = 30000) {
	this.maxRetries = maxRetries;
	this.baseDelay = baseDelay;
	this.maxDelay = maxDelay;
  }

  async executeWithRetry(operation, context = {}) {
	let lastError;
	
	for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
	  try {
		const result = await operation();
		
		// Log successful retry
		if (attempt > 1) {
		  console.log(`✅ Operation succeeded on attempt ${attempt}/${this.maxRetries}`);
		}
		
		return result;
	  } catch (error) {
		lastError = error;
		
		// Determine if error is retriable
		if (!this.isRetriableError(error)) {
		  throw error; // Fail fast for non-retriable errors
		}
		
		if (attempt === this.maxRetries) {
		  break; // Last attempt failed
		}
		
		// Calculate exponential backoff delay
		const delay = Math.min(
		  this.baseDelay * Math.pow(2, attempt - 1),
		  this.maxDelay
		);
		
		console.log(`⏱️ Attempt ${attempt}/${this.maxRetries} failed: ${error.message}`);
		console.log(`🔄 Retrying in ${delay}ms...`);
		
		await this.sleep(delay);
	  }
	}
	
	// All retries exhausted
	throw new Error(`Operation failed after ${this.maxRetries} attempts. Last error: ${lastError.message}`);
  }

  isRetriableError(error) {
	const retriablePatterns = [
	  /timeout/i,
	  /connection/i,
	  /socket hang up/i,
	  /econnreset/i,
	  /service unavailable/i,
	  /too many requests/i,
	  /rate limit/i,
	  /502|503|504/,
	];
	
	return retriablePatterns.some(pattern => 
	  pattern.test(error.message) || pattern.test(error.code)
	);
  }

  sleep(ms) {
	return new Promise(resolve => setTimeout(resolve, ms));
  }
}

// Usage in n8n Code Node
const retryManager = new RetryManager(3, 2000, 15000);

const result = await retryManager.executeWithRetry(async () => {
  // Your API call or operation here
  const response = await fetch('https://api.example.com/data', {
	method: 'POST',
	headers: {
	  'Content-Type': 'application/json',
	  'Authorization': `Bearer ${$credentials.apiToken.token}`
	},
	body: JSON.stringify($json)
  });
  
  if (!response.ok) {
	throw new Error(`HTTP ${response.status}: ${response.statusText}`);
  }
  
  return await response.json();
});

return [{ json: result }];

```javascript
// Exponential Backoff Retry Logic
class RetryManager {
  constructor(maxRetries = 3, baseDelay = 1000, maxDelay = 30000) {
	this.maxRetries = maxRetries;
	this.baseDelay = baseDelay;
	this.maxDelay = maxDelay;
  }

  async executeWithRetry(operation, context = {}) {
	let lastError;
	
	for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
	  try {
		const result = await operation();
		
		// Log successful retry
		if (attempt > 1) {
		  console.log(`✅ Operation succeeded on attempt ${attempt}/${this.maxRetries}`);
		}
		
		return result;
	  } catch (error) {
		lastError = error;
		
		// Determine if error is retriable
		if (!this.isRetriableError(error)) {
		  throw error; // Fail fast for non-retriable errors
		}
		
		if (attempt === this.maxRetries) {
		  break; // Last attempt failed
		}
		
		// Calculate exponential backoff delay
		const delay = Math.min(
		  this.baseDelay * Math.pow(2, attempt - 1),
		  this.maxDelay
		);
		
		console.log(`⏱️ Attempt ${attempt}/${this.maxRetries} failed: ${error.message}`);
		console.log(`🔄 Retrying in ${delay}ms...`);
		
		await this.sleep(delay);
	  }
	}
	
	// All retries exhausted
	throw new Error(`Operation failed after ${this.maxRetries} attempts. Last error: ${lastError.message}`);
  }

  isRetriableError(error) {
	const retriablePatterns = [
	  /timeout/i,
	  /connection/i,
	  /socket hang up/i,
	  /econnreset/i,
	  /service unavailable/i,
	  /too many requests/i,
	  /rate limit/i,
	  /502|503|504/,
	];
	
	return retriablePatterns.some(pattern => 
	  pattern.test(error.message) || pattern.test(error.code)
	);
  }

  sleep(ms) {
	return new Promise(resolve => setTimeout(resolve, ms));
  }
}

// Usage in n8n Code Node
const retryManager = new RetryManager(3, 2000, 15000);

const result = await retryManager.executeWithRetry(async () => {
  // Your API call or operation here
  const response = await fetch('https://api.example.com/data', {
	method: 'POST',
	headers: {
	  'Content-Type': 'application/json',
	  'Authorization': `Bearer ${$credentials.apiToken.token}`
	},
	body: JSON.stringify($json)
  });
  
  if (!response.ok) {
	throw new Error(`HTTP ${response.status}: ${response.statusText}`);
  }
  
  return await response.json();
});

return [{ json: result }];

JavaScript

Debugging und Observability:

💡 Professional Debugging Workflow: Implementiere structured logging und tracing in deinen Workflows für bessere Observability.

// Enhanced Logging and Tracing
class WorkflowLogger {
  constructor(workflowId, executionId) {
	this.workflowId = workflowId;
	this.executionId = executionId;
	this.startTime = Date.now();
  }

  log(level, message, data = {}) {
	const logEntry = {
	  timestamp: new Date().toISOString(),
	  level: level.toUpperCase(),
	  workflowId: this.workflowId,
	  executionId: this.executionId,
	  message: message,
	  data: data,
	  duration: Date.now() - this.startTime
	};

	// Send to logging infrastructure
	console.log(JSON.stringify(logEntry));
	
	// Optional: Send to external logging service
	// await this.sendToElasticsearch(logEntry);
	// await this.sendToSplunk(logEntry);
  }

  error(message, error, context = {}) {
	this.log('error', message, {
	  error: {
		name: error.name,
		message: error.message,
		stack: error.stack
	  },
	  context: context
	});
  }

  info(message, data = {}) {
	this.log('info', message, data);
  }

  debug(message, data = {}) {
	this.log('debug', message, data);
  }

  performance(operation, duration, metadata = {}) {
	this.log('performance', `Operation: ${operation}`, {
	  operation: operation,
	  duration: duration,
	  metadata: metadata
	});
  }
}

// Usage in n8n workflows
const logger = new WorkflowLogger($workflow.id, $execution.id);

try {
  logger.info('Starting API operation', { endpoint: 'https://api.example.com' });
  
  const startTime = Date.now();
  const response = await fetch('https://api.example.com/data');
  const duration = Date.now() - startTime;
  
  logger.performance('API_CALL', duration, { 
	statusCode: response.status,
	responseSize: response.headers.get('content-length')
  });

  if (!response.ok) {
	throw new Error(`HTTP ${response.status}: ${response.statusText}`);
  }

  const data = await response.json();
  logger.info('API operation successful', { recordCount: data.length });
  
  return [{ json: data }];
  
} catch (error) {
  logger.error('API operation failed', error, { 
	inputData: $json,
	nodePosition: $node.position
  });
  throw error;
}

// Enhanced Logging and Tracing
class WorkflowLogger {
  constructor(workflowId, executionId) {
	this.workflowId = workflowId;
	this.executionId = executionId;
	this.startTime = Date.now();
  }

  log(level, message, data = {}) {
	const logEntry = {
	  timestamp: new Date().toISOString(),
	  level: level.toUpperCase(),
	  workflowId: this.workflowId,
	  executionId: this.executionId,
	  message: message,
	  data: data,
	  duration: Date.now() - this.startTime
	};

	// Send to logging infrastructure
	console.log(JSON.stringify(logEntry));
	
	// Optional: Send to external logging service
	// await this.sendToElasticsearch(logEntry);
	// await this.sendToSplunk(logEntry);
  }

  error(message, error, context = {}) {
	this.log('error', message, {
	  error: {
		name: error.name,
		message: error.message,
		stack: error.stack
	  },
	  context: context
	});
  }

  info(message, data = {}) {
	this.log('info', message, data);
  }

  debug(message, data = {}) {
	this.log('debug', message, data);
  }

  performance(operation, duration, metadata = {}) {
	this.log('performance', `Operation: ${operation}`, {
	  operation: operation,
	  duration: duration,
	  metadata: metadata
	});
  }
}

// Usage in n8n workflows
const logger = new WorkflowLogger($workflow.id, $execution.id);

try {
  logger.info('Starting API operation', { endpoint: 'https://api.example.com' });
  
  const startTime = Date.now();
  const response = await fetch('https://api.example.com/data');
  const duration = Date.now() - startTime;
  
  logger.performance('API_CALL', duration, { 
	statusCode: response.status,
	responseSize: response.headers.get('content-length')
  });

  if (!response.ok) {
	throw new Error(`HTTP ${response.status}: ${response.statusText}`);
  }

  const data = await response.json();
  logger.info('API operation successful', { recordCount: data.length });
  
  return [{ json: data }];
  
} catch (error) {
  logger.error('API operation failed', error, { 
	inputData: $json,
	nodePosition: $node.position
  });
  throw error;
}

JavaScript

⚠️ Debug-Performance Impact: Extensive Logging kann die Workflow-Performance beeinträchtigen. Verwende Log-Level und konditionelles Logging basierend auf Environment-Variablen.

Mit diesen Workflow-Development-Techniken schaffst du die Grundlage für robuste, wartbare und skalierbare n8n-Automatisierungen. Die Kombination aus JSON-basierter Versionierung, Custom Node Development und systematischem Error Handling ermöglicht es dir, n8n professionell in kritischen DevOps-Prozessen einzusetzen.

Integration in DevOps-Toolchains

Die fundamentalen Workflow-Development-Techniken hast du jetzt verstanden – jetzt geht es darum, n8n nahtlos in deine bestehende DevOps-Infrastruktur zu integrieren. In diesem Abschnitt lernst du, wie n8n als zentraler Orchestrator in CI/CD-Pipelines, Infrastructure-as-Code-Workflows und Monitoring-Systemen fungiert. Die hier beschriebenen Integration-Patterns verwandeln n8n von einem isolierten Automatisierungs-Tool in das verbindende Element deiner gesamten DevOps-Toolchain.

Warum ist nahtlose Toolchain-Integration kritisch? Moderne DevOps-Umgebungen bestehen aus dutzenden spezialisierter Tools. Der Erfolg hängt davon ab, wie gut diese Tools zusammenarbeiten. n8n kann als Event Bus und Orchestration Layer fungieren, der komplexe Multi-Tool-Workflows ermöglicht, ohne dass du Custom Code für jede Integration schreiben musst.

CI/CD-Pipeline-Integration und GitOps-Workflows

Die Integration von n8n in CI/CD-Pipelines eröffnet völlig neue Möglichkeiten der Automatisierung. n8n kann als Pipeline Orchestrator, Event Gateway oder Post-Deployment Handler fungieren und komplexe Deployment-Workflows koordinieren, die über traditionelle CI/CD-Tools hinausgehen.

n8n als CI/CD Pipeline Orchestrator:

Traditionelle CI/CD-Tools wie Jenkins, GitLab CI oder GitHub Actions sind hervorragend für lineare Build-und-Deploy-Prozesse geeignet. n8n ergänzt diese Tools um Event-driven Orchestration und Cross-System Integration. Die Kombination ermöglicht es dir, komplexe Deployment-Workflows zu erstellen, die mehrere Tools und Systeme koordinieren.

┌───────────────────────────────────────────────────────────┐
│                    CI/CD Integration Architecture         │
├───────────────────────────────────────────────────────────┤
│  Git Repository                                           │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    │
│  │   Commit    │───▶│    Push     │───▶│  Webhook    │    │
│  │   Changes   │    │   to Repo   │    │   Trigger   │    │
│  └─────────────┘    └─────────────┘    └─────────────┘    │
└───────────────────────────────────────────────────────────┘
												│
												▼
┌───────────────────────────────────────────────────────────┐
│                      n8n Orchestrator                     │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    │
│  │  Webhook    │───▶│ Branch      │───▶│ Environment │    │
│  │  Receiver   │    │ Analysis    │    │ Selection   │    │
│  └─────────────┘    └─────────────┘    └─────────────┘    │
└───────────────────────────────────────────────────────────┘
												│
												▼
┌───────────────────────────────────────────────────────────┐
│                    Parallel CI/CD Execution               │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    │
│  │  Jenkins    │    │  GitLab CI  │    │   Ansible   │    │
│  │  Pipeline   │    │  Pipeline   │    │  Playbook   │    │
│  └─────────────┘    └─────────────┘    └─────────────┘    │
└───────────────────────────────────────────────────────────┘
												│
												▼
┌───────────────────────────────────────────────────────────┐
│                   Post-Deployment Orchestration           │ 
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    │
│  │  Health     │    │  Monitoring │    │ Notification│    │
│  │  Checks     │    │  Setup      │    │  & Alerts   │    │
│  └─────────────┘    └─────────────┘    └─────────────┘    │
└───────────────────────────────────────────────────────────┘

┌───────────────────────────────────────────────────────────┐
│                    CI/CD Integration Architecture         │
├───────────────────────────────────────────────────────────┤
│  Git Repository                                           │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    │
│  │   Commit    │───▶│    Push     │───▶│  Webhook    │    │
│  │   Changes   │    │   to Repo   │    │   Trigger   │    │
│  └─────────────┘    └─────────────┘    └─────────────┘    │
└───────────────────────────────────────────────────────────┘
												│
												▼
┌───────────────────────────────────────────────────────────┐
│                      n8n Orchestrator                     │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    │
│  │  Webhook    │───▶│ Branch      │───▶│ Environment │    │
│  │  Receiver   │    │ Analysis    │    │ Selection   │    │
│  └─────────────┘    └─────────────┘    └─────────────┘    │
└───────────────────────────────────────────────────────────┘
												│
												▼
┌───────────────────────────────────────────────────────────┐
│                    Parallel CI/CD Execution               │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    │
│  │  Jenkins    │    │  GitLab CI  │    │   Ansible   │    │
│  │  Pipeline   │    │  Pipeline   │    │  Playbook   │    │
│  └─────────────┘    └─────────────┘    └─────────────┘    │
└───────────────────────────────────────────────────────────┘
												│
												▼
┌───────────────────────────────────────────────────────────┐
│                   Post-Deployment Orchestration           │ 
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    │
│  │  Health     │    │  Monitoring │    │ Notification│    │
│  │  Checks     │    │  Setup      │    │  & Alerts   │    │
│  └─────────────┘    └─────────────┘    └─────────────┘    │
└───────────────────────────────────────────────────────────┘

Markdown

🔧 Praktisches Beispiel – Multi-Pipeline Orchestration:

{
  "name": "Enterprise CI/CD Orchestrator",
  "nodes": [
	{
	  "parameters": {
		"path": "cicd-orchestrator",
		"options": {
		  "responseMode": "onReceived",
		  "responseData": "firstEntryJson"
		},
		"httpMethod": "POST"
	  },
	  "id": "git-webhook-receiver",
	  "name": "Git Webhook Receiver",
	  "type": "n8n-nodes-base.webhook",
	  "position": [240, 300]
	},
	{
	  "parameters": {
		"jsCode": "// Advanced Git Event Processing and Routing Logic\nconst payload = $input.first().json;\n\n// Validate webhook payload\nif (!payload.repository || !payload.head_commit || !payload.ref) {\n  throw new Error('Invalid webhook payload: missing required fields');\n}\n\n// Extract branch information\nconst fullRef = payload.ref;\nconst branch = fullRef.replace('refs/heads/', '');\nconst isMainBranch = branch === 'main' || branch === 'master';\nconst isReleaseBranch = branch.startsWith('release/');\nconst isHotfixBranch = branch.startsWith('hotfix/');\nconst isFeatureBranch = branch.startsWith('feature/');\n\n// Repository analysis\nconst repository = {\n  name: payload.repository.name,\n  fullName: payload.repository.full_name,\n  owner: payload.repository.owner.login,\n  url: payload.repository.html_url,\n  isPrivate: payload.repository.private\n};\n\n// Commit analysis\nconst commit = {\n  sha: payload.head_commit.id,\n  shortSha: payload.head_commit.id.substring(0, 8),\n  message: payload.head_commit.message,\n  author: {\n    name: payload.head_commit.author.name,\n    email: payload.head_commit.author.email\n  },\n  timestamp: payload.head_commit.timestamp,\n  url: payload.head_commit.url\n};\n\n// Determine deployment strategy\nlet deploymentStrategy = {\n  environment: 'development',\n  requiresApproval: false,\n  runTests: true,\n  deployToProduction: false,\n  notificationChannels: ['#dev-notifications'],\n  parallelPipelines: ['unit-tests', 'linting'],\n  postDeployActions: ['basic-health-check']\n};\n\n// Main/Master branch - Production deployment\nif (isMainBranch) {\n  deploymentStrategy = {\n    environment: 'production',\n    requiresApproval: true,\n    runTests: true,\n    deployToProduction: true,\n    notificationChannels: ['#deployments', '#general'],\n    parallelPipelines: ['unit-tests', 'integration-tests', 'security-scan', 'performance-tests'],\n    postDeployActions: ['health-check', 'smoke-tests', 'monitoring-setup', 'backup-verification']\n  };\n}\n\n// Release branch - Staging deployment\nelse if (isReleaseBranch) {\n  const releaseVersion = branch.replace('release/', '');\n  deploymentStrategy = {\n    environment: 'staging',\n    requiresApproval: false,\n    runTests: true,\n    deployToProduction: false,\n    releaseVersion: releaseVersion,\n    notificationChannels: ['#staging-deployments', '#qa-team'],\n    parallelPipelines: ['unit-tests', 'integration-tests', 'e2e-tests'],\n    postDeployActions: ['health-check', 'qa-notification', 'staging-data-refresh']\n  };\n}\n\n// Hotfix branch - Emergency deployment\nelse if (isHotfixBranch) {\n  deploymentStrategy = {\n    environment: 'production',\n    requiresApproval: true,\n    runTests: true,\n    deployToProduction: true,\n    isHotfix: true,\n    notificationChannels: ['#critical-deployments', '#oncall'],\n    parallelPipelines: ['unit-tests', 'critical-integration-tests'],\n    postDeployActions: ['immediate-health-check', 'rollback-plan-verification', 'incident-update']\n  };\n}\n\n// Feature branch - Development deployment\nelse if (isFeatureBranch) {\n  deploymentStrategy = {\n    environment: 'development',\n    requiresApproval: false,\n    runTests: true,\n    deployToProduction: false,\n    featureName: branch.replace('feature/', ''),\n    notificationChannels: ['#dev-notifications'],\n    parallelPipelines: ['unit-tests', 'linting', 'security-scan'],\n    postDeployActions: ['basic-health-check']\n  };\n}\n\n// Build comprehensive deployment context\nconst deploymentContext = {\n  // Basic Information\n  timestamp: new Date().toISOString(),\n  workflowRunId: generateUUID(),\n  triggeredBy: 'git-webhook',\n  \n  // Repository Context\n  repository: repository,\n  commit: commit,\n  branch: {\n    name: branch,\n    fullRef: fullRef,\n    type: {\n      isMain: isMainBranch,\n      isRelease: isReleaseBranch,\n      isHotfix: isHotfixBranch,\n      isFeature: isFeatureBranch\n    }\n  },\n  \n  // Deployment Strategy\n  deployment: deploymentStrategy,\n  \n  // Pipeline Configuration\n  pipelines: {\n    jenkins: {\n      enabled: true,\n      jobName: `${repository.name}-${deploymentStrategy.environment}`,\n      parameters: {\n        GIT_COMMIT: commit.sha,\n        GIT_BRANCH: branch,\n        ENVIRONMENT: deploymentStrategy.environment,\n        RUN_TESTS: deploymentStrategy.runTests.toString(),\n        DEPLOY_TO_PROD: deploymentStrategy.deployToProduction.toString()\n      }\n    },\n    gitlabCI: {\n      enabled: repository.isPrivate,\n      projectId: payload.repository.id,\n      ref: branch,\n      variables: {\n        DEPLOYMENT_ENV: deploymentStrategy.environment,\n        COMMIT_SHA: commit.sha\n      }\n    },\n    ansible: {\n      enabled: deploymentStrategy.deployToProduction,\n      playbook: `deploy-${repository.name}.yml`,\n      inventory: deploymentStrategy.environment,\n      extraVars: {\n        app_version: commit.shortSha,\n        deployment_timestamp: new Date().toISOString()\n      }\n    }\n  },\n  \n  // Monitoring and Notifications\n  monitoring: {\n    setupRequired: deploymentStrategy.deployToProduction,\n    healthCheckEndpoints: [\n      `https://${repository.name}-${deploymentStrategy.environment}.company.com/health`,\n      `https://${repository.name}-${deploymentStrategy.environment}.company.com/metrics`\n    ],\n    alertingRules: deploymentStrategy.deployToProduction ? 'production' : 'development'\n  },\n  \n  // Approval Workflow\n  approval: {\n    required: deploymentStrategy.requiresApproval,\n    approvers: deploymentStrategy.deployToProduction ? \n      ['devops-lead@company.com', 'tech-lead@company.com'] : [],\n    timeoutMinutes: 30\n  }\n};\n\n// Helper function for UUID generation\nfunction generateUUID() {\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {\n    const r = Math.random() * 16 | 0;\n    const v = c === 'x' ? r : (r & 0x3 | 0x8);\n    return v.toString(16);\n  });\n}\n\nreturn [{ json: deploymentContext }];"
	  },
	  "id": "git-event-processor",
	  "name": "Process Git Event",
	  "type": "n8n-nodes-base.code",
	  "position": [460, 300]
	},
	{
	  "parameters": {
		"conditions": {
		  "options": {
			"caseSensitive": true,
			"leftValue": "",
			"typeValidation": "strict"
		  },
		  "conditions": [
			{
			  "leftValue": "={{ $json.approval.required }}",
			  "rightValue": true,
			  "operator": {
				"type": "boolean"
			  }
			}
		  ]
		}
	  },
	  "id": "approval-gate",
	  "name": "Requires Approval?",
	  "type": "n8n-nodes-base.if",
	  "position": [680, 300]
	},
	{
	  "parameters": {
		"resource": "message",
		"operation": "postToChannel",
		"channel": "#deployment-approvals",
		"text": "🚀 **Deployment Approval Required**\n\n**Repository:** {{ $json.repository.fullName }}\n**Branch:** {{ $json.branch.name }}\n**Commit:** {{ $json.commit.shortSha }} - {{ $json.commit.message }}\n**Environment:** {{ $json.deployment.environment }}\n**Author:** {{ $json.commit.author.name }}\n\n**Approvers:** {{ $json.approval.approvers.join(', ') }}\n\n[View Commit]({{ $json.commit.url }}) | [Pipeline Details](https://n8n.company.com/workflow/{{ $workflow.id }}/executions/{{ $execution.id }})\n\n**React with ✅ to approve, ❌ to reject**",
		"attachments": [],
		"otherOptions": {
		  "includeLinkToWorkflow": true
		}
	  },
	  "id": "approval-request",
	  "name": "Request Approval",
	  "type": "n8n-nodes-base.slack",
	  "position": [900, 200],
	  "credentials": {
		"slackApi": {
		  "id": "slack-bot-token",
		  "name": "Slack Bot Token"
		}
	  }
	},
	{
	  "parameters": {
		"url": "https://jenkins.company.com/job/{{ $json.pipelines.jenkins.jobName }}/buildWithParameters",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpBasicAuth",
		"sendQuery": true,
		"queryParameters": {
		  "parameters": [
			{
			  "name": "GIT_COMMIT",
			  "value": "={{ $json.pipelines.jenkins.parameters.GIT_COMMIT }}"
			},
			{
			  "name": "GIT_BRANCH",
			  "value": "={{ $json.pipelines.jenkins.parameters.GIT_BRANCH }}"
			},
			{
			  "name": "ENVIRONMENT",
			  "value": "={{ $json.pipelines.jenkins.parameters.ENVIRONMENT }}"
			},
			{
			  "name": "RUN_TESTS",
			  "value": "={{ $json.pipelines.jenkins.parameters.RUN_TESTS }}"
			},
			{
			  "name": "N8N_CALLBACK_URL",
			  "value": "https://n8n.company.com/webhook/jenkins-callback/{{ $json.workflowRunId }}"
			}
		  ]
		},
		"options": {
		  "response": {
			"response": {
			  "responseFormat": "json"
			}
		  },
		  "timeout": 30000
		}
	  },
	  "id": "trigger-jenkins",
	  "name": "Trigger Jenkins Pipeline",
	  "type": "n8n-nodes-base.httpRequest",
	  "position": [900, 400],
	  "credentials": {
		"httpBasicAuth": {
		  "id": "jenkins-service-account",
		  "name": "Jenkins Service Account"
		}
	  }
	}
  ],
  "connections": {
	"Git Webhook Receiver": {
	  "main": [
		[
		  {
			"node": "Process Git Event",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	},
	"Process Git Event": {
	  "main": [
		[
		  {
			"node": "Requires Approval?",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	},
	"Requires Approval?": {
	  "main": [
		[
		  {
			"node": "Request Approval",
			"type": "main",
			"index": 0
		  }
		],
		[
		  {
			"node": "Trigger Jenkins Pipeline",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	}
  }
}

{
  "name": "Enterprise CI/CD Orchestrator",
  "nodes": [
	{
	  "parameters": {
		"path": "cicd-orchestrator",
		"options": {
		  "responseMode": "onReceived",
		  "responseData": "firstEntryJson"
		},
		"httpMethod": "POST"
	  },
	  "id": "git-webhook-receiver",
	  "name": "Git Webhook Receiver",
	  "type": "n8n-nodes-base.webhook",
	  "position": [240, 300]
	},
	{
	  "parameters": {
		"jsCode": "// Advanced Git Event Processing and Routing Logic\nconst payload = $input.first().json;\n\n// Validate webhook payload\nif (!payload.repository || !payload.head_commit || !payload.ref) {\n  throw new Error('Invalid webhook payload: missing required fields');\n}\n\n// Extract branch information\nconst fullRef = payload.ref;\nconst branch = fullRef.replace('refs/heads/', '');\nconst isMainBranch = branch === 'main' || branch === 'master';\nconst isReleaseBranch = branch.startsWith('release/');\nconst isHotfixBranch = branch.startsWith('hotfix/');\nconst isFeatureBranch = branch.startsWith('feature/');\n\n// Repository analysis\nconst repository = {\n  name: payload.repository.name,\n  fullName: payload.repository.full_name,\n  owner: payload.repository.owner.login,\n  url: payload.repository.html_url,\n  isPrivate: payload.repository.private\n};\n\n// Commit analysis\nconst commit = {\n  sha: payload.head_commit.id,\n  shortSha: payload.head_commit.id.substring(0, 8),\n  message: payload.head_commit.message,\n  author: {\n    name: payload.head_commit.author.name,\n    email: payload.head_commit.author.email\n  },\n  timestamp: payload.head_commit.timestamp,\n  url: payload.head_commit.url\n};\n\n// Determine deployment strategy\nlet deploymentStrategy = {\n  environment: 'development',\n  requiresApproval: false,\n  runTests: true,\n  deployToProduction: false,\n  notificationChannels: ['#dev-notifications'],\n  parallelPipelines: ['unit-tests', 'linting'],\n  postDeployActions: ['basic-health-check']\n};\n\n// Main/Master branch - Production deployment\nif (isMainBranch) {\n  deploymentStrategy = {\n    environment: 'production',\n    requiresApproval: true,\n    runTests: true,\n    deployToProduction: true,\n    notificationChannels: ['#deployments', '#general'],\n    parallelPipelines: ['unit-tests', 'integration-tests', 'security-scan', 'performance-tests'],\n    postDeployActions: ['health-check', 'smoke-tests', 'monitoring-setup', 'backup-verification']\n  };\n}\n\n// Release branch - Staging deployment\nelse if (isReleaseBranch) {\n  const releaseVersion = branch.replace('release/', '');\n  deploymentStrategy = {\n    environment: 'staging',\n    requiresApproval: false,\n    runTests: true,\n    deployToProduction: false,\n    releaseVersion: releaseVersion,\n    notificationChannels: ['#staging-deployments', '#qa-team'],\n    parallelPipelines: ['unit-tests', 'integration-tests', 'e2e-tests'],\n    postDeployActions: ['health-check', 'qa-notification', 'staging-data-refresh']\n  };\n}\n\n// Hotfix branch - Emergency deployment\nelse if (isHotfixBranch) {\n  deploymentStrategy = {\n    environment: 'production',\n    requiresApproval: true,\n    runTests: true,\n    deployToProduction: true,\n    isHotfix: true,\n    notificationChannels: ['#critical-deployments', '#oncall'],\n    parallelPipelines: ['unit-tests', 'critical-integration-tests'],\n    postDeployActions: ['immediate-health-check', 'rollback-plan-verification', 'incident-update']\n  };\n}\n\n// Feature branch - Development deployment\nelse if (isFeatureBranch) {\n  deploymentStrategy = {\n    environment: 'development',\n    requiresApproval: false,\n    runTests: true,\n    deployToProduction: false,\n    featureName: branch.replace('feature/', ''),\n    notificationChannels: ['#dev-notifications'],\n    parallelPipelines: ['unit-tests', 'linting', 'security-scan'],\n    postDeployActions: ['basic-health-check']\n  };\n}\n\n// Build comprehensive deployment context\nconst deploymentContext = {\n  // Basic Information\n  timestamp: new Date().toISOString(),\n  workflowRunId: generateUUID(),\n  triggeredBy: 'git-webhook',\n  \n  // Repository Context\n  repository: repository,\n  commit: commit,\n  branch: {\n    name: branch,\n    fullRef: fullRef,\n    type: {\n      isMain: isMainBranch,\n      isRelease: isReleaseBranch,\n      isHotfix: isHotfixBranch,\n      isFeature: isFeatureBranch\n    }\n  },\n  \n  // Deployment Strategy\n  deployment: deploymentStrategy,\n  \n  // Pipeline Configuration\n  pipelines: {\n    jenkins: {\n      enabled: true,\n      jobName: `${repository.name}-${deploymentStrategy.environment}`,\n      parameters: {\n        GIT_COMMIT: commit.sha,\n        GIT_BRANCH: branch,\n        ENVIRONMENT: deploymentStrategy.environment,\n        RUN_TESTS: deploymentStrategy.runTests.toString(),\n        DEPLOY_TO_PROD: deploymentStrategy.deployToProduction.toString()\n      }\n    },\n    gitlabCI: {\n      enabled: repository.isPrivate,\n      projectId: payload.repository.id,\n      ref: branch,\n      variables: {\n        DEPLOYMENT_ENV: deploymentStrategy.environment,\n        COMMIT_SHA: commit.sha\n      }\n    },\n    ansible: {\n      enabled: deploymentStrategy.deployToProduction,\n      playbook: `deploy-${repository.name}.yml`,\n      inventory: deploymentStrategy.environment,\n      extraVars: {\n        app_version: commit.shortSha,\n        deployment_timestamp: new Date().toISOString()\n      }\n    }\n  },\n  \n  // Monitoring and Notifications\n  monitoring: {\n    setupRequired: deploymentStrategy.deployToProduction,\n    healthCheckEndpoints: [\n      `https://${repository.name}-${deploymentStrategy.environment}.company.com/health`,\n      `https://${repository.name}-${deploymentStrategy.environment}.company.com/metrics`\n    ],\n    alertingRules: deploymentStrategy.deployToProduction ? 'production' : 'development'\n  },\n  \n  // Approval Workflow\n  approval: {\n    required: deploymentStrategy.requiresApproval,\n    approvers: deploymentStrategy.deployToProduction ? \n      ['devops-lead@company.com', 'tech-lead@company.com'] : [],\n    timeoutMinutes: 30\n  }\n};\n\n// Helper function for UUID generation\nfunction generateUUID() {\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {\n    const r = Math.random() * 16 | 0;\n    const v = c === 'x' ? r : (r & 0x3 | 0x8);\n    return v.toString(16);\n  });\n}\n\nreturn [{ json: deploymentContext }];"
	  },
	  "id": "git-event-processor",
	  "name": "Process Git Event",
	  "type": "n8n-nodes-base.code",
	  "position": [460, 300]
	},
	{
	  "parameters": {
		"conditions": {
		  "options": {
			"caseSensitive": true,
			"leftValue": "",
			"typeValidation": "strict"
		  },
		  "conditions": [
			{
			  "leftValue": "={{ $json.approval.required }}",
			  "rightValue": true,
			  "operator": {
				"type": "boolean"
			  }
			}
		  ]
		}
	  },
	  "id": "approval-gate",
	  "name": "Requires Approval?",
	  "type": "n8n-nodes-base.if",
	  "position": [680, 300]
	},
	{
	  "parameters": {
		"resource": "message",
		"operation": "postToChannel",
		"channel": "#deployment-approvals",
		"text": "🚀 **Deployment Approval Required**\n\n**Repository:** {{ $json.repository.fullName }}\n**Branch:** {{ $json.branch.name }}\n**Commit:** {{ $json.commit.shortSha }} - {{ $json.commit.message }}\n**Environment:** {{ $json.deployment.environment }}\n**Author:** {{ $json.commit.author.name }}\n\n**Approvers:** {{ $json.approval.approvers.join(', ') }}\n\n[View Commit]({{ $json.commit.url }}) | [Pipeline Details](https://n8n.company.com/workflow/{{ $workflow.id }}/executions/{{ $execution.id }})\n\n**React with ✅ to approve, ❌ to reject**",
		"attachments": [],
		"otherOptions": {
		  "includeLinkToWorkflow": true
		}
	  },
	  "id": "approval-request",
	  "name": "Request Approval",
	  "type": "n8n-nodes-base.slack",
	  "position": [900, 200],
	  "credentials": {
		"slackApi": {
		  "id": "slack-bot-token",
		  "name": "Slack Bot Token"
		}
	  }
	},
	{
	  "parameters": {
		"url": "https://jenkins.company.com/job/{{ $json.pipelines.jenkins.jobName }}/buildWithParameters",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpBasicAuth",
		"sendQuery": true,
		"queryParameters": {
		  "parameters": [
			{
			  "name": "GIT_COMMIT",
			  "value": "={{ $json.pipelines.jenkins.parameters.GIT_COMMIT }}"
			},
			{
			  "name": "GIT_BRANCH",
			  "value": "={{ $json.pipelines.jenkins.parameters.GIT_BRANCH }}"
			},
			{
			  "name": "ENVIRONMENT",
			  "value": "={{ $json.pipelines.jenkins.parameters.ENVIRONMENT }}"
			},
			{
			  "name": "RUN_TESTS",
			  "value": "={{ $json.pipelines.jenkins.parameters.RUN_TESTS }}"
			},
			{
			  "name": "N8N_CALLBACK_URL",
			  "value": "https://n8n.company.com/webhook/jenkins-callback/{{ $json.workflowRunId }}"
			}
		  ]
		},
		"options": {
		  "response": {
			"response": {
			  "responseFormat": "json"
			}
		  },
		  "timeout": 30000
		}
	  },
	  "id": "trigger-jenkins",
	  "name": "Trigger Jenkins Pipeline",
	  "type": "n8n-nodes-base.httpRequest",
	  "position": [900, 400],
	  "credentials": {
		"httpBasicAuth": {
		  "id": "jenkins-service-account",
		  "name": "Jenkins Service Account"
		}
	  }
	}
  ],
  "connections": {
	"Git Webhook Receiver": {
	  "main": [
		[
		  {
			"node": "Process Git Event",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	},
	"Process Git Event": {
	  "main": [
		[
		  {
			"node": "Requires Approval?",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	},
	"Requires Approval?": {
	  "main": [
		[
		  {
			"node": "Request Approval",
			"type": "main",
			"index": 0
		  }
		],
		[
		  {
			"node": "Trigger Jenkins Pipeline",
			"type": "main",
			"index": 0
		  }
		]
	  ]
	}
  }
}

JSON

GitOps-Integration mit n8n:

GitOps ist mehr als nur „Git als Single Source of Truth“ – es ist ein komplettes Delivery-Model. n8n kann als GitOps Controller fungieren und automatisch auf Änderungen in Git-Repositories reagieren, um Infrastructure-Updates, Application-Deployments und Configuration-Changes zu orchestrieren.

#!/bin/bash
# gitops-sync-controller.sh - n8n-basierter GitOps Controller

set -euo pipefail

# GitOps Repository Struktur:
# gitops-repo/
# ├── applications/
# │   ├── production/
# │   ├── staging/
# │   └── development/
# ├── infrastructure/
# │   ├── kubernetes/
# │   ├── terraform/
# │   └── ansible/
# └── configurations/
#     ├── monitoring/
#     ├── logging/
#     └── security/

GITOPS_REPO_URL="https://github.com/company/gitops-infrastructure.git"
GITOPS_LOCAL_PATH="/tmp/gitops-sync"
N8N_WEBHOOK_BASE="https://n8n.company.com/webhook"

# Function: Clone and analyze GitOps repository
analyze_gitops_changes() {
  local commit_sha="$1"
  local previous_sha="$2"
  
  # Clone repository and checkout specific commit
  git clone "$GITOPS_REPO_URL" "$GITOPS_LOCAL_PATH"
  cd "$GITOPS_LOCAL_PATH"
  git checkout "$commit_sha"
  
  # Analyze changed files
  local changed_files
  changed_files=$(git diff --name-only "$previous_sha" "$commit_sha")
  
  # Categorize changes
  local infrastructure_changes=()
  local application_changes=()
  local config_changes=()
  
  while IFS= read -r file; do
	if [[ "$file" == infrastructure/* ]]; then
	  infrastructure_changes+=("$file")
	elif [[ "$file" == applications/* ]]; then
	  application_changes+=("$file")
	elif [[ "$file" == configurations/* ]]; then
	  config_changes+=("$file")
	fi
  done <<< "$changed_files"
  
  # Generate deployment plan
  cat << EOF > deployment-plan.json
{
  "commitSha": "$commit_sha",
  "previousSha": "$previous_sha",
  "timestamp": "$(date -Iseconds)",
  "changes": {
	"infrastructure": $(printf '%s\n' "${infrastructure_changes[@]}" | jq -R . | jq -s .),
	"applications": $(printf '%s\n' "${application_changes[@]}" | jq -R . | jq -s .),
	"configurations": $(printf '%s\n' "${config_changes[@]}" | jq -R . | jq -s .)
  },
  "deploymentOrder": [
	"infrastructure",
	"configurations", 
	"applications"
  ]
}
EOF

  echo "deployment-plan.json"
}

# Function: Trigger n8n GitOps workflows
trigger_gitops_workflows() {
  local deployment_plan="$1"
  
  # Trigger infrastructure updates
  if [[ $(jq '.changes.infrastructure | length' "$deployment_plan") -gt 0 ]]; then
	curl -X POST "$N8N_WEBHOOK_BASE/gitops-infrastructure" \
	  -H "Content-Type: application/json" \
	  -d @"$deployment_plan"
  fi
  
  # Trigger configuration updates
  if [[ $(jq '.changes.configurations | length' "$deployment_plan") -gt 0 ]]; then
	curl -X POST "$N8N_WEBHOOK_BASE/gitops-configurations" \
	  -H "Content-Type: application/json" \
	  -d @"$deployment_plan"
  fi
  
  # Trigger application deployments
  if [[ $(jq '.changes.applications | length' "$deployment_plan") -gt 0 ]]; then
	curl -X POST "$N8N_WEBHOOK_BASE/gitops-applications" \
	  -H "Content-Type: application/json" \
	  -d @"$deployment_plan"
  fi
}

# Main execution
main() {
  local commit_sha="${1:-HEAD}"
  local previous_sha="${2:-HEAD~1}"
  
  echo "🔄 Starting GitOps sync for commit: $commit_sha"
  
  # Analyze changes
  local deployment_plan
  deployment_plan=$(analyze_gitops_changes "$commit_sha" "$previous_sha")
  
  # Trigger workflows
  trigger_gitops_workflows "$deployment_plan"
  
  # Cleanup
  rm -rf "$GITOPS_LOCAL_PATH"
  
  echo "✅ GitOps sync completed"
}

# Execute if called directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
  main "$@"
fi

#!/bin/bash
# gitops-sync-controller.sh - n8n-basierter GitOps Controller

set -euo pipefail

# GitOps Repository Struktur:
# gitops-repo/
# ├── applications/
# │   ├── production/
# │   ├── staging/
# │   └── development/
# ├── infrastructure/
# │   ├── kubernetes/
# │   ├── terraform/
# │   └── ansible/
# └── configurations/
#     ├── monitoring/
#     ├── logging/
#     └── security/

GITOPS_REPO_URL="https://github.com/company/gitops-infrastructure.git"
GITOPS_LOCAL_PATH="/tmp/gitops-sync"
N8N_WEBHOOK_BASE="https://n8n.company.com/webhook"

# Function: Clone and analyze GitOps repository
analyze_gitops_changes() {
  local commit_sha="$1"
  local previous_sha="$2"
  
  # Clone repository and checkout specific commit
  git clone "$GITOPS_REPO_URL" "$GITOPS_LOCAL_PATH"
  cd "$GITOPS_LOCAL_PATH"
  git checkout "$commit_sha"
  
  # Analyze changed files
  local changed_files
  changed_files=$(git diff --name-only "$previous_sha" "$commit_sha")
  
  # Categorize changes
  local infrastructure_changes=()
  local application_changes=()
  local config_changes=()
  
  while IFS= read -r file; do
	if [[ "$file" == infrastructure/* ]]; then
	  infrastructure_changes+=("$file")
	elif [[ "$file" == applications/* ]]; then
	  application_changes+=("$file")
	elif [[ "$file" == configurations/* ]]; then
	  config_changes+=("$file")
	fi
  done <<< "$changed_files"
  
  # Generate deployment plan
  cat << EOF > deployment-plan.json
{
  "commitSha": "$commit_sha",
  "previousSha": "$previous_sha",
  "timestamp": "$(date -Iseconds)",
  "changes": {
	"infrastructure": $(printf '%s\n' "${infrastructure_changes[@]}" | jq -R . | jq -s .),
	"applications": $(printf '%s\n' "${application_changes[@]}" | jq -R . | jq -s .),
	"configurations": $(printf '%s\n' "${config_changes[@]}" | jq -R . | jq -s .)
  },
  "deploymentOrder": [
	"infrastructure",
	"configurations", 
	"applications"
  ]
}
EOF

  echo "deployment-plan.json"
}

# Function: Trigger n8n GitOps workflows
trigger_gitops_workflows() {
  local deployment_plan="$1"
  
  # Trigger infrastructure updates
  if [[ $(jq '.changes.infrastructure | length' "$deployment_plan") -gt 0 ]]; then
	curl -X POST "$N8N_WEBHOOK_BASE/gitops-infrastructure" \
	  -H "Content-Type: application/json" \
	  -d @"$deployment_plan"
  fi
  
  # Trigger configuration updates
  if [[ $(jq '.changes.configurations | length' "$deployment_plan") -gt 0 ]]; then
	curl -X POST "$N8N_WEBHOOK_BASE/gitops-configurations" \
	  -H "Content-Type: application/json" \
	  -d @"$deployment_plan"
  fi
  
  # Trigger application deployments
  if [[ $(jq '.changes.applications | length' "$deployment_plan") -gt 0 ]]; then
	curl -X POST "$N8N_WEBHOOK_BASE/gitops-applications" \
	  -H "Content-Type: application/json" \
	  -d @"$deployment_plan"
  fi
}

# Main execution
main() {
  local commit_sha="${1:-HEAD}"
  local previous_sha="${2:-HEAD~1}"
  
  echo "🔄 Starting GitOps sync for commit: $commit_sha"
  
  # Analyze changes
  local deployment_plan
  deployment_plan=$(analyze_gitops_changes "$commit_sha" "$previous_sha")
  
  # Trigger workflows
  trigger_gitops_workflows "$deployment_plan"
  
  # Cleanup
  rm -rf "$GITOPS_LOCAL_PATH"
  
  echo "✅ GitOps sync completed"
}

# Execute if called directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
  main "$@"
fi

Bash

💡 GitOps Best Practice: Verwende separate n8n-Workflows für Infrastructure, Configuration und Application Updates. Das ermöglicht granulare Kontrolle und reduziert das Risiko von Deployment-Cascades.

Multi-Environment Deployment Pipeline:

{
  "name": "GitOps Multi-Environment Deployment",
  "nodes": [
	{
	  "parameters": {
		"path": "gitops-infrastructure",
		"httpMethod": "POST"
	  },
	  "name": "GitOps Infrastructure Webhook",
	  "type": "n8n-nodes-base.webhook",
	  "position": [240, 300]
	},
	{
	  "parameters": {
		"jsCode": "// Infrastructure Deployment Orchestration\nconst deploymentPlan = $input.first().json;\nconst infraChanges = deploymentPlan.changes.infrastructure;\n\n// Analyze infrastructure changes\nconst terraformChanges = infraChanges.filter(file => file.includes('terraform/'));\nconst kubernetesChanges = infraChanges.filter(file => file.includes('kubernetes/'));\nconst ansibleChanges = infraChanges.filter(file => file.includes('ansible/'));\n\n// Determine deployment environments\nlet environments = [];\ninfraChanges.forEach(file => {\n  if (file.includes('/production/')) environments.push('production');\n  if (file.includes('/staging/')) environments.push('staging');\n  if (file.includes('/development/')) environments.push('development');\n});\n\n// Remove duplicates\nenvironments = [...new Set(environments)];\n\n// Create deployment tasks\nconst deploymentTasks = [];\n\n// Terraform deployments\nif (terraformChanges.length > 0) {\n  environments.forEach(env => {\n    deploymentTasks.push({\n      type: 'terraform',\n      environment: env,\n      files: terraformChanges.filter(f => f.includes(`/${env}/`)),\n      priority: 1, // Infrastructure first\n      requiresApproval: env === 'production'\n    });\n  });\n}\n\n// Kubernetes deployments\nif (kubernetesChanges.length > 0) {\n  environments.forEach(env => {\n    deploymentTasks.push({\n      type: 'kubernetes',\n      environment: env,\n      files: kubernetesChanges.filter(f => f.includes(`/${env}/`)),\n      priority: 2, // After infrastructure\n      requiresApproval: env === 'production'\n    });\n  });\n}\n\n// Ansible configurations\nif (ansibleChanges.length > 0) {\n  environments.forEach(env => {\n    deploymentTasks.push({\n      type: 'ansible',\n      environment: env,\n      files: ansibleChanges.filter(f => f.includes(`/${env}/`)),\n      priority: 3, // After Kubernetes\n      requiresApproval: false\n    });\n  });\n}\n\n// Sort by priority\ndeploymentTasks.sort((a, b) => a.priority - b.priority);\n\nreturn deploymentTasks.map((task, index) => ({\n  json: {\n    ...deploymentPlan,\n    deploymentTask: task,\n    taskIndex: index,\n    totalTasks: deploymentTasks.length\n  }\n}));"
	  },
	  "name": "Plan Infrastructure Deployment",
	  "type": "n8n-nodes-base.code",
	  "position": [460, 300]
	},
	{
	  "parameters": {
		"conditions": {
		  "conditions": [
			{
			  "leftValue": "={{ $json.deploymentTask.type }}",
			  "rightValue": "terraform",
			  "operator": {
				"type": "string"
			  }
			}
		  ]
		}
	  },
	  "name": "Is Terraform Deployment?",
	  "type": "n8n-nodes-base.if",
	  "position": [680, 300]
	},
	{
	  "parameters": {
		"url": "https://terraform-cloud.company.com/api/v2/runs",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpHeaderAuth",
		"sendHeaders": true,
		"headerParameters": {
		  "parameters": [
			{
			  "name": "Authorization",
			  "value": "Bearer {{ $credentials.terraformCloud.token }}"
			},
			{
			  "name": "Content-Type",
			  "value": "application/vnd.api+json"
			}
		  ]
		},
		"sendBody": true,
		"bodyParameters": {
		  "parameters": [
			{
			  "name": "data",
			  "value": "={\n  \"type\": \"runs\",\n  \"attributes\": {\n    \"message\": \"GitOps deployment - commit {{ $json.commitSha }}\",\n    \"is-destroy\": false,\n    \"auto-apply\": {{ $json.deploymentTask.environment !== 'production' }}\n  },\n  \"relationships\": {\n    \"workspace\": {\n      \"data\": {\n        \"type\": \"workspaces\",\n        \"id\": \"{{ $json.deploymentTask.environment }}-workspace-id\"\n      }\n    }\n  }\n}"
			}
		  ]
		},
		"options": {
		  "response": {
			"response": {
			  "responseFormat": "json"
			}
		  }
		}
	  },
	  "name": "Execute Terraform Run",
	  "type": "n8n-nodes-base.httpRequest",
	  "position": [900, 200],
	  "credentials": {
		"httpHeaderAuth": {
		  "id": "terraform-cloud-api",
		  "name": "Terraform Cloud API"
		}
	  }
	}
  ]
}

{
  "name": "GitOps Multi-Environment Deployment",
  "nodes": [
	{
	  "parameters": {
		"path": "gitops-infrastructure",
		"httpMethod": "POST"
	  },
	  "name": "GitOps Infrastructure Webhook",
	  "type": "n8n-nodes-base.webhook",
	  "position": [240, 300]
	},
	{
	  "parameters": {
		"jsCode": "// Infrastructure Deployment Orchestration\nconst deploymentPlan = $input.first().json;\nconst infraChanges = deploymentPlan.changes.infrastructure;\n\n// Analyze infrastructure changes\nconst terraformChanges = infraChanges.filter(file => file.includes('terraform/'));\nconst kubernetesChanges = infraChanges.filter(file => file.includes('kubernetes/'));\nconst ansibleChanges = infraChanges.filter(file => file.includes('ansible/'));\n\n// Determine deployment environments\nlet environments = [];\ninfraChanges.forEach(file => {\n  if (file.includes('/production/')) environments.push('production');\n  if (file.includes('/staging/')) environments.push('staging');\n  if (file.includes('/development/')) environments.push('development');\n});\n\n// Remove duplicates\nenvironments = [...new Set(environments)];\n\n// Create deployment tasks\nconst deploymentTasks = [];\n\n// Terraform deployments\nif (terraformChanges.length > 0) {\n  environments.forEach(env => {\n    deploymentTasks.push({\n      type: 'terraform',\n      environment: env,\n      files: terraformChanges.filter(f => f.includes(`/${env}/`)),\n      priority: 1, // Infrastructure first\n      requiresApproval: env === 'production'\n    });\n  });\n}\n\n// Kubernetes deployments\nif (kubernetesChanges.length > 0) {\n  environments.forEach(env => {\n    deploymentTasks.push({\n      type: 'kubernetes',\n      environment: env,\n      files: kubernetesChanges.filter(f => f.includes(`/${env}/`)),\n      priority: 2, // After infrastructure\n      requiresApproval: env === 'production'\n    });\n  });\n}\n\n// Ansible configurations\nif (ansibleChanges.length > 0) {\n  environments.forEach(env => {\n    deploymentTasks.push({\n      type: 'ansible',\n      environment: env,\n      files: ansibleChanges.filter(f => f.includes(`/${env}/`)),\n      priority: 3, // After Kubernetes\n      requiresApproval: false\n    });\n  });\n}\n\n// Sort by priority\ndeploymentTasks.sort((a, b) => a.priority - b.priority);\n\nreturn deploymentTasks.map((task, index) => ({\n  json: {\n    ...deploymentPlan,\n    deploymentTask: task,\n    taskIndex: index,\n    totalTasks: deploymentTasks.length\n  }\n}));"
	  },
	  "name": "Plan Infrastructure Deployment",
	  "type": "n8n-nodes-base.code",
	  "position": [460, 300]
	},
	{
	  "parameters": {
		"conditions": {
		  "conditions": [
			{
			  "leftValue": "={{ $json.deploymentTask.type }}",
			  "rightValue": "terraform",
			  "operator": {
				"type": "string"
			  }
			}
		  ]
		}
	  },
	  "name": "Is Terraform Deployment?",
	  "type": "n8n-nodes-base.if",
	  "position": [680, 300]
	},
	{
	  "parameters": {
		"url": "https://terraform-cloud.company.com/api/v2/runs",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpHeaderAuth",
		"sendHeaders": true,
		"headerParameters": {
		  "parameters": [
			{
			  "name": "Authorization",
			  "value": "Bearer {{ $credentials.terraformCloud.token }}"
			},
			{
			  "name": "Content-Type",
			  "value": "application/vnd.api+json"
			}
		  ]
		},
		"sendBody": true,
		"bodyParameters": {
		  "parameters": [
			{
			  "name": "data",
			  "value": "={\n  \"type\": \"runs\",\n  \"attributes\": {\n    \"message\": \"GitOps deployment - commit {{ $json.commitSha }}\",\n    \"is-destroy\": false,\n    \"auto-apply\": {{ $json.deploymentTask.environment !== 'production' }}\n  },\n  \"relationships\": {\n    \"workspace\": {\n      \"data\": {\n        \"type\": \"workspaces\",\n        \"id\": \"{{ $json.deploymentTask.environment }}-workspace-id\"\n      }\n    }\n  }\n}"
			}
		  ]
		},
		"options": {
		  "response": {
			"response": {
			  "responseFormat": "json"
			}
		  }
		}
	  },
	  "name": "Execute Terraform Run",
	  "type": "n8n-nodes-base.httpRequest",
	  "position": [900, 200],
	  "credentials": {
		"httpHeaderAuth": {
		  "id": "terraform-cloud-api",
		  "name": "Terraform Cloud API"
		}
	  }
	}
  ]
}

JSON

Continuous Compliance Integration:

Eine kritische Komponente moderner CI/CD-Pipelines ist Continuous Compliance – die automatisierte Überprüfung von Security- und Compliance-Anforderungen. n8n kann diese Checks orchestrieren und sicherstellen, dass alle Deployments den Unternehmensrichtlinien entsprechen.

# compliance-gate-workflow.sh - Compliance Checks als Code
#!/bin/bash

set -euo pipefail

COMPLIANCE_CONFIG="/opt/compliance/rules.yaml"
SCAN_RESULTS_DIR="/tmp/compliance-scans"
N8N_CALLBACK_URL="https://n8n.company.com/webhook/compliance-results"

# Compliance-Kategorien
declare -A COMPLIANCE_TOOLS=(
  ["security"]="trivy,clair,snyk"
  ["quality"]="sonarqube,codeclimate"
  ["performance"]="k6,lighthouse"
  ["accessibility"]="axe,wave"
  ["legal"]="fossa,whitesource"
)

run_compliance_scans() {
  local deployment_context="$1"
  local environment=$(echo "$deployment_context" | jq -r '.deployment.environment')
  
  mkdir -p "$SCAN_RESULTS_DIR"
  
  # Security Scans
  echo "🔒 Running security compliance scans..."
  
  # Container Security Scan
  trivy image --format json --output "$SCAN_RESULTS_DIR/trivy.json" \
	"registry.company.com/app:$(echo "$deployment_context" | jq -r '.commit.shortSha')"
  
  # Dependency Vulnerability Scan
  snyk test --json > "$SCAN_RESULTS_DIR/snyk.json" || true
  
  # Infrastructure Security Scan
  checkov --framework terraform --output json \
	--output-file "$SCAN_RESULTS_DIR/checkov.json" \
	"./infrastructure/$environment/" || true
  
  # Quality Scans
  echo "📊 Running quality compliance scans..."
  
  # Code Quality
  sonar-scanner \
	-Dsonar.projectKey="$(echo "$deployment_context" | jq -r '.repository.name')" \
	-Dsonar.sources=./src \
	-Dsonar.host.url="https://sonarqube.company.com" \
	-Dsonar.login="$SONAR_TOKEN" \
	-Dsonar.scm.revision="$(echo "$deployment_context" | jq -r '.commit.sha')" \
	-Dsonar.analysis.mode=publish \
	-Dsonar.report.export.path="$SCAN_RESULTS_DIR/sonarqube.json"
  
  # Performance Scans (for production deployments)
  if [[ "$environment" == "production" ]]; then
	echo "⚡ Running performance compliance scans..."
	
	# Load Testing
	k6 run --out json="$SCAN_RESULTS_DIR/k6.json" \
	  "./tests/performance/load-test.js"
  fi
  
  # Aggregate results
  generate_compliance_report "$deployment_context"
}

generate_compliance_report() {
  local deployment_context="$1"
  
  cat << EOF > "$SCAN_RESULTS_DIR/compliance-report.json"
{
  "timestamp": "$(date -Iseconds)",
  "deploymentContext": $deployment_context,
  "complianceResults": {
	"security": {
	  "trivy": $(cat "$SCAN_RESULTS_DIR/trivy.json" 2>/dev/null || echo "null"),
	  "snyk": $(cat "$SCAN_RESULTS_DIR/snyk.json" 2>/dev/null || echo "null"),
	  "checkov": $(cat "$SCAN_RESULTS_DIR/checkov.json" 2>/dev/null || echo "null")
	},
	"quality": {
	  "sonarqube": $(cat "$SCAN_RESULTS_DIR/sonarqube.json" 2>/dev/null || echo "null")
	},
	"performance": {
	  "k6": $(cat "$SCAN_RESULTS_DIR/k6.json" 2>/dev/null || echo "null")
	}
  },
  "complianceStatus": "$(determine_compliance_status)",
  "gateDecision": "$(determine_gate_decision)"
}
EOF

  # Send results to n8n for further processing
  curl -X POST "$N8N_CALLBACK_URL" \
	-H "Content-Type: application/json" \
	-d @"$SCAN_RESULTS_DIR/compliance-report.json"
}

determine_compliance_status() {
  # Implement complex compliance logic
  echo "COMPLIANT" # Simplified for example
}

determine_gate_decision() {
  # Determine if deployment can proceed
  echo "PROCEED" # Simplified for example
}

# Execute compliance scans
run_compliance_scans "$1"

# compliance-gate-workflow.sh - Compliance Checks als Code
#!/bin/bash

set -euo pipefail

COMPLIANCE_CONFIG="/opt/compliance/rules.yaml"
SCAN_RESULTS_DIR="/tmp/compliance-scans"
N8N_CALLBACK_URL="https://n8n.company.com/webhook/compliance-results"

# Compliance-Kategorien
declare -A COMPLIANCE_TOOLS=(
  ["security"]="trivy,clair,snyk"
  ["quality"]="sonarqube,codeclimate"
  ["performance"]="k6,lighthouse"
  ["accessibility"]="axe,wave"
  ["legal"]="fossa,whitesource"
)

run_compliance_scans() {
  local deployment_context="$1"
  local environment=$(echo "$deployment_context" | jq -r '.deployment.environment')
  
  mkdir -p "$SCAN_RESULTS_DIR"
  
  # Security Scans
  echo "🔒 Running security compliance scans..."
  
  # Container Security Scan
  trivy image --format json --output "$SCAN_RESULTS_DIR/trivy.json" \
	"registry.company.com/app:$(echo "$deployment_context" | jq -r '.commit.shortSha')"
  
  # Dependency Vulnerability Scan
  snyk test --json > "$SCAN_RESULTS_DIR/snyk.json" || true
  
  # Infrastructure Security Scan
  checkov --framework terraform --output json \
	--output-file "$SCAN_RESULTS_DIR/checkov.json" \
	"./infrastructure/$environment/" || true
  
  # Quality Scans
  echo "📊 Running quality compliance scans..."
  
  # Code Quality
  sonar-scanner \
	-Dsonar.projectKey="$(echo "$deployment_context" | jq -r '.repository.name')" \
	-Dsonar.sources=./src \
	-Dsonar.host.url="https://sonarqube.company.com" \
	-Dsonar.login="$SONAR_TOKEN" \
	-Dsonar.scm.revision="$(echo "$deployment_context" | jq -r '.commit.sha')" \
	-Dsonar.analysis.mode=publish \
	-Dsonar.report.export.path="$SCAN_RESULTS_DIR/sonarqube.json"
  
  # Performance Scans (for production deployments)
  if [[ "$environment" == "production" ]]; then
	echo "⚡ Running performance compliance scans..."
	
	# Load Testing
	k6 run --out json="$SCAN_RESULTS_DIR/k6.json" \
	  "./tests/performance/load-test.js"
  fi
  
  # Aggregate results
  generate_compliance_report "$deployment_context"
}

generate_compliance_report() {
  local deployment_context="$1"
  
  cat << EOF > "$SCAN_RESULTS_DIR/compliance-report.json"
{
  "timestamp": "$(date -Iseconds)",
  "deploymentContext": $deployment_context,
  "complianceResults": {
	"security": {
	  "trivy": $(cat "$SCAN_RESULTS_DIR/trivy.json" 2>/dev/null || echo "null"),
	  "snyk": $(cat "$SCAN_RESULTS_DIR/snyk.json" 2>/dev/null || echo "null"),
	  "checkov": $(cat "$SCAN_RESULTS_DIR/checkov.json" 2>/dev/null || echo "null")
	},
	"quality": {
	  "sonarqube": $(cat "$SCAN_RESULTS_DIR/sonarqube.json" 2>/dev/null || echo "null")
	},
	"performance": {
	  "k6": $(cat "$SCAN_RESULTS_DIR/k6.json" 2>/dev/null || echo "null")
	}
  },
  "complianceStatus": "$(determine_compliance_status)",
  "gateDecision": "$(determine_gate_decision)"
}
EOF

  # Send results to n8n for further processing
  curl -X POST "$N8N_CALLBACK_URL" \
	-H "Content-Type: application/json" \
	-d @"$SCAN_RESULTS_DIR/compliance-report.json"
}

determine_compliance_status() {
  # Implement complex compliance logic
  echo "COMPLIANT" # Simplified for example
}

determine_gate_decision() {
  # Determine if deployment can proceed
  echo "PROCEED" # Simplified for example
}

# Execute compliance scans
run_compliance_scans "$1"

Bash

⚠️ Compliance Performance Impact: Compliance-Scans können die Pipeline-Zeit erheblich verlängern. Implementiere parallele Ausführung und Cache-Mechanismen für wiederkehrende Scans.

Infrastructure as Code mit n8n-Workflows

Infrastructure as Code (IaC) und n8n ergänzen sich perfekt. n8n kann als IaC Orchestrator fungieren und komplexe Infrastructure-Deployments koordinieren, die mehrere Tools wie Terraform, Ansible und Helm umfassen. Die event-driven Architektur von n8n ermöglicht es, Infrastructure-Changes als Reaktion auf Application-Deployments, Monitoring-Alerts oder Business-Events zu triggern.

n8n als IaC Orchestration Layer:

Traditionelle IaC-Tools sind hervorragend für einzelne Infrastructure-Domains geeignet. Terraform für Cloud-Resources, Ansible für Configuration-Management, Helm für Kubernetes-Applications. n8n kann diese Tools orchestrieren und komplexe Multi-Tool-Deployments koordinieren.

┌───────────────────────────────────────────────────────┐
│            IaC Orchestration Architecture             │ 
├───────────────────────────────────────────────────────┤
│  Event Sources                                        │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │   Git       │  │ Monitoring  │  │  Manual     │    │
│  │   Changes   │  │   Alerts    │  │  Triggers   │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
└───────────────────────────────────────────────────────┘
								│
								▼
┌───────────────────────────────────────────────────────┐
│             n8n IaC Orchestrator                      │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ Dependency  │  │ Validation  │  │ Execution   │    │
│  │ Analysis    │  │ & Planning  │  │ Planning    │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
└───────────────────────────────────────────────────────┘
								│
								▼
┌───────────────────────────────────────────────────────┐
│             Parallel IaC Execution                    │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ Terraform   │  │   Ansible   │  │    Helm     │    │
│  │ (Cloud Res) │  │ (Config Mgmt│  │ (K8s Apps)  │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
└───────────────────────────────────────────────────────┘
								│
								▼
┌───────────────────────────────────────────────────────┐
│             Post-Deployment Validation                │       
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ Health      │  │ Compliance  │  │ Performance │    │  
│  │ Checks      │  │ Validation  │  │ Testing     │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
└───────────────────────────────────────────────────────┘

┌───────────────────────────────────────────────────────┐
│            IaC Orchestration Architecture             │ 
├───────────────────────────────────────────────────────┤
│  Event Sources                                        │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │   Git       │  │ Monitoring  │  │  Manual     │    │
│  │   Changes   │  │   Alerts    │  │  Triggers   │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
└───────────────────────────────────────────────────────┘
								│
								▼
┌───────────────────────────────────────────────────────┐
│             n8n IaC Orchestrator                      │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ Dependency  │  │ Validation  │  │ Execution   │    │
│  │ Analysis    │  │ & Planning  │  │ Planning    │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
└───────────────────────────────────────────────────────┘
								│
								▼
┌───────────────────────────────────────────────────────┐
│             Parallel IaC Execution                    │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ Terraform   │  │   Ansible   │  │    Helm     │    │
│  │ (Cloud Res) │  │ (Config Mgmt│  │ (K8s Apps)  │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
└───────────────────────────────────────────────────────┘
								│
								▼
┌───────────────────────────────────────────────────────┐
│             Post-Deployment Validation                │       
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ Health      │  │ Compliance  │  │ Performance │    │  
│  │ Checks      │  │ Validation  │  │ Testing     │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
└───────────────────────────────────────────────────────┘

Markdown

🔧 Advanced IaC Orchestration Workflow:

{
  "name": "Enterprise IaC Orchestrator",
  "nodes": [
	{
	  "parameters": {
		"path": "iac-orchestrator",
		"httpMethod": "POST",
		"options": {
		  "responseMode": "onReceived"
		}
	  },
	  "name": "IaC Trigger",
	  "type": "n8n-nodes-base.webhook",
	  "position": [240, 300]
	},
	{
	  "parameters": {
		"jsCode": "// Advanced Infrastructure Deployment Planning\nconst request = $input.first().json;\n\n// Validate input structure\nif (!request.infrastructure || !request.environment) {\n  throw new Error('Invalid request: missing infrastructure or environment');\n}\n\nconst infrastructure = request.infrastructure;\nconst environment = request.environment;\nconst requestedBy = request.requestedBy || 'unknown';\nconst changeReason = request.changeReason || 'Infrastructure update';\n\n// Analyze infrastructure changes\nconst infraComponents = {\n  terraform: infrastructure.terraform || [],\n  ansible: infrastructure.ansible || [],\n  helm: infrastructure.helm || [],\n  kubernetes: infrastructure.kubernetes || []\n};\n\n// Dependency Analysis\nconst dependencyGraph = {\n  // Cloud infrastructure must be created first\n  terraform: {\n    dependencies: [],\n    dependents: ['ansible', 'helm', 'kubernetes'],\n    executionOrder: 1\n  },\n  // Configuration management after infrastructure\n  ansible: {\n    dependencies: ['terraform'],\n    dependents: ['helm', 'kubernetes'],\n    executionOrder: 2\n  },\n  // Kubernetes applications after basic infrastructure\n  helm: {\n    dependencies: ['terraform', 'ansible'],\n    dependents: [],\n    executionOrder: 3\n  },\n  // Raw Kubernetes resources last\n  kubernetes: {\n    dependencies: ['terraform', 'ansible'],\n    dependents: [],\n    executionOrder: 3\n  }\n};\n\n// Risk Assessment\nlet riskLevel = 'low';\nlet requiresApproval = false;\nlet rollbackPlan = 'automatic';\n\n// Production environment increases risk\nif (environment === 'production') {\n  riskLevel = 'high';\n  requiresApproval = true;\n  rollbackPlan = 'manual';\n}\n\n// Complex changes increase risk\nconst totalChanges = Object.values(infraComponents).reduce((sum, changes) => sum + changes.length, 0);\nif (totalChanges > 10) {\n  riskLevel = 'high';\n  requiresApproval = true;\n}\n\n// Database/Storage changes are always high risk\nconst hasDataChanges = [\n  ...infraComponents.terraform,\n  ...infraComponents.ansible,\n  ...infraComponents.helm\n].some(change => \n  change.includes('database') || \n  change.includes('storage') || \n  change.includes('persistence')\n);\n\nif (hasDataChanges) {\n  riskLevel = 'critical';\n  requiresApproval = true;\n  rollbackPlan = 'manual';\n}\n\n// Generate execution plan\nconst executionPlan = {\n  planId: generateUUID(),\n  timestamp: new Date().toISOString(),\n  environment: environment,\n  requestedBy: requestedBy,\n  changeReason: changeReason,\n  \n  // Risk assessment\n  risk: {\n    level: riskLevel,\n    requiresApproval: requiresApproval,\n    rollbackPlan: rollbackPlan,\n    estimatedDuration: calculateDuration(infraComponents),\n    impactedServices: analyzeImpact(infraComponents, environment)\n  },\n  \n  // Execution phases\n  phases: generateExecutionPhases(infraComponents, dependencyGraph),\n  \n  // Validation criteria\n  validation: {\n    preDeployment: [\n      'terraform-plan-review',\n      'ansible-syntax-check',\n      'helm-template-validation',\n      'kubectl-dry-run'\n    ],\n    postDeployment: [\n      'health-check',\n      'connectivity-test',\n      'performance-baseline',\n      'security-scan'\n    ]\n  },\n  \n  // Rollback strategy\n  rollback: {\n    strategy: rollbackPlan,\n    triggers: [\n      'health-check-failure',\n      'performance-degradation',\n      'manual-trigger'\n    ],\n    timeoutMinutes: 30\n  }\n};\n\n// Helper functions\nfunction generateUUID() {\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {\n    const r = Math.random() * 16 | 0;\n    const v = c === 'x' ? r : (r & 0x3 | 0x8);\n    return v.toString(16);\n  });\n}\n\nfunction calculateDuration(components) {\n  // Estimate deployment duration based on component complexity\n  let duration = 0;\n  duration += components.terraform.length * 5; // 5 min per Terraform resource\n  duration += components.ansible.length * 3;   // 3 min per Ansible task\n  duration += components.helm.length * 2;      // 2 min per Helm chart\n  duration += components.kubernetes.length * 1; // 1 min per K8s resource\n  return Math.max(duration, 10); // Minimum 10 minutes\n}\n\nfunction analyzeImpact(components, environment) {\n  // Analyze which services might be impacted\n  const services = [];\n  \n  components.terraform.forEach(resource => {\n    if (resource.includes('database')) services.push('database-services');\n    if (resource.includes('load_balancer')) services.push('web-services');\n    if (resource.includes('cache')) services.push('cache-dependent-services');\n  });\n  \n  components.helm.forEach(chart => {\n    if (chart.includes('ingress')) services.push('external-traffic');\n    if (chart.includes('monitoring')) services.push('observability-stack');\n  });\n  \n  return [...new Set(services)];\n}\n\nfunction generateExecutionPhases(components, dependencyGraph) {\n  const phases = [];\n  \n  // Sort components by execution order\n  const sortedComponents = Object.entries(dependencyGraph)\n    .sort((a, b) => a[1].executionOrder - b[1].executionOrder)\n    .map(([tool]) => tool)\n    .filter(tool => components[tool] && components[tool].length > 0);\n  \n  sortedComponents.forEach((tool, index) => {\n    phases.push({\n      phase: index + 1,\n      tool: tool,\n      components: components[tool],\n      parallelizable: dependencyGraph[tool].executionOrder === 3, // Helm and K8s can run in parallel\n      estimatedDuration: calculateToolDuration(tool, components[tool].length)\n    });\n  });\n  \n  return phases;\n}\n\nfunction calculateToolDuration(tool, componentCount) {\n  const durations = {\n    terraform: componentCount * 5,\n    ansible: componentCount * 3,\n    helm: componentCount * 2,\n    kubernetes: componentCount * 1\n  };\n  return durations[tool] || componentCount;\n}\n\nreturn [{ json: executionPlan }];"
	  },
	  "name": "Plan Infrastructure Deployment",
	  "type": "n8n-nodes-base.code",
	  "position": [460, 300]
	},
	{
	  "parameters": {
		"conditions": {
		  "conditions": [
			{
			  "leftValue": "={{ $json.risk.requiresApproval }}",
			  "rightValue": true,
			  "operator": {
				"type": "boolean"
			  }
			}
		  ]
		}
	  },
	  "name": "Requires Approval?",
	  "type": "n8n-nodes-base.if",
	  "position": [680, 300]
	},
	{
	  "parameters": {
		"resource": "message",
		"operation": "postToChannel",
		"channel": "#infrastructure-approvals",
		"text": "🏗️ **Infrastructure Deployment Approval Required**\n\n**Environment:** {{ $json.environment }}\n**Risk Level:** {{ $json.risk.level }}\n**Requested By:** {{ $json.requestedBy }}\n**Reason:** {{ $json.changeReason }}\n\n**Estimated Duration:** {{ $json.risk.estimatedDuration }} minutes\n**Impacted Services:** {{ $json.risk.impactedServices.join(', ') }}\n\n**Deployment Phases:**\n{{ $json.phases.map(p => `${p.phase}. ${p.tool} (${p.components.length} components)`).join('\\n') }}\n\n[View Execution Plan](https://n8n.company.com/workflow/{{ $workflow.id }}/executions/{{ $execution.id }})\n\n**React with ✅ to approve, ❌ to reject**",
		"attachments": [],
		"otherOptions": {
		  "includeLinkToWorkflow": true
		}
	  },
	  "name": "Request Infrastructure Approval",
	  "type": "n8n-nodes-base.slack",
	  "position": [900, 200],
	  "credentials": {
		"slackApi": {
		  "id": "slack-bot-token",
		  "name": "Slack Bot Token"
		}
	  }
	}
  ]
}

{
  "name": "Enterprise IaC Orchestrator",
  "nodes": [
	{
	  "parameters": {
		"path": "iac-orchestrator",
		"httpMethod": "POST",
		"options": {
		  "responseMode": "onReceived"
		}
	  },
	  "name": "IaC Trigger",
	  "type": "n8n-nodes-base.webhook",
	  "position": [240, 300]
	},
	{
	  "parameters": {
		"jsCode": "// Advanced Infrastructure Deployment Planning\nconst request = $input.first().json;\n\n// Validate input structure\nif (!request.infrastructure || !request.environment) {\n  throw new Error('Invalid request: missing infrastructure or environment');\n}\n\nconst infrastructure = request.infrastructure;\nconst environment = request.environment;\nconst requestedBy = request.requestedBy || 'unknown';\nconst changeReason = request.changeReason || 'Infrastructure update';\n\n// Analyze infrastructure changes\nconst infraComponents = {\n  terraform: infrastructure.terraform || [],\n  ansible: infrastructure.ansible || [],\n  helm: infrastructure.helm || [],\n  kubernetes: infrastructure.kubernetes || []\n};\n\n// Dependency Analysis\nconst dependencyGraph = {\n  // Cloud infrastructure must be created first\n  terraform: {\n    dependencies: [],\n    dependents: ['ansible', 'helm', 'kubernetes'],\n    executionOrder: 1\n  },\n  // Configuration management after infrastructure\n  ansible: {\n    dependencies: ['terraform'],\n    dependents: ['helm', 'kubernetes'],\n    executionOrder: 2\n  },\n  // Kubernetes applications after basic infrastructure\n  helm: {\n    dependencies: ['terraform', 'ansible'],\n    dependents: [],\n    executionOrder: 3\n  },\n  // Raw Kubernetes resources last\n  kubernetes: {\n    dependencies: ['terraform', 'ansible'],\n    dependents: [],\n    executionOrder: 3\n  }\n};\n\n// Risk Assessment\nlet riskLevel = 'low';\nlet requiresApproval = false;\nlet rollbackPlan = 'automatic';\n\n// Production environment increases risk\nif (environment === 'production') {\n  riskLevel = 'high';\n  requiresApproval = true;\n  rollbackPlan = 'manual';\n}\n\n// Complex changes increase risk\nconst totalChanges = Object.values(infraComponents).reduce((sum, changes) => sum + changes.length, 0);\nif (totalChanges > 10) {\n  riskLevel = 'high';\n  requiresApproval = true;\n}\n\n// Database/Storage changes are always high risk\nconst hasDataChanges = [\n  ...infraComponents.terraform,\n  ...infraComponents.ansible,\n  ...infraComponents.helm\n].some(change => \n  change.includes('database') || \n  change.includes('storage') || \n  change.includes('persistence')\n);\n\nif (hasDataChanges) {\n  riskLevel = 'critical';\n  requiresApproval = true;\n  rollbackPlan = 'manual';\n}\n\n// Generate execution plan\nconst executionPlan = {\n  planId: generateUUID(),\n  timestamp: new Date().toISOString(),\n  environment: environment,\n  requestedBy: requestedBy,\n  changeReason: changeReason,\n  \n  // Risk assessment\n  risk: {\n    level: riskLevel,\n    requiresApproval: requiresApproval,\n    rollbackPlan: rollbackPlan,\n    estimatedDuration: calculateDuration(infraComponents),\n    impactedServices: analyzeImpact(infraComponents, environment)\n  },\n  \n  // Execution phases\n  phases: generateExecutionPhases(infraComponents, dependencyGraph),\n  \n  // Validation criteria\n  validation: {\n    preDeployment: [\n      'terraform-plan-review',\n      'ansible-syntax-check',\n      'helm-template-validation',\n      'kubectl-dry-run'\n    ],\n    postDeployment: [\n      'health-check',\n      'connectivity-test',\n      'performance-baseline',\n      'security-scan'\n    ]\n  },\n  \n  // Rollback strategy\n  rollback: {\n    strategy: rollbackPlan,\n    triggers: [\n      'health-check-failure',\n      'performance-degradation',\n      'manual-trigger'\n    ],\n    timeoutMinutes: 30\n  }\n};\n\n// Helper functions\nfunction generateUUID() {\n  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {\n    const r = Math.random() * 16 | 0;\n    const v = c === 'x' ? r : (r & 0x3 | 0x8);\n    return v.toString(16);\n  });\n}\n\nfunction calculateDuration(components) {\n  // Estimate deployment duration based on component complexity\n  let duration = 0;\n  duration += components.terraform.length * 5; // 5 min per Terraform resource\n  duration += components.ansible.length * 3;   // 3 min per Ansible task\n  duration += components.helm.length * 2;      // 2 min per Helm chart\n  duration += components.kubernetes.length * 1; // 1 min per K8s resource\n  return Math.max(duration, 10); // Minimum 10 minutes\n}\n\nfunction analyzeImpact(components, environment) {\n  // Analyze which services might be impacted\n  const services = [];\n  \n  components.terraform.forEach(resource => {\n    if (resource.includes('database')) services.push('database-services');\n    if (resource.includes('load_balancer')) services.push('web-services');\n    if (resource.includes('cache')) services.push('cache-dependent-services');\n  });\n  \n  components.helm.forEach(chart => {\n    if (chart.includes('ingress')) services.push('external-traffic');\n    if (chart.includes('monitoring')) services.push('observability-stack');\n  });\n  \n  return [...new Set(services)];\n}\n\nfunction generateExecutionPhases(components, dependencyGraph) {\n  const phases = [];\n  \n  // Sort components by execution order\n  const sortedComponents = Object.entries(dependencyGraph)\n    .sort((a, b) => a[1].executionOrder - b[1].executionOrder)\n    .map(([tool]) => tool)\n    .filter(tool => components[tool] && components[tool].length > 0);\n  \n  sortedComponents.forEach((tool, index) => {\n    phases.push({\n      phase: index + 1,\n      tool: tool,\n      components: components[tool],\n      parallelizable: dependencyGraph[tool].executionOrder === 3, // Helm and K8s can run in parallel\n      estimatedDuration: calculateToolDuration(tool, components[tool].length)\n    });\n  });\n  \n  return phases;\n}\n\nfunction calculateToolDuration(tool, componentCount) {\n  const durations = {\n    terraform: componentCount * 5,\n    ansible: componentCount * 3,\n    helm: componentCount * 2,\n    kubernetes: componentCount * 1\n  };\n  return durations[tool] || componentCount;\n}\n\nreturn [{ json: executionPlan }];"
	  },
	  "name": "Plan Infrastructure Deployment",
	  "type": "n8n-nodes-base.code",
	  "position": [460, 300]
	},
	{
	  "parameters": {
		"conditions": {
		  "conditions": [
			{
			  "leftValue": "={{ $json.risk.requiresApproval }}",
			  "rightValue": true,
			  "operator": {
				"type": "boolean"
			  }
			}
		  ]
		}
	  },
	  "name": "Requires Approval?",
	  "type": "n8n-nodes-base.if",
	  "position": [680, 300]
	},
	{
	  "parameters": {
		"resource": "message",
		"operation": "postToChannel",
		"channel": "#infrastructure-approvals",
		"text": "🏗️ **Infrastructure Deployment Approval Required**\n\n**Environment:** {{ $json.environment }}\n**Risk Level:** {{ $json.risk.level }}\n**Requested By:** {{ $json.requestedBy }}\n**Reason:** {{ $json.changeReason }}\n\n**Estimated Duration:** {{ $json.risk.estimatedDuration }} minutes\n**Impacted Services:** {{ $json.risk.impactedServices.join(', ') }}\n\n**Deployment Phases:**\n{{ $json.phases.map(p => `${p.phase}. ${p.tool} (${p.components.length} components)`).join('\\n') }}\n\n[View Execution Plan](https://n8n.company.com/workflow/{{ $workflow.id }}/executions/{{ $execution.id }})\n\n**React with ✅ to approve, ❌ to reject**",
		"attachments": [],
		"otherOptions": {
		  "includeLinkToWorkflow": true
		}
	  },
	  "name": "Request Infrastructure Approval",
	  "type": "n8n-nodes-base.slack",
	  "position": [900, 200],
	  "credentials": {
		"slackApi": {
		  "id": "slack-bot-token",
		  "name": "Slack Bot Token"
		}
	  }
	}
  ]
}

JSON

Dynamic Infrastructure Scaling:

n8n kann Infrastructure-Skalierung als Reaktion auf Monitoring-Metriken oder Business-Events automatisieren. Das folgende Beispiel zeigt, wie Auto-Scaling basierend auf Application-Load implementiert wird:

// Dynamic Terraform Scaling Logic
const monitoringData = $input.first().json;

// Analyze current metrics
const currentLoad = {
  cpu: monitoringData.metrics.cpu_usage_percent,
  memory: monitoringData.metrics.memory_usage_percent,
  requests: monitoringData.metrics.requests_per_minute,
  responseTime: monitoringData.metrics.avg_response_time_ms
};

// Define scaling thresholds
const scalingThresholds = {
  scaleUp: {
	cpu: 70,
	memory: 80,
	requests: 1000,
	responseTime: 2000
  },
  scaleDown: {
	cpu: 30,
	memory: 40,
	requests: 200,
	responseTime: 500
  }
};

// Determine scaling action
let scalingAction = 'none';
let scalingReason = [];

// Scale up conditions
if (currentLoad.cpu > scalingThresholds.scaleUp.cpu) {
  scalingAction = 'up';
  scalingReason.push(`CPU usage ${currentLoad.cpu}% > ${scalingThresholds.scaleUp.cpu}%`);
}

if (currentLoad.memory > scalingThresholds.scaleUp.memory) {
  scalingAction = 'up';
  scalingReason.push(`Memory usage ${currentLoad.memory}% > ${scalingThresholds.scaleUp.memory}%`);
}

// Scale down conditions (only if not scaling up)
if (scalingAction === 'none') {
  if (currentLoad.cpu < scalingThresholds.scaleDown.cpu && 
	  currentLoad.memory < scalingThresholds.scaleDown.memory) {
	scalingAction = 'down';
	scalingReason.push(`Low resource usage: CPU ${currentLoad.cpu}%, Memory ${currentLoad.memory}%`);
  }
}

// Generate Terraform scaling configuration
if (scalingAction !== 'none') {
  const currentInstanceCount = monitoringData.infrastructure.instance_count || 3;
  const maxInstances = 20;
  const minInstances = 2;
  
  let newInstanceCount = currentInstanceCount;
  
  if (scalingAction === 'up') {
	newInstanceCount = Math.min(currentInstanceCount + 2, maxInstances);
  } else if (scalingAction === 'down') {
	newInstanceCount = Math.max(currentInstanceCount - 1, minInstances);
  }
  
  const terraformConfig = {
	action: 'apply',
	workspace: `${monitoringData.environment}-auto-scaling`,
	variables: {
	  instance_count: newInstanceCount,
	  scaling_reason: scalingReason.join(', '),
	  triggered_by: 'n8n-auto-scaling',
	  timestamp: new Date().toISOString()
	},
	autoApprove: monitoringData.environment !== 'production'
  };
  
  return [{
	json: {
	  scalingRequired: true,
	  scalingAction: scalingAction,
	  scalingReason: scalingReason,
	  currentMetrics: currentLoad,
	  infrastructure: {
		currentInstanceCount: currentInstanceCount,
		newInstanceCount: newInstanceCount,
		terraformConfig: terraformConfig
	  }
	}
  }];
}

return [{
  json: {
	scalingRequired: false,
	currentMetrics: currentLoad,
	message: 'No scaling action required'
  }
}];

// Dynamic Terraform Scaling Logic
const monitoringData = $input.first().json;

// Analyze current metrics
const currentLoad = {
  cpu: monitoringData.metrics.cpu_usage_percent,
  memory: monitoringData.metrics.memory_usage_percent,
  requests: monitoringData.metrics.requests_per_minute,
  responseTime: monitoringData.metrics.avg_response_time_ms
};

// Define scaling thresholds
const scalingThresholds = {
  scaleUp: {
	cpu: 70,
	memory: 80,
	requests: 1000,
	responseTime: 2000
  },
  scaleDown: {
	cpu: 30,
	memory: 40,
	requests: 200,
	responseTime: 500
  }
};

// Determine scaling action
let scalingAction = 'none';
let scalingReason = [];

// Scale up conditions
if (currentLoad.cpu > scalingThresholds.scaleUp.cpu) {
  scalingAction = 'up';
  scalingReason.push(`CPU usage ${currentLoad.cpu}% > ${scalingThresholds.scaleUp.cpu}%`);
}

if (currentLoad.memory > scalingThresholds.scaleUp.memory) {
  scalingAction = 'up';
  scalingReason.push(`Memory usage ${currentLoad.memory}% > ${scalingThresholds.scaleUp.memory}%`);
}

// Scale down conditions (only if not scaling up)
if (scalingAction === 'none') {
  if (currentLoad.cpu < scalingThresholds.scaleDown.cpu && 
	  currentLoad.memory < scalingThresholds.scaleDown.memory) {
	scalingAction = 'down';
	scalingReason.push(`Low resource usage: CPU ${currentLoad.cpu}%, Memory ${currentLoad.memory}%`);
  }
}

// Generate Terraform scaling configuration
if (scalingAction !== 'none') {
  const currentInstanceCount = monitoringData.infrastructure.instance_count || 3;
  const maxInstances = 20;
  const minInstances = 2;
  
  let newInstanceCount = currentInstanceCount;
  
  if (scalingAction === 'up') {
	newInstanceCount = Math.min(currentInstanceCount + 2, maxInstances);
  } else if (scalingAction === 'down') {
	newInstanceCount = Math.max(currentInstanceCount - 1, minInstances);
  }
  
  const terraformConfig = {
	action: 'apply',
	workspace: `${monitoringData.environment}-auto-scaling`,
	variables: {
	  instance_count: newInstanceCount,
	  scaling_reason: scalingReason.join(', '),
	  triggered_by: 'n8n-auto-scaling',
	  timestamp: new Date().toISOString()
	},
	autoApprove: monitoringData.environment !== 'production'
  };
  
  return [{
	json: {
	  scalingRequired: true,
	  scalingAction: scalingAction,
	  scalingReason: scalingReason,
	  currentMetrics: currentLoad,
	  infrastructure: {
		currentInstanceCount: currentInstanceCount,
		newInstanceCount: newInstanceCount,
		terraformConfig: terraformConfig
	  }
	}
  }];
}

return [{
  json: {
	scalingRequired: false,
	currentMetrics: currentLoad,
	message: 'No scaling action required'
  }
}];

JavaScript

❗ Auto-Scaling Sicherheit: Implementiere immer Rate-Limiting und Maximum-Limits für Auto-Scaling, um Cost-Explosions und Cascading-Failures zu vermeiden.

Monitoring, Logging und Observability

Observability ist entscheidend für produktive n8n-Deployments. Du benötigst umfassende Monitoring-Strategien, die nicht nur n8n selbst überwachen, sondern auch die Workflows und deren Auswirkungen auf deine Infrastruktur verfolgen.

Multi-Layer Observability Strategy:

┌───────────────────────────────────────────────────────┐
│            Observability Architecture                 │
├───────────────────────────────────────────────────────┤
│  Application Layer (n8n Workflows)                    │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ Workflow    │  │ Execution   │  │ Node-Level  │    │
│  │ Metrics     │  │ Traces      │  │ Monitoring  │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
├───────────────────────────────────────────────────────┤
│  Platform Layer (n8n Infrastructure)                  │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ System      │  │ Database    │  │ Queue       │    │
│  │ Metrics     │  │ Performance │  │ Health      │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
├───────────────────────────────────────────────────────┤
│  Infrastructure Layer (Kubernetes/Docker)             │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ Container   │  │ Network     │  │ Storage     │    │
│  │ Metrics     │  │ Monitoring  │  │ I/O         │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
└───────────────────────────────────────────────────────┘

┌───────────────────────────────────────────────────────┐
│            Observability Architecture                 │
├───────────────────────────────────────────────────────┤
│  Application Layer (n8n Workflows)                    │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ Workflow    │  │ Execution   │  │ Node-Level  │    │
│  │ Metrics     │  │ Traces      │  │ Monitoring  │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
├───────────────────────────────────────────────────────┤
│  Platform Layer (n8n Infrastructure)                  │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ System      │  │ Database    │  │ Queue       │    │
│  │ Metrics     │  │ Performance │  │ Health      │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
├───────────────────────────────────────────────────────┤
│  Infrastructure Layer (Kubernetes/Docker)             │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐    │
│  │ Container   │  │ Network     │  │ Storage     │    │
│  │ Metrics     │  │ Monitoring  │  │ I/O         │    │
│  └─────────────┘  └─────────────┘  └─────────────┘    │
└───────────────────────────────────────────────────────┘

Markdown

🔧 Comprehensive Monitoring Setup:

# prometheus-n8n-monitoring.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-n8n-config
  namespace: monitoring
data:
  n8n-rules.yaml: |
	groups:
	- name: n8n.rules
	  rules:
	  # Workflow Execution Metrics
	  - alert: N8N_WorkflowExecutionFailureRate
		expr: |
		  (
			sum(rate(n8n_workflow_executions_total{status="error"}[5m])) by (workflow_name) /
			sum(rate(n8n_workflow_executions_total[5m])) by (workflow_name)
		  ) * 100 > 10
		for: 2m
		labels:
		  severity: warning
		annotations:
		  summary: "High workflow failure rate for {{ $labels.workflow_name }}"
		  description: "Workflow {{ $labels.workflow_name }} has a failure rate of {{ $value }}% over the last 5 minutes"
	  
	  # Queue Health Metrics
	  - alert: N8N_QueueBacklog
		expr: n8n_queue_waiting_jobs > 100
		for: 5m
		labels:
		  severity: warning
		annotations:
		  summary: "n8n queue backlog detected"
		  description: "{{ $value }} jobs are waiting in the n8n queue"
	  
	  # Database Performance
	  - alert: N8N_DatabaseConnectionExhaustion
		expr: n8n_database_connections_active / n8n_database_connections_max > 0.8
		for: 2m
		labels:
		  severity: critical
		annotations:
		  summary: "n8n database connection pool nearly exhausted"
		  description: "{{ $value }} database connections are active out of maximum available"
	  
	  # Worker Health
	  - alert: N8N_WorkerProcessDown
		expr: up{job="n8n-worker"} == 0
		for: 1m
		labels:
		  severity: critical
		annotations:
		  summary: "n8n worker process is down"
		  description: "Worker instance {{ $labels.instance }} is not responding"
	  
	  # Memory Usage
	  - alert: N8N_HighMemoryUsage
		expr: |
		  (
			node_memory_MemTotal_bytes{job="n8n"} - 
			node_memory_MemAvailable_bytes{job="n8n"}
		  ) / node_memory_MemTotal_bytes{job="n8n"} * 100 > 85
		for: 5m
		labels:
		  severity: warning
		annotations:
		  summary: "High memory usage on n8n instance"
		  description: "Memory usage is {{ $value }}% on {{ $labels.instance }}"

---
apiVersion: v1
kind: Service
metadata:
  name: n8n-metrics
  namespace: n8n-production
  labels:
	app: n8n-main
spec:
  ports:
  - port: 5678
	name: metrics
	targetPort: 5678
  selector:
	app: n8n-main

---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: n8n-servicemonitor
  namespace: monitoring
  labels:
	app: n8n
spec:
  selector:
	matchLabels:
	  app: n8n-main
  endpoints:
  - port: metrics
	path: /metrics
	interval: 30s
	scrapeTimeout: 10s
  namespaceSelector:
	matchNames:
	- n8n-production

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-n8n-dashboard
  namespace: monitoring
data:
  n8n-dashboard.json: |
	{
	  "dashboard": {
		"id": null,
		"title": "n8n Production Monitoring",
		"tags": ["n8n", "automation"],
		"timezone": "browser",
		"panels": [
		  {
			"id": 1,
			"title": "Workflow Executions",
			"type": "graph",
			"targets": [
			  {
				"expr": "sum(rate(n8n_workflow_executions_total[5m])) by (status)",
				"legendFormat": "{{ status }}"
			  }
			],
			"yAxes": [
			  {
				"label": "Executions/sec"
			  }
			]
		  },
		  {
			"id": 2,
			"title": "Queue Metrics",
			"type": "singlestat",
			"targets": [
			  {
				"expr": "n8n_queue_waiting_jobs",
				"legendFormat": "Waiting Jobs"
			  }
			]
		  },
		  {
			"id": 3,
			"title": "Error Rate by Workflow",
			"type": "table",
			"targets": [
			  {
				"expr": "sum(rate(n8n_workflow_executions_total{status=\"error\"}[1h])) by (workflow_name)",
				"format": "table",
				"instant": true
			  }
			]
		  }
		],
		"time": {
		  "from": "now-1h",
		  "to": "now"
		},
		"refresh": "10s"
	  }
	}

# prometheus-n8n-monitoring.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-n8n-config
  namespace: monitoring
data:
  n8n-rules.yaml: |
	groups:
	- name: n8n.rules
	  rules:
	  # Workflow Execution Metrics
	  - alert: N8N_WorkflowExecutionFailureRate
		expr: |
		  (
			sum(rate(n8n_workflow_executions_total{status="error"}[5m])) by (workflow_name) /
			sum(rate(n8n_workflow_executions_total[5m])) by (workflow_name)
		  ) * 100 > 10
		for: 2m
		labels:
		  severity: warning
		annotations:
		  summary: "High workflow failure rate for {{ $labels.workflow_name }}"
		  description: "Workflow {{ $labels.workflow_name }} has a failure rate of {{ $value }}% over the last 5 minutes"
	  
	  # Queue Health Metrics
	  - alert: N8N_QueueBacklog
		expr: n8n_queue_waiting_jobs > 100
		for: 5m
		labels:
		  severity: warning
		annotations:
		  summary: "n8n queue backlog detected"
		  description: "{{ $value }} jobs are waiting in the n8n queue"
	  
	  # Database Performance
	  - alert: N8N_DatabaseConnectionExhaustion
		expr: n8n_database_connections_active / n8n_database_connections_max > 0.8
		for: 2m
		labels:
		  severity: critical
		annotations:
		  summary: "n8n database connection pool nearly exhausted"
		  description: "{{ $value }} database connections are active out of maximum available"
	  
	  # Worker Health
	  - alert: N8N_WorkerProcessDown
		expr: up{job="n8n-worker"} == 0
		for: 1m
		labels:
		  severity: critical
		annotations:
		  summary: "n8n worker process is down"
		  description: "Worker instance {{ $labels.instance }} is not responding"
	  
	  # Memory Usage
	  - alert: N8N_HighMemoryUsage
		expr: |
		  (
			node_memory_MemTotal_bytes{job="n8n"} - 
			node_memory_MemAvailable_bytes{job="n8n"}
		  ) / node_memory_MemTotal_bytes{job="n8n"} * 100 > 85
		for: 5m
		labels:
		  severity: warning
		annotations:
		  summary: "High memory usage on n8n instance"
		  description: "Memory usage is {{ $value }}% on {{ $labels.instance }}"

---
apiVersion: v1
kind: Service
metadata:
  name: n8n-metrics
  namespace: n8n-production
  labels:
	app: n8n-main
spec:
  ports:
  - port: 5678
	name: metrics
	targetPort: 5678
  selector:
	app: n8n-main

---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: n8n-servicemonitor
  namespace: monitoring
  labels:
	app: n8n
spec:
  selector:
	matchLabels:
	  app: n8n-main
  endpoints:
  - port: metrics
	path: /metrics
	interval: 30s
	scrapeTimeout: 10s
  namespaceSelector:
	matchNames:
	- n8n-production

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-n8n-dashboard
  namespace: monitoring
data:
  n8n-dashboard.json: |
	{
	  "dashboard": {
		"id": null,
		"title": "n8n Production Monitoring",
		"tags": ["n8n", "automation"],
		"timezone": "browser",
		"panels": [
		  {
			"id": 1,
			"title": "Workflow Executions",
			"type": "graph",
			"targets": [
			  {
				"expr": "sum(rate(n8n_workflow_executions_total[5m])) by (status)",
				"legendFormat": "{{ status }}"
			  }
			],
			"yAxes": [
			  {
				"label": "Executions/sec"
			  }
			]
		  },
		  {
			"id": 2,
			"title": "Queue Metrics",
			"type": "singlestat",
			"targets": [
			  {
				"expr": "n8n_queue_waiting_jobs",
				"legendFormat": "Waiting Jobs"
			  }
			]
		  },
		  {
			"id": 3,
			"title": "Error Rate by Workflow",
			"type": "table",
			"targets": [
			  {
				"expr": "sum(rate(n8n_workflow_executions_total{status=\"error\"}[1h])) by (workflow_name)",
				"format": "table",
				"instant": true
			  }
			]
		  }
		],
		"time": {
		  "from": "now-1h",
		  "to": "now"
		},
		"refresh": "10s"
	  }
	}

YAML

Advanced Logging Strategy:

💡 Structured Logging Best Practice: Implementiere structured logging mit einheitlichen Log-Formaten across alle n8n-Workflows für bessere Observability.

// Advanced Workflow Logging Framework
class WorkflowObservability {
  constructor(workflowId, executionId, environment = 'production') {
	this.workflowId = workflowId;
	this.executionId = executionId;
	this.environment = environment;
	this.startTime = Date.now();
	this.traceId = this.generateTraceId();
	
	// Initialize counters
	this.metrics = {
	  nodeExecutions: 0,
	  apiCalls: 0,
	  errors: 0,
	  warnings: 0
	};
  }

  generateTraceId() {
	return `trace_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
  }

  log(level, message, context = {}, nodeInfo = {}) {
	const logEntry = {
	  timestamp: new Date().toISOString(),
	  level: level.toUpperCase(),
	  message: message,
	  
	  // Workflow Context
	  workflow: {
		id: this.workflowId,
		executionId: this.executionId,
		traceId: this.traceId,
		environment: this.environment
	  },
	  
	  // Node Context
	  node: {
		name: nodeInfo.name || 'unknown',
		type: nodeInfo.type || 'unknown',
		position: nodeInfo.position || null
	  },
	  
	  // Performance Context
	  performance: {
		executionTime: Date.now() - this.startTime,
		nodeExecutions: this.metrics.nodeExecutions,
		apiCalls: this.metrics.apiCalls
	  },
	  
	  // Custom Context
	  context: context,
	  
	  // Labels for easier filtering
	  labels: {
		workflow_name: $workflow.name,
		environment: this.environment,
		node_type: nodeInfo.type,
		trace_id: this.traceId
	  }
	};

	// Send to multiple logging destinations
	this.sendToConsole(logEntry);
	this.sendToElasticsearch(logEntry);
	this.sendToDatadog(logEntry);
	
	// Update metrics
	this.updateMetrics(level);
  }

  sendToConsole(logEntry) {
	console.log(JSON.stringify(logEntry));
  }

  async sendToElasticsearch(logEntry) {
	try {
	  if (this.environment === 'production') {
		await fetch('https://elasticsearch.company.com/n8n-logs/_doc', {
		  method: 'POST',
		  headers: {
			'Content-Type': 'application/json',
			'Authorization': `Bearer ${$credentials.elasticsearch.token}`
		  },
		  body: JSON.stringify(logEntry)
		});
	  }
	} catch (error) {
	  console.error('Failed to send log to Elasticsearch:', error);
	}
  }

  async sendToDatadog(logEntry) {
	try {
	  if (this.environment === 'production') {
		await fetch('https://http-intake.logs.datadoghq.com/v1/input/' + $credentials.datadog.apiKey, {
		  method: 'POST',
		  headers: {
			'Content-Type': 'application/json'
		  },
		  body: JSON.stringify(logEntry)
		});
	  }
	} catch (error) {
	  console.error('Failed to send log to Datadog:', error);
	}
  }

  updateMetrics(level) {
	this.metrics.nodeExecutions++;
	
	if (level === 'ERROR') {
	  this.metrics.errors++;
	} else if (level === 'WARN') {
	  this.metrics.warnings++;
	}
  }

  // Specialized logging methods
  error(message, error, context = {}) {
	this.log('ERROR', message, {
	  ...context,
	  error: {
		name: error.name,
		message: error.message,
		stack: error.stack
	  }
	}, $node);
  }

  apiCall(endpoint, method, responseTime, statusCode, context = {}) {
	this.metrics.apiCalls++;
	this.log('INFO', `API Call: ${method} ${endpoint}`, {
	  ...context,
	  api: {
		endpoint: endpoint,
		method: method,
		responseTime: responseTime,
		statusCode: statusCode
	  }
	}, $node);
  }

  performance(operation, duration, metadata = {}) {
	this.log('INFO', `Performance: ${operation}`, {
	  performance: {
		operation: operation,
		duration: duration,
		metadata: metadata
	  }
	}, $node);
  }

  // Generate final execution summary
  generateSummary() {
	const totalDuration = Date.now() - this.startTime;
	
	return {
	  workflow: {
		id: this.workflowId,
		executionId: this.executionId,
		traceId: this.traceId
	  },
	  performance: {
		totalDuration: totalDuration,
		nodeExecutions: this.metrics.nodeExecutions,
		apiCalls: this.metrics.apiCalls,
		avgNodeDuration: totalDuration / this.metrics.nodeExecutions
	  },
	  quality: {
		errors: this.metrics.errors,
		warnings: this.metrics.warnings,
		successRate: ((this.metrics.nodeExecutions - this.metrics.errors) / this.metrics.nodeExecutions * 100).toFixed(2)
	  }
	};
  }
}

// Usage in n8n workflows
const observer = new WorkflowObservability($workflow.id, $execution.id, 'production');

try {
  observer.log('INFO', 'Starting workflow execution', {
	inputData: $json,
	trigger: $node.name
  });

  // API call with monitoring
  const startTime = Date.now();
  const response = await fetch('https://api.example.com/data', {
	method: 'POST',
	headers: { 'Content-Type': 'application/json' },
	body: JSON.stringify($json)
  });
  const responseTime = Date.now() - startTime;
  
  observer.apiCall('https://api.example.com/data', 'POST', responseTime, response.status, {
	requestSize: JSON.stringify($json).length,
	responseSize: response.headers.get('content-length')
  });

  if (!response.ok) {
	throw new Error(`HTTP ${response.status}: ${response.statusText}`);
  }

  const data = await response.json();
  
  observer.log('INFO', 'Workflow completed successfully', {
	outputData: { recordCount: data.length },
	summary: observer.generateSummary()
  });

  return [{ json: data }];

} catch (error) {
  observer.error('Workflow execution failed', error, {
	inputData: $json,
	nodePosition: $node.position,
	summary: observer.generateSummary()
  });
  
  throw error;
}

// Advanced Workflow Logging Framework
class WorkflowObservability {
  constructor(workflowId, executionId, environment = 'production') {
	this.workflowId = workflowId;
	this.executionId = executionId;
	this.environment = environment;
	this.startTime = Date.now();
	this.traceId = this.generateTraceId();
	
	// Initialize counters
	this.metrics = {
	  nodeExecutions: 0,
	  apiCalls: 0,
	  errors: 0,
	  warnings: 0
	};
  }

  generateTraceId() {
	return `trace_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
  }

  log(level, message, context = {}, nodeInfo = {}) {
	const logEntry = {
	  timestamp: new Date().toISOString(),
	  level: level.toUpperCase(),
	  message: message,
	  
	  // Workflow Context
	  workflow: {
		id: this.workflowId,
		executionId: this.executionId,
		traceId: this.traceId,
		environment: this.environment
	  },
	  
	  // Node Context
	  node: {
		name: nodeInfo.name || 'unknown',
		type: nodeInfo.type || 'unknown',
		position: nodeInfo.position || null
	  },
	  
	  // Performance Context
	  performance: {
		executionTime: Date.now() - this.startTime,
		nodeExecutions: this.metrics.nodeExecutions,
		apiCalls: this.metrics.apiCalls
	  },
	  
	  // Custom Context
	  context: context,
	  
	  // Labels for easier filtering
	  labels: {
		workflow_name: $workflow.name,
		environment: this.environment,
		node_type: nodeInfo.type,
		trace_id: this.traceId
	  }
	};

	// Send to multiple logging destinations
	this.sendToConsole(logEntry);
	this.sendToElasticsearch(logEntry);
	this.sendToDatadog(logEntry);
	
	// Update metrics
	this.updateMetrics(level);
  }

  sendToConsole(logEntry) {
	console.log(JSON.stringify(logEntry));
  }

  async sendToElasticsearch(logEntry) {
	try {
	  if (this.environment === 'production') {
		await fetch('https://elasticsearch.company.com/n8n-logs/_doc', {
		  method: 'POST',
		  headers: {
			'Content-Type': 'application/json',
			'Authorization': `Bearer ${$credentials.elasticsearch.token}`
		  },
		  body: JSON.stringify(logEntry)
		});
	  }
	} catch (error) {
	  console.error('Failed to send log to Elasticsearch:', error);
	}
  }

  async sendToDatadog(logEntry) {
	try {
	  if (this.environment === 'production') {
		await fetch('https://http-intake.logs.datadoghq.com/v1/input/' + $credentials.datadog.apiKey, {
		  method: 'POST',
		  headers: {
			'Content-Type': 'application/json'
		  },
		  body: JSON.stringify(logEntry)
		});
	  }
	} catch (error) {
	  console.error('Failed to send log to Datadog:', error);
	}
  }

  updateMetrics(level) {
	this.metrics.nodeExecutions++;
	
	if (level === 'ERROR') {
	  this.metrics.errors++;
	} else if (level === 'WARN') {
	  this.metrics.warnings++;
	}
  }

  // Specialized logging methods
  error(message, error, context = {}) {
	this.log('ERROR', message, {
	  ...context,
	  error: {
		name: error.name,
		message: error.message,
		stack: error.stack
	  }
	}, $node);
  }

  apiCall(endpoint, method, responseTime, statusCode, context = {}) {
	this.metrics.apiCalls++;
	this.log('INFO', `API Call: ${method} ${endpoint}`, {
	  ...context,
	  api: {
		endpoint: endpoint,
		method: method,
		responseTime: responseTime,
		statusCode: statusCode
	  }
	}, $node);
  }

  performance(operation, duration, metadata = {}) {
	this.log('INFO', `Performance: ${operation}`, {
	  performance: {
		operation: operation,
		duration: duration,
		metadata: metadata
	  }
	}, $node);
  }

  // Generate final execution summary
  generateSummary() {
	const totalDuration = Date.now() - this.startTime;
	
	return {
	  workflow: {
		id: this.workflowId,
		executionId: this.executionId,
		traceId: this.traceId
	  },
	  performance: {
		totalDuration: totalDuration,
		nodeExecutions: this.metrics.nodeExecutions,
		apiCalls: this.metrics.apiCalls,
		avgNodeDuration: totalDuration / this.metrics.nodeExecutions
	  },
	  quality: {
		errors: this.metrics.errors,
		warnings: this.metrics.warnings,
		successRate: ((this.metrics.nodeExecutions - this.metrics.errors) / this.metrics.nodeExecutions * 100).toFixed(2)
	  }
	};
  }
}

// Usage in n8n workflows
const observer = new WorkflowObservability($workflow.id, $execution.id, 'production');

try {
  observer.log('INFO', 'Starting workflow execution', {
	inputData: $json,
	trigger: $node.name
  });

  // API call with monitoring
  const startTime = Date.now();
  const response = await fetch('https://api.example.com/data', {
	method: 'POST',
	headers: { 'Content-Type': 'application/json' },
	body: JSON.stringify($json)
  });
  const responseTime = Date.now() - startTime;
  
  observer.apiCall('https://api.example.com/data', 'POST', responseTime, response.status, {
	requestSize: JSON.stringify($json).length,
	responseSize: response.headers.get('content-length')
  });

  if (!response.ok) {
	throw new Error(`HTTP ${response.status}: ${response.statusText}`);
  }

  const data = await response.json();
  
  observer.log('INFO', 'Workflow completed successfully', {
	outputData: { recordCount: data.length },
	summary: observer.generateSummary()
  });

  return [{ json: data }];

} catch (error) {
  observer.error('Workflow execution failed', error, {
	inputData: $json,
	nodePosition: $node.position,
	summary: observer.generateSummary()
  });
  
  throw error;
}

JavaScript

⚠️ Logging Performance Impact: Extensive Logging kann die Workflow-Performance beeinträchtigen. In produktiven Umgebungen solltest du asynchrone Logging-Mechanismen und Log-Level-basierte Filterung implementieren.

Die Integration von n8n in DevOps-Toolchains verwandelt es von einem isolierten Automatisierungs-Tool in das zentrale Nervensystem deiner Infrastruktur-Workflows. Mit CI/CD-Pipeline-Integration, Infrastructure-as-Code-Orchestration und umfassendem Monitoring schaffst du eine Automatisierungsplattform, die nahtlos in deine bestehende DevOps-Landschaft integriert und diese erheblich erweitert.

Security und Enterprise-Considerations

Die Implementierung von n8n in unternehmenskritischen Umgebungen erfordert durchdachte Security-Strategien und Enterprise-Grade-Funktionen. Production-Deployments unterscheiden sich fundamental von Development-Setups – hier geht es um Compliance-Anforderungen, Multi-Tenancy-Architekturen und Governance-Frameworks, die gleichzeitig Sicherheit gewährleisten und operative Flexibilität ermöglichen.

Security ist kein nachträglicher Gedanke, sondern muss von Anfang an in die Architektur integriert werden. Enterprise-Umgebungen stellen spezifische Anforderungen an Authentifizierung, Autorisierung, Audit-Logging und Credential-Management, die weit über Basic-Auth-Mechanismen hinausgehen.

Authentication, Authorization und Multi-Tenancy

Enterprise-Authentication in n8n geht über einfache Username/Password-Kombinationen hinaus. Moderne Unternehmen benötigen Integration mit bestehenden Identity-Management-Systemen, Role-Based Access Control (RBAC) und mandantenfähige Architekturen, die verschiedene Teams und Projekte sicher voneinander trennen.

Enterprise Identity Integration:

n8n unterstützt verschiedene Enterprise-Identity-Provider über standardisierte Protokolle. Die Integration erfolgt über OAuth 2.0, SAML 2.0 oder OpenID Connect, wodurch sich n8n nahtlos in bestehende Identity-Landschaften einfügt.

# LDAP/Active Directory Integration
export N8N_USER_MANAGEMENT_LDAP_ENABLED=true
export N8N_USER_MANAGEMENT_LDAP_SERVER="ldaps://ad.company.com:636"
export N8N_USER_MANAGEMENT_LDAP_BASE_DN="dc=company,dc=com"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_ID_ATTRIBUTE="sAMAccountName"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_EMAIL_ATTRIBUTE="mail"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_FIRST_NAME_ATTRIBUTE="givenName"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_LAST_NAME_ATTRIBUTE="sn"

# SAML Configuration
export N8N_SAML_ENABLED=true
export N8N_SAML_ENTITY_ID="https://n8n.company.com"
export N8N_SAML_RETURN_URL="https://n8n.company.com/rest/sso/saml"
export N8N_SAML_IDP_URL="https://sso.company.com/saml/login"
export N8N_SAML_CERT_PATH="/opt/n8n/certs/saml-idp.crt"
export N8N_SAML_PRIVATE_KEY_PATH="/opt/n8n/certs/saml-sp.key"

# Advanced SAML Attribute Mapping
export N8N_SAML_ATTRIBUTES_EMAIL="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
export N8N_SAML_ATTRIBUTES_FIRST_NAME="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
export N8N_SAML_ATTRIBUTES_LAST_NAME="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
export N8N_SAML_ATTRIBUTES_GROUPS="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"

# LDAP/Active Directory Integration
export N8N_USER_MANAGEMENT_LDAP_ENABLED=true
export N8N_USER_MANAGEMENT_LDAP_SERVER="ldaps://ad.company.com:636"
export N8N_USER_MANAGEMENT_LDAP_BASE_DN="dc=company,dc=com"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_ID_ATTRIBUTE="sAMAccountName"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_EMAIL_ATTRIBUTE="mail"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_FIRST_NAME_ATTRIBUTE="givenName"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_LAST_NAME_ATTRIBUTE="sn"

# SAML Configuration
export N8N_SAML_ENABLED=true
export N8N_SAML_ENTITY_ID="https://n8n.company.com"
export N8N_SAML_RETURN_URL="https://n8n.company.com/rest/sso/saml"
export N8N_SAML_IDP_URL="https://sso.company.com/saml/login"
export N8N_SAML_CERT_PATH="/opt/n8n/certs/saml-idp.crt"
export N8N_SAML_PRIVATE_KEY_PATH="/opt/n8n/certs/saml-sp.key"

# Advanced SAML Attribute Mapping
export N8N_SAML_ATTRIBUTES_EMAIL="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
export N8N_SAML_ATTRIBUTES_FIRST_NAME="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
export N8N_SAML_ATTRIBUTES_LAST_NAME="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
export N8N_SAML_ATTRIBUTES_GROUPS="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"

Bash

Role-Based Access Control Implementation:

Ein durchdachtes RBAC-System ermöglicht es, granulare Berechtigungen für verschiedene User-Gruppen zu definieren. Die folgende Struktur zeigt ein typisches Enterprise-RBAC-Schema:

Role	Workflow Permissions	Credential Access	Admin Functions	API Access
Viewer	Read-only	None	None	Read-only
Developer	Create, Edit own	Read assigned	None	Full
Team Lead	Create, Edit team	Manage team creds	Team management	Full
DevOps Engineer	Full workflow access	Infrastructure creds	Limited admin	Full
Security Officer	Read all, Audit	View all (encrypted)	Security config	Read-only
Platform Admin	Full access	Full access	Full admin	Full

🔧 Advanced RBAC Configuration:

// rbac-policy-engine.ts - Custom RBAC Implementation
interface RBACPolicy {
  user: UserContext;
  resource: ResourceType;
  action: ActionType;
  context?: PolicyContext;
}

interface UserContext {
  userId: string;
  roles: string[];
  groups: string[];
  attributes: Record<string, any>;
}

interface PolicyContext {
  environment: string;
  timeOfDay: string;
  ipAddress: string;
  workflowTags: string[];
}

class EnterpriseRBACEngine {
  private policies: Map<string, PolicyRule[]> = new Map();
  
  constructor() {
	this.initializeDefaultPolicies();
  }

  initializeDefaultPolicies() {
	// Developer Role Policies
	this.addPolicy('developer', {
	  resources: ['workflow', 'execution'],
	  actions: ['create', 'read', 'update'],
	  conditions: [
		'user.groups.includes(resource.owner_group)',
		'resource.tags.includes("development") || resource.environment !== "production"'
	  ]
	});

	// DevOps Engineer Policies
	this.addPolicy('devops-engineer', {
	  resources: ['workflow', 'credential', 'webhook'],
	  actions: ['create', 'read', 'update', 'delete'],
	  conditions: [
		'resource.tags.includes("infrastructure") || user.groups.includes("devops-team")',
		'context.timeOfDay >= "08:00" && context.timeOfDay <= "18:00" || resource.environment !== "production"'
	  ]
	});

	// Security Officer Policies
	this.addPolicy('security-officer', {
	  resources: ['*'],
	  actions: ['read', 'audit'],
	  conditions: [
		'action === "audit" || (action === "read" && resource.sensitive !== true)'
	  ]
	});

	// Time-based Production Access
	this.addPolicy('production-maintenance-window', {
	  resources: ['workflow'],
	  actions: ['update', 'delete'],
	  conditions: [
		'resource.environment === "production"',
		'context.timeOfDay >= "02:00" && context.timeOfDay <= "06:00"',
		'user.roles.includes("devops-engineer") || user.roles.includes("platform-admin")'
	  ]
	});
  }

  async evaluatePolicy(policy: RBACPolicy): Promise<AuthorizationResult> {
	const userRoles = policy.user.roles;
	const applicablePolicies: PolicyRule[] = [];

	// Collect all applicable policies for user roles
	userRoles.forEach(role => {
	  const rolePolicies = this.policies.get(role);
	  if (rolePolicies) {
		applicablePolicies.push(...rolePolicies);
	  }
	});

	// Evaluate each policy
	for (const policyRule of applicablePolicies) {
	  const result = await this.evaluatePolicyRule(policyRule, policy);
	  if (result.granted) {
		return result;
	  }
	}

	// Default deny
	return {
	  granted: false,
	  reason: 'No matching policy found',
	  requiredPermissions: this.suggestRequiredPermissions(policy)
	};
  }

  private async evaluatePolicyRule(rule: PolicyRule, policy: RBACPolicy): Promise<AuthorizationResult> {
	// Resource matching
	if (!this.matchesResource(rule.resources, policy.resource)) {
	  return { granted: false, reason: 'Resource not covered by policy' };
	}

	// Action matching
	if (!rule.actions.includes(policy.action)) {
	  return { granted: false, reason: 'Action not permitted by policy' };
	}

	// Condition evaluation
	for (const condition of rule.conditions) {
	  if (!this.evaluateCondition(condition, policy)) {
		return { granted: false, reason: `Condition failed: ${condition}` };
	  }
	}

	return {
	  granted: true,
	  reason: 'Policy match found',
	  matchedPolicy: rule.name
	};
  }

  private evaluateCondition(condition: string, policy: RBACPolicy): boolean {
	try {
	  // Secure condition evaluation with sandboxed context
	  const context = {
		user: policy.user,
		resource: policy.resource,
		context: policy.context,
		// Helper functions
		includes: (array: any[], item: any) => array?.includes(item) || false,
		hasRole: (role: string) => policy.user.roles.includes(role),
		hasGroup: (group: string) => policy.user.groups.includes(group),
		isTimeInRange: (start: string, end: string) => {
		  const current = new Date().toTimeString().slice(0, 5);
		  return current >= start && current <= end;
		}
	  };

	  return new Function('context', `with(context) { return ${condition}; }`)(context);
	} catch (error) {
	  console.error('Condition evaluation failed:', error);
	  return false;
	}
  }
}

// Usage in n8n API middleware
const rbacEngine = new EnterpriseRBACEngine();

async function authorizeRequest(req: Request, res: Response, next: NextFunction) {
  const user = req.user; // from authentication middleware
  const resource = extractResourceFromRequest(req);
  const action = mapHttpMethodToAction(req.method);

  const authResult = await rbacEngine.evaluatePolicy({
	user: {
	  userId: user.id,
	  roles: user.roles,
	  groups: user.groups,
	  attributes: user.attributes
	},
	resource: resource.type,
	action: action,
	context: {
	  environment: resource.environment,
	  timeOfDay: new Date().toTimeString().slice(0, 5),
	  ipAddress: req.ip,
	  workflowTags: resource.tags
	}
  });

  if (authResult.granted) {
	// Log successful authorization
	auditLogger.info('Authorization granted', {
	  userId: user.id,
	  resource: resource.type,
	  action: action,
	  policy: authResult.matchedPolicy
	});
	next();
  } else {
	// Log authorization denial
	auditLogger.warn('Authorization denied', {
	  userId: user.id,
	  resource: resource.type,
	  action: action,
	  reason: authResult.reason
	});
	
	res.status(403).json({
	  error: 'Insufficient permissions',
	  required: authResult.requiredPermissions
	});
  }
}

// rbac-policy-engine.ts - Custom RBAC Implementation
interface RBACPolicy {
  user: UserContext;
  resource: ResourceType;
  action: ActionType;
  context?: PolicyContext;
}

interface UserContext {
  userId: string;
  roles: string[];
  groups: string[];
  attributes: Record<string, any>;
}

interface PolicyContext {
  environment: string;
  timeOfDay: string;
  ipAddress: string;
  workflowTags: string[];
}

class EnterpriseRBACEngine {
  private policies: Map<string, PolicyRule[]> = new Map();
  
  constructor() {
	this.initializeDefaultPolicies();
  }

  initializeDefaultPolicies() {
	// Developer Role Policies
	this.addPolicy('developer', {
	  resources: ['workflow', 'execution'],
	  actions: ['create', 'read', 'update'],
	  conditions: [
		'user.groups.includes(resource.owner_group)',
		'resource.tags.includes("development") || resource.environment !== "production"'
	  ]
	});

	// DevOps Engineer Policies
	this.addPolicy('devops-engineer', {
	  resources: ['workflow', 'credential', 'webhook'],
	  actions: ['create', 'read', 'update', 'delete'],
	  conditions: [
		'resource.tags.includes("infrastructure") || user.groups.includes("devops-team")',
		'context.timeOfDay >= "08:00" && context.timeOfDay <= "18:00" || resource.environment !== "production"'
	  ]
	});

	// Security Officer Policies
	this.addPolicy('security-officer', {
	  resources: ['*'],
	  actions: ['read', 'audit'],
	  conditions: [
		'action === "audit" || (action === "read" && resource.sensitive !== true)'
	  ]
	});

	// Time-based Production Access
	this.addPolicy('production-maintenance-window', {
	  resources: ['workflow'],
	  actions: ['update', 'delete'],
	  conditions: [
		'resource.environment === "production"',
		'context.timeOfDay >= "02:00" && context.timeOfDay <= "06:00"',
		'user.roles.includes("devops-engineer") || user.roles.includes("platform-admin")'
	  ]
	});
  }

  async evaluatePolicy(policy: RBACPolicy): Promise<AuthorizationResult> {
	const userRoles = policy.user.roles;
	const applicablePolicies: PolicyRule[] = [];

	// Collect all applicable policies for user roles
	userRoles.forEach(role => {
	  const rolePolicies = this.policies.get(role);
	  if (rolePolicies) {
		applicablePolicies.push(...rolePolicies);
	  }
	});

	// Evaluate each policy
	for (const policyRule of applicablePolicies) {
	  const result = await this.evaluatePolicyRule(policyRule, policy);
	  if (result.granted) {
		return result;
	  }
	}

	// Default deny
	return {
	  granted: false,
	  reason: 'No matching policy found',
	  requiredPermissions: this.suggestRequiredPermissions(policy)
	};
  }

  private async evaluatePolicyRule(rule: PolicyRule, policy: RBACPolicy): Promise<AuthorizationResult> {
	// Resource matching
	if (!this.matchesResource(rule.resources, policy.resource)) {
	  return { granted: false, reason: 'Resource not covered by policy' };
	}

	// Action matching
	if (!rule.actions.includes(policy.action)) {
	  return { granted: false, reason: 'Action not permitted by policy' };
	}

	// Condition evaluation
	for (const condition of rule.conditions) {
	  if (!this.evaluateCondition(condition, policy)) {
		return { granted: false, reason: `Condition failed: ${condition}` };
	  }
	}

	return {
	  granted: true,
	  reason: 'Policy match found',
	  matchedPolicy: rule.name
	};
  }

  private evaluateCondition(condition: string, policy: RBACPolicy): boolean {
	try {
	  // Secure condition evaluation with sandboxed context
	  const context = {
		user: policy.user,
		resource: policy.resource,
		context: policy.context,
		// Helper functions
		includes: (array: any[], item: any) => array?.includes(item) || false,
		hasRole: (role: string) => policy.user.roles.includes(role),
		hasGroup: (group: string) => policy.user.groups.includes(group),
		isTimeInRange: (start: string, end: string) => {
		  const current = new Date().toTimeString().slice(0, 5);
		  return current >= start && current <= end;
		}
	  };

	  return new Function('context', `with(context) { return ${condition}; }`)(context);
	} catch (error) {
	  console.error('Condition evaluation failed:', error);
	  return false;
	}
  }
}

// Usage in n8n API middleware
const rbacEngine = new EnterpriseRBACEngine();

async function authorizeRequest(req: Request, res: Response, next: NextFunction) {
  const user = req.user; // from authentication middleware
  const resource = extractResourceFromRequest(req);
  const action = mapHttpMethodToAction(req.method);

  const authResult = await rbacEngine.evaluatePolicy({
	user: {
	  userId: user.id,
	  roles: user.roles,
	  groups: user.groups,
	  attributes: user.attributes
	},
	resource: resource.type,
	action: action,
	context: {
	  environment: resource.environment,
	  timeOfDay: new Date().toTimeString().slice(0, 5),
	  ipAddress: req.ip,
	  workflowTags: resource.tags
	}
  });

  if (authResult.granted) {
	// Log successful authorization
	auditLogger.info('Authorization granted', {
	  userId: user.id,
	  resource: resource.type,
	  action: action,
	  policy: authResult.matchedPolicy
	});
	next();
  } else {
	// Log authorization denial
	auditLogger.warn('Authorization denied', {
	  userId: user.id,
	  resource: resource.type,
	  action: action,
	  reason: authResult.reason
	});
	
	res.status(403).json({
	  error: 'Insufficient permissions',
	  required: authResult.requiredPermissions
	});
  }
}

TypeScript

Multi-Tenancy Architecture:

Multi-Tenancy in n8n erfordert sowohl logische als auch physische Isolation von Tenant-Daten. Die Implementierung erfolgt über Workspace-basierte Segregation mit strikter Datenkapselung.

# kubernetes-multi-tenant-setup.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: n8n-tenant-alpha
  labels:
	tenant: alpha
	isolation-level: strict
---
apiVersion: v1
kind: Namespace  
metadata:
  name: n8n-tenant-beta
  labels:
	tenant: beta
	isolation-level: strict
---
# Network Policy für Tenant-Isolation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tenant-isolation
  namespace: n8n-tenant-alpha
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
	- namespaceSelector:
		matchLabels:
		  tenant: alpha
  - from:
	- namespaceSelector:
		matchLabels:
		  name: n8n-shared-services
  egress:
  - to:
	- namespaceSelector:
		matchLabels:
		  tenant: alpha
  - to:
	- namespaceSelector:
		matchLabels:
		  name: n8n-shared-services
  - to: []
	ports:
	- protocol: TCP
	  port: 443
	- protocol: TCP  
	  port: 53
	- protocol: UDP
	  port: 53
---
# Tenant-spezifische n8n Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-tenant-alpha
  namespace: n8n-tenant-alpha
spec:
  replicas: 2
  selector:
	matchLabels:
	  app: n8n-tenant-alpha
  template:
	metadata:
	  labels:
		app: n8n-tenant-alpha
		tenant: alpha
	spec:
	  containers:
	  - name: n8n
		image: n8nio/n8n:latest
		env:
		- name: N8N_MULTI_TENANT_ENABLED
		  value: "true"
		- name: N8N_TENANT_ID
		  value: "alpha"
		- name: DB_POSTGRESDB_DATABASE
		  value: "n8n_tenant_alpha"
		- name: DB_POSTGRESDB_SCHEMA
		  value: "tenant_alpha"
		- name: N8N_ENCRYPTION_KEY
		  valueFrom:
			secretKeyRef:
			  name: n8n-tenant-alpha-secrets
			  key: encryption-key
		- name: N8N_USER_MANAGEMENT_DISABLED
		  value: "false"
		- name: N8N_WORKFLOWS_DEFAULT_OWNER
		  value: "tenant-alpha-admin"
		resources:
		  requests:
			memory: "512Mi"
			cpu: "250m"
		  limits:
			memory: "2Gi"
			cpu: "1000m"
		securityContext:
		  allowPrivilegeEscalation: false
		  readOnlyRootFilesystem: true
		  runAsNonRoot: true
		  runAsUser: 1000
		  capabilities:
			drop:
			- ALL

# kubernetes-multi-tenant-setup.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: n8n-tenant-alpha
  labels:
	tenant: alpha
	isolation-level: strict
---
apiVersion: v1
kind: Namespace  
metadata:
  name: n8n-tenant-beta
  labels:
	tenant: beta
	isolation-level: strict
---
# Network Policy für Tenant-Isolation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: tenant-isolation
  namespace: n8n-tenant-alpha
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
	- namespaceSelector:
		matchLabels:
		  tenant: alpha
  - from:
	- namespaceSelector:
		matchLabels:
		  name: n8n-shared-services
  egress:
  - to:
	- namespaceSelector:
		matchLabels:
		  tenant: alpha
  - to:
	- namespaceSelector:
		matchLabels:
		  name: n8n-shared-services
  - to: []
	ports:
	- protocol: TCP
	  port: 443
	- protocol: TCP  
	  port: 53
	- protocol: UDP
	  port: 53
---
# Tenant-spezifische n8n Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-tenant-alpha
  namespace: n8n-tenant-alpha
spec:
  replicas: 2
  selector:
	matchLabels:
	  app: n8n-tenant-alpha
  template:
	metadata:
	  labels:
		app: n8n-tenant-alpha
		tenant: alpha
	spec:
	  containers:
	  - name: n8n
		image: n8nio/n8n:latest
		env:
		- name: N8N_MULTI_TENANT_ENABLED
		  value: "true"
		- name: N8N_TENANT_ID
		  value: "alpha"
		- name: DB_POSTGRESDB_DATABASE
		  value: "n8n_tenant_alpha"
		- name: DB_POSTGRESDB_SCHEMA
		  value: "tenant_alpha"
		- name: N8N_ENCRYPTION_KEY
		  valueFrom:
			secretKeyRef:
			  name: n8n-tenant-alpha-secrets
			  key: encryption-key
		- name: N8N_USER_MANAGEMENT_DISABLED
		  value: "false"
		- name: N8N_WORKFLOWS_DEFAULT_OWNER
		  value: "tenant-alpha-admin"
		resources:
		  requests:
			memory: "512Mi"
			cpu: "250m"
		  limits:
			memory: "2Gi"
			cpu: "1000m"
		securityContext:
		  allowPrivilegeEscalation: false
		  readOnlyRootFilesystem: true
		  runAsNonRoot: true
		  runAsUser: 1000
		  capabilities:
			drop:
			- ALL

YAML

💡 Multi-Tenancy Best Practice: Verwende separate Datenbank-Schemas oder sogar separate Datenbanken für verschiedene Tenants. Das bietet maximale Datenisolation und vereinfacht Compliance-Audits.

⚠️ Security Risk: Shared-Infrastructure-Multi-Tenancy kann zu Tenant-übergreifenden Daten-Leaks führen. Bei hochsensiblen Daten solltest du physisch getrennte n8n-Instanzen pro Tenant verwenden.

Credential Management und Secret Handling

Credential-Management ist einer der kritischsten Sicherheitsaspekte in n8n-Deployments. Enterprise-Umgebungen erfordern sichere Speicherung, Rotation und Audit-Trails für alle Credentials, die in Workflows verwendet werden.

Enterprise Secret Management Integration:

n8n kann mit externen Secret-Management-Systemen integriert werden, um Credentials zentral zu verwalten und automatische Rotation zu ermöglichen.

// enterprise-secret-manager.js - HashiCorp Vault Integration
class EnterpriseSecretManager {
  constructor() {
	this.vaultClient = new VaultClient({
	  endpoint: process.env.VAULT_ENDPOINT,
	  token: process.env.VAULT_TOKEN
	});
	this.credentialCache = new Map();
	this.cacheTimeout = 300000; // 5 minutes
  }

  async getCredential(credentialId, userId, workflowId) {
	try {
	  // Check cache first
	  const cacheKey = `${credentialId}_${userId}`;
	  const cached = this.credentialCache.get(cacheKey);
	  
	  if (cached && Date.now() - cached.timestamp < this.cacheTimeout) {
		this.auditCredentialAccess(credentialId, userId, workflowId, 'cache-hit');
		return cached.data;
	  }

	  // Retrieve from Vault
	  const secretPath = `n8n/credentials/${credentialId}`;
	  const vaultResponse = await this.vaultClient.read(secretPath);
	  
	  if (!vaultResponse || !vaultResponse.data) {
		throw new Error(`Credential ${credentialId} not found in Vault`);
	  }

	  // Verify user access to credential
	  const accessGranted = await this.verifyCredentialAccess(credentialId, userId);
	  if (!accessGranted) {
		this.auditCredentialAccess(credentialId, userId, workflowId, 'access-denied');
		throw new Error(`User ${userId} not authorized for credential ${credentialId}`);
	  }

	  // Decrypt credential data
	  const encryptionKey = process.env.N8N_ENCRYPTION_KEY;
	  const decryptedData = this.decryptCredential(vaultResponse.data.data, encryptionKey);
	  
	  // Cache decrypted data
	  this.credentialCache.set(cacheKey, {
		data: decryptedData,
		timestamp: Date.now()
	  });

	  this.auditCredentialAccess(credentialId, userId, workflowId, 'vault-retrieved');
	  return decryptedData;

	} catch (error) {
	  this.auditCredentialAccess(credentialId, userId, workflowId, 'error', error.message);
	  throw error;
	}
  }

  async storeCredential(credentialId, credentialData, userId) {
	try {
	  // Encrypt credential data
	  const encryptionKey = process.env.N8N_ENCRYPTION_KEY;
	  const encryptedData = this.encryptCredential(credentialData, encryptionKey);

	  // Add metadata
	  const vaultData = {
		data: encryptedData,
		metadata: {
		  createdBy: userId,
		  createdAt: new Date().toISOString(),
		  version: this.generateVersion(),
		  tags: credentialData.tags || [],
		  environment: process.env.NODE_ENV
		}
	  };

	  // Store in Vault
	  const secretPath = `n8n/credentials/${credentialId}`;
	  await this.vaultClient.write(secretPath, vaultData);

	  // Set up automatic rotation if supported
	  if (this.supportsRotation(credentialData.type)) {
		await this.scheduleCredentialRotation(credentialId, credentialData.rotationPolicy);
	  }

	  // Invalidate cache
	  this.invalidateCredentialCache(credentialId);

	  this.auditCredentialManagement(credentialId, userId, 'created');
	  return true;

	} catch (error) {
	  this.auditCredentialManagement(credentialId, userId, 'create-failed', error.message);
	  throw error;
	}
  }

  async rotateCredential(credentialId) {
	try {
	  const secretPath = `n8n/credentials/${credentialId}`;
	  const currentCredential = await this.vaultClient.read(secretPath);
	  
	  if (!currentCredential) {
		throw new Error(`Credential ${credentialId} not found for rotation`);
	  }

	  // Generate new credential based on type
	  const credentialType = currentCredential.data.metadata.type;
	  const newCredentialData = await this.generateNewCredential(credentialType, currentCredential.data);

	  // Store new version while keeping old version accessible
	  const newVersion = this.generateVersion();
	  await this.vaultClient.write(`${secretPath}/v${newVersion}`, {
		...currentCredential.data,
		data: newCredentialData,
		metadata: {
		  ...currentCredential.data.metadata,
		  rotatedAt: new Date().toISOString(),
		  version: newVersion,
		  previousVersion: currentCredential.data.metadata.version
		}
	  });

	  // Update current version pointer
	  await this.vaultClient.write(secretPath, {
		...currentCredential.data,
		data: newCredentialData,
		metadata: {
		  ...currentCredential.data.metadata,
		  rotatedAt: new Date().toISOString(),
		  version: newVersion
		}
	  });

	  // Invalidate cache
	  this.invalidateCredentialCache(credentialId);

	  // Schedule next rotation
	  await this.scheduleCredentialRotation(credentialId, currentCredential.data.metadata.rotationPolicy);

	  this.auditCredentialManagement(credentialId, 'system', 'rotated', `New version: ${newVersion}`);
	  return newVersion;

	} catch (error) {
	  this.auditCredentialManagement(credentialId, 'system', 'rotation-failed', error.message);
	  throw error;
	}
  }

  async verifyCredentialAccess(credentialId, userId) {
	// Implement RBAC verification
	const user = await this.getUserContext(userId);
	const credential = await this.getCredentialMetadata(credentialId);
	
	// Check direct permissions
	if (credential.metadata.allowedUsers?.includes(userId)) {
	  return true;
	}

	// Check group permissions
	const userGroups = user.groups || [];
	const allowedGroups = credential.metadata.allowedGroups || [];
	
	if (userGroups.some(group => allowedGroups.includes(group))) {
	  return true;
	}

	// Check role-based permissions
	const userRoles = user.roles || [];
	const allowedRoles = credential.metadata.allowedRoles || [];
	
	if (userRoles.some(role => allowedRoles.includes(role))) {
	  return true;
	}

	return false;
  }

  auditCredentialAccess(credentialId, userId, workflowId, action, details = null) {
	const auditEntry = {
	  timestamp: new Date().toISOString(),
	  event: 'credential_access',
	  credentialId: credentialId,
	  userId: userId,
	  workflowId: workflowId,
	  action: action,
	  details: details,
	  sourceIp: this.getCurrentRequestIp(),
	  userAgent: this.getCurrentUserAgent()
	};

	// Send to audit logging system
	this.sendToAuditLog(auditEntry);
  }

  auditCredentialManagement(credentialId, userId, action, details = null) {
	const auditEntry = {
	  timestamp: new Date().toISOString(),
	  event: 'credential_management',
	  credentialId: credentialId,
	  userId: userId,
	  action: action,
	  details: details,
	  sourceIp: this.getCurrentRequestIp(),
	  userAgent: this.getCurrentUserAgent()
	};

	this.sendToAuditLog(auditEntry);
  }
}

// enterprise-secret-manager.js - HashiCorp Vault Integration
class EnterpriseSecretManager {
  constructor() {
	this.vaultClient = new VaultClient({
	  endpoint: process.env.VAULT_ENDPOINT,
	  token: process.env.VAULT_TOKEN
	});
	this.credentialCache = new Map();
	this.cacheTimeout = 300000; // 5 minutes
  }

  async getCredential(credentialId, userId, workflowId) {
	try {
	  // Check cache first
	  const cacheKey = `${credentialId}_${userId}`;
	  const cached = this.credentialCache.get(cacheKey);
	  
	  if (cached && Date.now() - cached.timestamp < this.cacheTimeout) {
		this.auditCredentialAccess(credentialId, userId, workflowId, 'cache-hit');
		return cached.data;
	  }

	  // Retrieve from Vault
	  const secretPath = `n8n/credentials/${credentialId}`;
	  const vaultResponse = await this.vaultClient.read(secretPath);
	  
	  if (!vaultResponse || !vaultResponse.data) {
		throw new Error(`Credential ${credentialId} not found in Vault`);
	  }

	  // Verify user access to credential
	  const accessGranted = await this.verifyCredentialAccess(credentialId, userId);
	  if (!accessGranted) {
		this.auditCredentialAccess(credentialId, userId, workflowId, 'access-denied');
		throw new Error(`User ${userId} not authorized for credential ${credentialId}`);
	  }

	  // Decrypt credential data
	  const encryptionKey = process.env.N8N_ENCRYPTION_KEY;
	  const decryptedData = this.decryptCredential(vaultResponse.data.data, encryptionKey);
	  
	  // Cache decrypted data
	  this.credentialCache.set(cacheKey, {
		data: decryptedData,
		timestamp: Date.now()
	  });

	  this.auditCredentialAccess(credentialId, userId, workflowId, 'vault-retrieved');
	  return decryptedData;

	} catch (error) {
	  this.auditCredentialAccess(credentialId, userId, workflowId, 'error', error.message);
	  throw error;
	}
  }

  async storeCredential(credentialId, credentialData, userId) {
	try {
	  // Encrypt credential data
	  const encryptionKey = process.env.N8N_ENCRYPTION_KEY;
	  const encryptedData = this.encryptCredential(credentialData, encryptionKey);

	  // Add metadata
	  const vaultData = {
		data: encryptedData,
		metadata: {
		  createdBy: userId,
		  createdAt: new Date().toISOString(),
		  version: this.generateVersion(),
		  tags: credentialData.tags || [],
		  environment: process.env.NODE_ENV
		}
	  };

	  // Store in Vault
	  const secretPath = `n8n/credentials/${credentialId}`;
	  await this.vaultClient.write(secretPath, vaultData);

	  // Set up automatic rotation if supported
	  if (this.supportsRotation(credentialData.type)) {
		await this.scheduleCredentialRotation(credentialId, credentialData.rotationPolicy);
	  }

	  // Invalidate cache
	  this.invalidateCredentialCache(credentialId);

	  this.auditCredentialManagement(credentialId, userId, 'created');
	  return true;

	} catch (error) {
	  this.auditCredentialManagement(credentialId, userId, 'create-failed', error.message);
	  throw error;
	}
  }

  async rotateCredential(credentialId) {
	try {
	  const secretPath = `n8n/credentials/${credentialId}`;
	  const currentCredential = await this.vaultClient.read(secretPath);
	  
	  if (!currentCredential) {
		throw new Error(`Credential ${credentialId} not found for rotation`);
	  }

	  // Generate new credential based on type
	  const credentialType = currentCredential.data.metadata.type;
	  const newCredentialData = await this.generateNewCredential(credentialType, currentCredential.data);

	  // Store new version while keeping old version accessible
	  const newVersion = this.generateVersion();
	  await this.vaultClient.write(`${secretPath}/v${newVersion}`, {
		...currentCredential.data,
		data: newCredentialData,
		metadata: {
		  ...currentCredential.data.metadata,
		  rotatedAt: new Date().toISOString(),
		  version: newVersion,
		  previousVersion: currentCredential.data.metadata.version
		}
	  });

	  // Update current version pointer
	  await this.vaultClient.write(secretPath, {
		...currentCredential.data,
		data: newCredentialData,
		metadata: {
		  ...currentCredential.data.metadata,
		  rotatedAt: new Date().toISOString(),
		  version: newVersion
		}
	  });

	  // Invalidate cache
	  this.invalidateCredentialCache(credentialId);

	  // Schedule next rotation
	  await this.scheduleCredentialRotation(credentialId, currentCredential.data.metadata.rotationPolicy);

	  this.auditCredentialManagement(credentialId, 'system', 'rotated', `New version: ${newVersion}`);
	  return newVersion;

	} catch (error) {
	  this.auditCredentialManagement(credentialId, 'system', 'rotation-failed', error.message);
	  throw error;
	}
  }

  async verifyCredentialAccess(credentialId, userId) {
	// Implement RBAC verification
	const user = await this.getUserContext(userId);
	const credential = await this.getCredentialMetadata(credentialId);
	
	// Check direct permissions
	if (credential.metadata.allowedUsers?.includes(userId)) {
	  return true;
	}

	// Check group permissions
	const userGroups = user.groups || [];
	const allowedGroups = credential.metadata.allowedGroups || [];
	
	if (userGroups.some(group => allowedGroups.includes(group))) {
	  return true;
	}

	// Check role-based permissions
	const userRoles = user.roles || [];
	const allowedRoles = credential.metadata.allowedRoles || [];
	
	if (userRoles.some(role => allowedRoles.includes(role))) {
	  return true;
	}

	return false;
  }

  auditCredentialAccess(credentialId, userId, workflowId, action, details = null) {
	const auditEntry = {
	  timestamp: new Date().toISOString(),
	  event: 'credential_access',
	  credentialId: credentialId,
	  userId: userId,
	  workflowId: workflowId,
	  action: action,
	  details: details,
	  sourceIp: this.getCurrentRequestIp(),
	  userAgent: this.getCurrentUserAgent()
	};

	// Send to audit logging system
	this.sendToAuditLog(auditEntry);
  }

  auditCredentialManagement(credentialId, userId, action, details = null) {
	const auditEntry = {
	  timestamp: new Date().toISOString(),
	  event: 'credential_management',
	  credentialId: credentialId,
	  userId: userId,
	  action: action,
	  details: details,
	  sourceIp: this.getCurrentRequestIp(),
	  userAgent: this.getCurrentUserAgent()
	};

	this.sendToAuditLog(auditEntry);
  }
}

JavaScript

Credential Encryption und Key Management:

#!/bin/bash
# credential-encryption-setup.sh - Enterprise Credential Encryption

set -euo pipefail

VAULT_NAMESPACE="n8n-production"
KEY_ROTATION_DAYS=90
BACKUP_RETENTION_DAYS=365

# Initialize Vault Transit Engine für Credential Encryption
setup_vault_transit() {
  echo "🔐 Setting up Vault transit engine..."
  
  # Enable transit secrets engine
  vault secrets enable -path=n8n-transit transit
  
  # Create encryption key für n8n credentials
  vault write -f n8n-transit/keys/n8n-credentials \
	type=aes256-gcm96 \
	exportable=false \
	allow_plaintext_backup=false \
	auto_rotate_period=${KEY_ROTATION_DAYS}d
  
  # Create policy für n8n service
  cat << 'EOF' > n8n-transit-policy.hcl
path "n8n-transit/encrypt/n8n-credentials" {
  capabilities = ["update"]
}

path "n8n-transit/decrypt/n8n-credentials" {
  capabilities = ["update"]
}

path "n8n-transit/datakey/plaintext/n8n-credentials" {
  capabilities = ["update"]
}

path "n8n-transit/keys/n8n-credentials" {
  capabilities = ["read"]
}
EOF

  vault policy write n8n-transit-policy n8n-transit-policy.hcl
  
  # Create service token
  vault write auth/token/create \
	policies="n8n-transit-policy" \
	renewable=true \
	ttl=8760h \
	explicit_max_ttl=8760h
}

# Credential backup strategy
backup_credentials() {
  local backup_dir="/opt/n8n/backups/credentials"
  local timestamp=$(date +"%Y%m%d_%H%M%S")
  
  echo "💾 Creating encrypted credential backup..."
  
  mkdir -p "${backup_dir}/${timestamp}"
  
  # Export credentials from Vault
  vault kv get -format=json n8n/credentials/ | \
	jq '.data' > "${backup_dir}/${timestamp}/credentials.json"
  
  # Encrypt backup with GPG
  gpg --cipher-algo AES256 \
	  --compress-algo 2 \
	  --symmetric \
	  --armor \
	  --passphrase "${BACKUP_ENCRYPTION_KEY}" \
	  --output "${backup_dir}/${timestamp}/credentials.json.gpg" \
	  "${backup_dir}/${timestamp}/credentials.json"
  
  # Remove plaintext backup
  rm "${backup_dir}/${timestamp}/credentials.json"
  
  # Create backup manifest
  cat << EOF > "${backup_dir}/${timestamp}/manifest.json"
{
  "timestamp": "${timestamp}",
  "vault_version": "$(vault version | head -n1)",
  "encryption_key_version": "$(vault read -field=latest_version n8n-transit/keys/n8n-credentials)",
  "credential_count": $(vault kv list -format=json n8n/credentials/ | jq '. | length'),
  "backup_type": "full",
  "retention_until": "$(date -d "+${BACKUP_RETENTION_DAYS} days" +"%Y-%m-%d")"
}
EOF

  echo "✅ Backup created: ${backup_dir}/${timestamp}"
}

# Credential rotation automation
rotate_expired_credentials() {
  echo "🔄 Checking for credentials requiring rotation..."
  
  local rotation_threshold=$(date -d "-${KEY_ROTATION_DAYS} days" +"%Y-%m-%d")
  
  # Get list of credentials from Vault
  vault kv list -format=json n8n/credentials/ | jq -r '.[]' | while read credential_id; do
	# Get credential metadata
	local last_rotation=$(vault kv get -format=json "n8n/credentials/${credential_id}" | \
	  jq -r '.data.metadata.rotatedAt // .data.metadata.createdAt')
	
	if [[ "${last_rotation}" < "${rotation_threshold}" ]]; then
	  echo "📅 Credential ${credential_id} requires rotation (last: ${last_rotation})"
	  
	  # Trigger rotation via n8n API
	  curl -X POST "https://n8n.company.com/api/v1/credentials/${credential_id}/rotate" \
		-H "Authorization: Bearer ${N8N_API_TOKEN}" \
		-H "Content-Type: application/json"
	fi
  done
}

# Main execution
main() {
  case "${1:-setup}" in
	setup)
	  setup_vault_transit
	  ;;
	backup)
	  backup_credentials
	  ;;
	rotate)
	  rotate_expired_credentials
	  ;;
	*)
	  echo "Usage: $0 [setup|backup|rotate]"
	  exit 1
	  ;;
  esac
}

main "$@"

#!/bin/bash
# credential-encryption-setup.sh - Enterprise Credential Encryption

set -euo pipefail

VAULT_NAMESPACE="n8n-production"
KEY_ROTATION_DAYS=90
BACKUP_RETENTION_DAYS=365

# Initialize Vault Transit Engine für Credential Encryption
setup_vault_transit() {
  echo "🔐 Setting up Vault transit engine..."
  
  # Enable transit secrets engine
  vault secrets enable -path=n8n-transit transit
  
  # Create encryption key für n8n credentials
  vault write -f n8n-transit/keys/n8n-credentials \
	type=aes256-gcm96 \
	exportable=false \
	allow_plaintext_backup=false \
	auto_rotate_period=${KEY_ROTATION_DAYS}d
  
  # Create policy für n8n service
  cat << 'EOF' > n8n-transit-policy.hcl
path "n8n-transit/encrypt/n8n-credentials" {
  capabilities = ["update"]
}

path "n8n-transit/decrypt/n8n-credentials" {
  capabilities = ["update"]
}

path "n8n-transit/datakey/plaintext/n8n-credentials" {
  capabilities = ["update"]
}

path "n8n-transit/keys/n8n-credentials" {
  capabilities = ["read"]
}
EOF

  vault policy write n8n-transit-policy n8n-transit-policy.hcl
  
  # Create service token
  vault write auth/token/create \
	policies="n8n-transit-policy" \
	renewable=true \
	ttl=8760h \
	explicit_max_ttl=8760h
}

# Credential backup strategy
backup_credentials() {
  local backup_dir="/opt/n8n/backups/credentials"
  local timestamp=$(date +"%Y%m%d_%H%M%S")
  
  echo "💾 Creating encrypted credential backup..."
  
  mkdir -p "${backup_dir}/${timestamp}"
  
  # Export credentials from Vault
  vault kv get -format=json n8n/credentials/ | \
	jq '.data' > "${backup_dir}/${timestamp}/credentials.json"
  
  # Encrypt backup with GPG
  gpg --cipher-algo AES256 \
	  --compress-algo 2 \
	  --symmetric \
	  --armor \
	  --passphrase "${BACKUP_ENCRYPTION_KEY}" \
	  --output "${backup_dir}/${timestamp}/credentials.json.gpg" \
	  "${backup_dir}/${timestamp}/credentials.json"
  
  # Remove plaintext backup
  rm "${backup_dir}/${timestamp}/credentials.json"
  
  # Create backup manifest
  cat << EOF > "${backup_dir}/${timestamp}/manifest.json"
{
  "timestamp": "${timestamp}",
  "vault_version": "$(vault version | head -n1)",
  "encryption_key_version": "$(vault read -field=latest_version n8n-transit/keys/n8n-credentials)",
  "credential_count": $(vault kv list -format=json n8n/credentials/ | jq '. | length'),
  "backup_type": "full",
  "retention_until": "$(date -d "+${BACKUP_RETENTION_DAYS} days" +"%Y-%m-%d")"
}
EOF

  echo "✅ Backup created: ${backup_dir}/${timestamp}"
}

# Credential rotation automation
rotate_expired_credentials() {
  echo "🔄 Checking for credentials requiring rotation..."
  
  local rotation_threshold=$(date -d "-${KEY_ROTATION_DAYS} days" +"%Y-%m-%d")
  
  # Get list of credentials from Vault
  vault kv list -format=json n8n/credentials/ | jq -r '.[]' | while read credential_id; do
	# Get credential metadata
	local last_rotation=$(vault kv get -format=json "n8n/credentials/${credential_id}" | \
	  jq -r '.data.metadata.rotatedAt // .data.metadata.createdAt')
	
	if [[ "${last_rotation}" < "${rotation_threshold}" ]]; then
	  echo "📅 Credential ${credential_id} requires rotation (last: ${last_rotation})"
	  
	  # Trigger rotation via n8n API
	  curl -X POST "https://n8n.company.com/api/v1/credentials/${credential_id}/rotate" \
		-H "Authorization: Bearer ${N8N_API_TOKEN}" \
		-H "Content-Type: application/json"
	fi
  done
}

# Main execution
main() {
  case "${1:-setup}" in
	setup)
	  setup_vault_transit
	  ;;
	backup)
	  backup_credentials
	  ;;
	rotate)
	  rotate_expired_credentials
	  ;;
	*)
	  echo "Usage: $0 [setup|backup|rotate]"
	  exit 1
	  ;;
  esac
}

main "$@"

Bash

❗ Critical Security Note: Niemals Credentials in n8n-Workflow-Definitionen hardcoden. Immer externe Secret-Management-Systeme verwenden und Credential-Access-Patterns auditieren.

Compliance, Audit-Logging und Governance

Compliance-Anforderungen wie GDPR, SOX, HIPAA oder PCI-DSS erfordern umfassende Audit-Trails, Daten-Governance und Reporting-Mechanismen. n8n muss in diese Compliance-Frameworks integriert werden und nachweisbare Kontrollen bieten.

Comprehensive Audit Logging:

// enterprise-audit-logger.js - Compliance-grade Audit Logging
class ComplianceAuditLogger {
  constructor(config) {
	this.config = {
	  environment: config.environment || 'production',
	  auditLevel: config.auditLevel || 'comprehensive',
	  retentionPeriod: config.retentionPeriod || '2555', // 7 years for compliance
	  encryptionEnabled: config.encryptionEnabled || true,
	  realTimeAlerts: config.realTimeAlerts || true,
	  ...config
	};
	
	this.initializeAuditTargets();
  }

  initializeAuditTargets() {
	this.auditTargets = [
	  new DatabaseAuditTarget(this.config.database),
	  new SyslogAuditTarget(this.config.syslog),
	  new ElasticsearchAuditTarget(this.config.elasticsearch),
	  new ComplianceReportingTarget(this.config.reporting)
	];
  }

  async logWorkflowEvent(eventType, workflowContext, userContext, additionalData = {}) {
	const auditEntry = {
	  // Standard Audit Fields
	  timestamp: new Date().toISOString(),
	  eventId: this.generateEventId(),
	  eventType: eventType,
	  eventCategory: 'workflow_operation',
	  severity: this.determineSeverity(eventType),
	  
	  // User Context
	  user: {
		id: userContext.id,
		email: userContext.email,
		roles: userContext.roles,
		groups: userContext.groups,
		sessionId: userContext.sessionId,
		ipAddress: userContext.ipAddress,
		userAgent: userContext.userAgent
	  },
	  
	  // Workflow Context  
	  workflow: {
		id: workflowContext.id,
		name: workflowContext.name,
		version: workflowContext.version,
		environment: workflowContext.environment,
		tags: workflowContext.tags,
		executionMode: workflowContext.executionMode,
		triggeredBy: workflowContext.triggeredBy
	  },
	  
	  // Technical Context
	  system: {
		instanceId: process.env.N8N_INSTANCE_ID,
		version: process.env.N8N_VERSION,
		nodeVersion: process.version,
		platform: process.platform,
		hostname: require('os').hostname()
	  },
	  
	  // Compliance Fields
	  compliance: {
		dataClassification: this.classifyWorkflowData(workflowContext),
		regulatoryContext: this.determineRegulatoryContext(workflowContext),
		retentionCategory: this.determineRetentionCategory(eventType),
		privacyImpact: this.assessPrivacyImpact(workflowContext)
	  },
	  
	  // Additional Context
	  additionalData: additionalData
	};

	// Enhanced logging for sensitive operations
	if (this.isSensitiveOperation(eventType)) {
	  auditEntry.security = {
		riskLevel: 'high',
		requiresReview: true,
		escalationRequired: this.requiresEscalation(eventType, userContext),
		complianceFlags: this.getComplianceFlags(workflowContext)
	  };
	}

	// Data Processing Activities (GDPR Article 30)
	if (this.involvesPersonalData(workflowContext)) {
	  auditEntry.dataProcessing = {
		purposes: this.extractDataProcessingPurposes(workflowContext),
		categories: this.categorizePersonalData(workflowContext),
		recipients: this.identifyDataRecipients(workflowContext),
		transfers: this.identifyDataTransfers(workflowContext),
		retention: this.getDataRetentionPolicy(workflowContext)
	  };
	}

	// Encrypt sensitive audit data
	if (this.config.encryptionEnabled) {
	  auditEntry.encryptedFields = await this.encryptSensitiveFields(auditEntry);
	}

	// Send to audit targets
	await this.sendToAuditTargets(auditEntry);

	// Real-time alerting for critical events
	if (this.config.realTimeAlerts && this.isCriticalEvent(eventType)) {
	  await this.sendRealTimeAlert(auditEntry);
	}

	return auditEntry.eventId;
  }

  classifyWorkflowData(workflowContext) {
	const classifications = [];
	
	// Analyze workflow tags and content
	const tags = workflowContext.tags || [];
	
	if (tags.includes('pii') || tags.includes('personal-data')) {
	  classifications.push('PERSONAL_DATA');
	}
	
	if (tags.includes('financial') || tags.includes('payment')) {
	  classifications.push('FINANCIAL_DATA');
	}
	
	if (tags.includes('health') || tags.includes('medical')) {
	  classifications.push('HEALTH_DATA');
	}
	
	if (tags.includes('classified') || tags.includes('confidential')) {
	  classifications.push('CONFIDENTIAL');
	}

	return classifications.length > 0 ? classifications : ['PUBLIC'];
  }

  determineRegulatoryContext(workflowContext) {
	const contexts = [];
	const tags = workflowContext.tags || [];
	const environment = workflowContext.environment;

	// GDPR applicability
	if (tags.includes('eu-data') || tags.includes('gdpr')) {
	  contexts.push('GDPR');
	}

	// HIPAA applicability  
	if (tags.includes('healthcare') || tags.includes('hipaa')) {
	  contexts.push('HIPAA');
	}

	// SOX applicability
	if (tags.includes('financial-reporting') || tags.includes('sox')) {
	  contexts.push('SOX');
	}

	// PCI-DSS applicability
	if (tags.includes('payment-processing') || tags.includes('pci')) {
	  contexts.push('PCI_DSS');
	}

	// Production data requires enhanced compliance
	if (environment === 'production') {
	  contexts.push('PRODUCTION_DATA');
	}

	return contexts;
  }

  async generateComplianceReport(reportType, timeRange) {
	const report = {
	  reportId: this.generateReportId(),
	  reportType: reportType,
	  generatedAt: new Date().toISOString(),
	  timeRange: timeRange,
	  generatedBy: 'system',
	  sections: {}
	};

	switch (reportType) {
	  case 'gdpr-article-30':
		report.sections = await this.generateGDPRArticle30Report(timeRange);
		break;
		
	  case 'sox-controls':
		report.sections = await this.generateSOXControlsReport(timeRange);
		break;
		
	  case 'security-audit':
		report.sections = await this.generateSecurityAuditReport(timeRange);
		break;
		
	  case 'data-lineage':
		report.sections = await this.generateDataLineageReport(timeRange);
		break;
	}

	// Sign report for integrity
	report.signature = await this.signReport(report);
	
	return report;
  }

  async generateGDPRArticle30Report(timeRange) {
	return {
	  dataProcessingActivities: await this.getDataProcessingActivities(timeRange),
	  legalBases: await this.getLegalBasesUsed(timeRange),
	  dataSubjectRights: await this.getDataSubjectRightsExercised(timeRange),
	  dataBreaches: await this.getDataBreachIncidents(timeRange),
	  dataTransfers: await this.getInternationalDataTransfers(timeRange),
	  retentionCompliance: await this.getRetentionComplianceStatus(timeRange)
	};
  }
}

// Usage in n8n webhook/trigger
const auditLogger = new ComplianceAuditLogger({
  environment: process.env.NODE_ENV,
  auditLevel: 'comprehensive',
  database: process.env.AUDIT_DATABASE_URL,
  elasticsearch: process.env.AUDIT_ELASTICSEARCH_URL,
  encryptionEnabled: true,
  realTimeAlerts: true
});

// Audit workflow execution
await auditLogger.logWorkflowEvent(
  'workflow_executed',
  {
	id: $workflow.id,
	name: $workflow.name,
	environment: process.env.NODE_ENV,
	tags: $workflow.tags,
	executionMode: 'webhook'
  },
  {
	id: $user?.id || 'system',
	email: $user?.email || 'system@company.com',
	roles: $user?.roles || ['system'],
	ipAddress: $request.ip
  },
  {
	inputDataSize: JSON.stringify($input.all()).length,
	processingDuration: Date.now() - $execution.startTime,
	nodesExecuted: $execution.nodeCount
  }
);

// enterprise-audit-logger.js - Compliance-grade Audit Logging
class ComplianceAuditLogger {
  constructor(config) {
	this.config = {
	  environment: config.environment || 'production',
	  auditLevel: config.auditLevel || 'comprehensive',
	  retentionPeriod: config.retentionPeriod || '2555', // 7 years for compliance
	  encryptionEnabled: config.encryptionEnabled || true,
	  realTimeAlerts: config.realTimeAlerts || true,
	  ...config
	};
	
	this.initializeAuditTargets();
  }

  initializeAuditTargets() {
	this.auditTargets = [
	  new DatabaseAuditTarget(this.config.database),
	  new SyslogAuditTarget(this.config.syslog),
	  new ElasticsearchAuditTarget(this.config.elasticsearch),
	  new ComplianceReportingTarget(this.config.reporting)
	];
  }

  async logWorkflowEvent(eventType, workflowContext, userContext, additionalData = {}) {
	const auditEntry = {
	  // Standard Audit Fields
	  timestamp: new Date().toISOString(),
	  eventId: this.generateEventId(),
	  eventType: eventType,
	  eventCategory: 'workflow_operation',
	  severity: this.determineSeverity(eventType),
	  
	  // User Context
	  user: {
		id: userContext.id,
		email: userContext.email,
		roles: userContext.roles,
		groups: userContext.groups,
		sessionId: userContext.sessionId,
		ipAddress: userContext.ipAddress,
		userAgent: userContext.userAgent
	  },
	  
	  // Workflow Context  
	  workflow: {
		id: workflowContext.id,
		name: workflowContext.name,
		version: workflowContext.version,
		environment: workflowContext.environment,
		tags: workflowContext.tags,
		executionMode: workflowContext.executionMode,
		triggeredBy: workflowContext.triggeredBy
	  },
	  
	  // Technical Context
	  system: {
		instanceId: process.env.N8N_INSTANCE_ID,
		version: process.env.N8N_VERSION,
		nodeVersion: process.version,
		platform: process.platform,
		hostname: require('os').hostname()
	  },
	  
	  // Compliance Fields
	  compliance: {
		dataClassification: this.classifyWorkflowData(workflowContext),
		regulatoryContext: this.determineRegulatoryContext(workflowContext),
		retentionCategory: this.determineRetentionCategory(eventType),
		privacyImpact: this.assessPrivacyImpact(workflowContext)
	  },
	  
	  // Additional Context
	  additionalData: additionalData
	};

	// Enhanced logging for sensitive operations
	if (this.isSensitiveOperation(eventType)) {
	  auditEntry.security = {
		riskLevel: 'high',
		requiresReview: true,
		escalationRequired: this.requiresEscalation(eventType, userContext),
		complianceFlags: this.getComplianceFlags(workflowContext)
	  };
	}

	// Data Processing Activities (GDPR Article 30)
	if (this.involvesPersonalData(workflowContext)) {
	  auditEntry.dataProcessing = {
		purposes: this.extractDataProcessingPurposes(workflowContext),
		categories: this.categorizePersonalData(workflowContext),
		recipients: this.identifyDataRecipients(workflowContext),
		transfers: this.identifyDataTransfers(workflowContext),
		retention: this.getDataRetentionPolicy(workflowContext)
	  };
	}

	// Encrypt sensitive audit data
	if (this.config.encryptionEnabled) {
	  auditEntry.encryptedFields = await this.encryptSensitiveFields(auditEntry);
	}

	// Send to audit targets
	await this.sendToAuditTargets(auditEntry);

	// Real-time alerting for critical events
	if (this.config.realTimeAlerts && this.isCriticalEvent(eventType)) {
	  await this.sendRealTimeAlert(auditEntry);
	}

	return auditEntry.eventId;
  }

  classifyWorkflowData(workflowContext) {
	const classifications = [];
	
	// Analyze workflow tags and content
	const tags = workflowContext.tags || [];
	
	if (tags.includes('pii') || tags.includes('personal-data')) {
	  classifications.push('PERSONAL_DATA');
	}
	
	if (tags.includes('financial') || tags.includes('payment')) {
	  classifications.push('FINANCIAL_DATA');
	}
	
	if (tags.includes('health') || tags.includes('medical')) {
	  classifications.push('HEALTH_DATA');
	}
	
	if (tags.includes('classified') || tags.includes('confidential')) {
	  classifications.push('CONFIDENTIAL');
	}

	return classifications.length > 0 ? classifications : ['PUBLIC'];
  }

  determineRegulatoryContext(workflowContext) {
	const contexts = [];
	const tags = workflowContext.tags || [];
	const environment = workflowContext.environment;

	// GDPR applicability
	if (tags.includes('eu-data') || tags.includes('gdpr')) {
	  contexts.push('GDPR');
	}

	// HIPAA applicability  
	if (tags.includes('healthcare') || tags.includes('hipaa')) {
	  contexts.push('HIPAA');
	}

	// SOX applicability
	if (tags.includes('financial-reporting') || tags.includes('sox')) {
	  contexts.push('SOX');
	}

	// PCI-DSS applicability
	if (tags.includes('payment-processing') || tags.includes('pci')) {
	  contexts.push('PCI_DSS');
	}

	// Production data requires enhanced compliance
	if (environment === 'production') {
	  contexts.push('PRODUCTION_DATA');
	}

	return contexts;
  }

  async generateComplianceReport(reportType, timeRange) {
	const report = {
	  reportId: this.generateReportId(),
	  reportType: reportType,
	  generatedAt: new Date().toISOString(),
	  timeRange: timeRange,
	  generatedBy: 'system',
	  sections: {}
	};

	switch (reportType) {
	  case 'gdpr-article-30':
		report.sections = await this.generateGDPRArticle30Report(timeRange);
		break;
		
	  case 'sox-controls':
		report.sections = await this.generateSOXControlsReport(timeRange);
		break;
		
	  case 'security-audit':
		report.sections = await this.generateSecurityAuditReport(timeRange);
		break;
		
	  case 'data-lineage':
		report.sections = await this.generateDataLineageReport(timeRange);
		break;
	}

	// Sign report for integrity
	report.signature = await this.signReport(report);
	
	return report;
  }

  async generateGDPRArticle30Report(timeRange) {
	return {
	  dataProcessingActivities: await this.getDataProcessingActivities(timeRange),
	  legalBases: await this.getLegalBasesUsed(timeRange),
	  dataSubjectRights: await this.getDataSubjectRightsExercised(timeRange),
	  dataBreaches: await this.getDataBreachIncidents(timeRange),
	  dataTransfers: await this.getInternationalDataTransfers(timeRange),
	  retentionCompliance: await this.getRetentionComplianceStatus(timeRange)
	};
  }
}

// Usage in n8n webhook/trigger
const auditLogger = new ComplianceAuditLogger({
  environment: process.env.NODE_ENV,
  auditLevel: 'comprehensive',
  database: process.env.AUDIT_DATABASE_URL,
  elasticsearch: process.env.AUDIT_ELASTICSEARCH_URL,
  encryptionEnabled: true,
  realTimeAlerts: true
});

// Audit workflow execution
await auditLogger.logWorkflowEvent(
  'workflow_executed',
  {
	id: $workflow.id,
	name: $workflow.name,
	environment: process.env.NODE_ENV,
	tags: $workflow.tags,
	executionMode: 'webhook'
  },
  {
	id: $user?.id || 'system',
	email: $user?.email || 'system@company.com',
	roles: $user?.roles || ['system'],
	ipAddress: $request.ip
  },
  {
	inputDataSize: JSON.stringify($input.all()).length,
	processingDuration: Date.now() - $execution.startTime,
	nodesExecuted: $execution.nodeCount
  }
);

JavaScript

Governance Framework Implementation:

# governance-policies.yaml - n8n Governance Configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: n8n-governance-policies
  namespace: n8n-production
data:
  workflow-governance.yaml: |
	# Workflow Governance Policies
	policies:
	  workflow_creation:
		approval_required: true
		approval_matrix:
		  development: ["team-lead"]
		  staging: ["devops-engineer", "security-officer"]
		  production: ["devops-lead", "security-officer", "compliance-officer"]
		
		mandatory_fields:
		  - description
		  - owner
		  - criticality_level
		  - data_classification
		  - regulatory_context
		
		naming_convention:
		  pattern: "^[a-z0-9\\-]+$"
		  max_length: 50
		  reserved_prefixes: ["system-", "admin-", "security-"]
		
		tagging_requirements:
		  mandatory_tags: ["environment", "team", "criticality"]
		  allowed_values:
			environment: ["development", "staging", "production"]
			criticality: ["low", "medium", "high", "critical"]
			team: ["devops", "platform", "security", "data"]
	  
	  credential_management:
		encryption_required: true
		rotation_policy:
		  max_age_days: 90
		  notification_days: 7
		
		access_control:
		  approval_required: true
		  approval_matrix:
			production_credentials: ["security-officer", "devops-lead"]
			development_credentials: ["team-lead"]
		
		audit_requirements:
		  log_all_access: true
		  log_all_modifications: true
		  retention_days: 2555  # 7 years
	  
	  data_governance:
		personal_data_handling:
		  consent_tracking: true
		  purpose_limitation: true
		  data_minimization: true
		  retention_limits:
			default_days: 365
			marketing_days: 730
			legal_days: 2555
		
		data_classification:
		  automatic_detection: true
		  classification_levels: ["public", "internal", "confidential", "restricted"]
		  handling_requirements:
			confidential: ["encryption", "access_logging", "approval_required"]
			restricted: ["encryption", "access_logging", "approval_required", "air_gapped"]
  
  compliance-controls.yaml: |
	# Compliance Control Framework
	controls:
	  access_controls:
		AC-001:
		  title: "User Authentication"
		  requirement: "All users must authenticate via SSO"
		  implementation: "SAML/OIDC integration required"
		  verification: "Automated compliance check"
		
		AC-002:
		  title: "Role-Based Access Control"
		  requirement: "Principle of least privilege"
		  implementation: "RBAC engine with regular reviews"
		  verification: "Quarterly access reviews"
	  
	  audit_controls:
		AU-001:
		  title: "Comprehensive Audit Logging"
		  requirement: "All actions must be logged"
		  implementation: "Centralized audit logging system"
		  verification: "Log completeness verification"
		
		AU-002:
		  title: "Audit Log Protection"
		  requirement: "Audit logs must be tamper-evident"
		  implementation: "Cryptographic signatures and immutable storage"
		  verification: "Integrity verification process"
	  
	  data_protection:
		DP-001:
		  title: "Data Encryption"
		  requirement: "All sensitive data encrypted"
		  implementation: "AES-256 encryption at rest and in transit"
		  verification: "Encryption verification scans"
		
		DP-002:
		  title: "Data Retention"
		  requirement: "Data retained per policy"
		  implementation: "Automated retention and deletion"
		  verification: "Retention compliance reports"

---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: governance-compliance-check
  namespace: n8n-production
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM
  jobTemplate:
	spec:
	  template:
		spec:
		  containers:
		  - name: compliance-checker
			image: company-registry.com/n8n-compliance:latest
			command: ["/scripts/check-compliance.sh"]
			env:
			- name: N8N_API_URL
			  value: "https://n8n.company.com"
			- name: N8N_API_TOKEN
			  valueFrom:
				secretKeyRef:
				  name: n8n-api-credentials
				  key: api-token
			volumeMounts:
			- name: governance-policies
			  mountPath: /etc/governance
		  volumes:
		  - name: governance-policies
			configMap:
			  name: n8n-governance-policies
		  restartPolicy: OnFailure

# governance-policies.yaml - n8n Governance Configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: n8n-governance-policies
  namespace: n8n-production
data:
  workflow-governance.yaml: |
	# Workflow Governance Policies
	policies:
	  workflow_creation:
		approval_required: true
		approval_matrix:
		  development: ["team-lead"]
		  staging: ["devops-engineer", "security-officer"]
		  production: ["devops-lead", "security-officer", "compliance-officer"]
		
		mandatory_fields:
		  - description
		  - owner
		  - criticality_level
		  - data_classification
		  - regulatory_context
		
		naming_convention:
		  pattern: "^[a-z0-9\\-]+$"
		  max_length: 50
		  reserved_prefixes: ["system-", "admin-", "security-"]
		
		tagging_requirements:
		  mandatory_tags: ["environment", "team", "criticality"]
		  allowed_values:
			environment: ["development", "staging", "production"]
			criticality: ["low", "medium", "high", "critical"]
			team: ["devops", "platform", "security", "data"]
	  
	  credential_management:
		encryption_required: true
		rotation_policy:
		  max_age_days: 90
		  notification_days: 7
		
		access_control:
		  approval_required: true
		  approval_matrix:
			production_credentials: ["security-officer", "devops-lead"]
			development_credentials: ["team-lead"]
		
		audit_requirements:
		  log_all_access: true
		  log_all_modifications: true
		  retention_days: 2555  # 7 years
	  
	  data_governance:
		personal_data_handling:
		  consent_tracking: true
		  purpose_limitation: true
		  data_minimization: true
		  retention_limits:
			default_days: 365
			marketing_days: 730
			legal_days: 2555
		
		data_classification:
		  automatic_detection: true
		  classification_levels: ["public", "internal", "confidential", "restricted"]
		  handling_requirements:
			confidential: ["encryption", "access_logging", "approval_required"]
			restricted: ["encryption", "access_logging", "approval_required", "air_gapped"]
  
  compliance-controls.yaml: |
	# Compliance Control Framework
	controls:
	  access_controls:
		AC-001:
		  title: "User Authentication"
		  requirement: "All users must authenticate via SSO"
		  implementation: "SAML/OIDC integration required"
		  verification: "Automated compliance check"
		
		AC-002:
		  title: "Role-Based Access Control"
		  requirement: "Principle of least privilege"
		  implementation: "RBAC engine with regular reviews"
		  verification: "Quarterly access reviews"
	  
	  audit_controls:
		AU-001:
		  title: "Comprehensive Audit Logging"
		  requirement: "All actions must be logged"
		  implementation: "Centralized audit logging system"
		  verification: "Log completeness verification"
		
		AU-002:
		  title: "Audit Log Protection"
		  requirement: "Audit logs must be tamper-evident"
		  implementation: "Cryptographic signatures and immutable storage"
		  verification: "Integrity verification process"
	  
	  data_protection:
		DP-001:
		  title: "Data Encryption"
		  requirement: "All sensitive data encrypted"
		  implementation: "AES-256 encryption at rest and in transit"
		  verification: "Encryption verification scans"
		
		DP-002:
		  title: "Data Retention"
		  requirement: "Data retained per policy"
		  implementation: "Automated retention and deletion"
		  verification: "Retention compliance reports"

---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: governance-compliance-check
  namespace: n8n-production
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM
  jobTemplate:
	spec:
	  template:
		spec:
		  containers:
		  - name: compliance-checker
			image: company-registry.com/n8n-compliance:latest
			command: ["/scripts/check-compliance.sh"]
			env:
			- name: N8N_API_URL
			  value: "https://n8n.company.com"
			- name: N8N_API_TOKEN
			  valueFrom:
				secretKeyRef:
				  name: n8n-api-credentials
				  key: api-token
			volumeMounts:
			- name: governance-policies
			  mountPath: /etc/governance
		  volumes:
		  - name: governance-policies
			configMap:
			  name: n8n-governance-policies
		  restartPolicy: OnFailure

YAML

Die Implementierung von Enterprise-Security und Governance in n8n erfordert einen ganzheitlichen Ansatz. Authentication und Authorization bilden das Fundament, Credential Management gewährleistet sichere Secret-Handhabung, und Compliance-Frameworks sorgen für nachvollziehbare Governance. Diese Komponenten arbeiten zusammen, um n8n für unternehmenskritische Automatisierungen zu qualifizieren, ohne operative Flexibilität zu beeinträchtigen.

Mit diesen Security- und Enterprise-Considerations schaffst du eine Automatisierungsplattform, die nicht nur funktional überzeugt, sondern auch höchsten Sicherheits- und Compliance-Anforderungen genügt. n8n wird dadurch von einem Automatisierungs-Tool zu einer vertrauenswürdigen Enterprise-Plattform, die als strategisches Asset in kritischen Geschäftsprozessen eingesetzt werden kann.

Offizielle Dokumentation

n8n Core Dokumentation:

Offizielle n8n Dokumentation – Vollständige API-Referenz und Setup-Guides
n8n Community Hub – Forum für technische Diskussionen und Best Practices
n8n GitHub Repository – Source Code, Issues und Contribution Guidelines

API und Entwicklung:

n8n REST API Dokumentation – Vollständige API-Referenz für Automatisierung
Custom Node Development Guide – TypeScript Node Development
n8n SDK Documentation – Community Node Framework

Production Deployment Ressourcen

Container und Orchestrierung:

Offizielle Docker Images – Production-ready Container Images
n8n Kubernetes Helm Charts – Community Helm Charts für K8s
n8n Docker Compose Examples – Production-ready Compose Files

Infrastructure as Code:

Terraform n8n Module – Terraform Provider für Cloud Deployments
Ansible n8n Role – Ansible Automation für n8n Setup
AWS CloudFormation Templates – AWS-spezifische IaC Templates

Security und Enterprise Features

Authentication und SSO:

SAML Configuration Guide – Enterprise SSO Integration
LDAP Integration Setup – Active Directory Integration
OAuth2 Provider Configuration – OAuth2/OIDC Setup

Secret Management:

HashiCorp Vault Integration – Enterprise Secret Management
AWS Secrets Manager Integration – Cloud-native Secrets
Azure Key Vault Integration – Azure Secret Management

Monitoring und Observability

Monitoring Tools:

Prometheus Metrics Endpoint – Native Prometheus Integration
Grafana Dashboard Templates – Vorgefertigte Dashboards
ELK Stack Integration Guide – Elasticsearch Logging Setup

Health Checks:

n8n Health Check Endpoints – Kubernetes Readiness/Liveness Probes
Uptime Monitoring Scripts – Custom Health Monitoring

CI/CD und GitOps Integration

Pipeline Integration:

GitHub Actions n8n Integration – GitHub Workflows
GitLab CI n8n Templates – GitLab Integration
Jenkins n8n Plugin – Jenkins Pipeline Integration

Workflow Management:

n8n CLI Tools – Command Line Interface für Automation
Workflow Import/Export Scripts – Batch Operations
Git-based Workflow Management – Version Control Integration

Community und Lernressourcen

Best Practices:

n8n Best Practices Guide – Offizielle Best Practices
Production Checklist – Go-Live Checkliste
Performance Optimization Guide – Skalierungs-Strategien

Community Ressourcen:

n8n Templates Library – Workflow Template Collection
Community Nodes Registry – Erweiterte Node-Bibliotheken
n8n YouTube Channel – Video-Tutorials und Use Cases

Fazit:

Nach diesem umfassenden Deep-Dive kennst du jetzt die fundamentalen Architekturprinzipien von n8n und weißt, wie die event-driven Workflow-Engine mit Worker-Prozessen und Queue-Management funktioniert. Du hast gelernt, production-ready Deployments mit Docker und Kubernetes aufzusetzen, horizontale Skalierung zu implementieren und robuste Backup-Strategien zu entwickeln.

Die JSON-basierte Workflow-Entwicklung mit Custom Nodes, Error-Handling und GitOps-Integration ermöglicht es dir, wartbare und testbare Automatisierungen zu erstellen. Besonders wertvoll sind die CI/CD-Integration-Patterns und Infrastructure-as-Code-Orchestrierung, die n8n zum zentralen Hub deiner DevOps-Toolchain machen.

Enterprise-Security mit RBAC, Multi-Tenancy und Compliance-Logging qualifiziert n8n für unternehmenskritische Prozesse. Mit den hier vermittelten Techniken transformierst du n8n von einem simplen Automatisierungs-Tool in das strategische Backbone deiner Infrastruktur-Workflows – selbst-gehostet, skalierbar und vollständig unter deiner Kontrolle.

Warum n8n für DevOps-Teams?

Was dich in diesem Artikel erwartet:

Der Unterschied zu anderen Automatisierungs-Plattformen:

Was n8n zu einem Game-Changer macht:

Architektur und Grundkonzepte

Event-driven Workflow-Engine und Node-basierte Verarbeitung

Execution Context und Worker-Prozesse

API-First-Ansatz und Headless-Betrieb

Deployment-Strategien

Container-orchestrierte Installation mit Docker/Kubernetes

Workflow und Node

JSON-basierte Workflow-Definition und Versionierung

Custom Node Development mit TypeScript/JavaScript

Error Handling, Retry Logic und Debugging-Strategien

Integration in DevOps-Toolchains

CI/CD-Pipeline-Integration und GitOps-Workflows

Infrastructure as Code mit n8n-Workflows

Monitoring, Logging und Observability

Security und Enterprise-Considerations

Authentication, Authorization und Multi-Tenancy

Credential Management und Secret Handling

Compliance, Audit-Logging und Governance

Offizielle Dokumentation

Production Deployment Ressourcen

Security und Enterprise Features

Monitoring und Observability

CI/CD und GitOps Integration

Community und Lernressourcen

Fazit:

Ähnliche Beiträge

Terraform für Fortgeschrittene: Terraform Syntax und HCL Masterclass

Terraform Grundlagen: Infrastructure as Code für Linux-Administratoren und DevOps

Portainer unter Ubuntu 24.04 LTS installieren: Ein umfassender Leitfaden