n8n for DevOps teams: enterprise deployment and production integration

┌─────────────────────────────────────────────────────────────┐
│                 Node-based DAG processing                   │
│                                                             │
│   ┌───────────────┐     ┌───────────────┐     ┌─────────┐   │
│   │ Trigger Node  │────▶│ Process Node  │────▶│ Action  │   │
│   │ (Event Input) │     │ (Data Transf) │     │  (API)  │   │
│   └───────────────┘     └───────────────┘     └─────────┘   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│                 Event bus and publisher-subscriber          │
│                                                             │
│   ┌───────────────┐     ┌───────────────┐   ┌───────────┐   │
│   │    Webhook    │────▶│   Event Bus   │──▶│HTTP Req.  │   │
│   │  (Publisher)  │     │ (Dispatcher)  │   │(Subscriber│   │
│   └───────────────┘     └───────┬───────┘   └───────────┘   │
│                                 │                           │
│                                 ▼                           │
│                         ┌───────────────┐                   │
│                         │     Queue     │                   │
│                         │  Management   │                   │
│                         └───────────────┘                   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

// Standard n8n item format
{
  json: {

// Main data structure
	id: 123,
	name: "example",
	metadata: {
	  timestamp: "2025-01-01T12:00:00Z"
	}
  },
  binary: {

// Binary data (optional)
	file: {
	  data: "base64-encoded-content",
	  mimeType: "application/pdf",
	  fileName: "document.pdf"
	}
  }
}

// Webhook input processing
const payload = $input.all()[0].json;

// Branch-based routing logic
if (payload.ref === 'refs/heads/main') {
  return [
	{
	  json: {
		action: 'deploy_production',
		commit: payload.head_commit.id,
		message: payload.head_commit.message,
		author: payload.head_commit.author.name,
		environment: 'production'
	  }
	}
  ];
} else if (payload.ref.startsWith('refs/heads/develop')) {
  return [
	{
	  json: {
		action: 'deploy_staging',
		commit: payload.head_commit.id,
		branch: payload.ref.replace('refs/heads/', ''),
		environment: 'staging'
	  }
	}
  ];
}

// Feature branch: run tests only
return [
  {
	json: {
	  action: 'run_tests',
	  commit: payload.head_commit.id,
	  branch: payload.ref.replace('refs/heads/', '')
	}
  }
];

// Error handling in the Code node
try {
  const response = await fetch('https://api.example.com/data');
  if (!response.ok) {
	throw new Error(`API Error: ${response.status} - ${response.statusText}`);
  }
  return response.json();
} catch (error) {
 
 // Custom error with context
  throw new Error(`External API failed: ${error.message}`);
}

// Batch processing example
const batchSize = 100;
const items = $input.all();
const batches = [];

for (let i = 0; i < items.length; i += batchSize) {
  const batch = items.slice(i, i + batchSize);
  batches.push({
	json: {
	  batch_id: Math.floor(i / batchSize),
	  items: batch.map(item => item.json),
	  total_batches: Math.ceil(items.length / batchSize)
	}
  });
}

return batches;

┌─────────────────────────────────────────────────────────────┐
│                        Main Process                         │
│  ┌──────────────┐   ┌───────────────┐   ┌────────────────┐  │
│  │  Web Server  │   │ Queue Manager │   │ DB Connection  │  │
│  │  (REST API)  │   │(Redis/Memory) │   │     Pool       │  │
│  └──────────────┘   └───────────────┘   └────────────────┘  │
│                              │                              │
│                              ▼ Job Distribution             │
│                      Worker Processes                       │
│  ┌──────────────┐   ┌───────────────┐   ┌────────────────┐  │
│  │   Worker 1   │   │   Worker 2    │   │    Worker 3    │  │
│  │  Context A   │   │   Context B   │   │   Context C    │  │
│  │  Context D   │   │   Context E   │   │   Context F    │  │
│  └──────────────┘   └───────────────┘   └────────────────┘  │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│                 Worker process lifecycle                    │
│                                                             │
│   ┌───────────┐        ┌───────────┐        ┌───────────┐   │
│   │   Idle    │───────▶│ Receiving │───────▶│ Executing │   │
│   │   State   │        │    Job    │        │ Workflow  │   │
│   └───────────┘        └───────────┘        └─────┬─────┘   │
│         ▲                                         │         │
│         │                                         ▼         │
│   ┌─────┴─────┐        ┌───────────┐        ┌───────────┐   │
│   │  Cleanup  │◀───────┤ Completed │◀───────│ Reporting │   │
│   │  Memory   │        │   State   │        │  Result   │   │
│   └───────────┘        └───────────┘        └───────────┘   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# Worker-specific configuration
export N8N_WORKERS_ENABLED=true
export N8N_WORKERS_MAX_CONCURRENCY=10
export N8N_WORKERS_TIMEOUT=3600
export N8N_WORKERS_MAX_MEMORY_MB=2048

# Queue configuration for worker communication
export QUEUE_BULL_REDIS_HOST=redis.internal
export QUEUE_BULL_REDIS_PORT=6379
export QUEUE_BULL_REDIS_DB=2
export QUEUE_BULL_REDIS_PASSWORD=secure_redis_password

# Single worker (default mode)
n8n worker

# Multiple workers on one system
for i in {1..4}; do
N8N_WORKER_ID=worker_$i n8n worker &
done

# Distributed workers (Kubernetes deployment)
kubectl scale deployment n8n-worker --replicas=10

# PostgreSQL connection pool optimization
export N8N_DATABASE_POSTGRESDB_POOL_SIZE=20
export N8N_DATABASE_POSTGRESDB_MAX_CONNECTIONS=100
export N8N_DATABASE_POSTGRESDB_IDLE_TIMEOUT=30000

// Memory-efficient binary data processing
const binaryData = $input.binary.file;

// Streaming instead of loading everything
const stream = require('stream');
const { pipeline } = require('stream/promises');
await pipeline(
createReadStream(binaryData.data),
transformStream,
createWriteStream(outputPath)
);

// Release memory explicitly
delete $input.binary.file;

# Worker with automatic restart
while true; do
n8n worker
echo "Worker crashed, restarting in 5 seconds..."
sleep 5
done

# Systemd service for production
cat << 'EOF' > /etc/systemd/system/n8n-worker.service
[Unit]
Description=n8n Worker Process
After=network.target
[Service]
Type=simple
User=n8n
WorkingDirectory=/opt/n8n
ExecStart=/usr/local/bin/n8n worker
Restart=always
RestartSec=5
Environment=NODE_ENV=production
[Install]
WantedBy=multi-user.target
EOF

┌─────────────────────────────────────────────────────────────┐
│                 Queue-based load distribution               │
│                                                             │
│   ┌──────────────┐    ┌──────────────┐    ┌─────────────┐   │
│   │ Main Process │───▶│  Job Queue   │───▶│ Worker Pool │   │
│   │ (Scheduler)  │    │   (Redis)    │    │ (Consumer)  │   │
│   └──────────────┘    └──────┬───────┘    └─────────────┘   │
│                              │                              │
│                              ▼                              │
│                      ┌──────────────┐                       │
│                      │ Dead Letter  │                       │
│                      │    Queue     │                       │
│                      │(Failed Jobs) │                       │
│                      └──────────────┘                       │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# Worker health-check script
#!/bin/bash
WORKER_PID=$(pgrep -f "n8n worker")
if [ -z "$WORKER_PID" ]; then
  echo "CRITICAL: n8n worker not running"
  exit 2
fi

# Check memory usage
MEMORY_MB=$(ps -p $WORKER_PID -o rss= | awk '{print int($1/1024)}')
if [ $MEMORY_MB -gt 4096 ]; then
  echo "WARNING: Worker using ${MEMORY_MB}MB memory"
  exit 1
fi

echo "OK: Worker running with ${MEMORY_MB}MB memory"
exit 0

# 1. Load workflow from Git repository
git clone https://github.com/company/n8n-workflows.git
cd n8n-workflows/production/

# 2. Validate workflow definition
jq empty production-deploy.json || {
  echo "Invalid JSON in workflow definition"
  exit 1
}

# 3. Create/update workflow via API
WORKFLOW_ID=$(curl -s -X POST https://n8n.company.com/api/v1/workflows \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" \
  -d @production-deploy.json | jq -r '.id')

# 4. Activate workflow
curl -X POST https://n8n.company.com/api/v1/workflows/${WORKFLOW_ID}/activate \
  -H "Authorization: Bearer ${N8N_API_TOKEN}"

# 5. Fetch webhook URL and register it in CI/CD
WEBHOOK_URL=$(curl -s https://n8n.company.com/api/v1/workflows/${WORKFLOW_ID} \
  -H "Authorization: Bearer ${N8N_API_TOKEN}" | \
  jq -r '.nodes[] | select(.type == "n8n-nodes-base.webhook") | .webhookUrl')

echo "Webhook URL: ${WEBHOOK_URL}"

# Headless start without web UI
export N8N_DISABLE_UI=true
export N8N_ENDPOINTS_REST_AUTH=bearer
export N8N_API_KEY=n8n_api_production_token_12345

# With external database backend for scalability
export N8N_DATABASE_TYPE=postgresdb
export N8N_DATABASE_HOST=postgres.internal.company.com
export N8N_DATABASE_PORT=5432
export N8N_DATABASE_NAME=n8n_production
export N8N_DATABASE_USER=n8n_app_user
export N8N_DATABASE_PASSWORD=secure_production_password
export N8N_DATABASE_SSL_ENABLED=true

# Worker mode for horizontal scaling
n8n worker

# 1. API token authentication (recommended for automation)
curl -H "Authorization: Bearer n8n_api_production_token_12345" \
https://n8n.company.com/api/v1/workflows

# 2. Basic authentication (legacy support)
curl -u "service-account:complex_password_123" \
https://n8n.company.com/api/v1/workflows

# 3. Session-based authentication (UI-based)
curl -b "n8n-auth=SESSION_COOKIE_VALUE" \
https://n8n.company.com/api/v1/workflows

# 4. JWT token (Enterprise Edition)
curl -H "Authorization: JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
https://n8n.company.com/api/v1/workflows

# Service account for CI/CD with read-only rights

curl -X POST https://n8n.company.com/api/v1/users \
-H "Authorization: Bearer ${ADMIN_TOKEN}" \
-d '{
	"email": "ci-cd@company.com",
	"firstName": "CI/CD",
	"lastName": "Service",
	"role": "editor",
	"permissions": {
	 "workflows": ["read", "execute"],
	 "executions": ["read"],
	 "credentials": ["read"]
	}
}'

// Advanced webhook response with custom headers
const startTime = Date.now();

// Payload validation
if (!$input.first().json.repository || !$input.first().json.commits) {
  $response.statusCode = 400;
  return {
	error: "Invalid webhook payload",
	expected: ["repository", "commits"]
  };
}

// Trigger asynchronous processing
const processingId = generateUUID();
await queue.add('deployment-pipeline', {
  id: processingId,
  payload: $input.first().json,
  timestamp: new Date().toISOString()
});

// Immediate response with tracking information
return {
  json: { 
	status: "accepted", 
	processing_id: processingId,
	estimated_completion: new Date(Date.now() + 300000).toISOString()
  },
  headers: {
	"X-Processing-Time": Date.now() - startTime,
	"X-Workflow-ID": $workflow.id,
	"X-Processing-ID": processingId,
	"Location": `/api/v1/executions/${processingId}`
  },
  statusCode: 202
};

# .github/workflows/n8n-deploy.yml
name: Deploy n8n Workflows
on:
push:
	paths: ['workflows/**']
jobs:
deploy:
	runs-on: ubuntu-latest
	steps:
	 * uses: actions/checkout@v3
	 * name: Validate Workflow Definitions
		run: |
		 for workflow in workflows/*.json; do
			jq empty "$workflow" || exit 1
		 done
	 * name: Deploy to n8n
		run: |
		 for workflow in workflows/*.json; do
			curl -X POST $N8N_API_URL/api/v1/workflows \
			 -H "Authorization: Bearer $N8N_API_TOKEN" \
			 -H "Content-Type: application/json" \
			 -d @"$workflow"
		 done
		env:
		 N8N_API_URL: ${{ secrets.N8N_API_URL }}
		 N8N_API_TOKEN: ${{ secrets.N8N_API_TOKEN }}

# terraform/n8n-workflows.tf
resource "null_resource" "n8n_workflow" {
for_each = fileset(path.module, "workflows/*.json")
provisioner "local-exec" {
	command = <<-EOT
	 curl -X POST ${var.n8n_api_url}/api/v1/workflows \
		-H "Authorization: Bearer ${var.n8n_api_token}" \
		-H "Content-Type: application/json" \
		-d @${each.value}
	EOT
}
triggers = {
	workflow_hash = filemd5(each.value)
}
}

# n8n-exporter.sh - custom Prometheus exporter

#!/bin/bash
while true; do

# Collect workflow metrics
ACTIVE_WORKFLOWS=$(curl -s -H "Authorization: Bearer $N8N_API_TOKEN" \
	"$N8N_API_URL/api/v1/workflows?active=true" | jq '. | length')
FAILED_EXECUTIONS=$(curl -s -H "Authorization: Bearer $N8N_API_TOKEN" \
	"$N8N_API_URL/api/v1/executions?status=error&limit=1000" | jq '. | length')
echo "n8n_active_workflows $ACTIVE_WORKFLOWS" > /tmp/n8n-metrics.prom
echo "n8n_failed_executions_total $FAILED_EXECUTIONS" >> /tmp/n8n-metrics.prom
sleep 30
done

# Raise API rate limits for production
export N8N_API_RATE_LIMIT_ENABLED=true
export N8N_API_RATE_LIMIT_MAX_REQUESTS=10000
export N8N_API_RATE_LIMIT_WINDOW_MS=60000
export N8N_API_RATE_LIMIT_TRUST_PROXY=true

# Bulk operations for large workflow sets
curl -X POST https://n8n.company.com/api/v1/workflows/bulk \
-H "Authorization: Bearer $N8N_API_TOKEN" \
-d '{
	"operation": "activate",
	"workflow_ids": ["1", "2", "3", "4", "5"],
	"options": {
	 "validate": true,
	 "dry_run": false
	}
}'

# Workflow templates for standardised deployments
curl -X POST https://n8n.company.com/api/v1/workflows/from-template \
-H "Authorization: Bearer $N8N_API_TOKEN" \
-d '{
	"template_id": "git-ci-cd-pipeline",
	"parameters": {
	 "repository_url": "https://github.com/company/app.git",
	 "deploy_environment": "production",
	 "notification_slack_channel": "#deployments"
	}
}'

# docker-compose.production.yml
version: '3.8'

services:
  postgres:
	image: postgres:15-alpine
	restart: unless-stopped
	environment:
	  POSTGRES_DB: n8n_production
	  POSTGRES_USER: n8n_user
	  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
	  POSTGRES_NON_ROOT_USER: n8n_app
	  POSTGRES_NON_ROOT_PASSWORD: ${POSTGRES_APP_PASSWORD}
	volumes:
	  * postgres_data:/var/lib/postgresql/data
	  * ./init-scripts:/docker-entrypoint-initdb.d:ro
	healthcheck:
	  test: ["CMD-SHELL", "pg_isready -U n8n_user -d n8n_production"]
	  interval: 10s
	  timeout: 5s
	  retries: 5
	networks:
	  * n8n-internal

  redis:
	image: redis:7-alpine
	restart: unless-stopped
	command: redis-server --requirepass ${REDIS_PASSWORD} --maxmemory 512mb --maxmemory-policy allkeys-lru
	volumes:
	  * redis_data:/data
	healthcheck:
	  test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
	  interval: 10s
	  timeout: 3s
	  retries: 5
	networks:
	  * n8n-internal

  n8n-main:
	image: n8nio/n8n:latest
	restart: unless-stopped
	environment:
	  # Database configuration
	  DB_TYPE: postgresdb
	  DB_POSTGRESDB_HOST: postgres
	  DB_POSTGRESDB_PORT: 5432
	  DB_POSTGRESDB_DATABASE: n8n_production
	  DB_POSTGRESDB_USER: n8n_app
	  DB_POSTGRESDB_PASSWORD: ${POSTGRES_APP_PASSWORD}
	  
	  # Queue configuration
	  EXECUTIONS_MODE: queue
	  QUEUE_BULL_REDIS_HOST: redis
	  QUEUE_BULL_REDIS_PASSWORD: ${REDIS_PASSWORD}
	  QUEUE_BULL_REDIS_PORT: 6379
	  QUEUE_BULL_REDIS_DB: 0
	  
	  # Security and performance
	  N8N_SECURE_COOKIE: true
	  N8N_PROTOCOL: https
	  N8N_HOST: ${N8N_DOMAIN}
	  N8N_PORT: 5678
	  N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
	  
	  # Webhook configuration
	  WEBHOOK_URL: https://${N8N_DOMAIN}/
	  
	  # Disable execution in main process
	  EXECUTIONS_PROCESS: main
	ports:
	  * "127.0.0.1:5678:5678"
	volumes:
	  * n8n_data:/home/node/.n8n
	  * ./custom-nodes:/home/node/.n8n/custom
	depends_on:
	  postgres:
		condition: service_healthy
	  redis:
		condition: service_healthy
	networks:
	  * n8n-internal
	  * web-proxy
	labels:
	  * "traefik.enable=true"
	  * "traefik.http.routers.n8n.rule=Host(`${N8N_DOMAIN}`)"
	  * "traefik.http.routers.n8n.tls.certresolver=letsencrypt"

  n8n-worker:
	image: n8nio/n8n:latest
	restart: unless-stopped
	command: n8n worker
	environment:
	  # Database configuration (same as main)
	  DB_TYPE: postgresdb
	  DB_POSTGRESDB_HOST: postgres
	  DB_POSTGRESDB_PORT: 5432
	  DB_POSTGRESDB_DATABASE: n8n_production
	  DB_POSTGRESDB_USER: n8n_app
	  DB_POSTGRESDB_PASSWORD: ${POSTGRES_APP_PASSWORD}
	  
	  # Queue configuration
	  QUEUE_BULL_REDIS_HOST: redis
	  QUEUE_BULL_REDIS_PASSWORD: ${REDIS_PASSWORD}
	  QUEUE_BULL_REDIS_PORT: 6379
	  QUEUE_BULL_REDIS_DB: 0
	  
	  # Worker-specific configuration
	  N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
	  EXECUTIONS_PROCESS: own
	  
	  # Performance tuning
	  N8N_WORKERS_CONCURRENCY: 10
	  N8N_WORKERS_TIMEOUT: 3600
	volumes:
	  * n8n_data:/home/node/.n8n
	  * ./custom-nodes:/home/node/.n8n/custom
	depends_on:
	  postgres:
		condition: service_healthy
	  redis:
		condition: service_healthy
	networks:
	  * n8n-internal
	deploy:
	  replicas: 3
	  resources:
		limits:
		  memory: 2G
		  cpus: "1.0"
		reservations:
		  memory: 512M
		  cpus: "0.5"

volumes:
  postgres_data:
	driver: local
	driver_opts:
	  type: none
	  o: bind
	  device: /opt/n8n/postgres-data
  redis_data:
	driver: local
  n8n_data:
	driver: local
	driver_opts:
	  type: none
	  o: bind
	  device: /opt/n8n/app-data

networks:
  n8n-internal:
	driver: bridge
	internal: true
  web-proxy:
	external: true

# Create environment file
cat << 'EOF' > .env.production
POSTGRES_PASSWORD=secure_postgres_root_password_123
POSTGRES_APP_PASSWORD=secure_app_user_password_456
REDIS_PASSWORD=secure_redis_password_789
N8N_DOMAIN=n8n.company.com
N8N_ENCRYPTION_KEY=$(openssl rand -hex 32)
EOF

# Create production directories
sudo mkdir -p /opt/n8n/{postgres-data,app-data,backups,custom-nodes}
sudo chown -R 1000:1000 /opt/n8n/app-data
sudo chmod 700 /opt/n8n/postgres-data

# SSL certificates via Let's Encrypt (Traefik)
docker run -d \
  --name traefik \
  --restart unless-stopped \
  -p 80:80 -p 443:443 \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /opt/traefik/acme.json:/acme.json \
  -v /opt/traefik/traefik.yml:/etc/traefik/traefik.yml:ro \
  traefik:v2.10

# Start n8n deployment
docker-compose -f docker-compose.production.yml up -d

# n8n-namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: n8n-production
  labels:
	name: n8n-production

---
# n8n-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: n8n-config
  namespace: n8n-production
data:
  N8N_HOST: "n8n.company.com"
  N8N_PROTOCOL: "https"
  N8N_PORT: "5678"
  DB_TYPE: "postgresdb"
  DB_POSTGRESDB_HOST: "postgres-service.n8n-production.svc.cluster.local"
  DB_POSTGRESDB_PORT: "5432"
  DB_POSTGRESDB_DATABASE: "n8n_production"
  EXECUTIONS_MODE: "queue"
  QUEUE_BULL_REDIS_HOST: "redis-service.n8n-production.svc.cluster.local"
  QUEUE_BULL_REDIS_PORT: "6379"
  QUEUE_BULL_REDIS_DB: "0"
  WEBHOOK_URL: "https://n8n.company.com/"
  N8N_METRICS: "true"
  N8N_DIAGNOSTICS_ENABLED: "false"

---
# n8n-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: n8n-secrets
  namespace: n8n-production
type: Opaque
data:
  N8N_ENCRYPTION_KEY: # base64 encoded
  DB_POSTGRESDB_PASSWORD: # base64 encoded
  QUEUE_BULL_REDIS_PASSWORD: # base64 encoded

---
# n8n-main-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-main
  namespace: n8n-production
  labels:
	app: n8n-main
spec:
  replicas: 2
  strategy:
	type: RollingUpdate
	rollingUpdate:
	  maxUnavailable: 1
	  maxSurge: 1
  selector:
	matchLabels:
	  app: n8n-main
  template:
	metadata:
	  labels:
		app: n8n-main
	spec:
	  affinity:
		podAntiAffinity:
		  preferredDuringSchedulingIgnoredDuringExecution:
		  * weight: 100
			podAffinityTerm:
			  labelSelector:
				matchExpressions:
				* key: app
				  operator: In
				  values:
				  * n8n-main
			  topologyKey: kubernetes.io/hostname
	  containers:
	  * name: n8n-main
		image: n8nio/n8n:latest
		ports:
		* containerPort: 5678
		  name: http
		envFrom:
		* configMapRef:
			name: n8n-config
		* secretRef:
			name: n8n-secrets
		env:
		* name: DB_POSTGRESDB_USER
		  value: "n8n_app"
		resources:
		  requests:
			memory: "1Gi"
			cpu: "500m"
		  limits:
			memory: "2Gi"
			cpu: "1000m"
		livenessProbe:
		  httpGet:
			path: /healthz
			port: 5678
		  initialDelaySeconds: 30
		  periodSeconds: 10
		  timeoutSeconds: 5
		  failureThreshold: 3
		readinessProbe:
		  httpGet:
			path: /healthz
			port: 5678
		  initialDelaySeconds: 10
		  periodSeconds: 5
		  timeoutSeconds: 3
		  failureThreshold: 3
		volumeMounts:
		* name: n8n-data
		  mountPath: /home/node/.n8n
		* name: custom-nodes
		  mountPath: /home/node/.n8n/custom
	  volumes:
	  * name: n8n-data
		persistentVolumeClaim:
		  claimName: n8n-main-pvc
	  * name: custom-nodes
		configMap:
		  name: n8n-custom-nodes

---
# n8n-worker-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-worker
  namespace: n8n-production
  labels:
	app: n8n-worker
spec:
  replicas: 5
  strategy:
	type: RollingUpdate
	rollingUpdate:
	  maxUnavailable: 1
	  maxSurge: 2
  selector:
	matchLabels:
	  app: n8n-worker
  template:
	metadata:
	  labels:
		app: n8n-worker
	spec:
	  affinity:
		podAntiAffinity:
		  preferredDuringSchedulingIgnoredDuringExecution:
		  * weight: 50
			podAffinityTerm:
			  labelSelector:
				matchExpressions:
				* key: app
				  operator: In
				  values:
				  * n8n-worker
			  topologyKey: kubernetes.io/hostname
	  containers:
	  * name: n8n-worker
		image: n8nio/n8n:latest
		command: ["n8n", "worker"]
		envFrom:
		* configMapRef:
			name: n8n-config
		* secretRef:
			name: n8n-secrets
		env:
		* name: DB_POSTGRESDB_USER
		  value: "n8n_app"
		* name: EXECUTIONS_PROCESS
		  value: "own"
		* name: N8N_WORKERS_CONCURRENCY
		  value: "10"
		* name: N8N_WORKERS_TIMEOUT
		  value: "3600"
		resources:
		  requests:
			memory: "512Mi"
			cpu: "250m"
		  limits:
			memory: "2Gi"
			cpu: "1000m"
		volumeMounts:
		* name: n8n-data
		  mountPath: /home/node/.n8n
		  readOnly: true
		* name: custom-nodes
		  mountPath: /home/node/.n8n/custom
		  readOnly: true
	  volumes:
	  * name: n8n-data
		persistentVolumeClaim:
		  claimName: n8n-shared-pvc
	  * name: custom-nodes
		configMap:
		  name: n8n-custom-nodes

---
# n8n-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: n8n-worker-hpa
  namespace: n8n-production
spec:
  scaleTargetRef:
	apiVersion: apps/v1
	kind: Deployment
	name: n8n-worker
  minReplicas: 3
  maxReplicas: 20
  metrics:
  * type: Resource
	resource:
	  name: cpu
	  target:
		type: Utilization
		averageUtilization: 70
  * type: Resource
	resource:
	  name: memory
	  target:
		type: Utilization
		averageUtilization: 80
  behavior:
	scaleUp:
	  stabilizationWindowSeconds: 60
	  policies:
	  * type: Percent
		value: 100
		periodSeconds: 60
	scaleDown:
	  stabilizationWindowSeconds: 300
	  policies:
	  * type: Percent
		value: 50
		periodSeconds: 60

# values.production.yaml
replicaCount:
  main: 2
  worker: 5

image:
  repository: n8nio/n8n
  tag: "latest"
  pullPolicy: IfNotPresent

service:
  type: ClusterIP
  port: 5678

ingress:
  enabled: true
  className: "nginx"
  annotations:
	cert-manager.io/cluster-issuer: "letsencrypt-prod"
	nginx.ingress.kubernetes.io/ssl-redirect: "true"
	nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
  hosts:
	* host: n8n.company.com
	  paths:
		* path: /
		  pathType: Prefix
  tls:
	* secretName: n8n-tls
	  hosts:
		* n8n.company.com

postgresql:
  enabled: true
  auth:
	postgresPassword: "secure_root_password"
	username: "n8n_app"
	password: "secure_app_password"
	database: "n8n_production"
  primary:
	persistence:
	  enabled: true
	  size: 100Gi
	  storageClass: "fast-ssd"

redis:
  enabled: true
  auth:
	enabled: true
	password: "secure_redis_password"
  master:
	persistence:
	  enabled: true
	  size: 10Gi

autoscaling:
  enabled: true
  minReplicas: 3
  maxReplicas: 20
  targetCPUUtilizationPercentage: 70
  targetMemoryUtilizationPercentage: 80

resources:
  main:
	limits:
	  cpu: 1000m
	  memory: 2Gi
	requests:
	  cpu: 500m
	  memory: 1Gi
  worker:
	limits:
	  cpu: 1000m
	  memory: 2Gi
	requests:
	  cpu: 250m
	  memory: 512Mi

monitoring:
  enabled: true
  serviceMonitor:
	enabled: true
	namespace: monitoring

# Add Helm repository
helm repo add n8n https://8gears.container-registry.com/chartrepo/library
helm repo update

# Custom values for production
helm install n8n-production n8n/n8n \
  --namespace n8n-production \
  --create-namespace \
  --values values.production.yaml \
  --wait --timeout=300s

# Monitor deployment status
kubectl get pods -n n8n-production -w
kubectl logs -n n8n-production deployment/n8n-main -f

┌─────────────────────────────────────────────────────────────┐
│                 n8n high-throughput queue mode              │
│                                                             │
│   ┌───────────────┐     ┌───────────────┐     ┌─────────┐   │
│   │ Webhook/Timer │────▶│ Main Process  │────▶│  Redis  │   │
│   │  (Triggers)   │     │ (Orchestrator)│     │ (Queue) │   │
│   └───────────────┘     └───────┬───────┘     └────┬────┘   │
│                                 │                  │        │
│                   ┌─────────────┴──────────────────┤        │
│                   ▼                                ▼        │
│          ┌─────────────────┐              ┌─────────────────┐
│          │    Worker 1     │              │    Worker 2     │
│          │   (Execution)   │              │   (Execution)   │
│          └────────┬────────┘              └────────┬────────┘
│                   │                                │        │
│                   └────────────────┬───────────────┘        │
│                                    ▼                        │
│                           ┌─────────────────┐               │
│                           │   PostgreSQL    │               │
│                           │ (State/Results) │               │
│                           └─────────────────┘               │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# redis.production.conf
# Memory management
maxmemory 4gb
maxmemory-policy allkeys-lru
maxmemory-samples 10

# Persistence for job-queue reliability
save 900 1
save 300 10
save 60 10000
rdbcompression yes
rdbchecksum yes

# Network and performance
tcp-keepalive 300
timeout 0
tcp-backlog 511
databases 16

# Security
requirepass secure_redis_password_production_123
rename-command FLUSHDB ""
rename-command FLUSHALL ""
rename-command DEBUG ""

# Logging
loglevel notice
syslog-enabled yes
syslog-ident redis-n8n-queue

# Client connection limits
maxclients 10000

# Queue-specific settings
notify-keyspace-events Ex

# /etc/haproxy/haproxy.cfg
global
	daemon
	user haproxy
	group haproxy
	log stdout local0
	maxconn 4096
	ssl-default-bind-options ssl-min-ver TLSv1.2
	ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384

defaults
	mode http
	timeout connect 10s
	timeout client 30s
	timeout server 30s
	option httplog
	option dontlognull
	retries 3

frontend n8n_frontend
	bind *:443 ssl crt /etc/ssl/certs/n8n.company.com.pem
	redirect scheme https if !{ ssl_fc }
	
	# Rate limiting
	stick-table type ip size 100k expire 30s store http_req_rate(10s)
	http-request track-sc0 src
	http-request reject if { sc_http_req_rate(0) gt 20 }
	
	# Health check endpoint
	acl health_check path_beg /healthz
	use_backend n8n_health if health_check
	
	# Main application
	default_backend n8n_main

backend n8n_main
	balance leastconn
	option httpchk GET /healthz
	http-check expect status 200
	
	server n8n-main-1 10.0.1.10:5678 check inter 10s rise 2 fall 3 weight 100
	server n8n-main-2 10.0.1.11:5678 check inter 10s rise 2 fall 3 weight 100
	
backend n8n_health
	http-request return status 200 content-type text/plain string "OK"

listen stats
	bind *:8404
	stats enable
	stats uri /stats
	stats refresh 30s
	stats admin if TRUE

# CPU-intensive workflows (less concurrency)
export N8N_WORKERS_CONCURRENCY=5
export N8N_WORKERS_TIMEOUT=7200
export NODE_OPTIONS="--max-old-space-size=4096"

# I/O-intensive workflows (more concurrency)
export N8N_WORKERS_CONCURRENCY=20
export N8N_WORKERS_TIMEOUT=1800
export NODE_OPTIONS="--max-old-space-size=2048"

# Mixed workloads (balanced)
export N8N_WORKERS_CONCURRENCY=10
export N8N_WORKERS_TIMEOUT=3600
export NODE_OPTIONS="--max-old-space-size=3072"

# Start worker with tuned settings
n8n worker

# custom-metrics-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: n8n-worker-queue-hpa
  namespace: n8n-production
spec:
  scaleTargetRef:
	apiVersion: apps/v1
	kind: Deployment
	name: n8n-worker
  minReplicas: 3
  maxReplicas: 50
  metrics:
  * type: External
	external:
	  metric:
		name: redis_queue_length
		selector:
		  matchLabels:
			queue_name: "bull:queue:default"
	  target:
		type: AverageValue
		averageValue: "10"
  behavior:
	scaleUp:
	  stabilizationWindowSeconds: 60
	  policies:
	  * type: Pods
		value: 5
		periodSeconds: 60
	scaleDown:
	  stabilizationWindowSeconds: 300
	  policies:
	  * type: Pods
		value: 2
		periodSeconds: 60

┌─────────────────────────────────────────────────────────────┐
│                      Application Layer                      │
│   ┌───────────────┐     ┌───────────────┐   ┌───────────┐   │
│   │   Workflows   │     │  Credentials  │   │Executions │   │
│   │  (JSON Defs)  │     │  (Encrypted)  │   │ (History) │   │
│   └───────────────┘     └───────────────┘   └───────────┘   │
│                                 │                           │
│                                 ▼                           │
│                 Database Layer (PostgreSQL Cluster)         │
│   ┌───────────────┐     ┌───────────────┐   ┌───────────┐   │
│   │Primary Master │     │ Read Replica  │   │  Backup   │   │
│   │ (Read/Write)  │     │  (Reporting)  │   │  Server   │   │
│   └───────────────┘     └───────────────┘   └───────────┘   │
│                                 │                           │
│                                 ▼                           │
│                     Enterprise Storage Layer                │
│   ┌───────────────┐     ┌───────────────┐   ┌───────────┐   │
│   │   Local SSD   │     │  Network NAS  │   │ Cloud S3  │   │
│   │  (Hot Data)   │     │ (Warm Backup) │   │(Cold Arch)│   │
│   └───────────────┘     └───────────────┘   └───────────┘   │
└─────────────────────────────────────────────────────────────┘

# postgres-ha-deployment.yaml
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: postgres-n8n-ha
namespace: n8n-production
spec:
instances: 3
postgresql:
	parameters:
	 max_connections: "200"
	 shared_buffers: "256MB"
	 effective_cache_size: "1GB"
	 maintenance_work_mem: "64MB"
	 checkpoint_completion_target: "0.9"
	 wal_buffers: "16MB"
	 default_statistics_target: "100"
	 random_page_cost: "1.1"
	 effective_io_concurrency: "200"
	 work_mem: "4MB"
	 min_wal_size: "1GB"
	 max_wal_size: "4GB"
bootstrap:
	initdb:
	 database: n8n_production
	 owner: n8n_user
	 secret:
		name: postgres-credentials
	 dataChecksums: true
storage:
	size: 500Gi
	storageClass: fast-ssd
monitoring:
	enabled: true
	customMetrics:
	 * name: "pg_stat_user_tables"
		query: "SELECT schemaname, tablename, n_tup_ins, n_tup_upd, n_tup_del FROM pg_stat_user_tables"
backup:
	target: prefer-standby
	retentionPolicy: "30d"
	data:
	 compression: gzip
	 encryption: AES256
	 immediateCheckpoint: true
	wal:
	 retention: "7d"
	 compression: gzip
	s3:
	 bucket: "n8n-database-backups"
	 path: "/postgres-backups"
	 region: "eu-central-1"
	 credentials:
		accessKeyId:
		 name: s3-credentials
		 key: ACCESS_KEY_ID
		secretAccessKey:
		 name: s3-credentials
		 key: SECRET_ACCESS_KEY
failoverDelay: 0
switchoverDelay: 60

#!/bin/bash
# backup-n8n-complete.sh
set -euo pipefail
BACKUP_DIR="/opt/backups/n8n"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
RETENTION_DAYS=30
S3_BUCKET="company-n8n-backups"

# Logging setup
exec 1> >(logger -s -t n8n-backup)
exec 2>&1
echo "Starting n8n backup at $(date)"

# 1. Database backup (PostgreSQL)
echo "Creating database backup..."
PGPASSWORD="${DB_PASSWORD}" pg_dump \
-h postgres.n8n-production.svc.cluster.local \
-U n8n_user \
-d n8n_production \
--verbose \
--compress=9 \
--format=custom \
--file="${BACKUP_DIR}/database_${TIMESTAMP}.pgdump"

# 2. Workflow export via n8n API
echo "Exporting workflows via API..."
mkdir -p "${BACKUP_DIR}/workflows_${TIMESTAMP}"

# Get all workflow IDs
WORKFLOW_IDS=$(curl -s \
-H "Authorization: Bearer ${N8N_API_TOKEN}" \
"${N8N_API_URL}/api/v1/workflows" | \
jq -r '.data[].id')

# Export each workflow
for workflow_id in ${WORKFLOW_IDS}; do
curl -s \
	-H "Authorization: Bearer ${N8N_API_TOKEN}" \
	"${N8N_API_URL}/api/v1/workflows/${workflow_id}" | \
	jq '.' > "${BACKUP_DIR}/workflows_${TIMESTAMP}/workflow_${workflow_id}.json"
done

# 3. Credentials backup (encrypted by n8n)
echo "Creating credentials backup..."
PGPASSWORD="${DB_PASSWORD}" pg_dump \
-h postgres.n8n-production.svc.cluster.local \
-U n8n_user \
-d n8n_production \
--table=credentials_entity \
--format=custom \
--file="${BACKUP_DIR}/credentials_${TIMESTAMP}.pgdump"

# 4. Configuration files backup
echo "Backing up configuration files..."
kubectl get configmaps -n n8n-production -o yaml > "${BACKUP_DIR}/configmaps_${TIMESTAMP}.yaml"
kubectl get secrets -n n8n-production -o yaml > "${BACKUP_DIR}/secrets_${TIMESTAMP}.yaml"

# 5. Create consolidated archive
echo "Creating consolidated backup archive..."
tar -czf "${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
-C "${BACKUP_DIR}" \
"database_${TIMESTAMP}.pgdump" \
"workflows_${TIMESTAMP}/" \
"credentials_${TIMESTAMP}.pgdump" \
"configmaps_${TIMESTAMP}.yaml" \
"secrets_${TIMESTAMP}.yaml"

# 6. Upload to S3 with encryption
echo "Uploading to S3..."
aws s3 cp "${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
"s3://${S3_BUCKET}/daily/${TIMESTAMP}/" \
--server-side-encryption AES256 \
--storage-class STANDARD_IA

# 7. Verify backup integrity
echo "Verifying backup integrity..."
aws s3api head-object \
--bucket "${S3_BUCKET}" \
--key "daily/${TIMESTAMP}/n8n_complete_backup_${TIMESTAMP}.tar.gz" \
--query 'ContentLength' --output text > /dev/null

# 8. Cleanup old local backups
echo "Cleaning up old local backups..."
find "${BACKUP_DIR}" -type f -name "*.tar.gz" -mtime +${RETENTION_DAYS} -delete
find "${BACKUP_DIR}" -type f -name "*.pgdump" -mtime +${RETENTION_DAYS} -delete
find "${BACKUP_DIR}" -type d -name "workflows_*" -mtime +${RETENTION_DAYS} -exec rm -rf {} +

# 9. Update backup log
echo "Backup completed successfully at $(date)"
echo "Backup size: $(du -h ${BACKUP_DIR}/n8n_complete_backup_${TIMESTAMP}.tar.gz | cut -f1)"
echo "S3 location: s3://${S3_BUCKET}/daily/${TIMESTAMP}/"

# 10. Send notification (optional)
if command -v curl &> /dev/null && [[ -n "${SLACK_WEBHOOK_URL:-}" ]]; then
curl -X POST -H 'Content-type: application/json' \
	--data "{\"text\":\"✅ n8n backup completed successfully - ${TIMESTAMP}\"}" \
	"${SLACK_WEBHOOK_URL}"
fi

# n8n-backup-cronjob.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
name: n8n-backup
namespace: n8n-production
spec:
schedule: "0 2 * * *" # Daily at 2 AM
timeZone: "Europe/Berlin"
concurrencyPolicy: Forbid
successfulJobsHistoryLimit: 3
failedJobsHistoryLimit: 5
jobTemplate:
	spec:
	 activeDeadlineSeconds: 3600 # 1 hour timeout
	 template:
		spec:
		 restartPolicy: OnFailure
		 containers:
		 * name: backup
			image: company-registry.com/n8n-backup:latest
			command: ["/scripts/backup-n8n-complete.sh"]
			env:
			* name: DB_PASSWORD
			 valueFrom:
				secretKeyRef:
				 name: postgres-credentials
				 key: password
			* name: N8N_API_TOKEN
			 valueFrom:
				secretKeyRef:
				 name: n8n-secrets
				 key: api-token
			* name: N8N_API_URL
			 value: "https://n8n.company.com"
			volumeMounts:
			* name: backup-storage
			 mountPath: /opt/backups
			* name: scripts
			 mountPath: /scripts
			resources:
			 requests:
				memory: "512Mi"
				cpu: "250m"
			 limits:
				memory: "2Gi"
				cpu: "1000m"
		 volumes:
		 * name: backup-storage
			persistentVolumeClaim:
			 claimName: backup-storage-pvc
		 * name: scripts
			configMap:
			 name: backup-scripts
			 defaultMode: 0755

#!/bin/bash
# restore-n8n-disaster-recovery.sh
set -euo pipefail
BACKUP_TIMESTAMP="${1:-}"
if [[ -z "$BACKUP_TIMESTAMP" ]]; then
echo "Usage: $0 <backup_timestamp>"
echo "Available backups:"
aws s3 ls s3://company-n8n-backups/daily/ | grep -o '[0-9]\{8\}_[0-9]\{6\}'
exit 1
fi
RESTORE_DIR="/tmp/n8n-restore-${BACKUP_TIMESTAMP}"
S3_BUCKET="company-n8n-backups"
echo "Starting disaster recovery for backup: ${BACKUP_TIMESTAMP}"

# 1. Download and extract backup
echo "Downloading backup from S3..."
mkdir -p "${RESTORE_DIR}"
aws s3 cp "s3://${S3_BUCKET}/daily/${BACKUP_TIMESTAMP}/n8n_complete_backup_${BACKUP_TIMESTAMP}.tar.gz" \
"${RESTORE_DIR}/"
cd "${RESTORE_DIR}"
tar -xzf "n8n_complete_backup_${BACKUP_TIMESTAMP}.tar.gz"

# 2. Scale down n8n deployment
echo "Scaling down n8n deployment..."
kubectl scale deployment n8n-main --replicas=0 -n n8n-production
kubectl scale deployment n8n-worker --replicas=0 -n n8n-production

# 3. Restore PostgreSQL database
echo "Restoring PostgreSQL database..."
kubectl exec -n n8n-production postgres-n8n-ha-1 -- psql -U postgres -c "DROP DATABASE IF EXISTS n8n_production;"
kubectl exec -n n8n-production postgres-n8n-ha-1 -- psql -U postgres -c "CREATE DATABASE n8n_production OWNER n8n_user;"
kubectl cp "database_${BACKUP_TIMESTAMP}.pgdump" n8n-production/postgres-n8n-ha-1:/tmp/
kubectl exec -n n8n-production postgres-n8n-ha-1 -- pg_restore \
-U n8n_user -d n8n_production \
--verbose --clean --if-exists \
"/tmp/database_${BACKUP_TIMESTAMP}.pgdump"

# 4. Restore Kubernetes configurations
echo "Restoring Kubernetes configurations..."
kubectl apply -f "configmaps_${BACKUP_TIMESTAMP}.yaml"
kubectl apply -f "secrets_${BACKUP_TIMESTAMP}.yaml"

 5. Scale up n8n deployment
echo "Scaling up n8n deployment..."
kubectl scale deployment n8n-main --replicas=2 -n n8n-production
kubectl scale deployment n8n-worker --replicas=5 -n n8n-production

# 6. Wait for deployment to be ready
echo "Waiting for pods to be ready..."
kubectl wait --for=condition=ready pod -l app=n8n-main -n n8n-production --timeout=300s
kubectl wait --for=condition=ready pod -l app=n8n-worker -n n8n-production --timeout=300s

# 7. Verify restoration
echo "Verifying restoration..."
WORKFLOW_COUNT=$(curl -s \
-H "Authorization: Bearer ${N8N_API_TOKEN}" \
"${N8N_API_URL}/api/v1/workflows" | \
jq '.data | length')
echo "✅ Disaster recovery completed!"
echo "Restored ${WORKFLOW_COUNT} workflows from backup ${BACKUP_TIMESTAMP}"
echo "n8n is available at: ${N8N_API_URL}"

{
"name": "DevOps CI/CD Pipeline",
"nodes": [
	{
	 "parameters": {
		"path": "github-webhook",
		"options": {
		 "responseMode": "onReceived"
		}
	 },
	 "id": "webhook-trigger-001",
	 "name": "GitHub Webhook",
	 "type": "n8n-nodes-base.webhook",
	 "typeVersion": 1,
	 "position": [240, 300],
	 "webhookId": "github-ci-cd-trigger"
	},
	{
	 "parameters": {
		"jsCode": "// Git Event Processing Logic\nconst payload = $input.first().json;\nconst branch = payload.ref.replace('refs/heads/', '');\nconst isMainBranch = branch === 'main';\n\n// Environment determination\nlet environment = 'development';\nif (isMainBranch) {\n environment = 'production';\n} else if (branch.startsWith('release/')) {\n environment = 'staging';\n}\n\n// Build deployment context\nconst deploymentContext = {\n repository: payload.repository.full_name,\n commit_sha: payload.head_commit.id,\n commit_message: payload.head_commit.message,\n author: payload.head_commit.author.name,\n branch: branch,\n environment: environment,\n timestamp: new Date().toISOString(),\n workflow_run_id: generateUUID()\n};\n\n// Validation and enrichment\nif (!payload.head_commit || !payload.repository) {\n throw new Error('Invalid webhook payload: missing required fields');\n}\n\nreturn [{\n json: deploymentContext,\n pairedItem: { item: 0 }\n}];\n\nfunction generateUUID() {\n return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {\n const r = Math.random() * 16 | 0;\n const v = c === 'x' ? r : (r & 0x3 | 0x8);\n return v.toString(16);\n });\n}"
	 },
	 "id": "code-processor-002",
	 "name": "Process Git Event",
	 "type": "n8n-nodes-base.code",
	 "typeVersion": 2,
	 "position": [460, 300]
	}
],
"connections": {
	"GitHub Webhook": {
	 "main": [
		[
		 {
			"node": "Process Git Event",
			"type": "main",
			"index": 0
		 }
		]
	 ]
	}
},
"active": false,
"settings": {
	"executionOrder": "v1",
	"saveManualExecutions": true,
	"callerPolicy": "workflowsFromSameOwner",
	"errorWorkflow": "error-handling-workflow-id"
},
"staticData": {},
"meta": {
	"templateCreatedBy": "devops-team",
	"templateId": "ci-cd-pipeline-v2.1",
	"instanceId": "production-instance-001"
},
"pinData": {},
"versionId": "v2.1.0-20250121",
"tags": ["devops", "ci-cd", "git", "automation"]
}

#!/bin/bash
# generate-n8n-workflow.sh - workflow generator for CI/CD pipelines
set -euo pipefail
TEMPLATE_DIR="/opt/n8n-templates"
OUTPUT_DIR="/opt/n8n-workflows"
REPO_NAME="${1:-example-app}"
ENVIRONMENT="${2:-staging}"
# Workflow metadata
WORKFLOW_ID="ci-cd-${REPO_NAME,,}-${ENVIRONMENT}"
WEBHOOK_PATH="webhook/${REPO_NAME,,}/${ENVIRONMENT}"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
# Process JSON template with envsubst
cat << EOF > "${OUTPUT_DIR}/${WORKFLOW_ID}.json"
{
"name": "CI/CD Pipeline - ${REPO_NAME} (${ENVIRONMENT})",
"nodes": [
	{
	 "parameters": {
		"path": "${WEBHOOK_PATH}",
		"options": {
		 "responseMode": "onReceived",
		 "responseData": "firstEntryJson"
		},
		"httpMethod": "POST"
	 },
	 "id": "webhook-${TIMESTAMP}",
	 "name": "Git Webhook - ${REPO_NAME}",
	 "type": "n8n-nodes-base.webhook",
	 "typeVersion": 1,
	 "position": [240, 300]
	},
	{
	 "parameters": {
		"resource": "repository",
		"operation": "getCommit",
		"owner": "\${{\$json.repository.owner.login}}",
		"repository": "${REPO_NAME}",
		"sha": "\${{\$json.head_commit.id}}"
	 },
	 "id": "github-api-${TIMESTAMP}",
	 "name": "Fetch Commit Details",
	 "type": "n8n-nodes-base.github",
	 "typeVersion": 1,
	 "position": [460, 300],
	 "credentials": {
		"githubApi": {
		 "id": "github-service-account",
		 "name": "GitHub Service Account"
		}
	 }
	},
	{
	 "parameters": {
		"url": "https://jenkins.company.com/job/${REPO_NAME}-${ENVIRONMENT}/buildWithParameters",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpBasicAuth",
		"sendQuery": true,
		"queryParameters": {
		 "parameters": [
			{
			 "name": "GIT_COMMIT",
			 "value": "\${{\$json.sha}}"
			},
			{
			 "name": "GIT_BRANCH",
			 "value": "\${{\$json.ref.replace('refs/heads/', '')}}"
			},
			{
			 "name": "ENVIRONMENT",
			 "value": "${ENVIRONMENT}"
			},
			{
			 "name": "TRIGGERED_BY",
			 "value": "n8n-webhook"
			}
		 ]
		}
	 },
	 "id": "jenkins-trigger-${TIMESTAMP}",
	 "name": "Trigger Jenkins Build",
	 "type": "n8n-nodes-base.httpRequest",
	 "typeVersion": 4.1,
	 "position": [680, 300],
	 "credentials": {
		"httpBasicAuth": {
		 "id": "jenkins-service-account",
		 "name": "Jenkins Service Account"
		}
	 }
	}
],
"connections": {
	"Git Webhook - ${REPO_NAME}": {
	 "main": [
		[
		 {
			"node": "Fetch Commit Details",
			"type": "main",
			"index": 0
		 }
		]
	 ]
	},
	"Fetch Commit Details": {
	 "main": [
		[
		 {
			"node": "Trigger Jenkins Build",
			"type": "main",
			"index": 0
		 }
		]
	 ]
	}
},
"active": false,
"settings": {
	"executionOrder": "v1",
	"saveManualExecutions": true,
	"callerPolicy": "workflowsFromSameOwner"
},
"meta": {
	"templateCreatedBy": "$(whoami)",
	"generatedAt": "$(date -Iseconds)",
	"repository": "${REPO_NAME}",
	"environment": "${ENVIRONMENT}"
},
"tags": ["ci-cd", "${ENVIRONMENT}", "${REPO_NAME,,}", "auto-generated"]
}
EOF
echo "✅ Workflow generated: ${OUTPUT_DIR}/${WORKFLOW_ID}.json"
echo "📎 Webhook URL will be: https://n8n.company.com/webhook/${WEBHOOK_PATH}"
# Optional: import directly into n8n
if [[ "${3:-}" == "--deploy" ]]; then
curl -X POST "https://n8n.company.com/api/v1/workflows" \
	-H "Authorization: Bearer ${N8N_API_TOKEN}" \
	-H "Content-Type: application/json" \
	-d @"${OUTPUT_DIR}/${WORKFLOW_ID}.json"
echo "🚀 Workflow deployed to n8n"
fi

┌─────────────────────────────────────────────────────────────┐
│                 n8n-workflows Git repository                │
├─────────────────────────────────────────────────────────────┤
│  n8n-workflows/                                             │
│  ├── .github/workflows/                                     │
│  │   ├── validate-workflows.yml                             │
│  │   └── deploy-workflows.yml                               │
│  ├── environments/                                          │
│  │   ├── development/                                       │
│  │   ├── staging/                                           │
│  │   └── production/                                        │
│  ├── templates/                                             │
│  │   ├── ci-cd-pipeline.template.json                       │
│  │   ├── monitoring-alert.template.json                     │
│  │   └── data-sync.template.json                            │
│  ├── shared/                                                │
│  │   ├── error-workflows/                                   │
│  │   └── utility-workflows/                                 │
│  └── tests/                                                 │
│      ├── unit/                                              │
│      └── integration/                                       │
└─────────────────────────────────────────────────────────────┘

{
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "n8n Workflow Schema",
"type": "object",
"required": ["name", "nodes", "connections"],
"properties": {
	"name": {
	 "type": "string",
	 "pattern": "^[A-Za-z0-9\\s\\-_]+$",
	 "maxLength": 100
	},
	"nodes": {
	 "type": "array",
	 "minItems": 1,
	 "items": {
		"type": "object",
		"required": ["id", "name", "type", "position"],
		"properties": {
		 "id": {
			"type": "string",
			"pattern": "^[a-zA-Z0-9\\-_]+$"
		 },
		 "type": {
			"type": "string",
			"enum": [
			 "n8n-nodes-base.webhook",
			 "n8n-nodes-base.httpRequest",
			 "n8n-nodes-base.code",
			 "n8n-nodes-base.if",
			 "n8n-nodes-base.github"
			]
		 },
		 "position": {
			"type": "array",
			"items": { "type": "number" },
			"minItems": 2,
			"maxItems": 2
		 }
		}
	 }
	}
}
}

// KubernetesNode.ts - custom node for K8s operations
import {
IExecuteFunctions,
INodeExecutionData,
INodeType,
INodeTypeDescription,
NodeParameterValue,
ICredentialType,
ILoadOptionsFunctions,
INodePropertyOptions,
} from 'n8n-workflow';
import { KubeConfig, CoreV1Api, AppsV1Api, BatchV1Api } from '@kubernetes/client-node';
export class KubernetesNode implements INodeType {
description: INodeTypeDescription = {
	displayName: 'Kubernetes',
	name: 'kubernetes',
	icon: 'file:kubernetes.svg',
	group: ['DevOps'],
	version: 1,
	subtitle: '={{$parameter["operation"] + ": " + $parameter["resource"]}}',
	description: 'Execute Kubernetes operations via kubectl API',
	defaults: {
	 name: 'Kubernetes',
	 color: '#326CE5',
	},
	inputs: ['main'],
	outputs: ['main'],
	credentials: [
	 {
		name: 'kubernetesApi',
		required: true,
	 },
	],
	requestDefaults: {
	 headers: {
		'User-Agent': 'n8n-kubernetes-node/1.0.0',
	 },
	},
	properties: [
	 {
		displayName: 'Resource',
		name: 'resource',
		type: 'options',
		noDataExpression: true,
		options: [
		 {
			name: 'Pod',
			value: 'pod',
		 },
		 {
			name: 'Deployment',
			value: 'deployment',
		 },
		 {
			name: 'Service',
			value: 'service',
		 },
		 {
			name: 'Job',
			value: 'job',
		 },
		 {
			name: 'ConfigMap',
			value: 'configMap',
		 },
		],
		default: 'pod',
		required: true,
	 },
	 {
		displayName: 'Operation',
		name: 'operation',
		type: 'options',
		noDataExpression: true,
		displayOptions: {
		 show: {
			resource: ['pod'],
		 },
		},
		options: [
		 {
			name: 'Get',
			value: 'get',
			description: 'Get pod information',
		 },
		 {
			name: 'List',
			value: 'list',
			description: 'List pods in namespace',
		 },
		 {
			name: 'Delete',
			value: 'delete',
			description: 'Delete a pod',
		 },
		 {
			name: 'Get Logs',
			value: 'getLogs',
			description: 'Get pod logs',
		 },
		 {
			name: 'Execute',
			value: 'exec',
			description: 'Execute command in pod',
		 },
		],
		default: 'get',
		required: true,
	 },
	 {
		displayName: 'Namespace',
		name: 'namespace',
		type: 'string',
		default: 'default',
		placeholder: 'default',
		description: 'Kubernetes namespace',
		required: true,
	 },
	 {
		displayName: 'Pod Name',
		name: 'podName',
		type: 'string',
		displayOptions: {
		 show: {
			resource: ['pod'],
			operation: ['get', 'delete', 'getLogs', 'exec'],
		 },
		},
		default: '',
		placeholder: 'my-pod-name',
		description: 'Name of the pod',
		required: true,
	 },
	 {
		displayName: 'Container Name',
		name: 'containerName',
		type: 'string',
		displayOptions: {
		 show: {
			resource: ['pod'],
			operation: ['getLogs', 'exec'],
		 },
		},
		default: '',
		placeholder: 'main-container',
		description: 'Container name (optional for single-container pods)',
	 },
	 {
		displayName: 'Command',
		name: 'command',
		type: 'string',
		displayOptions: {
		 show: {
			resource: ['pod'],
			operation: ['exec'],
		 },
		},
		default: '/bin/bash',
		placeholder: '/bin/bash -c "ls -la"',
		description: 'Command to execute in the pod',
		required: true,
	 },
	 {
		displayName: 'Follow Logs',
		name: 'followLogs',
		type: 'boolean',
		displayOptions: {
		 show: {
			resource: ['pod'],
			operation: ['getLogs'],
		 },
		},
		default: false,
		description: 'Follow log output (stream)',
	 },
	],
};
async execute(this: IExecuteFunctions): Promise<INodeExecutionData[][]> {
	const items = this.getInputData();
	const returnData: INodeExecutionData[] = [];
	// Kubernetes client setup
	const credentials = await this.getCredentials('kubernetesApi');
	const kubeConfig = new KubeConfig();
	try {
	 // Load kubeconfig from credentials
	 if (credentials.kubeconfig) {
		kubeConfig.loadFromString(credentials.kubeconfig as string);
	 } else {
		kubeConfig.loadFromDefault();
	 }
	} catch (error) {
	 throw new Error(`Failed to load Kubernetes configuration: ${error.message}`);
	}
	const coreV1Api = kubeConfig.makeApiClient(CoreV1Api);
	const appsV1Api = kubeConfig.makeApiClient(AppsV1Api);
	const batchV1Api = kubeConfig.makeApiClient(BatchV1Api);
	// Process each input item
	for (let itemIndex = 0; itemIndex < items.length; itemIndex++) {
	 try {
		const resource = this.getNodeParameter('resource', itemIndex) as string;
		const operation = this.getNodeParameter('operation', itemIndex) as string;
		const namespace = this.getNodeParameter('namespace', itemIndex) as string;
		let responseData: any;
		if (resource === 'pod') {
		 responseData = await this.handlePodOperations(
			coreV1Api,
			operation,
			namespace,
			itemIndex
		 );
		} else if (resource === 'deployment') {
		 responseData = await this.handleDeploymentOperations(
			appsV1Api,
			operation,
			namespace,
			itemIndex
		 );
		}
		returnData.push({
		 json: {
			resource,
			operation,
			namespace,
			timestamp: new Date().toISOString(),
			success: true,
			data: responseData,
		 },
		 pairedItem: { item: itemIndex },
		});
	 } catch (error) {
		if (this.continueOnFail()) {
		 returnData.push({
			json: {
			 error: error.message,
			 success: false,
			 timestamp: new Date().toISOString(),
			},
			pairedItem: { item: itemIndex },
		 });
		 continue;
		}
		throw error;
	 }
	}
	return [returnData];
}
private async handlePodOperations(
	coreV1Api: CoreV1Api,
	operation: string,
	namespace: string,
	itemIndex: number
): Promise<any> {
	const podName = this.getNodeParameter('podName', itemIndex) as string;
	switch (operation) {
	 case 'get':
		const podResponse = await coreV1Api.readNamespacedPod(podName, namespace);
		return podResponse.body;
	 case 'list':
		const listResponse = await coreV1Api.listNamespacedPod(namespace);
		return listResponse.body.items;
	 case 'delete':
		const deleteResponse = await coreV1Api.deleteNamespacedPod(podName, namespace);
		return { deleted: true, podName, namespace };
	 case 'getLogs':
		const containerName = this.getNodeParameter('containerName', itemIndex, '') as string;
		const followLogs = this.getNodeParameter('followLogs', itemIndex, false) as boolean;
		const logsResponse = await coreV1Api.readNamespacedPodLog(
		 podName,
		 namespace,
		 containerName || undefined,
		 followLogs
		);
		return { logs: logsResponse.body };
	 case 'exec':
		const command = this.getNodeParameter('command', itemIndex) as string;
		// Kubernetes exec is complex - simplified implementation
		return {
		 message: 'Exec operation initiated',
		 podName,
		 command,
		 namespace
		};
	 default:
		throw new Error(`Unknown pod operation: ${operation}`);
	}
}
private async handleDeploymentOperations(
	appsV1Api: AppsV1Api,
	operation: string,
	namespace: string,
	itemIndex: number
): Promise<any> {
	// Implementation for deployment operations
	// ...
	return { message: 'Deployment operation placeholder' };
}
}

// KubernetesApi.credentials.ts
import {
ICredentialType,
INodeProperties,
} from 'n8n-workflow';
export class KubernetesApi implements ICredentialType {
name = 'kubernetesApi';
displayName = 'Kubernetes API';
documentationUrl = 'https://kubernetes.io/docs/reference/access-authn-authz/authentication/';
properties: INodeProperties[] = [
	{
	 displayName: 'Authentication Method',
	 name: 'authType',
	 type: 'options',
	 options: [
		{
		 name: 'Kubeconfig',
		 value: 'kubeconfig',
		},
		{
		 name: 'Service Account Token',
		 value: 'serviceAccount',
		},
		{
		 name: 'Certificate',
		 value: 'certificate',
		},
	 ],
	 default: 'kubeconfig',
	},
	{
	 displayName: 'Kubeconfig',
	 name: 'kubeconfig',
	 type: 'string',
	 typeOptions: {
		password: true,
		rows: 10,
	 },
	 displayOptions: {
		show: {
		 authType: ['kubeconfig'],
		},
	 },
	 default: '',
	 description: 'Complete kubeconfig file content',
	},
	{
	 displayName: 'API Server URL',
	 name: 'serverUrl',
	 type: 'string',
	 displayOptions: {
		show: {
		 authType: ['serviceAccount', 'certificate'],
		},
	 },
	 default: 'https://kubernetes.default.svc',
	 placeholder: 'https://kubernetes.default.svc',
	 description: 'Kubernetes API server URL',
	},
	{
	 displayName: 'Service Account Token',
	 name: 'token',
	 type: 'string',
	 typeOptions: {
		password: true,
	 },
	 displayOptions: {
		show: {
		 authType: ['serviceAccount'],
		},
	 },
	 default: '',
	 description: 'Service account bearer token',
	},
];
}

// tests/KubernetesNode.test.ts
import { KubernetesNode } from '../nodes/KubernetesNode';
import {
IExecuteFunctions,
INodeExecutionData,
ICredentialsDecrypted,
ICredentialDataDecryptedObject,
} from 'n8n-workflow';
// Mock Kubernetes client
jest.mock('@kubernetes/client-node');
describe('KubernetesNode', () => {
let kubernetesNode: KubernetesNode;
let mockExecuteFunctions: Partial<IExecuteFunctions>;
beforeEach(() => {
	kubernetesNode = new KubernetesNode();
	mockExecuteFunctions = {
	 getInputData: jest.fn(),
	 getNodeParameter: jest.fn(),
	 getCredentials: jest.fn(),
	 continueOnFail: jest.fn(),
	};
});
it('should handle pod get operation', async () => {
	// Mock input data
	(mockExecuteFunctions.getInputData as jest.Mock).mockReturnValue([
	 { json: { podName: 'test-pod' } }
	]);
	(mockExecuteFunctions.getNodeParameter as jest.Mock)
	 .mockReturnValueOnce('pod') // resource
	 .mockReturnValueOnce('get') // operation
	 .mockReturnValueOnce('default') // namespace
	 .mockReturnValueOnce('test-pod'); // podName
	(mockExecuteFunctions.getCredentials as jest.Mock).mockResolvedValue({
	 kubeconfig: 'mock-kubeconfig-content'
	});
	// Execute node
	const result = await kubernetesNode.execute.call(
	 mockExecuteFunctions as IExecuteFunctions
	);
	// Assertions
	expect(result).toHaveLength(1);
	expect(result[0]).toHaveLength(1);
	expect(result[0][0].json.resource).toBe('pod');
	expect(result[0][0].json.operation).toBe('get');
});
});

# build-and-deploy-node.sh
#!/bin/bash
NODE_NAME="n8n-nodes-kubernetes"
NODE_VERSION="1.0.0"
BUILD_DIR="/tmp/n8n-node-build"
echo "🔨 Building custom node: ${NODE_NAME}"
# Cleanup and create directory
rm -rf "${BUILD_DIR}"
mkdir -p "${BUILD_DIR}"
# Copy node files
cp -r nodes/ credentials/ package.json tsconfig.json "${BUILD_DIR}/"
cd "${BUILD_DIR}"
# Install dependencies and build
npm install
npm run build
# Docker image for custom node
cat << 'EOF' > Dockerfile
FROM n8nio/n8n:latest
USER root
# Install custom node
COPY dist/ /home/node/.n8n/custom/
COPY package.json /home/node/.n8n/custom/
RUN cd /home/node/.n8n/custom && \
	npm install --only=production && \
	chown -R node:node /home/node/.n8n/
USER node
EOF
# Build and push
docker build -t "company-registry.com/n8n-kubernetes:${NODE_VERSION}" .
docker push "company-registry.com/n8n-kubernetes:${NODE_VERSION}"
echo "✅ Custom node deployed: company-registry.com/n8n-kubernetes:${NODE_VERSION}"

┌─────────────────────────────────────────────────────────────┐
│                    Error Handling Levels                    │
├─────────────────────────────────────────────────────────────┤
│  1. Node-Level Error Handling                               │
│     * Try/Catch in Code Nodes                               │
│     * Conditional Outputs (Continue on Fail)                │
│     * Input Validation & Schema Enforcement                 │
├─────────────────────────────────────────────────────────────┤
│  2. Workflow-Level Error Handling                           │
│     * Dedicated Error Trigger Workflow Integration          │
│     * IF / Switch Nodes for Intelligent Error Routing       │
│     * Automated Cleanup and Rollback Operations             │
├─────────────────────────────────────────────────────────────┤
│  3. System-Level Error Handling                             │
│     * Infrastructure Health & Process Monitoring            │
│     * Redis Dead Letter Queues (DLQ)                        │
│     * Circuit Breaker Patterns for External APIs            │
└─────────────────────────────────────────────────────────────┘

{
"name": "Production Error Handler",
"nodes": [
	{
	 "parameters": {},
	 "id": "error-trigger",
	 "name": "Error Trigger",
	 "type": "n8n-nodes-base.errorTrigger",
	 "position": [240, 300]
	},
	{
	 "parameters": {
		"jsCode": "// Enhanced Error Processing and Classification\nconst errorData = $input.first().json;\nconst executionData = errorData.execution;\nconst workflowData = errorData.workflow;\n\n// Error Classification\nlet errorSeverity = 'low';\nlet errorCategory = 'unknown';\nlet autoRetry = false;\nlet escalationLevel = 1;\n\n// Analyze error type and context\nif (errorData.error) {\n const errorMessage = errorData.error.message?.toLowerCase() || '';\n const errorName = errorData.error.name?.toLowerCase() || '';\n \n // Network/API Errors (retriable)\n if (errorMessage.includes('timeout') || \n errorMessage.includes('connection') ||\n errorMessage.includes('econnreset') ||\n errorMessage.includes('socket hang up')) {\n errorCategory = 'network';\n errorSeverity = 'medium';\n autoRetry = true;\n }\n \n // Authentication Errors (critical)\n else if (errorMessage.includes('unauthorized') ||\n errorMessage.includes('forbidden') ||\n errorMessage.includes('invalid token')) {\n errorCategory = 'authentication';\n errorSeverity = 'high';\n escalationLevel = 2;\n }\n \n // Data/Validation Errors\n else if (errorMessage.includes('invalid') ||\n errorMessage.includes('missing') ||\n errorMessage.includes('required')) {\n errorCategory = 'validation';\n errorSeverity = 'medium';\n }\n \n // Infrastructure Errors (critical)\n else if (errorMessage.includes('database') ||\n errorMessage.includes('redis') ||\n errorMessage.includes('queue')) {\n errorCategory = 'infrastructure';\n errorSeverity = 'critical';\n escalationLevel = 3;\n }\n}\n\n// Workflow Context Analysis\nconst isProductionWorkflow = workflowData.tags?.includes('production') || false;\nconst isCriticalWorkflow = workflowData.tags?.includes('critical') || false;\n\nif (isProductionWorkflow) {\n escalationLevel = Math.max(escalationLevel, 2);\n}\n\nif (isCriticalWorkflow) {\n escalationLevel = 3;\n errorSeverity = 'critical';\n}\n\n// Execution History Analysis\nlet recentFailures = 0;\nif (executionData.id) {\n // This would require API call to get recent executions\n // For now, we'll use a placeholder\n recentFailures = Math.floor(Math.random() * 3);\n}\n\n// Create comprehensive error context\nconst errorContext = {\n // Basic Error Information\n timestamp: new Date().toISOString(),\n executionId: executionData.id || 'unknown',\n workflowId: workflowData.id || 'unknown',\n workflowName: workflowData.name || 'Unknown Workflow',\n \n // Error Details\n error: {\n name: errorData.error?.name || 'Unknown Error',\n message: errorData.error?.message || 'No error message',\n stack: errorData.error?.stack || 'No stack trace',\n nodeType: errorData.error?.node?.type || 'unknown',\n nodeName: errorData.error?.node?.name || 'unknown',\n },\n \n // Classification\n classification: {\n category: errorCategory,\n severity: errorSeverity,\n autoRetry: autoRetry,\n escalationLevel: escalationLevel,\n recentFailures: recentFailures\n },\n \n // Context\n context: {\n isProduction: isProductionWorkflow,\n isCritical: isCriticalWorkflow,\n tags: workflowData.tags || [],\n executionMode: executionData.mode || 'unknown'\n },\n \n // URLs for quick access\n urls: {\n execution: `https://n8n.company.com/workflow/${workflowData.id}/executions/${executionData.id}`,\n workflow: `https://n8n.company.com/workflow/${workflowData.id}`,\n debugging: `https://n8n.company.com/workflow/${workflowData.id}/debug/${executionData.id}`\n }\n};\n\nreturn [{ json: errorContext }];"
	 },
	 "id": "error-analysis",
	 "name": "Analyze Error",
	 "type": "n8n-nodes-base.code",
	 "position": [460, 300]
	},
	{
	 "parameters": {
		"conditions": {
		 "options": {
			"caseSensitive": true,
			"leftValue": "",
			"typeValidation": "strict"
		 },
		 "conditions": [
			{
			 "leftValue": "={{ $json.classification.autoRetry }}",
			 "rightValue": true,
			 "operator": {
				"type": "boolean"
			 }
			},
			{
			 "leftValue": "={{ $json.classification.recentFailures }}",
			 "rightValue": 3,
			 "operator": {
				"type": "number",
				"operation": "lt"
			 }
			}
		 ],
		 "combinator": "and"
		},
		"options": {}
	 },
	 "id": "retry-decision",
	 "name": "Should Retry?",
	 "type": "n8n-nodes-base.if",
	 "position": [680, 300]
	},
	{
	 "parameters": {
		"url": "https://n8n.company.com/api/v1/executions/{{ $json.executionId }}/retry",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpHeaderAuth",
		"sendHeaders": true,
		"headerParameters": {
		 "parameters": [
			{
			 "name": "Authorization",
			 "value": "Bearer {{ $credentials.n8nApi.token }}"
			}
		 ]
		},
		"options": {
		 "response": {
			"response": {
			 "responseFormat": "json"
			}
		 }
		}
	 },
	 "id": "retry-execution",
	 "name": "Retry Execution",
	 "type": "n8n-nodes-base.httpRequest",
	 "position": [900, 200]
	}
],
"connections": {
	"Error Trigger": {
	 "main": [
		[
		 {
			"node": "Analyze Error",
			"type": "main",
			"index": 0
		 }
		]
	 ]
	},
	"Analyze Error": {
	 "main": [
		[
		 {
			"node": "Should Retry?",
			"type": "main",
			"index": 0
		 }
		]
	 ]
	},
	"Should Retry?": {
	 "main": [
		[
		 {
			"node": "Retry Execution",
			"type": "main",
			"index": 0
		 }
		],
		[
		 {
			"node": "Send Alert",
			"type": "main",
			"index": 0
		 }
		]
	 ]
	}
}
}

// Exponential backoff retry logic
class RetryManager {
constructor(maxRetries = 3, baseDelay = 1000, maxDelay = 30000) {
	this.maxRetries = maxRetries;
	this.baseDelay = baseDelay;
	this.maxDelay = maxDelay;
}
async executeWithRetry(operation, context = {}) {
	let lastError;
	for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
	 try {
		const result = await operation();
		// Log successful retry
		if (attempt > 1) {
		 console.log(`✅ Operation succeeded on attempt ${attempt}/${this.maxRetries}`);
		}
		return result;
	 } catch (error) {
		lastError = error;
		// Determine if error is retriable
		if (!this.isRetriableError(error)) {
		 throw error; // Fail fast for non-retriable errors
		}
		if (attempt === this.maxRetries) {
		 break; // Last attempt failed
		}
		// Calculate exponential backoff delay
		const delay = Math.min(
		 this.baseDelay * Math.pow(2, attempt - 1),
		 this.maxDelay
		);
		console.log(`⏱️ Attempt ${attempt}/${this.maxRetries} failed: ${error.message}`);
		console.log(`🔄 Retrying in ${delay}ms...`);
		await this.sleep(delay);
	 }
	}
	// All retries exhausted
	throw new Error(`Operation failed after ${this.maxRetries} attempts. Last error: ${lastError.message}`);
}
isRetriableError(error) {
	const retriablePatterns = [
	 /timeout/i,
	 /connection/i,
	 /socket hang up/i,
	 /econnreset/i,
	 /service unavailable/i,
	 /too many requests/i,
	 /rate limit/i,
	 /502|503|504/,
	];
	return retriablePatterns.some(pattern =>
	 pattern.test(error.message) || pattern.test(error.code)
	);
}
sleep(ms) {
	return new Promise(resolve => setTimeout(resolve, ms));
}
}
// Usage in n8n Code Node
const retryManager = new RetryManager(3, 2000, 15000);
const result = await retryManager.executeWithRetry(async () => {
// Your API call or operation here
const response = await fetch('https://api.example.com/data', {
	method: 'POST',
	headers: {
	 'Content-Type': 'application/json',
	 'Authorization': `Bearer ${$credentials.apiToken.token}`
	},
	body: JSON.stringify($json)
});
if (!response.ok) {
	throw new Error(`HTTP ${response.status}: ${response.statusText}`);
}
return await response.json();
});
return [{ json: result }];

// Enhanced Logging and Tracing
class WorkflowLogger {
constructor(workflowId, executionId) {
	this.workflowId = workflowId;
	this.executionId = executionId;
	this.startTime = Date.now();
}
log(level, message, data = {}) {
	const logEntry = {
	 timestamp: new Date().toISOString(),
	 level: level.toUpperCase(),
	 workflowId: this.workflowId,
	 executionId: this.executionId,
	 message: message,
	 data: data,
	 duration: Date.now() - this.startTime
	};
	// Send to logging infrastructure
	console.log(JSON.stringify(logEntry));
	// Optional: Send to external logging service
	// await this.sendToElasticsearch(logEntry);
	// await this.sendToSplunk(logEntry);
}
error(message, error, context = {}) {
	this.log('error', message, {
	 error: {
		name: error.name,
		message: error.message,
		stack: error.stack
	 },
	 context: context
	});
}
info(message, data = {}) {
	this.log('info', message, data);
}
debug(message, data = {}) {
	this.log('debug', message, data);
}
performance(operation, duration, metadata = {}) {
	this.log('performance', `Operation: ${operation}`, {
	 operation: operation,
	 duration: duration,
	 metadata: metadata
	});
}
}
// Usage in n8n workflows
const logger = new WorkflowLogger($workflow.id, $execution.id);
try {
logger.info('Starting API operation', { endpoint: 'https://api.example.com' });
const startTime = Date.now();
const response = await fetch('https://api.example.com/data');
const duration = Date.now() - startTime;
logger.performance('API_CALL', duration, {
	statusCode: response.status,
	responseSize: response.headers.get('content-length')
});
if (!response.ok) {
	throw new Error(`HTTP ${response.status}: ${response.statusText}`);
}
const data = await response.json();
logger.info('API operation successful', { recordCount: data.length });
return [{ json: data }];
} catch (error) {
logger.error('API operation failed', error, {
	inputData: $json,
	nodePosition: $node.position
});
throw error;
}

┌─────────────────────────────────────────────────────────────┐
│                CI/CD Integration Architecture               │
├─────────────────────────────────────────────────────────────┤
│   Git Repository                                            │
│   ┌─────────────┐       ┌─────────────┐     ┌─────────────┐ │
│   │Commit & Push│──────▶│Pull Request │────▶│Webhook Trig │ │
│   └─────────────┘       └─────────────┘     └──────┬──────┘ │
├────────────────────────────────────────────────────┼────────┤
│   n8n Orchestrator                                 ▼        │
│   ┌─────────────┐       ┌─────────────┐     ┌─────────────┐ │
│   │Webhook Recv │──────▶│Branch Anal. │────▶│Env Selection│ │
│   └─────────────┘       └─────────────┘     └──────┬──────┘ │
├────────────────────────────────────────────────────┼────────┤
│   Parallel Toolchain Execution                     ▼        │
│   ┌─────────────┐       ┌─────────────┐     ┌─────────────┐ │
│   │   Jenkins   │       │  GitLab CI  │     │   Ansible   │ │
│   │  (Pipeline) │       │(Runner Job) │     │ (Playbook)  │ │
│   └─────────────┘       └─────────────┘     └──────┬──────┘ │
├────────────────────────────────────────────────────┼────────┤
│   Post-Deployment Orchestration                    ▼        │
│   ┌─────────────┐       ┌─────────────┐     ┌─────────────┐ │
│   │Health Checks│       │ Monitoring  │     │Notification │ │
│   │  (HTTP 200) │       │   (Alerts)  │     │(Slack/Teams)│ │
│   └─────────────┘       └─────────────┘     └─────────────┘ │
└─────────────────────────────────────────────────────────────┘

{
"name": "Enterprise CI/CD Orchestrator",
"nodes": [
	{
	 "parameters": {
		"path": "cicd-orchestrator",
		"options": {
		 "responseMode": "onReceived",
		 "responseData": "firstEntryJson"
		},
		"httpMethod": "POST"
	 },
	 "id": "git-webhook-receiver",
	 "name": "Git Webhook Receiver",
	 "type": "n8n-nodes-base.webhook",
	 "position": [240, 300]
	},
	{
	 "parameters": {
		"jsCode": "// Advanced Git Event Processing and Routing Logic\nconst payload = $input.first().json;\n\n// Validate webhook payload\nif (!payload.repository || !payload.head_commit || !payload.ref) {\n throw new Error('Invalid webhook payload: missing required fields');\n}\n\n// Extract branch information\nconst fullRef = payload.ref;\nconst branch = fullRef.replace('refs/heads/', '');\nconst isMainBranch = branch === 'main' || branch === 'master';\nconst isReleaseBranch = branch.startsWith('release/');\nconst isHotfixBranch = branch.startsWith('hotfix/');\nconst isFeatureBranch = branch.startsWith('feature/');\n\n// Repository analysis\nconst repository = {\n name: payload.repository.name,\n fullName: payload.repository.full_name,\n owner: payload.repository.owner.login,\n url: payload.repository.html_url,\n isPrivate: payload.repository.private\n};\n\n// Commit analysis\nconst commit = {\n sha: payload.head_commit.id,\n shortSha: payload.head_commit.id.substring(0, 8),\n message: payload.head_commit.message,\n author: {\n name: payload.head_commit.author.name,\n email: payload.head_commit.author.email\n },\n timestamp: payload.head_commit.timestamp,\n url: payload.head_commit.url\n};\n\n// Determine deployment strategy\nlet deploymentStrategy = {\n environment: 'development',\n requiresApproval: false,\n runTests: true,\n deployToProduction: false,\n notificationChannels: ['#dev-notifications'],\n parallelPipelines: ['unit-tests', 'linting'],\n postDeployActions: ['basic-health-check']\n};\n\n// Main/Master branch - Production deployment\nif (isMainBranch) {\n deploymentStrategy = {\n environment: 'production',\n requiresApproval: true,\n runTests: true,\n deployToProduction: true,\n notificationChannels: ['#deployments', '#general'],\n parallelPipelines: ['unit-tests', 'integration-tests', 'security-scan', 'performance-tests'],\n postDeployActions: ['health-check', 'smoke-tests', 'monitoring-setup', 'backup-verification']\n };\n}\n\n// Release branch - Staging deployment\nelse if (isReleaseBranch) {\n const releaseVersion = branch.replace('release/', '');\n deploymentStrategy = {\n environment: 'staging',\n requiresApproval: false,\n runTests: true,\n deployToProduction: false,\n releaseVersion: releaseVersion,\n notificationChannels: ['#staging-deployments', '#qa-team'],\n parallelPipelines: ['unit-tests', 'integration-tests', 'e2e-tests'],\n postDeployActions: ['health-check', 'qa-notification', 'staging-data-refresh']\n };\n}\n\n// Hotfix branch - Emergency deployment\nelse if (isHotfixBranch) {\n deploymentStrategy = {\n environment: 'production',\n requiresApproval: true,\n runTests: true,\n deployToProduction: true,\n isHotfix: true,\n notificationChannels: ['#critical-deployments', '#oncall'],\n parallelPipelines: ['unit-tests', 'critical-integration-tests'],\n postDeployActions: ['immediate-health-check', 'rollback-plan-verification', 'incident-update']\n };\n}\n\n// Feature branch - Development deployment\nelse if (isFeatureBranch) {\n deploymentStrategy = {\n environment: 'development',\n requiresApproval: false,\n runTests: true,\n deployToProduction: false,\n featureName: branch.replace('feature/', ''),\n notificationChannels: ['#dev-notifications'],\n parallelPipelines: ['unit-tests', 'linting', 'security-scan'],\n postDeployActions: ['basic-health-check']\n };\n}\n\n// Build comprehensive deployment context\nconst deploymentContext = {\n // Basic Information\n timestamp: new Date().toISOString(),\n workflowRunId: generateUUID(),\n triggeredBy: 'git-webhook',\n \n // Repository Context\n repository: repository,\n commit: commit,\n branch: {\n name: branch,\n fullRef: fullRef,\n type: {\n isMain: isMainBranch,\n isRelease: isReleaseBranch,\n isHotfix: isHotfixBranch,\n isFeature: isFeatureBranch\n }\n },\n \n // Deployment Strategy\n deployment: deploymentStrategy,\n \n // Pipeline Configuration\n pipelines: {\n jenkins: {\n enabled: true,\n jobName: `${repository.name}-${deploymentStrategy.environment}`,\n parameters: {\n GIT_COMMIT: commit.sha,\n GIT_BRANCH: branch,\n ENVIRONMENT: deploymentStrategy.environment,\n RUN_TESTS: deploymentStrategy.runTests.toString(),\n DEPLOY_TO_PROD: deploymentStrategy.deployToProduction.toString()\n }\n },\n gitlabCI: {\n enabled: repository.isPrivate,\n projectId: payload.repository.id,\n ref: branch,\n variables: {\n DEPLOYMENT_ENV: deploymentStrategy.environment,\n COMMIT_SHA: commit.sha\n }\n },\n ansible: {\n enabled: deploymentStrategy.deployToProduction,\n playbook: `deploy-${repository.name}.yml`,\n inventory: deploymentStrategy.environment,\n extraVars: {\n app_version: commit.shortSha,\n deployment_timestamp: new Date().toISOString()\n }\n }\n },\n \n // Monitoring and Notifications\n monitoring: {\n setupRequired: deploymentStrategy.deployToProduction,\n healthCheckEndpoints: [\n `https://${repository.name}-${deploymentStrategy.environment}.company.com/health`,\n `https://${repository.name}-${deploymentStrategy.environment}.company.com/metrics`\n ],\n alertingRules: deploymentStrategy.deployToProduction ? 'production' : 'development'\n },\n \n // Approval Workflow\n approval: {\n required: deploymentStrategy.requiresApproval,\n approvers: deploymentStrategy.deployToProduction ? \n ['devops-lead@company.com', 'tech-lead@company.com'] : [],\n timeoutMinutes: 30\n }\n};\n\n// Helper function for UUID generation\nfunction generateUUID() {\n return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {\n const r = Math.random() * 16 | 0;\n const v = c === 'x' ? r : (r & 0x3 | 0x8);\n return v.toString(16);\n });\n}\n\nreturn [{ json: deploymentContext }];"
	 },
	 "id": "git-event-processor",
	 "name": "Process Git Event",
	 "type": "n8n-nodes-base.code",
	 "position": [460, 300]
	},
	{
	 "parameters": {
		"conditions": {
		 "options": {
			"caseSensitive": true,
			"leftValue": "",
			"typeValidation": "strict"
		 },
		 "conditions": [
			{
			 "leftValue": "={{ $json.approval.required }}",
			 "rightValue": true,
			 "operator": {
				"type": "boolean"
			 }
			}
		 ]
		}
	 },
	 "id": "approval-gate",
	 "name": "Requires Approval?",
	 "type": "n8n-nodes-base.if",
	 "position": [680, 300]
	},
	{
	 "parameters": {
		"resource": "message",
		"operation": "postToChannel",
		"channel": "#deployment-approvals",
		"text": "🚀 **Deployment Approval Required**\n\n**Repository:** {{ $json.repository.fullName }}\n**Branch:** {{ $json.branch.name }}\n**Commit:** {{ $json.commit.shortSha }} - {{ $json.commit.message }}\n**Environment:** {{ $json.deployment.environment }}\n**Author:** {{ $json.commit.author.name }}\n\n**Approvers:** {{ $json.approval.approvers.join(', ') }}\n\n[View Commit]({{ $json.commit.url }}) | [Pipeline Details](https://n8n.company.com/workflow/{{ $workflow.id }}/executions/{{ $execution.id }})\n\n**React with ✅ to approve, ❌ to reject**",
		"attachments": [],
		"otherOptions": {
		 "includeLinkToWorkflow": true
		}
	 },
	 "id": "approval-request",
	 "name": "Request Approval",
	 "type": "n8n-nodes-base.slack",
	 "position": [900, 200],
	 "credentials": {
		"slackApi": {
		 "id": "slack-bot-token",
		 "name": "Slack Bot Token"
		}
	 }
	},
	{
	 "parameters": {
		"url": "https://jenkins.company.com/job/{{ $json.pipelines.jenkins.jobName }}/buildWithParameters",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpBasicAuth",
		"sendQuery": true,
		"queryParameters": {
		 "parameters": [
			{
			 "name": "GIT_COMMIT",
			 "value": "={{ $json.pipelines.jenkins.parameters.GIT_COMMIT }}"
			},
			{
			 "name": "GIT_BRANCH",
			 "value": "={{ $json.pipelines.jenkins.parameters.GIT_BRANCH }}"
			},
			{
			 "name": "ENVIRONMENT",
			 "value": "={{ $json.pipelines.jenkins.parameters.ENVIRONMENT }}"
			},
			{
			 "name": "RUN_TESTS",
			 "value": "={{ $json.pipelines.jenkins.parameters.RUN_TESTS }}"
			},
			{
			 "name": "N8N_CALLBACK_URL",
			 "value": "https://n8n.company.com/webhook/jenkins-callback/{{ $json.workflowRunId }}"
			}
		 ]
		},
		"options": {
		 "response": {
			"response": {
			 "responseFormat": "json"
			}
		 },
		 "timeout": 30000
		}
	 },
	 "id": "trigger-jenkins",
	 "name": "Trigger Jenkins Pipeline",
	 "type": "n8n-nodes-base.httpRequest",
	 "position": [900, 400],
	 "credentials": {
		"httpBasicAuth": {
		 "id": "jenkins-service-account",
		 "name": "Jenkins Service Account"
		}
	 }
	}
],
"connections": {
	"Git Webhook Receiver": {
	 "main": [
		[
		 {
			"node": "Process Git Event",
			"type": "main",
			"index": 0
		 }
		]
	 ]
	},
	"Process Git Event": {
	 "main": [
		[
		 {
			"node": "Requires Approval?",
			"type": "main",
			"index": 0
		 }
		]
	 ]
	},
	"Requires Approval?": {
	 "main": [
		[
		 {
			"node": "Request Approval",
			"type": "main",
			"index": 0
		 }
		],
		[
		 {
			"node": "Trigger Jenkins Pipeline",
			"type": "main",
			"index": 0
		 }
		]
	 ]
	}
}
}

#!/bin/bash
# gitops-sync-controller.sh - n8n-based GitOps controller
set -euo pipefail
# GitOps repository structure:
# gitops-repo/
# ├── applications/
# │ ├── production/
# │ ├── staging/
# │ └── development/
# ├── infrastructure/
# │ ├── kubernetes/
# │ ├── terraform/
# │ └── ansible/
# └── configurations/
# ├── monitoring/
# ├── logging/
# └── security/
GITOPS_REPO_URL="https://github.com/company/gitops-infrastructure.git"
GITOPS_LOCAL_PATH="/tmp/gitops-sync"
N8N_WEBHOOK_BASE="https://n8n.company.com/webhook"
# Function: clone and analyse GitOps repository
analyze_gitops_changes() {
local commit_sha="$1"
local previous_sha="$2"
# Clone repository and checkout specific commit
git clone "$GITOPS_REPO_URL" "$GITOPS_LOCAL_PATH"
cd "$GITOPS_LOCAL_PATH"
git checkout "$commit_sha"
# Analyse changed files
local changed_files
changed_files=$(git diff --name-only "$previous_sha" "$commit_sha")
# Categorise changes
local infrastructure_changes=()
local application_changes=()
local config_changes=()
while IFS= read -r file; do
	if [[ "$file" == infrastructure/* ]]; then
	 infrastructure_changes+=("$file")
	elif [[ "$file" == applications/* ]]; then
	 application_changes+=("$file")
	elif [[ "$file" == configurations/* ]]; then
	 config_changes+=("$file")
	fi
done <<< "$changed_files"
# Generate deployment plan
cat << EOF > deployment-plan.json
{
"commitSha": "$commit_sha",
"previousSha": "$previous_sha",
"timestamp": "$(date -Iseconds)",
"changes": {
	"infrastructure": $(printf '%s\n' "${infrastructure_changes[@]}" | jq -R . | jq -s .),
	"applications": $(printf '%s\n' "${application_changes[@]}" | jq -R . | jq -s .),
	"configurations": $(printf '%s\n' "${config_changes[@]}" | jq -R . | jq -s .)
},
"deploymentOrder": [
	"infrastructure",
	"configurations",
	"applications"
]
}
EOF
echo "deployment-plan.json"
}
# Function: trigger n8n GitOps workflows
trigger_gitops_workflows() {
local deployment_plan="$1"
# Trigger infrastructure updates
if [[ $(jq '.changes.infrastructure | length' "$deployment_plan") -gt 0 ]]; then
	curl -X POST "$N8N_WEBHOOK_BASE/gitops-infrastructure" \
	 -H "Content-Type: application/json" \
	 -d @"$deployment_plan"
fi
# Trigger configuration updates
if [[ $(jq '.changes.configurations | length' "$deployment_plan") -gt 0 ]]; then
	curl -X POST "$N8N_WEBHOOK_BASE/gitops-configurations" \
	 -H "Content-Type: application/json" \
	 -d @"$deployment_plan"
fi
# Trigger application deployments
if [[ $(jq '.changes.applications | length' "$deployment_plan") -gt 0 ]]; then
	curl -X POST "$N8N_WEBHOOK_BASE/gitops-applications" \
	 -H "Content-Type: application/json" \
	 -d @"$deployment_plan"
fi
}
# Main execution
main() {
local commit_sha="${1:-HEAD}"
local previous_sha="${2:-HEAD~1}"
echo "🔄 Starting GitOps sync for commit: $commit_sha"
# Analyse changes
local deployment_plan
deployment_plan=$(analyze_gitops_changes "$commit_sha" "$previous_sha")
# Trigger workflows
trigger_gitops_workflows "$deployment_plan"
# Cleanup
rm -rf "$GITOPS_LOCAL_PATH"
echo "✅ GitOps sync completed"
}
# Execute if called directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
main "$@"
fi

{
"name": "GitOps Multi-Environment Deployment",
"nodes": [
	{
	 "parameters": {
		"path": "gitops-infrastructure",
		"httpMethod": "POST"
	 },
	 "name": "GitOps Infrastructure Webhook",
	 "type": "n8n-nodes-base.webhook",
	 "position": [240, 300]
	},
	{
	 "parameters": {
		"jsCode": "// Infrastructure Deployment Orchestration\nconst deploymentPlan = $input.first().json;\nconst infraChanges = deploymentPlan.changes.infrastructure;\n\n// Analyze infrastructure changes\nconst terraformChanges = infraChanges.filter(file => file.includes('terraform/'));\nconst kubernetesChanges = infraChanges.filter(file => file.includes('kubernetes/'));\nconst ansibleChanges = infraChanges.filter(file => file.includes('ansible/'));\n\n// Determine deployment environments\nlet environments = [];\ninfraChanges.forEach(file => {\n if (file.includes('/production/')) environments.push('production');\n if (file.includes('/staging/')) environments.push('staging');\n if (file.includes('/development/')) environments.push('development');\n});\n\n// Remove duplicates\nenvironments = [...new Set(environments)];\n\n// Create deployment tasks\nconst deploymentTasks = [];\n\n// Terraform deployments\nif (terraformChanges.length > 0) {\n environments.forEach(env => {\n deploymentTasks.push({\n type: 'terraform',\n environment: env,\n files: terraformChanges.filter(f => f.includes(`/${env}/`)),\n priority: 1, // Infrastructure first\n requiresApproval: env === 'production'\n });\n });\n}\n\n// Kubernetes deployments\nif (kubernetesChanges.length > 0) {\n environments.forEach(env => {\n deploymentTasks.push({\n type: 'kubernetes',\n environment: env,\n files: kubernetesChanges.filter(f => f.includes(`/${env}/`)),\n priority: 2, // After infrastructure\n requiresApproval: env === 'production'\n });\n });\n}\n\n// Ansible configurations\nif (ansibleChanges.length > 0) {\n environments.forEach(env => {\n deploymentTasks.push({\n type: 'ansible',\n environment: env,\n files: ansibleChanges.filter(f => f.includes(`/${env}/`)),\n priority: 3, // After Kubernetes\n requiresApproval: false\n });\n });\n}\n\n// Sort by priority\ndeploymentTasks.sort((a, b) => a.priority - b.priority);\n\nreturn deploymentTasks.map((task, index) => ({\n json: {\n ...deploymentPlan,\n deploymentTask: task,\n taskIndex: index,\n totalTasks: deploymentTasks.length\n }\n}));"
	 },
	 "name": "Plan Infrastructure Deployment",
	 "type": "n8n-nodes-base.code",
	 "position": [460, 300]
	},
	{
	 "parameters": {
		"conditions": {
		 "conditions": [
			{
			 "leftValue": "={{ $json.deploymentTask.type }}",
			 "rightValue": "terraform",
			 "operator": {
				"type": "string"
			 }
			}
		 ]
		}
	 },
	 "name": "Is Terraform Deployment?",
	 "type": "n8n-nodes-base.if",
	 "position": [680, 300]
	},
	{
	 "parameters": {
		"url": "https://terraform-cloud.company.com/api/v2/runs",
		"authentication": "predefinedCredentialType",
		"nodeCredentialType": "httpHeaderAuth",
		"sendHeaders": true,
		"headerParameters": {
		 "parameters": [
			{
			 "name": "Authorization",
			 "value": "Bearer {{ $credentials.terraformCloud.token }}"
			},
			{
			 "name": "Content-Type",
			 "value": "application/vnd.api+json"
			}
		 ]
		},
		"sendBody": true,
		"bodyParameters": {
		 "parameters": [
			{
			 "name": "data",
			 "value": "={\n \"type\": \"runs\",\n \"attributes\": {\n \"message\": \"GitOps deployment - commit {{ $json.commitSha }}\",\n \"is-destroy\": false,\n \"auto-apply\": {{ $json.deploymentTask.environment !== 'production' }}\n },\n \"relationships\": {\n \"workspace\": {\n \"data\": {\n \"type\": \"workspaces\",\n \"id\": \"{{ $json.deploymentTask.environment }}-workspace-id\"\n }\n }\n }\n}"
			}
		 ]
		},
		"options": {
		 "response": {
			"response": {
			 "responseFormat": "json"
			}
		 }
		}
	 },
	 "name": "Execute Terraform Run",
	 "type": "n8n-nodes-base.httpRequest",
	 "position": [900, 200],
	 "credentials": {
		"httpHeaderAuth": {
		 "id": "terraform-cloud-api",
		 "name": "Terraform Cloud API"
		}
	 }
	}
]
}

# compliance-gate-workflow.sh - compliance checks as code
#!/bin/bash
set -euo pipefail
COMPLIANCE_CONFIG="/opt/compliance/rules.yaml"
SCAN_RESULTS_DIR="/tmp/compliance-scans"
N8N_CALLBACK_URL="https://n8n.company.com/webhook/compliance-results"
# Compliance categories
declare -A COMPLIANCE_TOOLS=(
["security"]="trivy,clair,snyk"
["quality"]="sonarqube,codeclimate"
["performance"]="k6,lighthouse"
["accessibility"]="axe,wave"
["legal"]="fossa,whitesource"
)
run_compliance_scans() {
local deployment_context="$1"
local environment=$(echo "$deployment_context" | jq -r '.deployment.environment')
mkdir -p "$SCAN_RESULTS_DIR"
# Security scans
echo "🔒 Running security compliance scans..."
# Container security scan
trivy image --format json --output "$SCAN_RESULTS_DIR/trivy.json" \
	"registry.company.com/app:$(echo "$deployment_context" | jq -r '.commit.shortSha')"
# Dependency vulnerability scan
snyk test --json > "$SCAN_RESULTS_DIR/snyk.json" || true
# Infrastructure security scan
checkov --framework terraform --output json \
	--output-file "$SCAN_RESULTS_DIR/checkov.json" \
	"./infrastructure/$environment/" || true
# Quality scans
echo "📊 Running quality compliance scans..."
# Code quality
sonar-scanner \
	-Dsonar.projectKey="$(echo "$deployment_context" | jq -r '.repository.name')" \
	-Dsonar.sources=./src \
	-Dsonar.host.url="https://sonarqube.company.com" \
	-Dsonar.login="$SONAR_TOKEN" \
	-Dsonar.scm.revision="$(echo "$deployment_context" | jq -r '.commit.sha')" \
	-Dsonar.analysis.mode=publish \
	-Dsonar.report.export.path="$SCAN_RESULTS_DIR/sonarqube.json"
# Performance scans (for production deployments)
if [[ "$environment" == "production" ]]; then
	echo "⚡ Running performance compliance scans..."
	# Load testing
	k6 run --out json="$SCAN_RESULTS_DIR/k6.json" \
	 "./tests/performance/load-test.js"
fi
# Aggregate results
generate_compliance_report "$deployment_context"
}
generate_compliance_report() {
local deployment_context="$1"
cat << EOF > "$SCAN_RESULTS_DIR/compliance-report.json"
{
"timestamp": "$(date -Iseconds)",
"deploymentContext": $deployment_context,
"complianceResults": {
	"security": {
	 "trivy": $(cat "$SCAN_RESULTS_DIR/trivy.json" 2>/dev/null || echo "null"),
	 "snyk": $(cat "$SCAN_RESULTS_DIR/snyk.json" 2>/dev/null || echo "null"),
	 "checkov": $(cat "$SCAN_RESULTS_DIR/checkov.json" 2>/dev/null || echo "null")
	},
	"quality": {
	 "sonarqube": $(cat "$SCAN_RESULTS_DIR/sonarqube.json" 2>/dev/null || echo "null")
	},
	"performance": {
	 "k6": $(cat "$SCAN_RESULTS_DIR/k6.json" 2>/dev/null || echo "null")
	}
},
"complianceStatus": "$(determine_compliance_status)",
"gateDecision": "$(determine_gate_decision)"
}
EOF
# Send results to n8n for further processing
curl -X POST "$N8N_CALLBACK_URL" \
	-H "Content-Type: application/json" \
	-d @"$SCAN_RESULTS_DIR/compliance-report.json"
}
determine_compliance_status() {
# Implement complex compliance logic
echo "COMPLIANT" # Simplified for example
}
determine_gate_decision() {
# Determine if deployment can proceed
echo "PROCEED" # Simplified for example
}
# Execute compliance scans
run_compliance_scans "$1"

┌─────────────────────────────────────────────────────────────┐
│                 IaC Orchestration Architecture              │
├─────────────────────────────────────────────────────────────┤
│   Event Sources                                             │
│   ┌─────────────┐       ┌─────────────┐     ┌─────────────┐ │
│   │ Git Changes │       │Alertmanager │     │Manual Trigg.│ │
│   └──────┬──────┘       └──────┬──────┘     └──────┬──────┘ │
├──────────┼─────────────────────┼───────────────────┼────────┤
│   n8n IaC Orchestrator         ▼                   │        │
│   ┌─────────────┐       ┌─────────────┐     ┌──────▼──────┐ │
│   │ Dependency  │──────▶│ Validation  │────▶│  Execution  │ │
│   │  Analysis   │       │  & Planning │     │  Planning   │ │
│   └─────────────┘       └─────────────┘     └──────┬──────┘ │
├────────────────────────────────────────────────────┼────────┤
│   Parallel IaC Execution                           ▼        │
│   ┌─────────────┐       ┌─────────────┐     ┌─────────────┐ │
│   │  Terraform  │       │   Ansible   │     │ Helm Chart  │ │
│   │ (Cloud Res) │       │ (Config Mgmt│     │ (K8s Apps)  │ │
│   └─────────────┘       └─────────────┘     └──────┬──────┘ │
├────────────────────────────────────────────────────┼────────┤
│   Post-Deployment Validation                       ▼        │
│   ┌─────────────┐       ┌─────────────┐     ┌─────────────┐ │
│   │Health Checks│       │ Compliance  │     │ Performance │ │
│   │ (Readiness) │       │  (OPA/Gate) │     │  (Loadtest) │ │
│   └─────────────┘       └─────────────┘     └─────────────┘ │
└─────────────────────────────────────────────────────────────┘

{
"name": "Enterprise IaC Orchestrator",
"nodes": [
	{
	 "parameters": {
		"path": "iac-orchestrator",
		"httpMethod": "POST",
		"options": {
		 "responseMode": "onReceived"
		}
	 },
	 "name": "IaC Trigger",
	 "type": "n8n-nodes-base.webhook",
	 "position": [240, 300]
	},
	{
	 "parameters": {
		"jsCode": "// Advanced Infrastructure Deployment Planning\nconst request = $input.first().json;\n\n// Validate input structure\nif (!request.infrastructure || !request.environment) {\n throw new Error('Invalid request: missing infrastructure or environment');\n}\n\nconst infrastructure = request.infrastructure;\nconst environment = request.environment;\nconst requestedBy = request.requestedBy || 'unknown';\nconst changeReason = request.changeReason || 'Infrastructure update';\n\n// Analyze infrastructure changes\nconst infraComponents = {\n terraform: infrastructure.terraform || [],\n ansible: infrastructure.ansible || [],\n helm: infrastructure.helm || [],\n kubernetes: infrastructure.kubernetes || []\n};\n\n// Dependency Analysis\nconst dependencyGraph = {\n // Cloud infrastructure must be created first\n terraform: {\n dependencies: [],\n dependents: ['ansible', 'helm', 'kubernetes'],\n executionOrder: 1\n },\n // Configuration management after infrastructure\n ansible: {\n dependencies: ['terraform'],\n dependents: ['helm', 'kubernetes'],\n executionOrder: 2\n },\n // Kubernetes applications after basic infrastructure\n helm: {\n dependencies: ['terraform', 'ansible'],\n dependents: [],\n executionOrder: 3\n },\n // Raw Kubernetes resources last\n kubernetes: {\n dependencies: ['terraform', 'ansible'],\n dependents: [],\n executionOrder: 3\n }\n};\n\n// Risk Assessment\nlet riskLevel = 'low';\nlet requiresApproval = false;\nlet rollbackPlan = 'automatic';\n\n// Production environment increases risk\nif (environment === 'production') {\n riskLevel = 'high';\n requiresApproval = true;\n rollbackPlan = 'manual';\n}\n\n// Complex changes increase risk\nconst totalChanges = Object.values(infraComponents).reduce((sum, changes) => sum + changes.length, 0);\nif (totalChanges > 10) {\n riskLevel = 'high';\n requiresApproval = true;\n}\n\n// Database/Storage changes are always high risk\nconst hasDataChanges = [\n ...infraComponents.terraform,\n ...infraComponents.ansible,\n ...infraComponents.helm\n].some(change => \n change.includes('database') || \n change.includes('storage') || \n change.includes('persistence')\n);\n\nif (hasDataChanges) {\n riskLevel = 'critical';\n requiresApproval = true;\n rollbackPlan = 'manual';\n}\n\n// Generate execution plan\nconst executionPlan = {\n planId: generateUUID(),\n timestamp: new Date().toISOString(),\n environment: environment,\n requestedBy: requestedBy,\n changeReason: changeReason,\n \n // Risk assessment\n risk: {\n level: riskLevel,\n requiresApproval: requiresApproval,\n rollbackPlan: rollbackPlan,\n estimatedDuration: calculateDuration(infraComponents),\n impactedServices: analyzeImpact(infraComponents, environment)\n },\n \n // Execution phases\n phases: generateExecutionPhases(infraComponents, dependencyGraph),\n \n // Validation criteria\n validation: {\n preDeployment: [\n 'terraform-plan-review',\n 'ansible-syntax-check',\n 'helm-template-validation',\n 'kubectl-dry-run'\n ],\n postDeployment: [\n 'health-check',\n 'connectivity-test',\n 'performance-baseline',\n 'security-scan'\n ]\n },\n \n // Rollback strategy\n rollback: {\n strategy: rollbackPlan,\n triggers: [\n 'health-check-failure',\n 'performance-degradation',\n 'manual-trigger'\n ],\n timeoutMinutes: 30\n }\n};\n\n// Helper functions\nfunction generateUUID() {\n return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {\n const r = Math.random() * 16 | 0;\n const v = c === 'x' ? r : (r & 0x3 | 0x8);\n return v.toString(16);\n });\n}\n\nfunction calculateDuration(components) {\n // Estimate deployment duration based on component complexity\n let duration = 0;\n duration += components.terraform.length * 5; // 5 min per Terraform resource\n duration += components.ansible.length * 3; // 3 min per Ansible task\n duration += components.helm.length * 2; // 2 min per Helm chart\n duration += components.kubernetes.length * 1; // 1 min per K8s resource\n return Math.max(duration, 10); // Minimum 10 minutes\n}\n\nfunction analyzeImpact(components, environment) {\n // Analyze which services might be impacted\n const services = [];\n \n components.terraform.forEach(resource => {\n if (resource.includes('database')) services.push('database-services');\n if (resource.includes('load_balancer')) services.push('web-services');\n if (resource.includes('cache')) services.push('cache-dependent-services');\n });\n \n components.helm.forEach(chart => {\n if (chart.includes('ingress')) services.push('external-traffic');\n if (chart.includes('monitoring')) services.push('observability-stack');\n });\n \n return [...new Set(services)];\n}\n\nfunction generateExecutionPhases(components, dependencyGraph) {\n const phases = [];\n \n // Sort components by execution order\n const sortedComponents = Object.entries(dependencyGraph)\n .sort((a, b) => a[1].executionOrder - b[1].executionOrder)\n .map(([tool]) => tool)\n .filter(tool => components[tool] && components[tool].length > 0);\n \n sortedComponents.forEach((tool, index) => {\n phases.push({\n phase: index + 1,\n tool: tool,\n components: components[tool],\n parallelizable: dependencyGraph[tool].executionOrder === 3, // Helm and K8s can run in parallel\n estimatedDuration: calculateToolDuration(tool, components[tool].length)\n });\n });\n \n return phases;\n}\n\nfunction calculateToolDuration(tool, componentCount) {\n const durations = {\n terraform: componentCount * 5,\n ansible: componentCount * 3,\n helm: componentCount * 2,\n kubernetes: componentCount * 1\n };\n return durations[tool] || componentCount;\n}\n\nreturn [{ json: executionPlan }];"
	 },
	 "name": "Plan Infrastructure Deployment",
	 "type": "n8n-nodes-base.code",
	 "position": [460, 300]
	},
	{
	 "parameters": {
		"conditions": {
		 "conditions": [
			{
			 "leftValue": "={{ $json.risk.requiresApproval }}",
			 "rightValue": true,
			 "operator": {
				"type": "boolean"
			 }
			}
		 ]
		}
	 },
	 "name": "Requires Approval?",
	 "type": "n8n-nodes-base.if",
	 "position": [680, 300]
	},
	{
	 "parameters": {
		"resource": "message",
		"operation": "postToChannel",
		"channel": "#infrastructure-approvals",
		"text": "🏗️ **Infrastructure Deployment Approval Required**\n\n**Environment:** {{ $json.environment }}\n**Risk Level:** {{ $json.risk.level }}\n**Requested By:** {{ $json.requestedBy }}\n**Reason:** {{ $json.changeReason }}\n\n**Estimated Duration:** {{ $json.risk.estimatedDuration }} minutes\n**Impacted Services:** {{ $json.risk.impactedServices.join(', ') }}\n\n**Deployment Phases:**\n{{ $json.phases.map(p => `${p.phase}. ${p.tool} (${p.components.length} components)`).join('\\n') }}\n\n[View Execution Plan](https://n8n.company.com/workflow/{{ $workflow.id }}/executions/{{ $execution.id }})\n\n**React with ✅ to approve, ❌ to reject**",
		"attachments": [],
		"otherOptions": {
		 "includeLinkToWorkflow": true
		}
	 },
	 "name": "Request Infrastructure Approval",
	 "type": "n8n-nodes-base.slack",
	 "position": [900, 200],
	 "credentials": {
		"slackApi": {
		 "id": "slack-bot-token",
		 "name": "Slack Bot Token"
		}
	 }
	}
]
}

// Dynamic Terraform Scaling Logic
const monitoringData = $input.first().json;
// Analyze current metrics
const currentLoad = {
cpu: monitoringData.metrics.cpu_usage_percent,
memory: monitoringData.metrics.memory_usage_percent,
requests: monitoringData.metrics.requests_per_minute,
responseTime: monitoringData.metrics.avg_response_time_ms
};
// Define scaling thresholds
const scalingThresholds = {
scaleUp: {
	cpu: 70,
	memory: 80,
	requests: 1000,
	responseTime: 2000
},
scaleDown: {
	cpu: 30,
	memory: 40,
	requests: 200,
	responseTime: 500
}
};
// Determine scaling action
let scalingAction = 'none';
let scalingReason = [];
// Scale up conditions
if (currentLoad.cpu > scalingThresholds.scaleUp.cpu) {
scalingAction = 'up';
scalingReason.push(`CPU usage ${currentLoad.cpu}% > ${scalingThresholds.scaleUp.cpu}%`);
}
if (currentLoad.memory > scalingThresholds.scaleUp.memory) {
scalingAction = 'up';
scalingReason.push(`Memory usage ${currentLoad.memory}% > ${scalingThresholds.scaleUp.memory}%`);
}
// Scale down conditions (only if not scaling up)
if (scalingAction === 'none') {
if (currentLoad.cpu < scalingThresholds.scaleDown.cpu &&
	 currentLoad.memory < scalingThresholds.scaleDown.memory) {
	scalingAction = 'down';
	scalingReason.push(`Low resource usage: CPU ${currentLoad.cpu}%, Memory ${currentLoad.memory}%`);
}
}
// Generate Terraform scaling configuration
if (scalingAction !== 'none') {
const currentInstanceCount = monitoringData.infrastructure.instance_count || 3;
const maxInstances = 20;
const minInstances = 2;
let newInstanceCount = currentInstanceCount;
if (scalingAction === 'up') {
	newInstanceCount = Math.min(currentInstanceCount + 2, maxInstances);
} else if (scalingAction === 'down') {
	newInstanceCount = Math.max(currentInstanceCount - 1, minInstances);
}
const terraformConfig = {
	action: 'apply',
	workspace: `${monitoringData.environment}-auto-scaling`,
	variables: {
	 instance_count: newInstanceCount,
	 scaling_reason: scalingReason.join(', '),
	 triggered_by: 'n8n-auto-scaling',
	 timestamp: new Date().toISOString()
	},
	autoApprove: monitoringData.environment !== 'production'
};
return [{
	json: {
	 scalingRequired: true,
	 scalingAction: scalingAction,
	 scalingReason: scalingReason,
	 currentMetrics: currentLoad,
	 infrastructure: {
		currentInstanceCount: currentInstanceCount,
		newInstanceCount: newInstanceCount,
		terraformConfig: terraformConfig
	 }
	}
}];
}
return [{
json: {
	scalingRequired: false,
	currentMetrics: currentLoad,
	message: 'No scaling action required'
}
}];

┌─────────────────────────────────────────────────────────────┐
│                  Observability Architecture                 │
├─────────────────────────────────────────────────────────────┤
│   Application Layer (n8n Workflows)                         │
│   ┌─────────────┐       ┌─────────────┐     ┌─────────────┐ │
│   │  Workflow   │       │  Execution  │     │ Node-Level  │ │
│   │   Metrics   │       │   Traces    │     │ Monitoring  │ │
│   └─────────────┘       └─────────────┘     └─────────────┘ │
├─────────────────────────────────────────────────────────────┤
│   Platform Layer (n8n Infrastructure)                       │
│   ┌─────────────┐       ┌─────────────┐     ┌─────────────┐ │
│   │   System    │       │  Database   │     │    Queue    │ │
│   │   Metrics   │       │ Performance │     │    Health   │ │
│   └─────────────┘       └─────────────┘     └─────────────┘ │
├─────────────────────────────────────────────────────────────┤
│   Infrastructure Layer (Kubernetes & Docker)                │
│   ┌─────────────┐       ┌─────────────┐     ┌─────────────┐ │
│   │  Container  │       │   Network   │     │   Storage   │ │
│   │   Metrics   │       │ Monitoring  │     │     I/O     │ │
│   └─────────────┘       └─────────────┘     └─────────────┘ │
└─────────────────────────────────────────────────────────────┘

# prometheus-n8n-monitoring.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: prometheus-n8n-config
namespace: monitoring
data:
n8n-rules.yaml: |
	groups:
	* name: n8n.rules
	 rules:
	 # Workflow Execution Metrics
	 * alert: N8N_WorkflowExecutionFailureRate
		expr: |
		 (
			sum(rate(n8n_workflow_executions_total{status="error"}[5m])) by (workflow_name) /
			sum(rate(n8n_workflow_executions_total[5m])) by (workflow_name)
		 ) * 100 > 10
		for: 2m
		labels:
		 severity: warning
		annotations:
		 summary: "High workflow failure rate for {{ $labels.workflow_name }}"
		 description: "Workflow {{ $labels.workflow_name }} has a failure rate of {{ $value }}% over the last 5 minutes"
	 # Queue Health Metrics
	 * alert: N8N_QueueBacklog
		expr: n8n_queue_waiting_jobs > 100
		for: 5m
		labels:
		 severity: warning
		annotations:
		 summary: "n8n queue backlog detected"
		 description: "{{ $value }} jobs are waiting in the n8n queue"
	 # Database Performance
	 * alert: N8N_DatabaseConnectionExhaustion
		expr: n8n_database_connections_active / n8n_database_connections_max > 0.8
		for: 2m
		labels:
		 severity: critical
		annotations:
		 summary: "n8n database connection pool nearly exhausted"
		 description: "{{ $value }} database connections are active out of maximum available"
	 # Worker Health
	 * alert: N8N_WorkerProcessDown
		expr: up{job="n8n-worker"} == 0
		for: 1m
		labels:
		 severity: critical
		annotations:
		 summary: "n8n worker process is down"
		 description: "Worker instance {{ $labels.instance }} is not responding"
	 # Memory Usage
	 * alert: N8N_HighMemoryUsage
		expr: |
		 (
			node_memory_MemTotal_bytes{job="n8n"} -
			node_memory_MemAvailable_bytes{job="n8n"}
		 ) / node_memory_MemTotal_bytes{job="n8n"} * 100 > 85
		for: 5m
		labels:
		 severity: warning
		annotations:
		 summary: "High memory usage on n8n instance"
		 description: "Memory usage is {{ $value }}% on {{ $labels.instance }}"
---
apiVersion: v1
kind: Service
metadata:
name: n8n-metrics
namespace: n8n-production
labels:
	app: n8n-main
spec:
ports:
* port: 5678
	name: metrics
	targetPort: 5678
selector:
	app: n8n-main
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: n8n-servicemonitor
namespace: monitoring
labels:
	app: n8n
spec:
selector:
	matchLabels:
	 app: n8n-main
endpoints:
* port: metrics
	path: /metrics
	interval: 30s
	scrapeTimeout: 10s
namespaceSelector:
	matchNames:
	* n8n-production
---
apiVersion: v1
kind: ConfigMap
metadata:
name: grafana-n8n-dashboard
namespace: monitoring
data:
n8n-dashboard.json: |
	{
	 "dashboard": {
		"id": null,
		"title": "n8n Production Monitoring",
		"tags": ["n8n", "automation"],
		"timezone": "browser",
		"panels": [
		 {
			"id": 1,
			"title": "Workflow Executions",
			"type": "graph",
			"targets": [
			 {
				"expr": "sum(rate(n8n_workflow_executions_total[5m])) by (status)",
				"legendFormat": "{{ status }}"
			 }
			],
			"yAxes": [
			 {
				"label": "Executions/sec"
			 }
			]
		 },
		 {
			"id": 2,
			"title": "Queue Metrics",
			"type": "singlestat",
			"targets": [
			 {
				"expr": "n8n_queue_waiting_jobs",
				"legendFormat": "Waiting Jobs"
			 }
			]
		 },
		 {
			"id": 3,
			"title": "Error Rate by Workflow",
			"type": "table",
			"targets": [
			 {
				"expr": "sum(rate(n8n_workflow_executions_total{status=\"error\"}[1h])) by (workflow_name)",
				"format": "table",
				"instant": true
			 }
			]
		 }
		],
		"time": {
		 "from": "now-1h",
		 "to": "now"
		},
		"refresh": "10s"
	 }
	}

// Advanced Workflow Logging Framework
class WorkflowObservability {
constructor(workflowId, executionId, environment = 'production') {
	this.workflowId = workflowId;
	this.executionId = executionId;
	this.environment = environment;
	this.startTime = Date.now();
	this.traceId = this.generateTraceId();
	// Initialize counters
	this.metrics = {
	 nodeExecutions: 0,
	 apiCalls: 0,
	 errors: 0,
	 warnings: 0
	};
}
generateTraceId() {
	return `trace_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
}
log(level, message, context = {}, nodeInfo = {}) {
	const logEntry = {
	 timestamp: new Date().toISOString(),
	 level: level.toUpperCase(),
	 message: message,
	 // Workflow Context
	 workflow: {
		id: this.workflowId,
		executionId: this.executionId,
		traceId: this.traceId,
		environment: this.environment
	 },
	 // Node Context
	 node: {
		name: nodeInfo.name || 'unknown',
		type: nodeInfo.type || 'unknown',
		position: nodeInfo.position || null
	 },
	 // Performance Context
	 performance: {
		executionTime: Date.now() - this.startTime,
		nodeExecutions: this.metrics.nodeExecutions,
		apiCalls: this.metrics.apiCalls
	 },
	 // Custom Context
	 context: context,
	 // Labels for easier filtering
	 labels: {
		workflow_name: $workflow.name,
		environment: this.environment,
		node_type: nodeInfo.type,
		trace_id: this.traceId
	 }
	};
	// Send to multiple logging destinations
	this.sendToConsole(logEntry);
	this.sendToElasticsearch(logEntry);
	this.sendToDatadog(logEntry);
	// Update metrics
	this.updateMetrics(level);
}
sendToConsole(logEntry) {
	console.log(JSON.stringify(logEntry));
}
async sendToElasticsearch(logEntry) {
	try {
	 if (this.environment === 'production') {
		await fetch('https://elasticsearch.company.com/n8n-logs/_doc', {
		 method: 'POST',
		 headers: {
			'Content-Type': 'application/json',
			'Authorization': `Bearer ${$credentials.elasticsearch.token}`
		 },
		 body: JSON.stringify(logEntry)
		});
	 }
	} catch (error) {
	 console.error('Failed to send log to Elasticsearch:', error);
	}
}
async sendToDatadog(logEntry) {
	try {
	 if (this.environment === 'production') {
		await fetch('https://http-intake.logs.datadoghq.com/v1/input/' + $credentials.datadog.apiKey, {
		 method: 'POST',
		 headers: {
			'Content-Type': 'application/json'
		 },
		 body: JSON.stringify(logEntry)
		});
	 }
	} catch (error) {
	 console.error('Failed to send log to Datadog:', error);
	}
}
updateMetrics(level) {
	this.metrics.nodeExecutions++;
	if (level === 'ERROR') {
	 this.metrics.errors++;
	} else if (level === 'WARN') {
	 this.metrics.warnings++;
	}
}
// Specialized logging methods
error(message, error, context = {}) {
	this.log('ERROR', message, {
	 ...context,
	 error: {
		name: error.name,
		message: error.message,
		stack: error.stack
	 }
	}, $node);
}
apiCall(endpoint, method, responseTime, statusCode, context = {}) {
	this.metrics.apiCalls++;
	this.log('INFO', `API Call: ${method} ${endpoint}`, {
	 ...context,
	 api: {
		endpoint: endpoint,
		method: method,
		responseTime: responseTime,
		statusCode: statusCode
	 }
	}, $node);
}
performance(operation, duration, metadata = {}) {
	this.log('INFO', `Performance: ${operation}`, {
	 performance: {
		operation: operation,
		duration: duration,
		metadata: metadata
	 }
	}, $node);
}
// Generate final execution summary
generateSummary() {
	const totalDuration = Date.now() - this.startTime;
	return {
	 workflow: {
		id: this.workflowId,
		executionId: this.executionId,
		traceId: this.traceId
	 },
	 performance: {
		totalDuration: totalDuration,
		nodeExecutions: this.metrics.nodeExecutions,
		apiCalls: this.metrics.apiCalls,
		avgNodeDuration: totalDuration / this.metrics.nodeExecutions
	 },
	 quality: {
		errors: this.metrics.errors,
		warnings: this.metrics.warnings,
		successRate: ((this.metrics.nodeExecutions - this.metrics.errors) / this.metrics.nodeExecutions * 100).toFixed(2)
	 }
	};
}
}
// Usage in n8n workflows
const observer = new WorkflowObservability($workflow.id, $execution.id, 'production');
try {
observer.log('INFO', 'Starting workflow execution', {
	inputData: $json,
	trigger: $node.name
});
// API call with monitoring
const startTime = Date.now();
const response = await fetch('https://api.example.com/data', {
	method: 'POST',
	headers: { 'Content-Type': 'application/json' },
	body: JSON.stringify($json)
});
const responseTime = Date.now() - startTime;
observer.apiCall('https://api.example.com/data', 'POST', responseTime, response.status, {
	requestSize: JSON.stringify($json).length,
	responseSize: response.headers.get('content-length')
});
if (!response.ok) {
	throw new Error(`HTTP ${response.status}: ${response.statusText}`);
}
const data = await response.json();
observer.log('INFO', 'Workflow completed successfully', {
	outputData: { recordCount: data.length },
	summary: observer.generateSummary()
});
return [{ json: data }];
} catch (error) {
observer.error('Workflow execution failed', error, {
	inputData: $json,
	nodePosition: $node.position,
	summary: observer.generateSummary()
});
throw error;
}

# LDAP/Active Directory Integration
export N8N_USER_MANAGEMENT_LDAP_ENABLED=true
export N8N_USER_MANAGEMENT_LDAP_SERVER="ldaps://ad.company.com:636"
export N8N_USER_MANAGEMENT_LDAP_BASE_DN="dc=company,dc=com"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_ID_ATTRIBUTE="sAMAccountName"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_EMAIL_ATTRIBUTE="mail"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_FIRST_NAME_ATTRIBUTE="givenName"
export N8N_USER_MANAGEMENT_LDAP_LOGIN_LAST_NAME_ATTRIBUTE="sn"
# SAML Configuration
export N8N_SAML_ENABLED=true
export N8N_SAML_ENTITY_ID="https://n8n.company.com"
export N8N_SAML_RETURN_URL="https://n8n.company.com/rest/sso/saml"
export N8N_SAML_IDP_URL="https://sso.company.com/saml/login"
export N8N_SAML_CERT_PATH="/opt/n8n/certs/saml-idp.crt"
export N8N_SAML_PRIVATE_KEY_PATH="/opt/n8n/certs/saml-sp.key"
# Advanced SAML Attribute Mapping
export N8N_SAML_ATTRIBUTES_EMAIL="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
export N8N_SAML_ATTRIBUTES_FIRST_NAME="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
export N8N_SAML_ATTRIBUTES_LAST_NAME="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
export N8N_SAML_ATTRIBUTES_GROUPS="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"

// rbac-policy-engine.ts - Custom RBAC Implementation
interface RBACPolicy {
user: UserContext;
resource: ResourceType;
action: ActionType;
context?: PolicyContext;
}
interface UserContext {
userId: string;
roles: string[];
groups: string[];
attributes: Record<string, any>;
}
interface PolicyContext {
environment: string;
timeOfDay: string;
ipAddress: string;
workflowTags: string[];
}
class EnterpriseRBACEngine {
private policies: Map<string, PolicyRule[]> = new Map();
constructor() {
	this.initializeDefaultPolicies();
}
initializeDefaultPolicies() {
	// Developer Role Policies
	this.addPolicy('developer', {
	 resources: ['workflow', 'execution'],
	 actions: ['create', 'read', 'update'],
	 conditions: [
		'user.groups.includes(resource.owner_group)',
		'resource.tags.includes("development") || resource.environment !== "production"'
	 ]
	});
	// DevOps Engineer Policies
	this.addPolicy('devops-engineer', {
	 resources: ['workflow', 'credential', 'webhook'],
	 actions: ['create', 'read', 'update', 'delete'],
	 conditions: [
		'resource.tags.includes("infrastructure") || user.groups.includes("devops-team")',
		'context.timeOfDay >= "08:00" && context.timeOfDay <= "18:00" || resource.environment !== "production"'
	 ]
	});
	// Security Officer Policies
	this.addPolicy('security-officer', {
	 resources: ['*'],
	 actions: ['read', 'audit'],
	 conditions: [
		'action === "audit" || (action === "read" && resource.sensitive !== true)'
	 ]
	});
	// Time-based Production Access
	this.addPolicy('production-maintenance-window', {
	 resources: ['workflow'],
	 actions: ['update', 'delete'],
	 conditions: [
		'resource.environment === "production"',
		'context.timeOfDay >= "02:00" && context.timeOfDay <= "06:00"',
		'user.roles.includes("devops-engineer") || user.roles.includes("platform-admin")'
	 ]
	});
}
async evaluatePolicy(policy: RBACPolicy): Promise<AuthorizationResult> {
	const userRoles = policy.user.roles;
	const applicablePolicies: PolicyRule[] = [];
	// Collect all applicable policies for user roles
	userRoles.forEach(role => {
	 const rolePolicies = this.policies.get(role);
	 if (rolePolicies) {
		applicablePolicies.push(...rolePolicies);
	 }
	});
	// Evaluate each policy
	for (const policyRule of applicablePolicies) {
	 const result = await this.evaluatePolicyRule(policyRule, policy);
	 if (result.granted) {
		return result;
	 }
	}
	// Default deny
	return {
	 granted: false,
	 reason: 'No matching policy found',
	 requiredPermissions: this.suggestRequiredPermissions(policy)
	};
}
private async evaluatePolicyRule(rule: PolicyRule, policy: RBACPolicy): Promise<AuthorizationResult> {
	// Resource matching
	if (!this.matchesResource(rule.resources, policy.resource)) {
	 return { granted: false, reason: 'Resource not covered by policy' };
	}
	// Action matching
	if (!rule.actions.includes(policy.action)) {
	 return { granted: false, reason: 'Action not permitted by policy' };
	}
	// Condition evaluation
	for (const condition of rule.conditions) {
	 if (!this.evaluateCondition(condition, policy)) {
		return { granted: false, reason: `Condition failed: ${condition}` };
	 }
	}
	return {
	 granted: true,
	 reason: 'Policy match found',
	 matchedPolicy: rule.name
	};
}
private evaluateCondition(condition: string, policy: RBACPolicy): boolean {
	try {
	 // Secure condition evaluation with sandboxed context
	 const context = {
		user: policy.user,
		resource: policy.resource,
		context: policy.context,
		// Helper functions
		includes: (array: any[], item: any) => array?.includes(item) || false,
		hasRole: (role: string) => policy.user.roles.includes(role),
		hasGroup: (group: string) => policy.user.groups.includes(group),
		isTimeInRange: (start: string, end: string) => {
		 const current = new Date().toTimeString().slice(0, 5);
		 return current >= start && current <= end;
		}
	 };
	 return new Function('context', `with(context) { return ${condition}; }`)(context);
	} catch (error) {
	 console.error('Condition evaluation failed:', error);
	 return false;
	}
}
}
// Usage in n8n API middleware
const rbacEngine = new EnterpriseRBACEngine();
async function authorizeRequest(req: Request, res: Response, next: NextFunction) {
const user = req.user; // from authentication middleware
const resource = extractResourceFromRequest(req);
const action = mapHttpMethodToAction(req.method);
const authResult = await rbacEngine.evaluatePolicy({
	user: {
	 userId: user.id,
	 roles: user.roles,
	 groups: user.groups,
	 attributes: user.attributes
	},
	resource: resource.type,
	action: action,
	context: {
	 environment: resource.environment,
	 timeOfDay: new Date().toTimeString().slice(0, 5),
	 ipAddress: req.ip,
	 workflowTags: resource.tags
	}
});
if (authResult.granted) {
	// Log successful authorization
	auditLogger.info('Authorization granted', {
	 userId: user.id,
	 resource: resource.type,
	 action: action,
	 policy: authResult.matchedPolicy
	});
	next();
} else {
	// Log authorization denial
	auditLogger.warn('Authorization denied', {
	 userId: user.id,
	 resource: resource.type,
	 action: action,
	 reason: authResult.reason
	});
	res.status(403).json({
	 error: 'Insufficient permissions',
	 required: authResult.requiredPermissions
	});
}
}

# kubernetes-multi-tenant-setup.yaml
apiVersion: v1
kind: Namespace
metadata:
name: n8n-tenant-alpha
labels:
	tenant: alpha
	isolation-level: strict
---
apiVersion: v1
kind: Namespace
metadata:
name: n8n-tenant-beta
labels:
	tenant: beta
	isolation-level: strict
---
# Network policy for tenant isolation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: tenant-isolation
namespace: n8n-tenant-alpha
spec:
podSelector: {}
policyTypes:
* Ingress
* Egress
ingress:
* from:
	* namespaceSelector:
		matchLabels:
		 tenant: alpha
* from:
	* namespaceSelector:
		matchLabels:
		 name: n8n-shared-services
egress:
* to:
	* namespaceSelector:
		matchLabels:
		 tenant: alpha
* to:
	* namespaceSelector:
		matchLabels:
		 name: n8n-shared-services
* to: []
	ports:
	* protocol: TCP
	 port: 443
	* protocol: TCP
	 port: 53
	* protocol: UDP
	 port: 53
---
# Tenant-spezifische n8n Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
name: n8n-tenant-alpha
namespace: n8n-tenant-alpha
spec:
replicas: 2
selector:
	matchLabels:
	 app: n8n-tenant-alpha
template:
	metadata:
	 labels:
		app: n8n-tenant-alpha
		tenant: alpha
	spec:
	 containers:
	 * name: n8n
		image: n8nio/n8n:latest
		env:
		* name: N8N_MULTI_TENANT_ENABLED
		 value: "true"
		* name: N8N_TENANT_ID
		 value: "alpha"
		* name: DB_POSTGRESDB_DATABASE
		 value: "n8n_tenant_alpha"
		* name: DB_POSTGRESDB_SCHEMA
		 value: "tenant_alpha"
		* name: N8N_ENCRYPTION_KEY
		 valueFrom:
			secretKeyRef:
			 name: n8n-tenant-alpha-secrets
			 key: encryption-key
		* name: N8N_USER_MANAGEMENT_DISABLED
		 value: "false"
		* name: N8N_WORKFLOWS_DEFAULT_OWNER
		 value: "tenant-alpha-admin"
		resources:
		 requests:
			memory: "512Mi"
			cpu: "250m"
		 limits:
			memory: "2Gi"
			cpu: "1000m"
		securityContext:
		 allowPrivilegeEscalation: false
		 readOnlyRootFilesystem: true
		 runAsNonRoot: true
		 runAsUser: 1000
		 capabilities:
			drop:
			* ALL

// enterprise-secret-manager.js - HashiCorp Vault Integration
class EnterpriseSecretManager {
constructor() {
	this.vaultClient = new VaultClient({
	 endpoint: process.env.VAULT_ENDPOINT,
	 token: process.env.VAULT_TOKEN
	});
	this.credentialCache = new Map();
	this.cacheTimeout = 300000; // 5 minutes
}
async getCredential(credentialId, userId, workflowId) {
	try {
	 // Check cache first
	 const cacheKey = `${credentialId}_${userId}`;
	 const cached = this.credentialCache.get(cacheKey);
	 if (cached && Date.now() - cached.timestamp < this.cacheTimeout) {
		this.auditCredentialAccess(credentialId, userId, workflowId, 'cache-hit');
		return cached.data;
	 }
	 // Retrieve from Vault
	 const secretPath = `n8n/credentials/${credentialId}`;
	 const vaultResponse = await this.vaultClient.read(secretPath);
	 if (!vaultResponse || !vaultResponse.data) {
		throw new Error(`Credential ${credentialId} not found in Vault`);
	 }
	 // Verify user access to credential
	 const accessGranted = await this.verifyCredentialAccess(credentialId, userId);
	 if (!accessGranted) {
		this.auditCredentialAccess(credentialId, userId, workflowId, 'access-denied');
		throw new Error(`User ${userId} not authorized for credential ${credentialId}`);
	 }
	 // Decrypt credential data
	 const encryptionKey = process.env.N8N_ENCRYPTION_KEY;
	 const decryptedData = this.decryptCredential(vaultResponse.data.data, encryptionKey);
	 // Cache decrypted data
	 this.credentialCache.set(cacheKey, {
		data: decryptedData,
		timestamp: Date.now()
	 });
	 this.auditCredentialAccess(credentialId, userId, workflowId, 'vault-retrieved');
	 return decryptedData;
	} catch (error) {
	 this.auditCredentialAccess(credentialId, userId, workflowId, 'error', error.message);
	 throw error;
	}
}
async storeCredential(credentialId, credentialData, userId) {
	try {
	 // Encrypt credential data
	 const encryptionKey = process.env.N8N_ENCRYPTION_KEY;
	 const encryptedData = this.encryptCredential(credentialData, encryptionKey);
	 // Add metadata
	 const vaultData = {
		data: encryptedData,
		metadata: {
		 createdBy: userId,
		 createdAt: new Date().toISOString(),
		 version: this.generateVersion(),
		 tags: credentialData.tags || [],
		 environment: process.env.NODE_ENV
		}
	 };
	 // Store in Vault
	 const secretPath = `n8n/credentials/${credentialId}`;
	 await this.vaultClient.write(secretPath, vaultData);
	 // Set up automatic rotation if supported
	 if (this.supportsRotation(credentialData.type)) {
		await this.scheduleCredentialRotation(credentialId, credentialData.rotationPolicy);
	 }
	 // Invalidate cache
	 this.invalidateCredentialCache(credentialId);
	 this.auditCredentialManagement(credentialId, userId, 'created');
	 return true;
	} catch (error) {
	 this.auditCredentialManagement(credentialId, userId, 'create-failed', error.message);
	 throw error;
	}
}
async rotateCredential(credentialId) {
	try {
	 const secretPath = `n8n/credentials/${credentialId}`;
	 const currentCredential = await this.vaultClient.read(secretPath);
	 if (!currentCredential) {
		throw new Error(`Credential ${credentialId} not found for rotation`);
	 }
	 // Generate new credential based on type
	 const credentialType = currentCredential.data.metadata.type;
	 const newCredentialData = await this.generateNewCredential(credentialType, currentCredential.data);
	 // Store new version while keeping old version accessible
	 const newVersion = this.generateVersion();
	 await this.vaultClient.write(`${secretPath}/v${newVersion}`, {
		...currentCredential.data,
		data: newCredentialData,
		metadata: {
		 ...currentCredential.data.metadata,
		 rotatedAt: new Date().toISOString(),
		 version: newVersion,
		 previousVersion: currentCredential.data.metadata.version
		}
	 });
	 // Update current version pointer
	 await this.vaultClient.write(secretPath, {
		...currentCredential.data,
		data: newCredentialData,
		metadata: {
		 ...currentCredential.data.metadata,
		 rotatedAt: new Date().toISOString(),
		 version: newVersion
		}
	 });
	 // Invalidate cache
	 this.invalidateCredentialCache(credentialId);
	 // Schedule next rotation
	 await this.scheduleCredentialRotation(credentialId, currentCredential.data.metadata.rotationPolicy);
	 this.auditCredentialManagement(credentialId, 'system', 'rotated', `New version: ${newVersion}`);
	 return newVersion;
	} catch (error) {
	 this.auditCredentialManagement(credentialId, 'system', 'rotation-failed', error.message);
	 throw error;
	}
}
async verifyCredentialAccess(credentialId, userId) {
	// Implement RBAC verification
	const user = await this.getUserContext(userId);
	const credential = await this.getCredentialMetadata(credentialId);
	// Check direct permissions
	if (credential.metadata.allowedUsers?.includes(userId)) {
	 return true;
	}
	// Check group permissions
	const userGroups = user.groups || [];
	const allowedGroups = credential.metadata.allowedGroups || [];
	if (userGroups.some(group => allowedGroups.includes(group))) {
	 return true;
	}
	// Check role-based permissions
	const userRoles = user.roles || [];
	const allowedRoles = credential.metadata.allowedRoles || [];
	if (userRoles.some(role => allowedRoles.includes(role))) {
	 return true;
	}
	return false;
}
auditCredentialAccess(credentialId, userId, workflowId, action, details = null) {
	const auditEntry = {
	 timestamp: new Date().toISOString(),
	 event: 'credential_access',
	 credentialId: credentialId,
	 userId: userId,
	 workflowId: workflowId,
	 action: action,
	 details: details,
	 sourceIp: this.getCurrentRequestIp(),
	 userAgent: this.getCurrentUserAgent()
	};
	// Send to audit logging system
	this.sendToAuditLog(auditEntry);
}
auditCredentialManagement(credentialId, userId, action, details = null) {
	const auditEntry = {
	 timestamp: new Date().toISOString(),
	 event: 'credential_management',
	 credentialId: credentialId,
	 userId: userId,
	 action: action,
	 details: details,
	 sourceIp: this.getCurrentRequestIp(),
	 userAgent: this.getCurrentUserAgent()
	};
	this.sendToAuditLog(auditEntry);
}
}

#!/bin/bash
# credential-encryption-setup.sh - Enterprise Credential Encryption
set -euo pipefail
VAULT_NAMESPACE="n8n-production"
KEY_ROTATION_DAYS=90
BACKUP_RETENTION_DAYS=365
# Initialise Vault Transit Engine for credential encryption
setup_vault_transit() {
echo "🔐 Setting up Vault transit engine..."
# Enable transit secrets engine
vault secrets enable -path=n8n-transit transit
# Create encryption key for n8n credentials
vault write -f n8n-transit/keys/n8n-credentials \
	type=aes256-gcm96 \
	exportable=false \
	allow_plaintext_backup=false \
	auto_rotate_period=${KEY_ROTATION_DAYS}d
# Create policy for n8n service
cat << 'EOF' > n8n-transit-policy.hcl
path "n8n-transit/encrypt/n8n-credentials" {
capabilities = ["update"]
}
path "n8n-transit/decrypt/n8n-credentials" {
capabilities = ["update"]
}
path "n8n-transit/datakey/plaintext/n8n-credentials" {
capabilities = ["update"]
}
path "n8n-transit/keys/n8n-credentials" {
capabilities = ["read"]
}
EOF
vault policy write n8n-transit-policy n8n-transit-policy.hcl
# Create service token
vault write auth/token/create \
	policies="n8n-transit-policy" \
	renewable=true \
	ttl=8760h \
	explicit_max_ttl=8760h
}
# Credential backup strategy
backup_credentials() {
local backup_dir="/opt/n8n/backups/credentials"
local timestamp=$(date +"%Y%m%d_%H%M%S")
echo "💾 Creating encrypted credential backup..."
mkdir -p "${backup_dir}/${timestamp}"
# Export credentials from Vault
vault kv get -format=json n8n/credentials/ | \
	jq '.data' > "${backup_dir}/${timestamp}/credentials.json"
# Encrypt backup with GPG
gpg --cipher-algo AES256 \
	 --compress-algo 2 \
	 --symmetric \
	 --armor \
	 --passphrase "${BACKUP_ENCRYPTION_KEY}" \
	 --output "${backup_dir}/${timestamp}/credentials.json.gpg" \
	 "${backup_dir}/${timestamp}/credentials.json"
# Remove plaintext backup
rm "${backup_dir}/${timestamp}/credentials.json"
# Create backup manifest
cat << EOF > "${backup_dir}/${timestamp}/manifest.json"
{
"timestamp": "${timestamp}",
"vault_version": "$(vault version | head -n1)",
"encryption_key_version": "$(vault read -field=latest_version n8n-transit/keys/n8n-credentials)",
"credential_count": $(vault kv list -format=json n8n/credentials/ | jq '. | length'),
"backup_type": "full",
"retention_until": "$(date -d "+${BACKUP_RETENTION_DAYS} days" +"%Y-%m-%d")"
}
EOF
echo "✅ Backup created: ${backup_dir}/${timestamp}"
}
# Credential rotation automation
rotate_expired_credentials() {
echo "🔄 Checking for credentials requiring rotation..."
local rotation_threshold=$(date -d "-${KEY_ROTATION_DAYS} days" +"%Y-%m-%d")
# Get list of credentials from Vault
vault kv list -format=json n8n/credentials/ | jq -r '.[]' | while read credential_id; do
	# Get credential metadata
	local last_rotation=$(vault kv get -format=json "n8n/credentials/${credential_id}" | \
	 jq -r '.data.metadata.rotatedAt // .data.metadata.createdAt')
	if [[ "${last_rotation}" < "${rotation_threshold}" ]]; then
	 echo "📅 Credential ${credential_id} requires rotation (last: ${last_rotation})"
	 # Trigger rotation via n8n API
	 curl -X POST "https://n8n.company.com/api/v1/credentials/${credential_id}/rotate" \
		-H "Authorization: Bearer ${N8N_API_TOKEN}" \
		-H "Content-Type: application/json"
	fi
done
}
# Main execution
main() {
case "${1:-setup}" in
	setup)
	 setup_vault_transit
	 ;;
	backup)
	 backup_credentials
	 ;;
	rotate)
	 rotate_expired_credentials
	 ;;
	*)
	 echo "Usage: $0 [setup|backup|rotate]"
	 exit 1
	 ;;
esac
}
main "$@"

// enterprise-audit-logger.js - Compliance-grade Audit Logging
class ComplianceAuditLogger {
constructor(config) {
	this.config = {
	 environment: config.environment || 'production',
	 auditLevel: config.auditLevel || 'comprehensive',
	 retentionPeriod: config.retentionPeriod || '2555', // 7 years for compliance
	 encryptionEnabled: config.encryptionEnabled || true,
	 realTimeAlerts: config.realTimeAlerts || true,
	 ...config
	};
	this.initializeAuditTargets();
}
initializeAuditTargets() {
	this.auditTargets = [
	 new DatabaseAuditTarget(this.config.database),
	 new SyslogAuditTarget(this.config.syslog),
	 new ElasticsearchAuditTarget(this.config.elasticsearch),
	 new ComplianceReportingTarget(this.config.reporting)
	];
}
async logWorkflowEvent(eventType, workflowContext, userContext, additionalData = {}) {
	const auditEntry = {
	 // Standard Audit Fields
	 timestamp: new Date().toISOString(),
	 eventId: this.generateEventId(),
	 eventType: eventType,
	 eventCategory: 'workflow_operation',
	 severity: this.determineSeverity(eventType),
	 // User Context
	 user: {
		id: userContext.id,
		email: userContext.email,
		roles: userContext.roles,
		groups: userContext.groups,
		sessionId: userContext.sessionId,
		ipAddress: userContext.ipAddress,
		userAgent: userContext.userAgent
	 },
	 // Workflow Context
	 workflow: {
		id: workflowContext.id,
		name: workflowContext.name,
		version: workflowContext.version,
		environment: workflowContext.environment,
		tags: workflowContext.tags,
		executionMode: workflowContext.executionMode,
		triggeredBy: workflowContext.triggeredBy
	 },
	 // Technical Context
	 system: {
		instanceId: process.env.N8N_INSTANCE_ID,
		version: process.env.N8N_VERSION,
		nodeVersion: process.version,
		platform: process.platform,
		hostname: require('os').hostname()
	 },
	 // Compliance Fields
	 compliance: {
		dataClassification: this.classifyWorkflowData(workflowContext),
		regulatoryContext: this.determineRegulatoryContext(workflowContext),
		retentionCategory: this.determineRetentionCategory(eventType),
		privacyImpact: this.assessPrivacyImpact(workflowContext)
	 },
	 // Additional Context
	 additionalData: additionalData
	};
	// Enhanced logging for sensitive operations
	if (this.isSensitiveOperation(eventType)) {
	 auditEntry.security = {
		riskLevel: 'high',
		requiresReview: true,
		escalationRequired: this.requiresEscalation(eventType, userContext),
		complianceFlags: this.getComplianceFlags(workflowContext)
	 };
	}
	// Data Processing Activities (GDPR Article 30)
	if (this.involvesPersonalData(workflowContext)) {
	 auditEntry.dataProcessing = {
		purposes: this.extractDataProcessingPurposes(workflowContext),
		categories: this.categorizePersonalData(workflowContext),
		recipients: this.identifyDataRecipients(workflowContext),
		transfers: this.identifyDataTransfers(workflowContext),
		retention: this.getDataRetentionPolicy(workflowContext)
	 };
	}
	// Encrypt sensitive audit data
	if (this.config.encryptionEnabled) {
	 auditEntry.encryptedFields = await this.encryptSensitiveFields(auditEntry);
	}
	// Send to audit targets
	await this.sendToAuditTargets(auditEntry);
	// Real-time alerting for critical events
	if (this.config.realTimeAlerts && this.isCriticalEvent(eventType)) {
	 await this.sendRealTimeAlert(auditEntry);
	}
	return auditEntry.eventId;
}
classifyWorkflowData(workflowContext) {
	const classifications = [];
	// Analyze workflow tags and content
	const tags = workflowContext.tags || [];
	if (tags.includes('pii') || tags.includes('personal-data')) {
	 classifications.push('PERSONAL_DATA');
	}
	if (tags.includes('financial') || tags.includes('payment')) {
	 classifications.push('FINANCIAL_DATA');
	}
	if (tags.includes('health') || tags.includes('medical')) {
	 classifications.push('HEALTH_DATA');
	}
	if (tags.includes('classified') || tags.includes('confidential')) {
	 classifications.push('CONFIDENTIAL');
	}
	return classifications.length > 0 ? classifications : ['PUBLIC'];
}
determineRegulatoryContext(workflowContext) {
	const contexts = [];
	const tags = workflowContext.tags || [];
	const environment = workflowContext.environment;
	// GDPR applicability
	if (tags.includes('eu-data') || tags.includes('gdpr')) {
	 contexts.push('GDPR');
	}
	// HIPAA applicability
	if (tags.includes('healthcare') || tags.includes('hipaa')) {
	 contexts.push('HIPAA');
	}
	// SOX applicability
	if (tags.includes('financial-reporting') || tags.includes('sox')) {
	 contexts.push('SOX');
	}
	// PCI-DSS applicability
	if (tags.includes('payment-processing') || tags.includes('pci')) {
	 contexts.push('PCI_DSS');
	}
	// Production data requires enhanced compliance
	if (environment === 'production') {
	 contexts.push('PRODUCTION_DATA');
	}
	return contexts;
}
async generateComplianceReport(reportType, timeRange) {
	const report = {
	 reportId: this.generateReportId(),
	 reportType: reportType,
	 generatedAt: new Date().toISOString(),
	 timeRange: timeRange,
	 generatedBy: 'system',
	 sections: {}
	};
	switch (reportType) {
	 case 'gdpr-article-30':
		report.sections = await this.generateGDPRArticle30Report(timeRange);
		break;
	 case 'sox-controls':
		report.sections = await this.generateSOXControlsReport(timeRange);
		break;
	 case 'security-audit':
		report.sections = await this.generateSecurityAuditReport(timeRange);
		break;
	 case 'data-lineage':
		report.sections = await this.generateDataLineageReport(timeRange);
		break;
	}
	// Sign report for integrity
	report.signature = await this.signReport(report);
	return report;
}
async generateGDPRArticle30Report(timeRange) {
	return {
	 dataProcessingActivities: await this.getDataProcessingActivities(timeRange),
	 legalBases: await this.getLegalBasesUsed(timeRange),
	 dataSubjectRights: await this.getDataSubjectRightsExercised(timeRange),
	 dataBreaches: await this.getDataBreachIncidents(timeRange),
	 dataTransfers: await this.getInternationalDataTransfers(timeRange),
	 retentionCompliance: await this.getRetentionComplianceStatus(timeRange)
	};
}
}
// Usage in n8n webhook/trigger
const auditLogger = new ComplianceAuditLogger({
environment: process.env.NODE_ENV,
auditLevel: 'comprehensive',
database: process.env.AUDIT_DATABASE_URL,
elasticsearch: process.env.AUDIT_ELASTICSEARCH_URL,
encryptionEnabled: true,
realTimeAlerts: true
});
// Audit workflow execution
await auditLogger.logWorkflowEvent(
'workflow_executed',
{
	id: $workflow.id,
	name: $workflow.name,
	environment: process.env.NODE_ENV,
	tags: $workflow.tags,
	executionMode: 'webhook'
},
{
	id: $user?.id || 'system',
	email: $user?.email || 'system@company.com',
	roles: $user?.roles || ['system'],
	ipAddress: $request.ip
},
{
	inputDataSize: JSON.stringify($input.all()).length,
	processingDuration: Date.now() - $execution.startTime,
	nodesExecuted: $execution.nodeCount
}
);

# governance-policies.yaml - n8n Governance Configuration
apiVersion: v1
kind: ConfigMap
metadata:
name: n8n-governance-policies
namespace: n8n-production
data:
workflow-governance.yaml: |
	# Workflow Governance Policies
	policies:
	 workflow_creation:
		approval_required: true
		approval_matrix:
		 development: ["team-lead"]
		 staging: ["devops-engineer", "security-officer"]
		 production: ["devops-lead", "security-officer", "compliance-officer"]
		mandatory_fields:
		 * description
		 * owner
		 * criticality_level
		 * data_classification
		 * regulatory_context
		naming_convention:
		 pattern: "^[a-z0-9\\-]+$"
		 max_length: 50
		 reserved_prefixes: ["system-", "admin-", "security-"]
		tagging_requirements:
		 mandatory_tags: ["environment", "team", "criticality"]
		 allowed_values:
			environment: ["development", "staging", "production"]
			criticality: ["low", "medium", "high", "critical"]
			team: ["devops", "platform", "security", "data"]
	 credential_management:
		encryption_required: true
		rotation_policy:
		 max_age_days: 90
		 notification_days: 7
		access_control:
		 approval_required: true
		 approval_matrix:
			production_credentials: ["security-officer", "devops-lead"]
			development_credentials: ["team-lead"]
		audit_requirements:
		 log_all_access: true
		 log_all_modifications: true
		 retention_days: 2555 # 7 years
	 data_governance:
		personal_data_handling:
		 consent_tracking: true
		 purpose_limitation: true
		 data_minimization: true
		 retention_limits:
			default_days: 365
			marketing_days: 730
			legal_days: 2555
		data_classification:
		 automatic_detection: true
		 classification_levels: ["public", "internal", "confidential", "restricted"]
		 handling_requirements:
			confidential: ["encryption", "access_logging", "approval_required"]
			restricted: ["encryption", "access_logging", "approval_required", "air_gapped"]
compliance-controls.yaml: |
	# Compliance Control Framework
	controls:
	 access_controls:
		AC-001:
		 title: "User Authentication"
		 requirement: "All users must authenticate via SSO"
		 implementation: "SAML/OIDC integration required"
		 verification: "Automated compliance check"
		AC-002:
		 title: "Role-Based Access Control"
		 requirement: "Principle of least privilege"
		 implementation: "RBAC engine with regular reviews"
		 verification: "Quarterly access reviews"
	 audit_controls:
		AU-001:
		 title: "Comprehensive Audit Logging"
		 requirement: "All actions must be logged"
		 implementation: "Centralized audit logging system"
		 verification: "Log completeness verification"
		AU-002:
		 title: "Audit Log Protection"
		 requirement: "Audit logs must be tamper-evident"
		 implementation: "Cryptographic signatures and immutable storage"
		 verification: "Integrity verification process"
	 data_protection:
		DP-001:
		 title: "Data Encryption"
		 requirement: "All sensitive data encrypted"
		 implementation: "AES-256 encryption at rest and in transit"
		 verification: "Encryption verification scans"
		DP-002:
		 title: "Data Retention"
		 requirement: "Data retained per policy"
		 implementation: "Automated retention and deletion"
		 verification: "Retention compliance reports"
---
apiVersion: batch/v1
kind: CronJob
metadata:
name: governance-compliance-check
namespace: n8n-production
spec:
schedule: "0 2 * * *" # Daily at 2 AM
jobTemplate:
	spec:
	 template:
		spec:
		 containers:
		 * name: compliance-checker
			image: company-registry.com/n8n-compliance:latest
			command: ["/scripts/check-compliance.sh"]
			env:
			* name: N8N_API_URL
			 value: "https://n8n.company.com"
			* name: N8N_API_TOKEN
			 valueFrom:
				secretKeyRef:
				 name: n8n-api-credentials
				 key: api-token
			volumeMounts:
			* name: governance-policies
			 mountPath: /etc/governance
		 volumes:
		 * name: governance-policies
			configMap:
			 name: n8n-governance-policies
		 restartPolicy: OnFailure