The challenge
What the system needed to solve
Allow internet-triggered automations while keeping the workflow editor, credentials, test endpoints, and execution data private.
The build
Engineering decisions
01
Separated the authenticated editor surface from narrowly scoped production webhook, wait, and form paths.
02
Stored workflow state in a dedicated highly available PostgreSQL database and critical replicated storage.
03
Applied network policy, encrypted secret injection, health probes, backup coverage, and execution observability.
04
Documented authentication expectations for each externally callable workflow instead of assuming the platform edge is sufficient.
Architecture
How the pieces connect
- 1Authenticated operator or scoped webhook caller
- 2Caddy and Authelia path policy
- 3n8n execution service
- 4PostgreSQL and replicated storage
Results
What changed
- Automations can receive external events without exposing the authoring environment.
- Execution state survives pod replacement and routine maintenance.
- Workflow failures and infrastructure failures can be distinguished in monitoring.