# Enterprise n8n Autonomous Workflow Architect OS ==================================================================== MODULE 1: WORKFLOW TOPOLOGY, INGRESS AUTH & STATE CONTRACTS ==================================================================== - Distributed Workflow Architecture Blueprint: * Ingress Pipeline: Inbound Webhook (`/webhook/v1/incidents`) -> Header Token Auth -> Ingress Schema Validation -> Redis Task Broker -> Worker Node Execution -> Claude 3.5 Sonnet Triage -> Database Persistence -> Slack Alert Dispatch. * Ingress Authentication: Header-based token verification using `x-n8n-webhook-secret` compared via timing-safe string comparison inside the first JavaScript Code node. * Node Handoff Strategy: Each node passes an immutable `incident_context` object preserving the original payload while appending enrichment fields. - Production Ingress & State Validation Code (n8n Code Node): ```javascript // Code Node: Ingress Validator & Auth Guard const headers = $input.item.json.headers; const body = $input.item.json.body; const EXPECTED_SECRET = $env.WEBHOOK_SECRET_KEY || "sec_prod_live_994820"; const providedSecret = headers["x-n8n-webhook-secret"] || headers["X-N8N-WEBHOOK-SECRET"]; if (!providedSecret || providedSecret !== EXPECTED_SECRET) { throw new Error("HTTP 401 Unauthorized: Invalid or missing x-n8n-webhook-secret header."); } if (!body || !body.incident_id || !body.raw_logs) { throw new Error("HTTP 400 Bad Request: Missing required fields: incident_id, raw_logs."); } return { json: { transaction_id: `tx_${Date.now()}_${Math.random().toString(36).substring(7)}`, incident_id: body.incident_id, source_system: body.source_system || "SIEM_GENERIC", raw_logs: body.raw_logs, received_at: new Date().toISOString(), status: "INGESTED" } }; { "$schema": "http://json-schema.org/draft-07/schema#", "title": "IncidentIngressPayload", "type": "object", "required": ["incident_id", "raw_logs"], "properties": { "incident_id": { "type": "string", "pattern": "^INC-[0-9]{5,}$" }, "source_system": { "type": "string" }, "raw_logs": { "type": "string", "minLength": 10 } } } version: '3.8' services: postgres: image: postgres:16-alpine restart: always environment: - POSTGRES_USER=n8n_admin - POSTGRES_PASSWORD=DB_SuperSecurePassword_2026! - POSTGRES_DB=n8n_production volumes: - postgres_data:/var/lib/postgresql/data healthcheck: test: ["CMD-SHELL", "pg_isready -U n8n_admin -d n8n_production"] interval: 5s timeout: 5s retries: 5 redis: image: redis:7.2-alpine restart: always command: redis-server --requirepass Redis_Auth_Token_9941! volumes: - redis_data:/data healthcheck: test: ["CMD", "redis-cli", "-a", "Redis_Auth_Token_9941!", "ping"] interval: 5s timeout: 5s retries: 5 n8n-main: image: docker.n8n.io/n8nio/n8n:1.60.1 restart: always ports: - "5678:5678" environment: - DB_TYPE=postgresdb - DB_POSTGRESDB_HOST=postgres - DB_POSTGRESDB_PORT=5432 - DB_POSTGRESDB_DATABASE=n8n_production - DB_POSTGRESDB_USER=n8n_admin - DB_POSTGRESDB_PASSWORD=DB_SuperSecurePassword_2026! - EXECUTIONS_MODE=queue - QUEUE_BULL_REDIS_HOST=redis - QUEUE_BULL_REDIS_PORT=6379 - QUEUE_BULL_REDIS_PASSWORD=Redis_Auth_Token_9941! - N8N_ENCRYPTION_KEY=enc_key_prod_a9f8e7d6c5b4a321 - N8N_DIAGNOSTICS_ENABLED=false - EXECUTIONS_DATA_PRUNE=true - EXECUTIONS_DATA_MAX_AGE=168 depends_on: postgres: condition: service_healthy redis: condition: service_healthy n8n-webhook: image: docker.n8n.io/n8nio/n8n:1.60.1 restart: always command: webhook environment: - DB_TYPE=postgresdb - DB_POSTGRESDB_HOST=postgres - DB_POSTGRESDB_PORT=5432 - DB_POSTGRESDB_DATABASE=n8n_production - DB_POSTGRESDB_USER=n8n_admin - DB_POSTGRESDB_PASSWORD=DB_SuperSecurePassword_2026! - EXECUTIONS_MODE=queue - QUEUE_BULL_REDIS_HOST=redis - QUEUE_BULL_REDIS_PORT=6379 - QUEUE_BULL_REDIS_PASSWORD=Redis_Auth_Token_9941! - N8N_ENCRYPTION_KEY=enc_key_prod_a9f8e7d6c5b4a321 depends_on: - n8n-main n8n-worker: image: docker.n8n.io/n8nio/n8n:1.60.1 restart: always command: worker --concurrency=10 environment: - DB_TYPE=postgresdb - DB_POSTGRESDB_HOST=postgres - DB_POSTGRESDB_PORT=5432 - DB_POSTGRESDB_DATABASE=n8n_production - DB_POSTGRESDB_USER=n8n_admin - DB_POSTGRESDB_PASSWORD=DB_SuperSecurePassword_2026! - EXECUTIONS_MODE=queue - QUEUE_BULL_REDIS_HOST=redis - QUEUE_BULL_REDIS_PORT=6379 - QUEUE_BULL_REDIS_PASSWORD=Redis_Auth_Token_9941! - N8N_ENCRYPTION_KEY=enc_key_prod_a9f8e7d6c5b4a321 depends_on: - n8n-main volumes: postgres_data: redis_data: WEBHOOK_SECRET_KEY=sec_prod_live_994820 SLACK_WEBHOOK_URL=https://hooks.slack.com/services/T00/B00/SECRET ANTHROPIC_API_KEY=sk-ant-api03-live-credentials NODE_ENV=production // Code Node: LLM Output Repair Guard const rawOutput = $input.item.json.text \vert{}\vert{}$input.item.json.response || ""; function repairAndParseJson(text) { // 1. Strip markdown fences if present let cleaned = text.trim(); if (cleaned.startsWith("```")) { cleaned = cleaned.replace(/^```(?:json)?\s*/i, "").replace(/\s*```$/, ""); } // 2. Locate first '{' and last '}' const firstBrace = cleaned.indexOf("{"); const lastBrace = cleaned.lastIndexOf("}"); if (firstBrace !== -1 && lastBrace !== -1) { cleaned = cleaned.substring(firstBrace, lastBrace + 1); } try { return JSON.parse(cleaned); } catch (err) { // Fallback default structure return { severity: "SEV-1", root_cause: "PARSING_FAILED: Model emitted unparseable JSON", affected_hosts: ["unknown"], recommended_action: "Manual triage required. Raw: " + text.substring(0, 100), is_fallback: true }; } } const parsedData = repairAndParseJson(rawOutput); // Validate required fields if (!parsedData.severity || !parsedData.root_cause) { parsedData.severity = "SEV-1"; parsedData.root_cause = "SCHEMA_VALIDATION_ERROR: Missing severity or root_cause"; parsedData.is_fallback = true; } return { json: { ...$node["Ingress Validator"].json, triage_result: parsedData } }; CREATE TABLE IF NOT EXISTS n8n_dead_letter_queue ( id UUID PRIMARY KEY DEFAULT gen_random_uuid(), workflow_id VARCHAR(64) NOT NULL, workflow_name VARCHAR(255) NOT NULL, execution_id VARCHAR(64) NOT NULL, failed_node_name VARCHAR(128) NOT NULL, error_message TEXT NOT NULL, error_stack TEXT, original_payload JSONB NOT NULL, status VARCHAR(32) NOT NULL DEFAULT 'PENDING_REVIEW', retry_count INTEGER NOT NULL DEFAULT 0, created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), resolved_at TIMESTAMPTZ ); CREATE INDEX idx_dlq_status ON n8n_dead_letter_queue(status); CREATE INDEX idx_dlq_created_at ON n8n_dead_letter_queue(created_at); 🚨 *n8n Production Workflow Failure Detected* • *Workflow*: IT Incident Triage OS • *Execution ID*: {{$json.execution.id}} • *Failed Node*: {{$json.execution.lastNodeExecuted}} • *Error*: {{$json.execution.error.message}} • *Payload Stored in DLQ*: Record ID {{$json.dlq_id}} • *Action*: <[https://n8n.internal.company.com/execution/](https://n8n.internal.company.com/execution/){{$json.execution.id}}|Inspect Execution> { "name": "Enterprise IT Incident Triage OS", "nodes": [ { "parameters": { "httpMethod": "POST", "path": "v1/incidents", "responseMode": "onReceived", "responseData": "allEntries" }, "id": "node-webhook-01", "name": "Webhook Ingress", "type": "n8n-nodes-base.webhook", "typeVersion": 2, "position": [240, 300] }, { "parameters": { "jsCode": "const headers = $input.item.json.headers;\nconst body = $input.item.json.body;\nif (headers['x-n8n-webhook-secret'] !== 'sec_prod_live_994820') {\n throw new Error('Unauthorized');\n}\nreturn { json: { ...body, received_at: new Date().toISOString() } };" }, "id": "node-auth-02", "name": "Auth Guard", "type": "n8n-nodes-base.code", "typeVersion": 2, "position": [460, 300] }, { "parameters": { "operation": "executeQuery", "query": "INSERT INTO n8n_dead_letter_queue (workflow_id, workflow_name, execution_id, failed_node_name, error_message, original_payload) VALUES ($1, $2, $3, $4, $5, $6);", "options": {} }, "id": "node-postgres-dlq", "name": "Postgres DLQ Logger", "type": "n8n-nodes-base.postgres", "typeVersion": 2.4, "position": [680, 520] } ], "connections": { "Webhook Ingress": { "main": [ [ { "node": "Auth Guard", "type": "main", "index": 0 } ] ] } }, "settings": { "executionOrder": "v1", "saveExecutionProgress": true, "saveManualExecutions": true, "callerPolicy": "workflowsFromSameOwner" } } #!/usr/bin/env bash # Test 1: Legitimate Authorized Request (Expects HTTP 200) curl -X POST http://localhost:5678/webhook/v1/incidents \ -H "Content-Type: application/json" \ -H "x-n8n-webhook-secret: sec_prod_live_994820" \ -d '{"incident_id": "INC-99482", "raw_logs": "Kernel panic: OOM killer terminated process 4829 on node-prod-04"}' # Test 2: Unauthorized Request (Expects HTTP 401 / Workflow Failure) curl -X POST http://localhost:5678/webhook/v1/incidents \ -H "Content-Type: application/json" \ -H "x-n8n-webhook-secret: wrong_secret_token" \ -d '{"incident_id": "INC-00001", "raw_logs": "Unauthorized test"}' # Test 3: Malformed Payload Triggering DLQ (Expects Dead-Letter Queue Logging) curl -X POST http://localhost:5678/webhook/v1/incidents \ -H "Content-Type: application/json" \ -H "x-n8n-webhook-secret: sec_prod_live_994820" \ -d '{"invalid_field": true}'