[{"data":1,"prerenderedAt":1139},["ShallowReactive",2],{"home":3,"article-\u002Fblog\u002Fn8n-production-reference-architecture":318},{"id":4,"title":5,"articleCta":6,"capabilities":11,"capabilitiesSectionText":52,"capabilitiesSectionTitle":53,"closing":54,"contact":59,"engagements":71,"engagementsSectionText":103,"engagementsSectionTitle":104,"extension":105,"faq":106,"footer":144,"founder":149,"getStartedSectionTitle":164,"getStartedSteps":165,"heroCtaButton":178,"heroKicker":179,"heroPoints":180,"introSectionText":184,"introSectionTitle":185,"meta":186,"microcopy":187,"navbar":203,"processSectionText":226,"processSectionTitle":227,"processSteps":228,"qualifier":245,"services":264,"servicesSectionText":285,"servicesSectionTitle":286,"stem":287,"trustBar":288,"whyUs":295,"whyUsSectionTitle":316,"__hash__":317},"home\u002Fhome.yaml","AI Automation, Agents & Software Architecture Consultancy",{"kicker":7,"title":8,"primary":9,"secondary":10},"Working on something like this?","A 30-minute call tells us both whether we can help.","Book a discovery call","More field notes",[12,16,20,24,28,32,36,40,44,48],{"title":13,"icon":14,"description":15},"Custom Software, Built Around Your Workflow","code","One-size-fits-all fits nobody in particular. We design and ship software that matches the way your team operates, not the way a generic product wants you to.",{"title":17,"icon":18,"description":19},"AI Automation & Agentic Workflows","workflow","n8n orchestrations, LangGraph agents, and RAG pipelines that quietly handle the repetitive work in the background. Fewer tickets, fewer copy-paste jobs, more throughput.",{"title":21,"icon":22,"description":23},"MCP Integrations for AI-Ready Tools","plug","We build Model Context Protocol servers that expose your internal systems to Claude, ChatGPT, and Copilot, so your team can use AI safely against the data that matters.",{"title":25,"icon":26,"description":27},"ERP, CRM & Data Integrations","database","We wire up the systems that should have been talking years ago. Clean data flows between ERP, CRM, and operational tools, plus dashboards that turn it into decisions.",{"title":29,"icon":30,"description":31},"Full-Stack Engineering","layers","Frontend, backend, databases, APIs: we cover the whole build in Vue, React, Node, Python, PostgreSQL, Redis and MongoDB. One team owning the stack top-to-bottom means fewer seams for bugs to hide in.",{"title":33,"icon":34,"description":35},"Cloud, Platform Engineering & DevOps","cloud","AWS, Azure, GCP. Kubernetes, Terraform, CI\u002FCD pipelines, infrastructure as code. We build the platform your app runs on so deploys are boring, environments are reproducible, and on-call isn't a horror story.",{"title":37,"icon":38,"description":39},"Security, SecOps & Compliance","shield","Security built in from day one, not bolted on before the audit. Threat modelling, least-privilege access, secret management, dependency hygiene, and the paper trail to prove it. Comfortable working under HIPAA, SOC 2, and enterprise security review.",{"title":41,"icon":42,"description":43},"Architecture & System Design","network","Monolith, microservices, event-driven or serverless: we pick the shape that matches your scale, your team, and your budget, not the one that looks impressive in a talk. Clear boundaries, clean contracts, documentation a human can read.",{"title":45,"icon":46,"description":47},"Industry Experience That Transfers","building","Healthcare (HIPAA, HL7, FHIR), insurance, fintech, logistics, SaaS. Different industries share the same underlying problems, and the patterns that solve them carry over.",{"title":49,"icon":50,"description":51},"The Idea You Haven't Built Yet","lightbulb","Got a weird integration, a backlog of 'we should automate this', or a product idea that no vendor covers? Tell us about it. The interesting work tends to start with a messy whiteboard.","When the SaaS subscriptions stop adding up and the spreadsheets start creaking, it's time for something built around how your business works. Here's where we come in.","When Off-the-Shelf Software Stops Fitting",{"kicker":55,"title":56,"accent":57,"tagline":58},"Next step","Bring the problem.","We'll bring the architecture.","Software architecture and AI automation consultancy, led by a senior architect.",{"title":60,"description":61,"form":62},"Let's Talk About the Work You'd Rather Not Do Manually.","Tell us what's slow, brittle, or eating your team's week. We'll tell you whether automation, an AI agent, or a proper architecture rethink is the right call, and what it would take.",{"title":63,"description":64,"namePlaceholder":65,"emailPlaceholder":66,"messagePlaceholder":67,"submitButton":68,"errorMessage":69,"thankYouMessage":70},"Get in Touch","Tell us about your project or pain points.","Your Name","Your Email","How can we help?","Let's Talk","Oops! Something went wrong. Please try again later, or email us at","Thank you! We'll be in touch shortly.",[72,78,83,88,93,98],{"title":73,"featured":74,"bestFor":75,"description":76,"price":77},"Discovery Sprint",true,"Best for: teams with a fuzzy problem and a real deadline.","A focused one-to-two week engagement to turn a vague brief into a concrete plan. You walk away with an architecture recommendation, a costed roadmap, and a clear go\u002Fno-go.","Fixed fee · scoped up front",{"title":79,"bestFor":80,"description":81,"price":82},"Architecture Review","Best for: existing systems, vendor proposals, or pre-build sanity checks.","We review your codebase, infrastructure, or an incoming quote and give you a plain-English report: what's solid, what's risky, what to fix first, and what it'll cost.","Fixed fee · 1–2 weeks",{"title":84,"bestFor":85,"description":86,"price":87},"System & Architecture Audit","Best for: due diligence, pre-acquisition, or deep technical forensics across a product suite.","A multi-week, independent deep-dive across architecture, codebase, CI\u002FCD, security posture, and cloud-readiness. Delivered as a structured written report for executive stakeholders: technical risks, modernization gaps, and prioritized recommendations, backed by evidence.","Fixed fee · 3–12 weeks",{"title":89,"bestFor":90,"description":91,"price":92},"Fractional Architect Retainer","Best for: founders and SMEs without a full-time technical lead.","Ongoing senior technical leadership on a monthly retainer. You get a CTO-level adviser on call for hiring, architecture, vendor calls, and the decisions that are expensive to get wrong.","Monthly retainer · flexible scope",{"title":94,"bestFor":95,"description":96,"price":97},"Fixed-Scope Build","Best for: automations, integrations, and well-defined features.","You know what you need. We scope it, quote it, and ship it in four to twelve weeks, with working software demoed every fortnight.","Fixed quote after discovery",{"title":99,"bestFor":100,"description":101,"price":102},"Ongoing Delivery Partner","Best for: longer builds and teams that want a steady senior partner.","A small, senior pod working alongside your team on a rolling basis. Great for modernization, platform work, and anything that needs architectural consistency over months, not weeks.","Monthly · capped effort","Pick the engagement shape that fits the problem. We'll tell you which one you probably need.","Ways to Work With Us","yaml",{"title":107,"subtitle":108,"cta":109,"questions":110},"Frequently Asked Questions","The questions we hear most often on discovery calls.","Still have questions? Email us at",[111,114,117,120,123,126,129,132,135,138,141],{"question":112,"answer":113},"What does Innovi Pro do?","We're a small software consultancy. Two things we do well: help you make the big technical decisions (architecture, stack, vendors, scaling), and build the software and automations that come out of those decisions. Think senior engineering partner rather than body-shop agency.",{"question":115,"answer":116},"Who do you work with?","Founders and SMEs who've outgrown spreadsheets and SaaS duct tape, scale-ups that need a senior hand on the architecture, and established companies that want to modernize operations without a year-long transformation project. Industry-wise we've shipped work in healthcare, insurance, fintech, logistics, and SaaS.",{"question":118,"answer":119},"How is this different from hiring an agency or a dev shop?","You talk to the people doing the work. No layered account managers, no pitch-deck team handing you off to juniors. Engagements are led by a senior software architect, delivered by a small trusted network, and sized to the outcome — not to fill a bench.",{"question":121,"answer":122},"Do you only do AI work?","No. AI and automation are a big part of what we do because that's where most of the quick wins are right now, but the core of the business is solid software architecture and custom development. Sometimes the best answer is a better database schema, not an AI agent.",{"question":124,"answer":125},"How do engagements typically start?","With a short discovery call: no deck, no hard sell. We want to understand what is slow, brittle, or blocked. From there you get one of three things: a fixed-scope project proposal, a retainer for ongoing architectural guidance, or an honest 'you don't need us for this' and a pointer in the right direction.",{"question":127,"answer":128},"How much does a project cost?","It depends on scope and on how involved you want us to be. Discovery sprints, reviews and audits are fixed-fee and scoped up front. Builds get a fixed quote once discovery has defined them. Advisory and delivery partnerships run on a monthly retainer. Every proposal lists the deliverables, what is out of scope and how each deliverable will be accepted. We'd rather quote accurately than quote fast.",{"question":130,"answer":131},"How quickly can you start?","Discovery calls usually happen within the week. For smaller automation or advisory work we can often start within two weeks. Larger builds are planned around your timeline and ours. We deliberately keep the active client list small so the people you meet are the ones actually doing the work.",{"question":133,"answer":134},"Will you work with our existing team and tools?","Almost always, yes. Most of our work augments an in-house team rather than replacing it. We adapt to your stack, your processes, and your codebase; we're not here to rewrite everything in our favorite framework.",{"question":136,"answer":137},"What about security, compliance, and data protection?","Taken seriously by default. We've worked under HIPAA in healthcare and inside the security expectations of large regulated enterprises. NDAs are standard, data stays where it should, and we're comfortable operating in environments where audit trails and access control aren't optional.",{"question":139,"answer":140},"Do you have a preferred automation platform?","We use n8n heavily because it provides the right balance of power and transparency for most business automation. That said, we're not religious about tools. If a project is better served by a custom workflow engine, a LangGraph agent, or even plain code, that's what we'll recommend.",{"question":142,"answer":143},"We're not sure what we need yet. Is it too early to talk?","That's the best time to talk. A 30-minute call before you commit to a direction tends to save months of rebuilding later. Bring the problem, not a spec, and we'll help you figure out the shape of the solution.",{"title":145,"address":146,"email":147,"copyright":148},"Innovi Pro","Cluj-Napoca, Romania","contact@innovi.pro","© 2025 Innovi Pro. All rights reserved.",{"kicker":150,"name":151,"role":152,"photoAlt":153,"bio":154,"tags":157},"The architect behind Innovi Pro","Mihai Farcas","Lead Software Architect","Mihai Farcas, Lead Software Architect at Innovi Pro",[155,156],"I help teams across industries design and deliver custom software that is secure, scalable, and built around real operational needs. My work combines **architecture consulting** with hands-on delivery through a trusted network of engineers, so you can ship without hiring a full team first.","I write about the engineering behind this work on [mihai.ltd](https:\u002F\u002Fmihai.ltd\u002Fblog) and on the [Innovi Pro blog](\u002Fblog).",[158,159,160,161,162,163],"Software architecture","Agentic AI","n8n","MCP","Kubernetes","Healthcare IT","Get Started In 4 Easy Steps",[166,169,172,175],{"title":167,"description":168},"Reach Out","Email us or fill out the contact form describing your project requirements.",{"title":170,"description":171},"Discovery Call","We'll schedule a discovery call to discuss your vision and goals.",{"title":173,"description":174},"Get a Quote","Get a tailored proposal outlining the recommended solutions, timeline, and cost.",{"title":176,"description":177},"We Start Building","Once you're ready, we kick off the development process and keep you updated every step of the way.","See How We Can Help","Software architecture · AI automation · Cluj-Napoca",[181,182,183],"Led by a senior software architect","Production n8n & agentic AI systems","HIPAA, HL7 and FHIR experience","We build the AI agents, n8n workflows, and MCP integrations that take the repetitive, unglamorous work off your team, so people spend their time on the parts of the job that need a human.","AI Automation Built Around [Your Business.]",{},{"primaryCta":9,"stackTitle":188,"scorecardLink":189,"partnerBadge":190,"qualifierCta":193,"ideaCta":194,"featuredEngagement":195,"engagementsHelp":196,"engagementsHelpLink":197,"whyUsCard":198,"formNote":202},"The stack we ship on","The method",{"kicker":191,"label":192},"Production stack","n8n automation","Sounds like us? Let's talk","Tell us about it","Typical first step","Not sure which one fits?","Book a call and we'll tell you.",{"kicker":199,"title":200,"cta":201},"Start here","A 30-minute call. No deck, no hard sell.","Book it","NDAs are standard. Your message goes straight to the architect.",{"items":204},[205,208,211,214,217,220,223],{"title":206,"url":207},"Services","\u002F#services",{"title":209,"url":210},"Capabilities","\u002F#capabilities",{"title":212,"url":213},"Process","\u002F#process",{"title":215,"url":216},"Engagements","\u002F#engagements",{"title":218,"url":219},"Why Us","\u002F#why-us",{"title":221,"url":222},"Blog","\u002Fblog",{"title":224,"url":225},"Book a Call","\u002F#contact","No mystery, no 40-page Statements of Work. Here is what working with us looks like.","How We Work",[229,233,237,241],{"title":230,"meta":231,"description":232},"1. Discovery Call","30 min · free","A 30-minute conversation. You describe what's slow, broken, or blocking. We ask the awkward questions. No deck, no pitch, no obligation. If we're not the right fit, we'll say so and point you at someone who is, when we know one.",{"title":234,"meta":235,"description":236},"2. Architecture & Scoping","1–2 weeks · fixed fee","A short, paid deep-dive of one to two weeks. You get a written architecture recommendation, a risk list, and a costed roadmap. This alone is often the most valuable thing clients buy from us.",{"title":238,"meta":239,"description":240},"3. Build, Automate, Integrate","2-week cycles","Delivered in short, visible iterations: two-week cycles with working software at the end of each. We work in the open: shared backlog, shared repo, direct access to the engineers.",{"title":242,"meta":243,"description":244},"4. Handover & Keep-The-Lights-On","Optional retainer","You get clean code, documentation a human can read, and a team that's trained to own it. We stick around on a light retainer if you want ongoing architectural guidance, or step fully out. Your call.",{"title":246,"subtitle":247,"items":248},"Is this you?","Most of our best engagements start with one of these.",[249,252,255,258,261],{"title":250,"description":251},"Your SaaS stack has quietly become a spreadsheet with extra steps.","Ten tools, three of them half-used, and the real process still lives in someone's inbox. You need software that fits the way your team works.",{"title":253,"description":254},"You inherited a codebase and you're not sure if it's salvageable.","Maybe a previous agency, maybe a co-founder who left. You need a clear-eyed second opinion before you put another cent into it.",{"title":256,"description":257},"Your team spends half its week on work a computer should be doing.","Invoicing, triage, copy-pasting between systems, answering the same five questions. You're ready to automate but want it done properly, not with a fragile chain of scripts.",{"title":259,"description":260},"You're about to commit to a 6-figure build and want a second pair of eyes.","An independent architecture review before you sign. Vendor quotes decoded into plain English. A roadmap you can follow.",{"title":262,"description":263},"You know AI should be helping, but you don't know where to start.","Not another chatbot demo: automations and agents plugged into the systems you already run, with straight advice about what is worth doing and what is hype.",[265,275],{"title":266,"description":267,"icon":268,"deliverables":269},"Software Architecture & Technical Consultancy","A senior architect in your corner, without the full-time headcount. Independent system and architecture audits, technical due diligence, vendor code reviews, cloud and container readiness assessments, and costed modernization roadmaps. We produce written, data-driven reports executives can act on and engineers actually respect. Especially useful before acquisitions, major rebuilds, or any six-figure technical decision.","architect",[270,271,272,273,274],"Architecture and system audits","Technical due diligence","Vendor code reviews","Cloud and container readiness","Costed modernization roadmaps",{"title":276,"description":277,"icon":278,"deliverables":279},"AI Automation, Agents & n8n Workflows","Production-grade automation, not demo-ware. We design n8n workflows, build custom agentic AI with LangGraph, and ship MCP servers that plug your internal tools straight into Claude, ChatGPT, and Copilot. Autonomous agents for support, invoicing, and back-office ops. Clean integrations between ERP, CRM, and AI that keep working on a Monday morning.","automation",[280,281,282,283,284],"n8n workflows","LangGraph agents","MCP servers for Claude, ChatGPT and Copilot","Support, invoicing and back-office agents","ERP and CRM integrations","Two ways to work with us: strategic consultancy when the decisions are expensive, and hands-on delivery when it's time to build. Often both.","What We Do","home",{"title":289,"items":290},"Senior experience you can reach directly.",[291,292,293,294],"10+ years shipping enterprise software","Experience across healthcare, insurance, fintech & SaaS","Published on DEV, YouTube & industry blogs","HIPAA · HL7 · FHIR experience",[296,300,304,308,312],{"title":297,"icon":298,"description":299},"A Team Led by an Architect","compass","Every engagement is led end-to-end by a senior software architect: the same person on the discovery call, in the design doc, and on the pull requests. No handoff to a junior delivery team, no layer of account managers translating between you and the build.",{"title":301,"icon":302,"description":303},"Deep n8n Expertise, Serious About AI","badge","Extensive production experience in n8n, LangGraph, MCP, and the wider agentic AI stack. We pick the right tool for the job instead of forcing every problem into the same framework.",{"title":305,"icon":306,"description":307},"Enterprise Experience, Startup Pace","gauge","Patterns learned on large-scale enterprise systems, applied at the speed a smaller team needs. Secure, scalable, and not over-engineered.",{"title":309,"icon":310,"description":311},"Small Team, Direct Access","users","You talk to the people doing the work. Decisions happen in hours, not change-request cycles. Lean on purpose, so your budget goes into outcomes instead of overhead.",{"title":313,"icon":314,"description":315},"AI-Accelerated Delivery","sparkles","We use AI to move faster where it helps (code scaffolding, research, testing) and keep humans in charge of the parts that matter. You get more software, sooner, without the usual quality trade-off.","Why Teams Work With Us","6q6dgWrLG8hN7zDaK4pfIxGN1megf6_hGCU5JE2fAnQ",{"id":319,"title":320,"author":145,"body":321,"canonical":1119,"date":1120,"description":1121,"extension":1122,"image":344,"imageAlt":343,"imageFallback":1123,"meta":1124,"navigation":74,"ogImage":1123,"path":1125,"published":74,"readingTime":1126,"seo":1127,"stem":1128,"tags":1129,"twitterCard":1136,"type":1137,"__hash__":1138},"blog\u002Fblog\u002Fn8n-production-reference-architecture.md","Self-Hosting n8n in Production: A Reference Architecture You Can Deploy in One Command",{"type":322,"value":323,"toc":1102},"minimark",[324,328,332,335,338,346,351,354,365,371,374,377,381,388,441,447,450,454,457,462,465,472,477,484,488,491,498,505,509,517,535,538,541,545,556,562,568,676,682,688,694,704,710,714,898,905,909,921,924,928,931,934,953,956,960,963,991,998,1002,1005,1022,1025,1029,1061,1067,1070,1082,1092,1098],[325,326,320],"h1",{"id":327},"self-hosting-n8n-in-production-a-reference-architecture-you-can-deploy-in-one-command",[329,330,331],"p",{},"I run one command and get a production-grade n8n instance with HTTPS, a zero-trust tunnel, managed PostgreSQL and S3-compatible object storage. One more command and it's all gone.",[329,333,334],{},"It needs no SSH, no open ports, no clicking around in dashboards and no Kubernetes cathedral for a workflow engine.",[329,336,337],{},"This is the shape we deploy every time a client runs n8n for anything that matters. It's opinionated. It has saved us and our clients a lot of late-night calls.",[329,339,340],{},[341,342],"img",{"alt":343,"src":344,"title":345},"Production n8n reference architecture: Cloudflare Tunnel at the edge, n8n on a single UpCloud server, UpCloud managed PostgreSQL and Object Storage in the data tier, all provisioned with Pulumi.","\u002Fblog\u002Fdiagrams\u002Fn8n-production-architecture.webp","Edge, application, data: provisioned as code.",[347,348,350],"h2",{"id":349},"the-two-ways-people-get-this-wrong","The two ways people get this wrong",[329,352,353],{},"Most n8n deployments fall into one of two traps.",[329,355,356,360,361,364],{},[357,358,359],"strong",{},"Trap one: the homelab demo."," You run ",[14,362,363],{},"docker run n8nio\u002Fn8n",", hook it up to your tools, and it works. Great, until a workflow hits real load, the SQLite file hits write contention, the container restarts, and you discover that \"it worked at my desk\" is not the same as \"it works in production.\"",[329,366,367,370],{},[357,368,369],{},"Trap two: the over-engineered cathedral."," Three-node Kubernetes cluster, Helm charts, service mesh, autoscaled worker fleet, custom operators. For a tool that runs a dozen workflows. You spend more time on the platform than on the automations it's supposed to run.",[329,372,373],{},"There's a sweet spot between the two, and it's where almost every real client sits. Small enough that one server handles it. Grounded enough that backups, TLS, secrets, and the database are managed by someone other than you. Reproducible enough that the whole thing is declared as code.",[329,375,376],{},"That's what this article is.",[347,378,380],{"id":379},"what-you-get","What you get",[329,382,383,384,387],{},"One ",[14,385,386],{},"pulumi up"," command provisions the full stack:",[389,390,391,405,411,417,423,429,435],"ul",{},[392,393,394,395,404],"li",{},"A ",[357,396,397],{},[398,399,403],"a",{"href":400,"rel":401},"https:\u002F\u002Fsignup.upcloud.com\u002F?promo=affiliate-letstalkdev250&utm_source=innovi&utm_medium=affiliate&utm_campaign=n8n-reference-architecture",[402],"nofollow","$3\u002Fmonth UpCloud server"," (1 CPU, 1 GB RAM, 10 GB storage, Ubuntu 24.04) running n8n in Docker",[392,406,394,407,410],{},[357,408,409],{},"Cloudflare Tunnel",": a zero-trust, outbound-only connection, with zero open ports on the server.",[392,412,413,416],{},[357,414,415],{},"Automatic HTTPS and DDoS protection"," at Cloudflare's edge",[392,418,419,422],{},[357,420,421],{},"UpCloud Managed PostgreSQL"," with point-in-time recovery, daily backups and no ops burden",[392,424,425,428],{},[357,426,427],{},"UpCloud Object Storage"," (S3-compatible) for binary data such as PDFs, images and scraped HTML",[392,430,431,434],{},[357,432,433],{},"DNS records"," pointed at the tunnel automatically",[392,436,437,440],{},[357,438,439],{},"Secrets"," generated and stored in Pulumi's encrypted state, never in plaintext",[329,442,383,443,446],{},[14,444,445],{},"pulumi destroy"," removes all of it. Server, tunnel, DNS, database and bucket are gone. Nothing is left running or billing.",[329,448,449],{},"The whole stack is about 180 lines of TypeScript and runs for somewhere between $3 and $25 a month depending on whether you take the single-server shortcut or the full managed-data-tier version. The architecture is identical either way; only the data tier moves.",[347,451,453],{"id":452},"the-three-tiers","The three tiers",[329,455,456],{},"Think of a production n8n deployment as three layers: edge, application, data. Each layer has a specific job and a specific failure mode it prevents.",[458,459,461],"h3",{"id":460},"tier-1-edge-cloudflare-tunnel","Tier 1: Edge (Cloudflare Tunnel)",[329,463,464],{},"The traditional setup exposes your server to the internet. You open ports 80 and 443, configure a reverse proxy, wrestle with Let's Encrypt, manage renewals, and pray nobody scans you before you've hardened the box. Every open port is an attack surface.",[329,466,467,468,471],{},"Cloudflare Tunnels flip the model. The ",[14,469,470],{},"cloudflared"," daemon on your server opens an outbound-only connection to Cloudflare's network. Traffic flows in reverse:",[329,473,474],{},[357,475,476],{},"User → Cloudflare (HTTPS + DDoS) → Tunnel → n8n container",[329,478,479,480,483],{},"Your server has zero inbound ports open, so there are no firewall rules to babysit and no certificates to renew. Cloudflare handles TLS and edge filtering. n8n's basic-auth flag is a speed bump, not auth. For anything that needs more, bolt on ",[357,481,482],{},"Cloudflare Access"," for SSO. Two environment variables and the editor is gated behind your identity provider.",[458,485,487],{"id":486},"tier-2-application-n8n-on-docker","Tier 2: Application (n8n on Docker)",[329,489,490],{},"One UpCloud server. Docker Compose. n8n, with the database and object storage pointed at the managed services in Tier 3. It runs without a load balancer or a worker split.",[329,492,493,494,497],{},"You don't need separate main and worker pods until you're running hundreds of workflows per minute, and most of our clients never get there. When you do, the same architecture scales: you add ",[14,495,496],{},"EXECUTIONS_MODE=queue",", a Redis instance, and worker containers. The edge and data tiers don't change.",[329,499,500,501,504],{},"The one non-negotiable: ",[357,502,503],{},"don't run n8n on SQLite in production."," Default deployments do. Two workflows firing at the same time and the file locks. Use Postgres from day one.",[458,506,508],{"id":507},"tier-3-data-upcloud-managed-postgres-object-storage","Tier 3: Data (UpCloud Managed Postgres + Object Storage)",[329,510,511,512,516],{},"Two stores, both managed by ",[398,513,515],{"href":400,"rel":514},[402],"UpCloud",":",[389,518,519,525],{},[392,520,521,524],{},[357,522,523],{},"Managed PostgreSQL"," for workflow definitions, execution history, credentials, and the user table. Managed means point-in-time recovery, automated backups, version upgrades without downtime, and someone else on call when the disk fills up. The smallest plan ($19\u002Fmonth) is fine for any self-hosted n8n we've ever deployed.",[392,526,527,530,531,534],{},[357,528,529],{},"Object Storage"," (S3-compatible) for binary data. Workflows that move files (PDFs, scraped pages, image uploads) should store those blobs in object storage, not in the Postgres execution record. Set ",[14,532,533],{},"N8N_BINARY_DATA_MODE=s3"," and point it at your UpCloud bucket. Your Postgres stays small. Your execution history stays fast.",[329,536,537],{},"Why UpCloud specifically? Three reasons. The VM, the database, and the bucket all live in the same region, so latency between them is sub-millisecond. The pricing is predictable ($3 VM, $19 managed Postgres, pennies for object storage). And their API is clean enough that Pulumi can provision the whole thing end-to-end in one pass.",[329,539,540],{},"If you're doing this on AWS or GCP instead, the shape is identical: RDS or Cloud SQL for the database, S3 or GCS for the bucket. The architecture holds. The cost doesn't.",[347,542,544],{"id":543},"infrastructure-as-code-why-one-command-matters","Infrastructure as Code: why one command matters",[329,546,547,548,551,552,555],{},"The reason this setup is different from most n8n tutorials: ",[357,549,550],{},"everything is declared."," Server, tunnel, DNS, database, bucket and secrets all live in a Pulumi program. You don't click through dashboards. You don't SSH in to inject the tunnel token. You don't manually paste database connection strings into ",[14,553,554],{},".env"," files.",[329,557,558,559,561],{},"Here's what ",[14,560,386],{}," actually does:",[329,563,564,567],{},[357,565,566],{},"1. Creates the Cloudflare Tunnel."," A 32-byte random secret gets generated and the tunnel is registered against your account.",[569,570,575],"pre",{"className":571,"code":572,"language":573,"meta":574,"style":574},"language-typescript shiki shiki-themes github-dark-default","const tunnel = new cloudflare.ZeroTrustTunnelCloudflared(\"n8n-tunnel\", {\n  accountId: cfAccountId,\n  name: \"n8n-tunnel\",\n  configSrc: \"cloudflare\",\n  tunnelSecret: crypto.randomBytes(32).toString(\"base64\"),\n});\n","typescript","",[14,576,577,614,620,631,642,670],{"__ignoreMap":574},[578,579,582,586,590,593,596,600,604,607,611],"span",{"class":580,"line":581},"line",1,[578,583,585],{"class":584},"suJrU","const",[578,587,589],{"class":588},"sFSAA"," tunnel",[578,591,592],{"class":584}," =",[578,594,595],{"class":584}," new",[578,597,599],{"class":598},"sZEs4"," cloudflare.",[578,601,603],{"class":602},"sc3cj","ZeroTrustTunnelCloudflared",[578,605,606],{"class":598},"(",[578,608,610],{"class":609},"s9uIt","\"n8n-tunnel\"",[578,612,613],{"class":598},", {\n",[578,615,617],{"class":580,"line":616},2,[578,618,619],{"class":598},"  accountId: cfAccountId,\n",[578,621,623,626,628],{"class":580,"line":622},3,[578,624,625],{"class":598},"  name: ",[578,627,610],{"class":609},[578,629,630],{"class":598},",\n",[578,632,634,637,640],{"class":580,"line":633},4,[578,635,636],{"class":598},"  configSrc: ",[578,638,639],{"class":609},"\"cloudflare\"",[578,641,630],{"class":598},[578,643,645,648,651,653,656,659,662,664,667],{"class":580,"line":644},5,[578,646,647],{"class":598},"  tunnelSecret: crypto.",[578,649,650],{"class":602},"randomBytes",[578,652,606],{"class":598},[578,654,655],{"class":588},"32",[578,657,658],{"class":598},").",[578,660,661],{"class":602},"toString",[578,663,606],{"class":598},[578,665,666],{"class":609},"\"base64\"",[578,668,669],{"class":598},"),\n",[578,671,673],{"class":580,"line":672},6,[578,674,675],{"class":598},"});\n",[329,677,678,681],{},[357,679,680],{},"2. Fetches the tunnel token via API."," This is the trick that makes the whole thing zero-touch. Instead of SSHing in to inject the token after boot, Pulumi pulls it from Cloudflare and bakes it into the cloud-init script.",[329,683,684,687],{},[357,685,686],{},"3. Provisions managed Postgres and Object Storage"," on UpCloud, generates the connection strings and bucket credentials, and stores them in Pulumi's encrypted state.",[329,689,690,693],{},[357,691,692],{},"4. Creates a proxied CNAME"," pointing your domain at the tunnel. TLS termination and DDoS filtering happen at Cloudflare's edge before traffic reaches your server.",[329,695,696,699,700,703],{},[357,697,698],{},"5. Builds the cloud-init script"," with Docker install steps, a complete ",[14,701,702],{},"docker-compose.yml",", and every secret injected at render time. Nothing is written to disk in plaintext.",[329,705,706,709],{},[357,707,708],{},"6. Provisions the UpCloud VM"," with the script. Sixty seconds later the server has Docker, the compose file, and n8n running against the managed database and bucket. Nobody SSHs in and nothing is done by hand.",[458,711,713],{"id":712},"deploy-it","Deploy it",[569,715,719],{"className":716,"code":717,"language":718,"meta":574,"style":574},"language-bash shiki shiki-themes github-dark-default","# Clone and install\ncd infra && npm install\n\n# Fill in API tokens, domain, Cloudflare account\u002Fzone IDs\ncp ..\u002F.env.example ..\u002F.env && $EDITOR ..\u002F.env\n\n# Load env and generate secrets\nset -a && source ..\u002F.env && set +a\npulumi config set --secret n8nBasicAuthUser \"admin\"\npulumi config set --secret n8nBasicAuthPassword \"$(openssl rand -hex 16)\"\npulumi config set --secret n8nEncryptionKey \"$(openssl rand -hex 32)\"\n\npulumi up\n","bash",[14,720,721,727,745,750,755,772,776,782,805,826,858,885,890],{"__ignoreMap":574},[578,722,723],{"class":580,"line":581},[578,724,726],{"class":725},"sH3jZ","# Clone and install\n",[578,728,729,732,735,738,742],{"class":580,"line":616},[578,730,731],{"class":588},"cd",[578,733,734],{"class":609}," infra",[578,736,737],{"class":598}," && ",[578,739,741],{"class":740},"sQhOw","npm",[578,743,744],{"class":609}," install\n",[578,746,747],{"class":580,"line":622},[578,748,749],{"emptyLinePlaceholder":74},"\n",[578,751,752],{"class":580,"line":633},[578,753,754],{"class":725},"# Fill in API tokens, domain, Cloudflare account\u002Fzone IDs\n",[578,756,757,760,763,766,769],{"class":580,"line":644},[578,758,759],{"class":740},"cp",[578,761,762],{"class":609}," ..\u002F.env.example",[578,764,765],{"class":609}," ..\u002F.env",[578,767,768],{"class":598}," && $EDITOR ",[578,770,771],{"class":609},"..\u002F.env\n",[578,773,774],{"class":580,"line":672},[578,775,749],{"emptyLinePlaceholder":74},[578,777,779],{"class":580,"line":778},7,[578,780,781],{"class":725},"# Load env and generate secrets\n",[578,783,785,788,791,793,796,798,800,802],{"class":580,"line":784},8,[578,786,787],{"class":588},"set",[578,789,790],{"class":588}," -a",[578,792,737],{"class":598},[578,794,795],{"class":588},"source",[578,797,765],{"class":609},[578,799,737],{"class":598},[578,801,787],{"class":588},[578,803,804],{"class":609}," +a\n",[578,806,808,811,814,817,820,823],{"class":580,"line":807},9,[578,809,810],{"class":740},"pulumi",[578,812,813],{"class":609}," config",[578,815,816],{"class":609}," set",[578,818,819],{"class":588}," --secret",[578,821,822],{"class":609}," n8nBasicAuthUser",[578,824,825],{"class":609}," \"admin\"\n",[578,827,829,831,833,835,837,840,843,846,849,852,855],{"class":580,"line":828},10,[578,830,810],{"class":740},[578,832,813],{"class":609},[578,834,816],{"class":609},[578,836,819],{"class":588},[578,838,839],{"class":609}," n8nBasicAuthPassword",[578,841,842],{"class":609}," \"$(",[578,844,845],{"class":740},"openssl",[578,847,848],{"class":609}," rand ",[578,850,851],{"class":588},"-hex",[578,853,854],{"class":588}," 16",[578,856,857],{"class":609},")\"\n",[578,859,861,863,865,867,869,872,874,876,878,880,883],{"class":580,"line":860},11,[578,862,810],{"class":740},[578,864,813],{"class":609},[578,866,816],{"class":609},[578,868,819],{"class":588},[578,870,871],{"class":609}," n8nEncryptionKey",[578,873,842],{"class":609},[578,875,845],{"class":740},[578,877,848],{"class":609},[578,879,851],{"class":588},[578,881,882],{"class":588}," 32",[578,884,857],{"class":609},[578,886,888],{"class":580,"line":887},12,[578,889,749],{"emptyLinePlaceholder":74},[578,891,893,895],{"class":580,"line":892},13,[578,894,810],{"class":740},[578,896,897],{"class":609}," up\n",[329,899,900,901,904],{},"Five minutes. Visit ",[14,902,903],{},"https:\u002F\u002Fn8n.yourdomain.com"," and log in.",[458,906,908],{"id":907},"tear-it-down","Tear it down",[569,910,912],{"className":716,"code":911,"language":718,"meta":574,"style":574},"pulumi destroy\n",[14,913,914],{"__ignoreMap":574},[578,915,916,918],{"class":580,"line":581},[578,917,810],{"class":740},[578,919,920],{"class":609}," destroy\n",[329,922,923],{},"Server, tunnel, DNS, database and bucket are all removed. Your Pulumi state is the only record it ever existed.",[347,925,927],{"id":926},"secrets-done-right","Secrets done right",[329,929,930],{},"n8n encrypts credentials at rest using a single master key. The default is an auto-generated value written to the container filesystem on first boot. That means you don't know what it is, can't rotate it, and if your database gets backed up without the key, your backup is useless.",[329,932,933],{},"Fix it in two steps:",[935,936,937,947],"ol",{},[392,938,939,946],{},[357,940,941,942,945],{},"Set ",[14,943,944],{},"N8N_ENCRYPTION_KEY"," explicitly."," Pulumi generates it, keeps it in its encrypted state and injects it into the container at render time. You can rotate it by running one command.",[392,948,949,952],{},[357,950,951],{},"No credentials in workflow JSON."," Use n8n's Credentials feature, not pasted API keys in HTTP Request nodes. Workflow JSON gets exported, backed up, and sometimes committed to git. Credentials don't. Keep the wall between them.",[329,954,955],{},"The same rule applies to the Postgres password, the tunnel token, the UpCloud API key, and the object storage credentials. All of them live in Pulumi's encrypted state. None of them live in your shell history.",[347,957,959],{"id":958},"observability-briefly","Observability, briefly",[329,961,962],{},"Three things are worth setting up on day one, in order of pain-if-you-skip-them:",[389,964,965,971,981],{},[392,966,967,970],{},[357,968,969],{},"Alerts on execution failures."," n8n can ping a webhook on failure. Point it at Slack, Discord, or PagerDuty. One workflow fails silently for a week and you've lost a week of data.",[392,972,973,976,977,980],{},[357,974,975],{},"Structured logs."," Set ",[14,978,979],{},"N8N_LOG_OUTPUT=json"," and ship stdout to Loki, Datadog, or your log tool of choice. Searchable by workflow ID is the minimum bar.",[392,982,983,986,987,990],{},[357,984,985],{},"Execution retention."," The default is \"keep everything forever.\" Your Postgres execution table grows without bound and queries slow down. Set ",[14,988,989],{},"EXECUTIONS_DATA_PRUNE=true"," with 30-90 days of retention.",[329,992,993,994,997],{},"Prometheus metrics on ",[14,995,996],{},"\u002Fmetrics"," and OpenTelemetry traces are both supported and both worth turning on once you're past a few dozen workflows. You can skip them on day one; by month three you will want them.",[347,999,1001],{"id":1000},"when-n8n-cloud-is-the-better-choice","When n8n Cloud is the better choice",[329,1003,1004],{},"Self-hosting is the right call when you need a custom domain, your own database, specific compliance constraints, or the ability to spin up and tear down identical environments for staging and development.",[329,1006,1007,1008,1015,1016,1018,1019,1021],{},"If none of that applies and you'd rather not think about servers at all, ",[357,1009,1010],{},[398,1011,1014],{"href":1012,"rel":1013},"https:\u002F\u002Fn8n.partnerlinks.io\u002F700yejiez8he",[402],"n8n Cloud"," is the honest recommendation. Managed hosting, automatic updates, built-in auth, zero infrastructure. No ",[14,1017,386],{},", no ",[14,1020,554],{}," files, no Cloudflare tokens. Sign up, build workflows, done.",[329,1023,1024],{},"Both paths are valid. The question isn't \"which one is better.\" It's \"which one matches how you want to spend your time.\"",[347,1026,1028],{"id":1027},"the-takeaways","The takeaways",[389,1030,1031,1037,1043,1049,1055],{},[392,1032,1033,1036],{},[357,1034,1035],{},"Default n8n is great for prototyping, dangerous for production."," SQLite under load, no TLS, secrets in workflow JSON: all fixable, none fixed out of the box.",[392,1038,1039,1042],{},[357,1040,1041],{},"Three tiers, not four."," Edge (Cloudflare Tunnel), application (n8n on one server), data (managed Postgres + object storage). Workers and Redis are optional. Add them when you need them.",[392,1044,1045,1048],{},[357,1046,1047],{},"Declare the whole thing as code."," Pulumi, Terraform, OpenTofu: pick one. If you can't destroy and rebuild the environment in five minutes, it's not reproducible.",[392,1050,1051,1054],{},[357,1052,1053],{},"Managed Postgres is the single highest-ROI decision."," It removes the most common failure mode for the lowest ongoing cost.",[392,1056,1057,1060],{},[357,1058,1059],{},"Zero-trust at the edge beats open ports."," Cloudflare Tunnel + Access is the easiest real auth story you'll ever deploy.",[329,1062,1063,1064,1066],{},"n8n is a great tool and we run it ourselves. But \"great tool\" and \"production-ready out of the box\" are two different things. Do the extra hour of setup, or run one ",[14,1065,386],{},", and it will serve you for years.",[1068,1069],"hr",{},[329,1071,1072,1075,1076,1081],{},[357,1073,1074],{},"Want to try the exact stack?"," The full Pulumi source is on ",[398,1077,1080],{"href":1078,"rel":1079},"https:\u002F\u002Fgithub.com\u002Fmihailtd\u002Fiac-deploy-n8n-upcloud-cloudflare-pulumi",[402],"GitHub",". Clone it, set your API keys, deploy in five minutes.",[329,1083,1084,1087,1088,1091],{},[357,1085,1086],{},"Need help with your setup?"," We build and run production automation infrastructure for clients. ",[398,1089,1090],{"href":225},"Reach out"," and let's talk about your use case.",[329,1093,1094],{},[1095,1096,1097],"em",{},"Disclosure: this post contains affiliate links for UpCloud and n8n Cloud. We only recommend tools we use ourselves on production workloads.",[1099,1100,1101],"style",{},"html pre.shiki code .suJrU, html code.shiki .suJrU{--shiki-default:#FF7B72}html pre.shiki code .sFSAA, html code.shiki .sFSAA{--shiki-default:#79C0FF}html pre.shiki code .sZEs4, html code.shiki .sZEs4{--shiki-default:#E6EDF3}html pre.shiki code .sc3cj, html code.shiki .sc3cj{--shiki-default:#D2A8FF}html pre.shiki code .s9uIt, html code.shiki .s9uIt{--shiki-default:#A5D6FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sH3jZ, html code.shiki .sH3jZ{--shiki-default:#8B949E}html pre.shiki code .sQhOw, html code.shiki .sQhOw{--shiki-default:#FFA657}",{"title":574,"searchDepth":616,"depth":616,"links":1103},[1104,1105,1106,1111,1115,1116,1117,1118],{"id":349,"depth":616,"text":350},{"id":379,"depth":616,"text":380},{"id":452,"depth":616,"text":453,"children":1107},[1108,1109,1110],{"id":460,"depth":622,"text":461},{"id":486,"depth":622,"text":487},{"id":507,"depth":622,"text":508},{"id":543,"depth":616,"text":544,"children":1112},[1113,1114],{"id":712,"depth":622,"text":713},{"id":907,"depth":622,"text":908},{"id":926,"depth":616,"text":927},{"id":958,"depth":616,"text":959},{"id":1000,"depth":616,"text":1001},{"id":1027,"depth":616,"text":1028},"https:\u002F\u002Finnovi.pro\u002Fblog\u002Fn8n-production-reference-architecture","2026-04-06","A production-grade n8n reference architecture with Cloudflare Tunnel, UpCloud managed Postgres and Object Storage, provisioned end-to-end with Pulumi. One command up. One command down.","md","\u002Fblog\u002Fdiagrams\u002Fn8n-production-architecture.png",{},"\u002Fblog\u002Fn8n-production-reference-architecture","10 min",{"title":320,"description":1121},"blog\u002Fn8n-production-reference-architecture",[160,278,1130,1131,1132,1133,810,1134,1135],"workflow orchestration","self-hosted","reference architecture","infrastructure as code","upcloud","cloudflare","summary_large_image","article","rS5LSGIlMCtbsZTt4cz_VHPK5Dy-gypRT__g-_UoN-w",1791637290323]