# n8n with Tailscale Integration

![n8n with Tailscale](https://imgs.search.brave.com/F0umOZB6F-GhIw9aEm1fa7-tVDPQIxFT0_-RP5YIXnA/rs:fit:200:200:1:0/g:ce/aHR0cHM6Ly9yZXBv/c2l0b3J5LWltYWdl/cy5naXRodWJ1c2Vy/Y29udGVudC5jb20v/MTkzMjE1NTU0L2Rm/MzRiMzZkLTI3OWMt/NDk2Yy05MWMyLTk1/OWRkOWM5ZjEzZA)

This project sets up a n8n instance with Tailscale VPN integration using Docker Compose. It creates a secure, private network connection for your n8n instance using Tailscale.

## Prerequisites

- Docker and Docker Compose installed on your system
- A Tailscale account and auth key (get one from https://login.tailscale.com/admin/authkeys)
- Basic understanding of Docker and networking concepts

## Project Structure
```
ts-n8n/
├── docker-compose.yml
├── tailscale/
│   ├── tailscale-data/     # Persistent Tailscale state
│   └── config/             # Tailscale configuration files
└── n8n/
    └── config/             # n8n configuration files
```

## Setup Instructions

1. **Clone the Repository**
   ```bash
   git clone https://gitea.damconsulting.llc/DAM/ts-n8n
   cd ts-n8n
   ```
2. Create Required Directories
    ```bash
    mkdir -p tailscale/tailscale-data
    mkdir -p n8n_data
    ```
3. Configure Tailscale
    - Replace `{{YOUR_TAILSCALE_AUTHKEY}}` in the docker-compose.yml with your actual Tailscale auth key
    - Optionally, update the file in `tailscale/config/serve.json` if you need specific Tailscale serve configurations
        - CAUTION: Changing `"${TS_CERT_DOMAIN}:443": false` to `true` will expose the service to the internet

4. Configure n8n
    - See the [documentation](https://docs.n8n.io/?_gl=1*19afx3*_gcl_au*MjAxNDcxMjcxMi4xNzUwNzI3OTUy*_ga*NTQxOTAxNzE1LjE3NTA3Mjc5NTI.*_ga_0SC4FF2FH9*czE3NTA5MDQ5MzAkbzIkZzEkdDE3NTA5MDU0OTIkajMwJGwwJGgw) for configuration options

5. Start the Services
    ```bash
    docker compose up -d
    ```

6. Wait for Certificate to propagate [~2m] 

7. Login 
    - After starting the services your service should be available via tailnet at https://n8n.{{YOUR_TAILNET_DOMAIN}}.ts.net ie https://n8n.tail12345.ts.net/

## Services

### n8n-ts (Tailscale)

- Runs Tailscale VPN client
- Image: tailscale/tailscale:latest
- Container name: n8n-ts
- Hostname: n8n
- Requires NET_ADMIN and SYS_MODULE capabilities
- Persists state in ./tailscale/tailscale-data
- Uses configuration from ./tailscale/config

### n8n

- Depends on n8n-ts service

## Usage

- After starting the services your service should be available via tailnet at `https://n8n.{{YOUR_TAILNET_DOMAIN}}.ts.net` ie `https://n8n.tail12345.ts.net/`
- To manually get the Tailscale IP/hostname of your container:
    ```bash
    docker logs n8n-ts
    ```
    Look for the Tailscale IP address in the logs.

## Optional Features

- Uncomment and adjust the ports mapping if you need direct access (without Tailscale):
    ```yaml
    ports:
    - 5678:5678
    ```
- Stopping the Services
    ```bash
    docker compose down
    ```

## Troubleshooting
- Check container logs:
    ```bash
    docker logs n8n-ts
    docker logs n8n
    ```
- Ensure your Tailscale auth key is valid and not expired
- Verify the configuration files have proper permissions
- Make sure required directories exist before starting

## Notes
- The n8n service uses the Tailscale service's network stack via `network_mode: service:n8n-ts`
- Direct port mapping is disabled by default as Tailscale handles the networking
- Services restart automatically unless explicitly stopped
- For more information:
    - Tailscale documentation: https://tailscale.com/kb/
    - n8n [documentation](https://docs.n8n.io/?_gl=1*19afx3*_gcl_au*MjAxNDcxMjcxMi4xNzUwNzI3OTUy*_ga*NTQxOTAxNzE1LjE3NTA3Mjc5NTI.*_ga_0SC4FF2FH9*czE3NTA5MDQ5MzAkbzIkZzEkdDE3NTA5MDU0OTIkajMwJGwwJGgw)
    - n8n [repository](https://github.com/n8n-io/n8n)