ELADIO SARENO JR sarenodev

n8n Production Setup — Queue Mode with PostgreSQL & Redis (Docker Compose)

A production-ready n8n stack running in queue mode with PostgreSQL for persistence and Redis as the job queue. Executions are offloaded from the main server to dedicated worker containers.

Architecture

           ┌─────────────┐
  Browser  │  n8n_server │  (UI + webhook receiver)
 ──────► │ :5678 │

Docker Compose

File: docker-compose.yaml

volumes:
  etc_wireguard:

services:
  wg-easy:
    environment:
    #  Optional:

UFW but AWS Security Group-like

ufw-rules.sh:

#!/usr/bin/env bash
# ufw-rules.sh — Minimal AWS-SG style UFW (IPv4)
# Usage: sudo ./ufw-rules.sh
set -euo pipefail

# --- safety -------------------------------------------------------------------

Create backup on the source database

Note:

Owner and privileges are excluded.

pg_dump -U src_db_user -h src-db.example.com -d src_db_name --no-owner --no-privileges -F c -f mybackup-yyyMMddHHmmss.dump

Restore backup to the destination database

Create backup first before restoring

Bucket Policy

There are cases where we need to restrict IPs from accessing S3 bucket. But we also know that it's not possible to use Security Groups in S3 buckets. Luckily, there's a Bucket Policy where we can add IP restrictions that will act as a Firewall.

Example

{
    "Version": "2012-10-17",
 "Statement": [

$ sudo -i
$ dnf update
$ dnf install tmux -y

# Fix known issue with CentOS/Redhat. Ref: https://stackoverflow.com/a/68841102/8724367
$ setsebool -P httpd_can_network_connect 1

# Add 4GB Swap. Ref https://www.digitalocean.com/community/tutorials/how-to-add-swap-on-centos-7#create-a-swap-file
$ dd if=/dev/zero of=/swapfile count=4096 bs=1MiB

$ sudo -i
$ whoami
root
$ cat /etc/os-release 
PRETTY_NAME="Ubuntu 22.04.3 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.3 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy

OpenSSL 🔐

Install

Install the OpenSSL on Debian based systems

sudo apt-get install openssl

OS tools and user friendly cryptography GUI tools

Windows Certificate Manager Tool (certmgr.msc) Manage storage for x509 keys. No support for PGP/GPG. Can't sign or encode, can't generate a key. You can use IIS webserver managemnt console to generate a cert.Proprietary

GNOME Seahorse GUI for SSH keys, X509 certs, PGP/GPG. Linux only.

	FROM debian

	RUN apt-get update && \
	apt-get install -y \
	locales && \
	rm -r /var/lib/apt/lists/*

	RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \
	sed -i -e 's/# de_DE.UTF-8 UTF-8/de_DE.UTF-8 UTF-8/' /etc/locale.gen && \
	dpkg-reconfigure --frontend=noninteractive locales