p24-infra Docs

2641-n8n-cross-instance-audit

3 min read

Design — n8n Cross-Instance Audit + Retry Hardening + Playbook Restructure

Issue: #2641 · Status: Design (plan/scoping only) · Batch: K (#3338)

Scopes the audit and hardening work across the two n8n instances. The live workflow modifications (Tasks 2–4) require API access and are implementation work tracked separately — this doc defines the method, the inventory template, and the playbook consolidation plan only.

1. Instances

InstanceURLPurposeAPI key (SOPS)
n8n Cloudp24.app.n8n.cloudBusiness workflows (fibu, HR, synchronize-kasa, ai-documents, save-to-gitlab)N8N_CLOUD_API_KEY in secrets/n8n-bms4.env.sops
bms-4n8n.bms-4.infra.zintegrowana.onlineInfra + fleet (ATRAX, wa-router, mezmo-alert-router, brand-heygen)BMS4_N8N_API_KEY in secrets/n8n-bms4.env.sops

BMS4_N8N_API_KEY may be stale (401). If so → regenerate in bms-4 n8n UI → Settings → API, update SOPS via a secret-manager session (never in a dev-issue worker), document the rotation in docs/secrets-rotation-log.md.

2. Task 1 — Cross-instance inventory (docs/n8n-workflow-inventory.md)

Fetch all workflows from both instances (REST GET /api/v1/workflows; bms-4 falls back to SSH if the key is stale). Build:

Workflow nameCloud IDCloud activeCloud updatedAtbms-4 IDbms-4 activebms-4 updatedAtNewerNotes

Flag: exists on one instance only · active on one but inactive on the other · same name, different updatedAt (stale copy).

3. Tasks 2–4 — HTTP node hardening (implementation, method defined here)

Audit every n8n-nodes-base.httpRequest node in each active workflow and report on the issue:

  • Retry gaps — nodes missing retryOnFail: true.
  • Too-short backoff — waitBetweenTries < 30000 ms (insufficient for 502 recovery).
  • Stale node version — typeVersion < 4.2.
  • Pinbox24 auth consistency — nodes calling api.w4.pinbox24.com must use authorization: ={{ $('setToken').item.json.token }}. Flag hardcoded tokens, a different reference node name, or a Respond to Webhook node inside the processing chain (hangs execution).

Apply, per docs/playbooks/n8n-workflow-modification.md:

TargetSettings
api.w4.pinbox24.com / downloadPdfretryOnFail=true, maxTries=3, waitBetweenTries=60000
*.radieu.workers.dev auth nodesretryOnFail=true, maxTries=2, waitBetweenTries=15000

Skip vuZ1bgFHeiLr6JXp (synchronize-kasa) — all 21 HTTP nodes already hardened 2026-07-02.

4. Task 5 — Playbook restructure

Current state: 20+ scattered n8n playbooks + 9 docs/n8n-*.md files with overlap. Consolidation target:

docs/11-automations/n8n/
  README.md                  — index + which-doc-for-what
  operations.md              — merge n8n-operations, n8n-cloud-operations
  workflow-modification.md   — canonical (from docs/playbooks/)
  credentials.md             — merge n8n-secrets-audit, n8n-credential-portability
  inventory.md               — Task 1 output, regenerated on audit

Redirect stubs left at old paths for one release, then removed.

5. Sequencing & ownership

  1. Inventory (Task 1) — read-only, safe, do first.
  2. Node audit (report only) — read-only.
  3. Key-staleness check → if 401, secret-manager rotates before any writes.
  4. Apply retries (Tasks 2–4) — write, one workflow per commit-equivalent, verify each.
  5. Playbook restructure (Task 5) — docs-only, last.

6. Out of scope for this doc

No live workflow is modified and no key is rotated by this issue. This is the audit method + inventory template + restructure plan.

Design-only deliverable. Related: docs/playbooks/n8n-workflow-modification.md, docs/n8n-operations.md.

Graph View