p24-infra Docs

n8n-claude-proxy-removal

2 min read

Playbook: n8n Claude-proxy Removal & SSH Worker Migration

What triggers this

An n8n workflow fails with “connection refused” or similar error when calling http://host.docker.internal:9999/v1/messages — the former claude-proxy endpoint.

The claude-proxy.service on bms-4 was stopped and disabled 2026-06-24. It is permanently removed from the infrastructure design.

Confirm it

# On bms-4
systemctl is-active claude-proxy.service   # → inactive
ss -tlnp | grep 9999                       # → nothing

In n8n, check the failed execution log — it will show a network error on an HTTP Request node hitting host.docker.internal:9999.

Affected workflows (found 2026-06-24)

WorkflowIssueStatus
wa-ai-to-inbox#1214Broken — Call Claude VPS node
Tronik GPS - Kierowcy (#720)#1215Broken — call_claude node
Tronik GPS - Serwisant mobilny (#720)#1216Broken — call_claude node
github-auto-trigger#1217Broken — Trigger VPS claude-proxy node
Brand - Content Review—Inactive; calls api.anthropic.com direct — separate issue

Fix: migrate a workflow to SSH worker pattern

The correct pattern for n8n → Claude calls is an SSH Execute node:

  1. Credential: use vps-i1-root-ssh (or bms-4-root-ssh) — already in n8n vault
  2. Node type: n8n-nodes-base.executeCommand (SSH)
  3. Command: 
    su -s /bin/bash claude-runner -c 'claude -p "<prompt>"'
    For multi-line prompts, write to a temp file and pipe: 
    echo '<prompt>' | su -s /bin/bash claude-runner -c 'claude -p -'
  4. Parse response: SSH Execute returns stdout as result field. Claude’s response is the stdout of claude -p.

Reference implementation: BrandPilot AI workflow (SvcDlrMxBMN9aTUJ) — fully working SSH worker pattern.

What was the old pattern

HTTP Request node
  URL:  http://host.docker.internal:9999/v1/messages
  Auth: X-Proxy-Secret: {{ $env.CLAUDE_PROXY_SECRET }}
  Body: { model, max_tokens, messages: [{ role: "user", content: "<prompt>" }] }

The proxy ran claude -p CLI on bms-4 and returned the text response.

After migrating all workflows

  1. Remove CLAUDE_PROXY_SECRET from secrets/n8n-bms4.env.sops (it’s dead config).
  2. Remove CLAUDE_PROXY_SECRET from bms-4/docker-compose.yml env sections.
  3. Remove GITHUB_TRIGGER_SECRET from SOPS if github-auto-trigger migration confirms it’s no longer needed.

Escalation

If a workflow cannot be migrated to SSH Execute (e.g., the worker is down, credentials expired), check claude-runner auth on vps-i1:

ssh root@217.154.82.162 "su -s /bin/bash claude-runner -c 'claude -p say-ok'"

If auth is expired, follow docs/playbooks/claude-runner-reauth.md.

Prevention

Never add new n8n workflows that call host.docker.internal:9999 — the service is permanently removed. All Claude calls from n8n must use the SSH Execute pattern. The Do NOT section in CLAUDE.md documents this rule.

Graph View

Backlinks