Initial deploy: n8n with auth proxy and PostgreSQL

.gitignore

@@ -0,0 +1 @@
+PROJECT.md

Dockerfile

@@ -0,0 +1,40 @@
+FROM n8nio/n8n:latest
+
+USER root
+
+# Install proxy deps from lockfile — exact versions + integrity hashes verified
+COPY package.json package-lock.json /proxy/
+RUN cd /proxy && npm ci --ignore-scripts
+
+# nginx (proxy) on 5678 (exposed), n8n internally on 5679
+# n8n on 5200, Task Broker keeps its default 5679, proxy listens on 5678
+ENV N8N_PORT=5200
+ENV N8N_USER_FOLDER=/data
+ENV N8N_PROTOCOL=https
+ENV N8N_HOST=0.0.0.0
+ENV WEBHOOK_URL=https://vor-tests-philosophical-breadstick.hf.space/
+ENV GENERIC_TIMEZONE=UTC
+
+# Security hardening
+ENV N8N_BLOCK_ENV_ACCESS_IN_NODE=true
+ENV N8N_SECURE_COOKIE=true
+ENV N8N_METRICS=false
+ENV N8N_HIDE_USAGE_PAGE=true
+ENV N8N_DIAGNOSTICS_ENABLED=false
+ENV N8N_VERSION_NOTIFICATIONS_ENABLED=false
+
+# PostgreSQL — credentials injected at runtime via HF Space secrets
+ENV DB_TYPE=postgresdb
+ENV DB_POSTGRESDB_SSL_REJECT_UNAUTHORIZED=false
+
+COPY proxy.js /proxy.js
+COPY start.sh /start.sh
+RUN chmod +x /start.sh
+
+# Drop root — run as the node user the n8n image ships with
+USER node
+
+EXPOSE 5678
+
+ENTRYPOINT []
+CMD ["/bin/sh", "/start.sh"]

README.md

@@ -1,10 +1,11 @@
 ---
-title: Philosophical Breadstick
-emoji: 🏢
-colorFrom: purple
-colorTo: indigo
+title: PhilosophicalBreadstick
+emoji: 🥖
+colorFrom: blue
+colorTo: purple
 sdk: docker
 pinned: false
+app_port: 5678
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# Philosophical Breadstick

package-lock.json

@@ -0,0 +1,40 @@
+{
+  "name": "n8n-proxy",
+  "version": "1.0.0",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "n8n-proxy",
+      "version": "1.0.0",
+      "dependencies": {
+        "http-proxy": "1.18.1"
+      }
+    },
+    "node_modules/eventemitter3": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz",
+      "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw=="
+    },
+    "node_modules/follow-redirects": {
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
+      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw=="
+    },
+    "node_modules/http-proxy": {
+      "version": "1.18.1",
+      "resolved": "https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.1.tgz",
+      "integrity": "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==",
+      "dependencies": {
+        "eventemitter3": "^4.0.0",
+        "follow-redirects": "^1.0.0",
+        "requires-port": "^1.0.0"
+      }
+    },
+    "node_modules/requires-port": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
+      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ=="
+    }
+  }
+}

package.json

@@ -0,0 +1,8 @@
+{
+  "name": "n8n-proxy",
+  "version": "1.0.0",
+  "private": true,
+  "dependencies": {
+    "http-proxy": "1.18.1"
+  }
+}

proxy.js

@@ -0,0 +1,120 @@
+'use strict';
+const httpProxy = require('/proxy/node_modules/http-proxy');
+const http = require('http');
+
+const N8N_PORT = parseInt(process.env.N8N_PORT || '5200');
+const PROXY_PORT = 5678;
+const USER = process.env.NGINX_USER;
+const PASS = process.env.NGINX_PASSWORD;
+const WEBHOOK_RE = /^\/webhook(-test)?\//;
+
+// Rate limiter: max 10 failed attempts per IP within 15 minutes → block for 15 minutes
+const MAX_FAILURES = 10;
+const WINDOW_MS = 15 * 60 * 1000;
+const BLOCK_MS = 15 * 60 * 1000;
+const failures = new Map(); // ip → { count, windowStart, blockedUntil }
+
+function getClientIp(req) {
+  const forwarded = req.headers['x-forwarded-for'];
+  return (forwarded ? forwarded.split(',')[0] : req.socket.remoteAddress).trim();
+}
+
+function isBlocked(ip) {
+  const entry = failures.get(ip);
+  if (!entry) return false;
+  if (entry.blockedUntil && Date.now() < entry.blockedUntil) return true;
+  // Block expired — reset
+  if (entry.blockedUntil) failures.delete(ip);
+  return false;
+}
+
+function recordFailure(ip) {
+  const now = Date.now();
+  const entry = failures.get(ip) || { count: 0, windowStart: now, blockedUntil: null };
+  // Reset window if it has expired
+  if (now - entry.windowStart > WINDOW_MS) {
+    entry.count = 0;
+    entry.windowStart = now;
+  }
+  entry.count += 1;
+  if (entry.count >= MAX_FAILURES) {
+    entry.blockedUntil = now + BLOCK_MS;
+    console.warn(`[rate-limit] Blocked ${ip} after ${entry.count} failed attempts`);
+  }
+  failures.set(ip, entry);
+}
+
+function clearFailures(ip) {
+  failures.delete(ip);
+}
+
+// Purge stale entries every 30 minutes to prevent memory growth
+setInterval(() => {
+  const now = Date.now();
+  for (const [ip, entry] of failures) {
+    const expired = entry.blockedUntil
+      ? now > entry.blockedUntil
+      : now - entry.windowStart > WINDOW_MS;
+    if (expired) failures.delete(ip);
+  }
+}, 30 * 60 * 1000);
+
+const proxy = httpProxy.createProxyServer({
+  target: `http://127.0.0.1:${N8N_PORT}`,
+  ws: true,
+});
+
+proxy.on('error', (err, req, res) => {
+  if (res && res.writeHead) {
+    res.writeHead(502);
+    res.end('n8n starting up, please refresh in a moment');
+  }
+});
+
+function isAuthorized(req) {
+  if (WEBHOOK_RE.test(req.url)) return true;
+  const auth = req.headers['authorization'];
+  if (!auth || !auth.startsWith('Basic ')) return false;
+  const decoded = Buffer.from(auth.slice(6), 'base64').toString();
+  const colon = decoded.indexOf(':');
+  const user = decoded.slice(0, colon);
+  const pass = decoded.slice(colon + 1);
+  return user === USER && pass === PASS;
+}
+
+const server = http.createServer((req, res) => {
+  // Webhooks always pass through
+  if (WEBHOOK_RE.test(req.url)) return proxy.web(req, res);
+
+  const ip = getClientIp(req);
+
+  if (isBlocked(ip)) {
+    res.writeHead(429, { 'Content-Type': 'text/plain', 'Retry-After': '900' });
+    res.end('Too many failed attempts. Try again in 15 minutes.');
+    return;
+  }
+
+  if (isAuthorized(req)) {
+    clearFailures(ip);
+    proxy.web(req, res);
+  } else {
+    recordFailure(ip);
+    res.writeHead(401, {
+      'WWW-Authenticate': 'Basic realm="n8n"',
+      'Content-Type': 'text/plain',
+    });
+    res.end('Unauthorized');
+  }
+});
+
+server.on('upgrade', (req, socket, head) => {
+  if (WEBHOOK_RE.test(req.url) || isAuthorized(req)) {
+    proxy.ws(req, socket, head);
+  } else {
+    socket.destroy();
+  }
+});
+
+server.listen(PROXY_PORT, () => {
+  console.log(`Auth proxy ready on :${PROXY_PORT} → n8n on :${N8N_PORT}`);
+});

start.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -e
+
+# Fix config file permissions (mirrors what the n8n entrypoint does)
+if [ -f "${N8N_USER_FOLDER}/.n8n/config" ]; then
+  chmod 600 "${N8N_USER_FOLDER}/.n8n/config"
+fi
+
+# Start the auth proxy in the background
+/usr/local/bin/node /proxy.js &
+
+# Start n8n in the foreground
+exec /usr/local/bin/n8n