Remko Stas

Designing and Operating a Production-Grade Personal Automation Platform on n8n
Company: Personal project
Duration: August 2025 to now
Tools & Technologies: n8n, Docker, PostgreSQL/pgvector, TypeScript/Node.js, Playwright, FFmpeg, Cloudflare Tunnel, Tailscale, LLM orchestration (OpenAI, OpenRouter, Groq, Ollama), Discord API, SSH automation
Related: LinkedIn content system · n8n-wms feasibility study

Project Overview

Context
This is a self-directed homelab initiative. I designed, built and now operate a private automation platform on a single mini PC. It is an always-on system: scheduled pipelines, webhooks and Discord commands run unattended every day. It spans content creation, job search, security monitoring and personal data processing.

Key Result
I designed and operate a platform of more than 200 n8n workflows across 13 Docker Compose stacks. It integrates four LLM providers, cloud and local, and several custom-built microservices inside a strict security architecture. The entire system is reachable from the public internet through exactly one audited entry point. Every other service sits on a private Tailscale network.

Tools
n8n, Docker, PostgreSQL, TypeScript, LLM orchestration, system architecture, security design

The Problem

Repetitive, structured knowledge work shows up constantly outside a job. Job applications need it. Content production needs it. Price and security monitoring need it. Each task needs different logic, different data sources and different tools. Off-the-shelf automation platforms handle single tasks well, but they do not hold up as a system. They skip security boundaries. They skip error recovery. They skip auditability. They give no consistent way to reason about failure across dozens of interconnected processes running unattended.

Building something that actually behaved like production infrastructure meant solving problems most personal projects never face. I had to design network trust boundaries. I had to isolate credentials. I had to weigh LLM cost against data privacy on every workflow. I had to make the system recover gracefully. A step forty minutes into an unattended pipeline can fail at two in the morning.

The Solution

I built n8n into the orchestration layer of a broader platform. Docker hosts the surrounding services and custom code fills the gaps where n8n's native nodes stop being enough.

The platform sits behind Tailscale. n8n is the only service exposed publicly, and it reaches the internet through a single Cloudflare Tunnel. That design shrinks the attack surface to one audited entry point instead of a dozen scattered ones.

Workflows route deliberately between cloud models through OpenAI, OpenRouter and Groq, and local models through Ollama. The choice depends on cost and on how sensitive the data is, not on habit.

Where n8n's nodes hit a ceiling, I wrote custom microservices instead of forcing a workaround. A purpose-built API renders HTML into video with Playwright and FFmpeg. A separate OCR pipeline runs a spatial-clustering algorithm I wrote by hand. Both are called from n8n over HTTP.

Operational discipline runs through the whole platform. A shared error-handling workflow is wired into the main production flows. Validation gates run before I publish any change. A nightly job exports the full workflow state to git. Every change is auditable, and every state is recoverable.

Process Overview

Multi-agent content system
One agent writes LinkedIn posts. It drafts from a live voice reference. It checks each draft against my last ten posts to avoid repeating an opener. A second agent fact-checks the draft. It triages every claim locally first. Only the claims that genuinely need checking escalate to a cloud model with web search. That two-tier design keeps the expensive pass small instead of running it on everything. More in the LinkedIn content system case study.

AI-assisted job application system
This system redacts personal data before it sends anything to an LLM. It restricts AI-sourced employer research to sources that match the verified company domain. It enforces a strict output schema with an automatic repair step when the output drifts. A real production bug once truncated generated CVs because of a token-limit setting. I found the root cause, fixed it and documented the postmortem directly inside the workflow.

Deterministic security monitoring
A daily digest runs with zero LLM calls. It checks fail2ban and patch status over SSH, runs system-hardening scans and deduplicates findings against Postgres by fingerprint. Each finding gets auto-classified by severity, and only genuinely new high or critical findings route to a dedicated alert channel. I narrowed its scope after a real false positive over-triggered it.

Second Brain document pipeline
A self-hosted inbox for documents and images: every file is virus-scanned, classified and filed by an LLM, then chunked and embedded into PostgreSQL with pgvector for search, all driven by durable job queues in n8n. It holds more than 3,500 documents and 37,000 searchable passages.

Impact

The platform holds more than 200 workflows organized into roughly fifteen projects, not a pile of disconnected automations. Every service except n8n stays on Tailscale. The one public entry point, through Cloudflare Tunnel, is also the only attack surface. LLM provider choice tracks data sensitivity and cost on every workflow, including full local processing wherever privacy matters. Two real incidents are documented as postmortems: a production bug and a false-positive alert. That shows a system that gets actively run, not one that got built once and left alone. A nightly git-backed export of workflow state gives the whole platform a full history and a rollback path.

Why this Project Matters

This project draws on the same skill as the AB InBev and Red Bull work. It turns a messy, manual process into something structured, standardized and built to scale. Here, that skill runs at the level of a full platform instead of a single tool.

I designed security and trust boundaries for a system that handles real personal data, not just a task to automate. I made deliberate build-versus-buy calls, and wrote custom microservices exactly where an off-the-shelf platform stopped being enough. I applied engineering discipline to infrastructure nobody required me to hold to that standard: validation gates, error handling, postmortems and auditability. I have operated this system over time, including finding and fixing real incidents, not just delivering a one-time build.

It comes down to the same instinct that drove the AB InBev and Red Bull work. This time, that instinct points at infrastructure instead of a spreadsheet.

Page updated

Google Sites

Report abuse