freedzhost.cloud

Homelab 14: automate without a Zapier subscription, with n8n and a decision cascade

Level IntermediateEstimated time 1 hRead first Homelab 2: one HTTPS entrance for all your servicesA word you don't know? Glossary

n8n connects your services with visual workflows: a webhook arrives, a schedule fires, a few nodes later a task is filed, a model is loaded, a notification rings. It replaces Zapier or IFTTT at home. One honest note: n8n is "fair-code", its source is available and free for your own use, but it is not open source in the strict sense. We use it because nothing open matches it yet.

An eventwebhook, scheduleRulesdeterministicLocal judgesmall model, CPUActHosted modelpublic data onlyAsk youtask + notificationsettled by the rulesunsure · publicunsure · private
Each decision goes down the cheapest path that can settle it. Fixed rules first; if they cannot, a small local model; a hosted model only for public data; private and ambiguous goes to you, and nothing leaves home.

A bit of history

n8n ("nodemation") was started in 2019 in Berlin by Jan Oberhauser, as a self-hostable alternative to automation services such as Zapier and Make. Its licence is "fair-code": the source is open and you may host it for yourself or your company for free, but not resell it as a service. Workflows are drawn as nodes, and any node can be replaced by code when drawing is not enough.

1. Give it its own small VM

n8n runs arbitrary JavaScript and holds the credentials of every service it talks to. Do not put it next to your personal data (photos, papers): a small VM of its own (Homelab 1), with n8n and its PostgreSQL database, version pinned. Ours uses a few hundred MB of RAM.

N8N_ENCRYPTION_KEY=<a long random value>
N8N_DIAGNOSTICS_ENABLED=false
EXECUTIONS_DATA_PRUNE=true
EXECUTIONS_DATA_MAX_AGE=336        # hours: keep two weeks of runs
WEBHOOK_URL=https://n8n.yourdomain.tld/

N8N_ENCRYPTION_KEY encrypts every stored credential. Lose it and they are all unrecoverable. Keep a copy in your password manager (Homelab 3) the day you create it.

2. The decision cascade

The expensive mistake with automation is calling a large model for every small decision. Ours goes down a cascade, and stops at the first step that can settle it:

  1. Rules: fixed, deterministic conditions. Many decisions end here, in milliseconds.
  2. A small local judge: a model under 1B parameters on the processor, asked a typed question (yes/no, a choice, a score), not a free text.
  3. A hosted model, only if the data is public.
  4. You, for anything private and still ambiguous: a task in your list (Homelab 13) and a notification (Homelab 10). Nothing leaves home.

Every decision writes an event (who asked, which step decided), never the content itself: you can audit the cascade without storing private text.

3. Let it repair, within limits

A workflow can fix things by itself, for example reload a model that crashed. Give it limits that come from the action, not from its confidence: a short list of allowed actions, at most three repairs per hour for the same thing, nothing while a game holds the card, and a check after each repair.

Traps

Workflows cannot read environment variables by default (N8N_BLOCK_ENV_ACCESS_IN_NODE). Keep it that way: unblocking it would hand every node the database password and the encryption key. Put secrets in n8n credentials.

Sign the webhooks that trigger actions (an HMAC header checked in the workflow): a webhook URL alone is a door anyone who finds it can push.

Restarting n8n can make watchdog workflows raise false alarms (a job seen "silent" during the restart). Warn whoever reads the alerts before you restart.

Sources

Found this useful? Tell us what to measure next.