---
name: saiop-automation-stack
description: "Deploying n8n, Flowise, and NATS on the SAIOP stack — pre-provisioned secrets, UID quirks, and why some service images are far larger than they first appear."
version: 1.0.0
author: Claude Code (SAIOP ops session)
license: MIT
platforms: [linux]
prerequisites:
  env_vars: [N8N_DB_PASSWORD, N8N_BASIC_AUTH_USER, N8N_BASIC_AUTH_PASSWORD, N8N_ENCRYPTION_KEY, FLOWISE_USERNAME, FLOWISE_PASSWORD]
  commands: [docker]
metadata:
  hermes:
    tags: [SAIOP, n8n, Flowise, NATS, automation, deployment]
---

# n8n, Flowise, NATS on SAIOP

## When to use

Deploying or troubleshooting the automation layer (Deployment Guide §4.4).

## Key facts

- **n8n** already has a pre-provisioned Postgres DB/role (`n8n`) and secrets
  (`N8N_DB_PASSWORD`, `N8N_BASIC_AUTH_USER/PASSWORD`, `N8N_ENCRYPTION_KEY`) in
  `.env.master` from earlier setup — check before generating new ones.
- **n8n's official image runs as uid 1000** (`node` user inside the
  container) — the host data directory needs `chown 1000:1000`, not
  whatever the host's own primary admin user is.
- **Flowise runs as root** inside its container — no UID matching needed for
  its volume.
- **`flowiseai/flowise` Docker tags are not layer-compatible across
  versions** — pinning a specific version tag (e.g. `3.1.2`) instead of
  `latest` can mean a ~500MB fresh pull even if `latest` was already cached
  locally. Don't assume a "hung" `docker compose up` is actually stuck;
  check `docker ps -a` and the pull progress before killing it.
- **NATS** needs no public Traefik route — it's a backend event bus
  (`nats://` protocol, not HTTP). Run with `-js` for JetStream persistence
  and mount a data volume so streams survive restarts.
- None of these had a real `automation-compose.yml` in the reference bundle
  despite the Deployment Guide referencing one — built from scratch
  following house compose conventions (pinned versions, resource limits,
  `proxy` network + relevant internal network only).