full-stack-proxy-nginx-n8n-for-everyone-with-docker-compose
by damalis
Overview
Provides a self-hosted full-stack automation, AI, and database platform using Docker Compose, integrating n8n, Ollama, Open WebUI, PostgreSQL with Pgvector, Mailhog, and secured by Nginx with Certbot.
Installation
git clone https://github.com/damalis/full-stack-proxy-nginx-n8n-for-everyone-with-docker-compose.git && cd full-stack-proxy-nginx-n8n-for-everyone-with-docker-compose && chmod +x install.sh && ./install.shEnvironment Variables
- DOMAIN_NAME
- N8N_SUBDOMAIN
- WEBUI_SUBDOMAIN
- LETSENCRYPT_EMAIL
- DB_USER
- DB_PASSWORD
- DB_NAME
- PGA_CONTROLPASS
- LOCAL_TIMEZONE
- WEBUI_SECRET_KEY
- SSL_SNIPPET
- N8N_IMAGE_VERSION
- LETSENCRYPT_CONF_PREFIX
- N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
- N8N_HOST
- N8N_PORT
- N8N_PROTOCOL
- N8N_RUNNERS_ENABLED
- NODE_ENV
- WEBHOOK_URL
- GENERIC_TIMEZONE
- TZ
- NGINX_HOST
- NGINX_PORT
- MH_HOSTNAME
- MH_AUTH_FILE
- DATABASE_IMAGE_NAME
- DATABASE_VERSION
- POSTGRESQL_CONF_PREFIX
- PGDATA
- LANG
- POSTGRES_INITDB_ARGS
- PG_MAJOR
- OLLAMA_NUM_PARALLEL
- OLLAMA_MAX_LOADED_MODELS
- OLLAMA_BASE_URL
- WEBUI_URL
- DEFAULT_LOCALE
- WEBUI_NAME
- PORT
- PROXY_PREFIX
Security Notes
Critical security risks identified: 1. **Hardcoded Secret:** The `WEBUI_SECRET_KEY` for the Open WebUI service is hardcoded as 't0p-s3cr3t' in `docker-compose.yml`. This makes the WebUI vulnerable to unauthorized access and is a significant security flaw. 2. **Dangerous File Permissions:** The `install.sh` script executes `sudo chmod 666 /var/run/docker.sock`. This command grants full read/write access to the Docker daemon socket for all users on the system, including non-privileged ones. This allows any user to execute arbitrary commands as root via Docker, leading to severe privilege escalation and system compromise. 3. **Credential Reuse for MailHog:** The `mail` service reuses `DB_USER` and `DB_PASSWORD` for MailHog's authentication file. While MailHog is typically for development, this practice of reusing database credentials for a separate service can increase the attack surface if MailHog is exposed or compromised.
Similar Servers
mcp_massive
An AI agent orchestration server, likely interacting with LLMs and managing multi-agent workflows.
pg-aiguide
Provides AI-optimized PostgreSQL expertise, including semantic search across documentation and curated best-practice skills, for integration with AI coding assistants.
2ly
Skilder is an AI tool orchestration platform that provides an infrastructure layer for managing, monitoring, and connecting AI agent tools in a distributed microservices environment.
project-nova
This server containerizes the Paperless-NGX Model Context Protocol (MCP) server, enabling AI agents (like n8n) to manage, search, and organize digital documents within Paperless-NGX via Server-Sent Events (SSE).