Lucas Berger
b02819434f
- Image pull had --max-time 600 --max-time 5 (second wins = 5s timeout) - Removed duplicate, keeping 600s for large image pulls - Added WEB-01 requirement for webhook fix in Phase 10 - Created 07-02-SUMMARY.md and 07-VERIFICATION.md Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
97 lines
3.3 KiB
Markdown
97 lines
3.3 KiB
Markdown
---
|
|
phase: 07-socket-security
|
|
plan: 02
|
|
subsystem: workflow
|
|
tags: [n8n, docker-socket-proxy, security, migration]
|
|
|
|
# Dependency graph
|
|
requires:
|
|
- phase: 07-01
|
|
provides: docker-socket-proxy container on dockernet
|
|
provides:
|
|
- n8n workflow migrated to use proxy instead of direct socket
|
|
- n8n container no longer has docker.sock volume mount
|
|
affects: [telegram-bot-commands, docker-api-security]
|
|
|
|
# Tech tracking
|
|
tech-stack:
|
|
patterns: [tcp-proxy-api-calls, filtered-docker-access]
|
|
|
|
key-files:
|
|
modified: [n8n-workflow.json]
|
|
|
|
key-decisions:
|
|
- "All curl commands migrated from unix socket to TCP proxy"
|
|
- "5-second timeout added to all API calls (except 600s for image pull)"
|
|
- "Credential name corrected to 'Telegram account' with actual n8n ID"
|
|
- "docker.sock volume mount removed from n8n container"
|
|
|
|
patterns-established:
|
|
- "Docker API calls via http://docker-socket-proxy:2375"
|
|
- "Proxy-first architecture for container management"
|
|
|
|
# Metrics
|
|
duration: 25min
|
|
completed: 2026-02-03
|
|
---
|
|
|
|
# Phase 7 Plan 2: Migrate Workflow to Proxy Summary
|
|
|
|
**All n8n workflow curl commands migrated from direct Docker socket to TCP proxy, docker.sock mount removed**
|
|
|
|
## Performance
|
|
|
|
- **Duration:** 25 min
|
|
- **Started:** 2026-02-03T14:10:00Z
|
|
- **Completed:** 2026-02-03T14:35:00Z
|
|
- **Tasks:** 4 (2 auto, 2 checkpoints)
|
|
- **Files modified:** 1 (n8n-workflow.json)
|
|
|
|
## Accomplishments
|
|
|
|
- 16 curl commands migrated from `--unix-socket /var/run/docker.sock` to `http://docker-socket-proxy:2375`
|
|
- 5-second timeout added to all Docker API calls (except image pull which keeps 600s)
|
|
- Workflow pushed to n8n via API
|
|
- All 6 bot commands verified working through proxy (status, start, stop, restart, update, logs)
|
|
- docker.sock volume mount removed from n8n container
|
|
- Credential references fixed (name: "Telegram account", id: "I0xTTiASl7C1NZhJ")
|
|
|
|
## Task Commits
|
|
|
|
| # | Task | Commit | Files |
|
|
|---|------|--------|-------|
|
|
| 1 | Update Workflow Curl Commands | 12bdd98 | n8n-workflow.json |
|
|
| 2 | Push Updated Workflow to n8n | 7896856 | (API operation) |
|
|
| 3 | Verify All Bot Commands Work | - | (user verification) |
|
|
| 4 | Remove docker.sock Volume Mount | - | (user action in Unraid) |
|
|
| fix | Correct credential name/ID | 5471fee | n8n-workflow.json |
|
|
|
|
## Files Created/Modified
|
|
|
|
- **n8n-workflow.json**: All Docker socket references replaced with proxy endpoint
|
|
|
|
## Decisions Made
|
|
|
|
**Timeout strategy:** 5-second timeout for all API calls except image pull (600s for large images).
|
|
|
|
**Credential correction:** Fixed credential name from "Telegram API" to "Telegram account" and updated ID to actual n8n credential ID.
|
|
|
|
## Deviations from Plan
|
|
|
|
**Credential mismatch discovered:** Workflow had placeholder credential name/ID that didn't match n8n instance. Fixed by updating to actual credential name and ID.
|
|
|
|
## Issues Encountered
|
|
|
|
**Telegram webhook not triggering:** After API workflow update, Telegram webhook doesn't fire when workflow is published. Bot only responds via manual execute. Deferred to Phase 10 as WEB-01 requirement.
|
|
|
|
## Next Phase Readiness
|
|
|
|
**Ready for Phase 8 (Inline Keyboard Infrastructure):**
|
|
- All Docker API calls routed through filtered proxy
|
|
- n8n no longer has direct socket access
|
|
- Security foundation in place for new feature development
|
|
|
|
---
|
|
*Phase: 07-socket-security*
|
|
*Completed: 2026-02-03*
|