In progress
Lab Automation with n8n
Connecting Proxmox, Graylog, LibreNMS, Supabase, and the NAS to a self-hosted workflow engine, with least-privilege access.
- Stack
- n8nDockerSupabasePostgreSQLREST APIsSFTP
Part of FSJ-LAB.
Goal
Stop checking five dashboards by hand. I want n8n to pull status from every system in the lab, produce health reports and alerts, and eventually feed the AI lab assistant, all without handing it admin rights anywhere.
What I built
n8n runs in Docker on its own VM, with Supabase on another. Each integration uses a dedicated service account with only the access it needs:
| System | Access |
|---|---|
| Proxmox | Dedicated API user with the read-only Auditor role and a token |
| Graylog | Service account token, shared as viewer on only the streams it needs |
| LibreNMS | API token |
| Supabase | A restricted database role for writes; the privileged key stays server-side |
| Synology NAS | SFTP account, no admin group membership |
Problems I hit
- Graylog’s token auth is backwards. The token goes in the username field and the literal word “token” goes in the password.
- Writes need a header. Graylog rejects POST requests without an
X-Requested-Byheader. - Auth isn’t permission. A 403 after successful login meant the service account couldn’t see the stream. Stream access is granted separately from roles.
What I learned
- Least privilege takes more setup up front, but it means a leaked n8n credential can read the lab, not break it.
- Many “API errors” are really authorization errors. Read the status code carefully.
Next steps
- A daily lab health report
- Failed Proxmox task alerts
- Hourly metrics history in Supabase for a future dashboard
- Read-only API access to the UniFi controller and FortiGate