x-arcane:
  icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/n8n.svg
  urls:
    - https://n8n.io/
    - https://github.com/n8n-io/n8n

# n8n stack definition for get-n8n.sh (https://get.n8n.io).
# Downloaded at install time; the copy in your install directory is yours to
# edit. On --upgrade the script only repoints the sandbox image tags below at
# N8N_SANDBOX_VERSION. To review changes between versions:
# https://github.com/n8n-io/n8n/commits/master/docker/get-n8n-compose.yml
# compose-version: 2

# The sandbox service API, runner and sandbox images ship as one release and
# are only supported together, so a single N8N_SANDBOX_VERSION (from .env)
# pins all three.
volumes:
  n8n-data:
  sandbox-tls:

services:
  sandbox-api-init:
    image: ghcr.io/n8n-io/n8n-sandbox-service-api:${N8N_SANDBOX_VERSION:-1.6.0}
    container_name: n8n-sandbox-api-init
    restart: no
    user: '0:0'
    entrypoint: ['sh', '-c']
    command:
      - >
        bootstrap-mtls.sh --out-dir /tls --api-san sandbox-api
        --control-san-prefix sandbox-runner --world-readable &&
        chown -R sandbox-api:sandbox-api /tls/api && chmod -R a+rX /tls
    environment:
      NUM_RUNNERS: '1'
    volumes:
      - sandbox-tls:/tls

  # Never publish 8080/9090 to the host on an internet-facing server.
  # n8n reaches this container by service name, over the default Compose network.
  sandbox-api:
    image: ghcr.io/n8n-io/n8n-sandbox-service-api:${N8N_SANDBOX_VERSION:-1.6.0}
    container_name: n8n-sandbox-api
    restart: unless-stopped
    depends_on:
      sandbox-api-init:
        condition: service_completed_successfully
    environment:
      SANDBOX_API_KEYS: ${SANDBOX_API_KEYS:?required}
      SANDBOX_API_RUNNER_REGISTRATION_TOKEN: ${SANDBOX_API_RUNNER_REGISTRATION_TOKEN:?required}
      SANDBOX_API_RUNNER_API_KEY: ${SANDBOX_API_RUNNER_API_KEY:?required}

      SANDBOX_API_GRPC_TLS_CERT_FILE: /tls/api/grpc-server.crt
      SANDBOX_API_GRPC_TLS_KEY_FILE: /tls/api/grpc-server.key
      SANDBOX_API_GRPC_TLS_CLIENT_CA_FILE: /tls/api/ca.crt
      SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_CA_FILE: /tls/api/ca.crt
      SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_CERT_FILE: /tls/api/control-grpc-api-client.crt
      SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_KEY_FILE: /tls/api/control-grpc-api-client.key
      SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_SERVER_NAME: sandbox-runner-1
    volumes:
      - sandbox-tls:/tls:ro
    healthcheck:
      test: ['CMD', 'wget', '-qO-', 'http://localhost:8080/healthz']
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s

  # Never expose this container's ports publicly — it runs privileged Docker-in-Docker.
  sandbox-runner-1:
    image: ghcr.io/n8n-io/n8n-sandbox-service-runner-dind:${N8N_SANDBOX_VERSION:-1.6.0}
    container_name: n8n-sandbox-runner-1
    restart: unless-stopped
    privileged: true
    depends_on:
      sandbox-api:
        condition: service_healthy
    environment:
      SANDBOX_RUNNER_API_KEYS: ${SANDBOX_API_RUNNER_API_KEY:?required}
      SANDBOX_RUNNER_REGISTRATION_TOKEN: ${SANDBOX_API_RUNNER_REGISTRATION_TOKEN:?required}
      SANDBOX_RUNNER_API_GRPC_ADDR: sandbox-api:9090
      SANDBOX_RUNNER_HTTP_BASE_URL: https://sandbox-runner-1:8080
      SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR: ':9091'
      SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR: sandbox-runner-1:9091
      SANDBOX_RUNNER_ID: runner-1
      SANDBOX_RUNNER_DOCKER_SANDBOX_IMAGE: ghcr.io/n8n-io/n8n-sandbox-service-sandbox:${N8N_SANDBOX_VERSION:-1.6.0}
      SANDBOX_RUNNER_REGISTRATION_GRPC_CA_FILE: /tls/runner/ca.crt
      SANDBOX_RUNNER_REGISTRATION_GRPC_CERT_FILE: /tls/runner/grpc-client.crt
      SANDBOX_RUNNER_REGISTRATION_GRPC_KEY_FILE: /tls/runner/grpc-client.key
      SANDBOX_RUNNER_REGISTRATION_GRPC_SERVER_NAME: sandbox-api
      SANDBOX_RUNNER_CONTROL_GRPC_TLS_CERT_FILE: /tls/runner/control-grpc-server.crt
      SANDBOX_RUNNER_CONTROL_GRPC_TLS_KEY_FILE: /tls/runner/control-grpc-server.key
      SANDBOX_RUNNER_CONTROL_GRPC_TLS_CLIENT_CA_FILE: /tls/runner/ca.crt
    volumes:
      - sandbox-tls:/tls:ro

  n8n:
    image: docker.io/n8nio/n8n:${N8N_VERSION:-2.43.0}
    container_name: n8n
    restart: unless-stopped
    depends_on:
      sandbox-api:
        condition: service_healthy
    ports:
      - '5678:5678' # the only port that should be internet-facing
    environment:
      N8N_WEBHOOK_URL: ${N8N_WEBHOOK_URL:-http://localhost:5678}
      N8N_SANDBOX_SERVICE_URL: http://sandbox-api:8080
      N8N_SANDBOX_SERVICE_API_KEY: ${SANDBOX_API_KEYS:?required}
      N8N_INSTANCE_AI_SANDBOX_ENABLED: true
      N8N_INSTANCE_AI_SANDBOX_PROVIDER: n8n-sandbox
      N8N_INSTANCE_AI_SANDBOX_API_URL: http://sandbox-api:8080
      N8N_INSTANCE_AI_SEARXNG_URL: http://searxng:8080
    volumes:
      - n8n-data:/home/node/.n8n

  # Runs user code from Code nodes. Never publish this container's ports.
  runners:
    image: ghcr.io/n8n-io/runners:${N8N_VERSION:-2.43.0}
    container_name: n8n-runners
    restart: unless-stopped
    depends_on:
      n8n:
        condition: service_started
    environment:
      N8N_RUNNERS_AUTH_TOKEN: ${N8N_RUNNERS_AUTH_TOKEN:?required}
      N8N_RUNNERS_TASK_BROKER_URI: http://n8n:5679
      # Idle runners exit and are relaunched on demand (per the task-runners docs)
      N8N_RUNNERS_AUTO_SHUTDOWN_TIMEOUT: '15'

  # Internal-only: n8n reaches it by service name. Never publish its port.
  searxng:
    image: ghcr.io/searxng/searxng:latest
    container_name: n8n-searxng
    restart: unless-stopped
    environment:
      SEARXNG_SECRET: ${SEARXNG_SECRET:?required}
    configs:
      - source: searxng-settings
        target: /etc/searxng/settings.yml:ro

configs:
  searxng-settings:
    content: |
      use_default_settings: true
      search:
        formats:
          - html
          - json