feat(infra): deploy n8n as workflow automation platform

Summary

Self-host n8n at workflows.us-rse.org to replace Slack Workflow Builder. n8n is an open-source visual workflow automation tool that can trigger actions across Zulip, GitHub, Google Workspace, email, and any service with an API.

Infrastructure

Architecture: n8n container + Cloudflare Access (zero-trust gateway)

Component	Spec	Provider	Cost
n8n container	1 CPU / 1-2 GB RAM	Railway, Fly.io, or shared VPS	~$5-10/mo
Postgres database	Small instance for workflow data	Neon (free tier sufficient)	$0
Cloudflare proxy	DNS, CDN, SSL, bot protection	Cloudflare (free plan)	$0
Cloudflare Access	Zero-trust auth gate for admin UI	Cloudflare (free up to 50 users)	$0

Estimated total: ~$5-10/month

n8n is lightweight — 1 CPU and 1-2 GB RAM handles hundreds of workflows easily. The main resource need is the Postgres database for workflow definitions and execution history.

Cloudflare Architecture

workflows.us-rse.org → Cloudflare (proxy + CDN + bot protection)
                     → Cloudflare Access (OIDC via WorkOS, gate admin UI)
                     → Origin server (n8n container)

Cloudflare Access authenticates users BEFORE traffic reaches n8n. Unauthorized requests never touch the origin. Only board members and WG chairs (authenticated via WorkOS OIDC through Cloudflare Access) can access the workflow builder.

Benefits:

• DDoS/bot protection for free
• Zero-trust access control — no exposed admin panel
• CDN caching for n8n dashboard static assets
• SSL termination at Cloudflare edge
• No cert management on the origin server

Requirements

Deployment

• Deploy n8n container (Docker-based) on Railway, Fly.io, or shared VPS
• Configure workflows.us-rse.org subdomain via Cloudflare DNS
• Set up Cloudflare Access policy (restrict to WorkOS-authenticated users with admin/chair role)
• Connect n8n to Postgres (Neon free tier)
• Configure persistent storage for credentials (encrypted at rest)
• Automated backups of workflow definitions

Authentication

• Cloudflare Access as the primary gate (OIDC via WorkOS)
• Restrict workflow creation to board members and WG chairs
• n8n internal auth as secondary layer (basic auth or LDAP)

Slack Workflow Migration

• Audit existing Slack workflows (board + working groups)
• Document each workflow's trigger, steps, and output
• Recreate critical workflows in n8n targeting Zulip instead of Slack
• Test each migrated workflow before Slack shutdown

Key Workflows to Migrate

• Board meeting reminders and scheduling
• Working group standup/check-in automations
• Newsletter distribution triggers
• New member welcome messages
• Event announcement scheduling
• Community call reminders (odd/even month schedule)

Integrations

• Zulip (post messages, create topics, send DMs)
• GitHub (issue creation, PR notifications, release alerts)
• Google Calendar (event triggers)
• Email (SMTP for notifications)
• Webhook endpoints for custom triggers
• PostHog (trigger workflows on analytics events)

Context

Depends on: #1924 (Zulip deployment — workflows need a chat target)

n8n is open source (fair-code license), self-hostable, and has 400+ integrations. The visual workflow builder is accessible to non-developers, which is important since WG chairs create their own workflows.

Part of the platform ecosystem:

• us-rse.org — Main site (React)
• chat.us-rse.org — Zulip (#9)
• workflows.us-rse.org — n8n (this issue)
• collab.us-rse.org — Collaboration tool (#11, future)

Implementation Notes

• n8n community edition is free for self-hosting
• Visual drag-and-drop builder — no code required for most workflows
• Supports cron triggers, webhook triggers, and manual triggers
• Credential management is built-in (encrypted at rest)
• Cloudflare Access free tier supports up to 50 users — sufficient for board + WG chairs
• Consider running n8n on the same VPS as Zulip to reduce costs (n8n is very light)

The issue names no repository files, tests, or entry points; start by reviewing dependency #1924 and resolving the hosting-provider, authentication, and storage choices. Done means n8n is deployed at workflows.us-rse.org with Cloudflare Access, Postgres, persistence, backups, and the listed integrations and workflow migrations validated.