n8n Self-Healing Infrastructure
MRDTech uses n8n as the automation layer between monitoring, remediation, and Telegram alerting. The active workflows below are exported and sanitized in the GitHub repository:
Workflow inventory
| Workflow | Trigger condition | Remediation/action | Alert path |
|---|---|---|---|
| Wazuh Alert to Telegram | Wazuh emits a high-value security event or alert payload. | Formats the alert with rule, agent, severity, and source details. | Sends Telegram notification through the configured bot. |
| CrowdSec Ban to Telegram | CrowdSec creates a ban/decision from SSH, HTTP, reverse-proxy, or application abuse. | Summarizes source IP, scenario, duration, scope, and bouncer enforcement. | Sends Telegram notification through the configured bot. |
| QNAP Storage Threshold Alert | Scheduled NAS capacity check crosses warning or critical usage thresholds. | Authenticates to QNAP management endpoints, reads volume usage, and evaluates per-volume utilization. | Sends Telegram warning or critical storage alert. |
| Proxmox VM Self-Heal | Scheduled Proxmox VM health check detects stopped or unhealthy VM state. | Attempts controlled recovery/start for mapped VMs, then records outcome. | Sends Telegram remediation result when action is needed or recovery fails. |
| Docker Self-Heal Multi-Host | Scheduled Docker health check detects stopped/unhealthy containers across Docker hosts. | Restarts mapped containers on the affected host and rechecks status. | Sends Telegram alert with host, container, action, and result. |
| Service Endpoint Self-Heal | HTTP endpoint probe fails or returns an unhealthy response. | Maps endpoint to backing service/container, restarts the service, then re-tests endpoint health. | Sends Telegram alert showing failure, remediation action, and final state. |
| PBS Backup Failure Alert | Proxmox Backup Server task/job failure is detected. | Parses failed backup tasks and highlights affected VM/backup job. | Sends immediate Telegram backup failure notification. |
Design pattern
- n8n runs scheduled or webhook-triggered probes.
- The workflow executes a small script or HTTP/API request against the target system.
- The workflow only remediates known, mapped services. It does not guess. Guessing is how outages reproduce.
- Telegram receives either a high-signal alert or a remediation result.
- Exported workflow JSON is sanitized before GitHub publication: credentials, webhook IDs, API keys, bot tokens, chat IDs, passwords, and internal addresses are replaced with placeholders.
Target systems
- Wazuh SIEM for security alert intake.
- CrowdSec LAPI and bouncers for ban/decision visibility.
- QNAP NAS units for storage capacity thresholds.
- Proxmox for VM state and self-heal actions.
- Docker hosts for container health and restart actions.
- Published service endpoints for user-facing service availability.
- Proxmox Backup Server for backup failure alerting.
Operational notes
- Workflows require credentials to be re-mapped after import.
- Telegram bot and chat IDs must remain in n8n credentials or environment variables, never in Git.
- Remediation scope should stay explicit and allowlisted.
- Alert text should include the trigger, target, action attempted, and final status.