Production Deployment

Comprehensive guide to deploying Automatización Lurwis to production with enterprise-grade reliability and security.

Pre-Deployment Checklist

Infrastructure Requirements

Compute Resources

Minimum Requirements:

CPU: 4 cores
RAM: 8GB
Storage: 100GB SSD
Network: 1Gbps

Recommended for High Traffic:

CPU: 8+ cores
RAM: 16GB+
Storage: 250GB SSD with daily backups
Network: 10Gbps

Database Infrastructure

PostgreSQL:

Version: 12+
Connection Pooling: PgBouncer or built-in session pooler
Replication: Primary + read replica
Storage: 50GB minimum, with auto-scaling

MongoDB:

Version: 4.4+
Replica Set: 3 nodes minimum
Storage: 20GB for conversation history

Redis:

Version: 6+
Configuration: Standalone or cluster
Memory: 4GB minimum
Persistence: AOF enabled

External Services

WhatsApp Business API: Production access approved
Google Gemini API: Billing enabled, rate limits verified
Domain & SSL: Valid SSL certificate (Let’s Encrypt or commercial)
DNS: Properly configured with low TTL for failover

Security Hardening

Network Security

Enable HTTPS/TLS

Configure reverse proxy with SSL:Caddy (Recommended - Used in Workflows):

your-domain.com {
    reverse_proxy n8n:5678
    
    # Security headers
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Frame-Options "DENY"
        X-Content-Type-Options "nosniff"
        Referrer-Policy "strict-origin-when-cross-origin"
    }
    
    # Rate limiting
    rate_limit {
        zone webhook {
            key {remote_host}
            events 100
            window 1m
        }
    }
}

The Receptor workflow shows Caddy in use: via: 1.1 Caddy in the webhook headers.

Firewall Configuration

Allow only necessary ports:

# Allow HTTPS
ufw allow 443/tcp

# Allow SSH (restrict to your IP)
ufw allow from YOUR_IP to any port 22

# Deny all other incoming
ufw default deny incoming
ufw default allow outgoing
ufw enable

Database Security

PostgreSQL:

-- Enable Row Level Security
ALTER TABLE pedidos_picanteria ENABLE ROW LEVEL SECURITY;

-- Create policies
CREATE POLICY pedidos_isolation ON pedidos_picanteria
    USING (telefono = current_setting('app.current_user'));

Connection Security:

Use SSL/TLS for all database connections
Whitelist only n8n server IP
Use connection pooling to prevent exhaustion

API Security

WhatsApp Webhook Validation:The Receptor workflow validates Meta signatures:

x-hub-signature: sha1=...
x-hub-signature-256: sha256=...

Ensure signature verification is enabled in production.

Authentication & Authorization

# n8n Access Control
N8N_BASIC_AUTH_ACTIVE=true
N8N_BASIC_AUTH_USER=admin
N8N_BASIC_AUTH_PASSWORD=<strong-password>

# Additional Security
N8N_SECURE_COOKIE=true
N8N_JWT_AUTH_ACTIVE=true

Critical Security Requirements:

Change default credentials immediately
Use password manager for credential storage
Enable 2FA on all external services (Meta, Google Cloud)
Rotate API tokens every 90 days

High Availability Architecture

Recommended Production Architecture

┌─────────────────────────────────────────┐
│         Load Balancer / Caddy            │
│        (SSL Termination)                 │
└────────────┬────────────────────────────┘
             │
    ┌────────┴────────┐
    │                 │
┌───▼───┐        ┌───▼───┐
│ n8n   │        │ n8n   │  (Active-Passive)
│Primary│        │Standby│
└───┬───┘        └───────┘
    │
    ├──────────┬─────────────┬──────────────┐
    │          │             │              │
┌───▼───┐  ┌──▼──┐     ┌────▼────┐   ┌────▼─────┐
│Postgres│  │Redis│     │ MongoDB │   │  Gemini  │
│(RDS)   │  │     │     │(Replica │   │   API    │
└────────┘  └─────┘     │  Set)   │   └──────────┘
                        └─────────┘

Container Orchestration

Docker Compose (Simple)
Kubernetes (Advanced)

For single-server deployment:

version: '3.8'

services:
  n8n:
    image: n8nio/n8n:latest
    restart: unless-stopped
    ports:
      - "5678:5678"
    environment:
      - NODE_ENV=production
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=${N8N_USER}
      - N8N_BASIC_AUTH_PASSWORD=${N8N_PASSWORD}
      - WEBHOOK_URL=${WEBHOOK_URL}
      - EXECUTIONS_PROCESS=main
      - N8N_METRICS=true
    volumes:
      - n8n_data:/home/node/.n8n
      - ./backups:/backups
    healthcheck:
      test: ["CMD", "wget", "--spider", "http://localhost:5678/healthz"]
      interval: 30s
      timeout: 10s
      retries: 3

  caddy:
    image: caddy:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - n8n

volumes:
  n8n_data:
  caddy_data:
  caddy_config:

For enterprise scale:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-lurwis
spec:
  replicas: 2
  selector:
    matchLabels:
      app: n8n-lurwis
  template:
    metadata:
      labels:
        app: n8n-lurwis
    spec:
      containers:
      - name: n8n
        image: n8nio/n8n:latest
        ports:
        - containerPort: 5678
        env:
        - name: WEBHOOK_URL
          value: "https://your-domain.com"
        - name: N8N_BASIC_AUTH_ACTIVE
          value: "true"
        envFrom:
        - secretRef:
            name: n8n-secrets
        resources:
          requests:
            memory: "2Gi"
            cpu: "1000m"
          limits:
            memory: "4Gi"
            cpu: "2000m"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 5678
          initialDelaySeconds: 30
          periodSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: n8n-lurwis-service
spec:
  selector:
    app: n8n-lurwis
  ports:
  - protocol: TCP
    port: 80
    targetPort: 5678
  type: LoadBalancer

Scaling Strategy

Vertical Scaling

Identify bottlenecks

Monitor resource usage:

# CPU and memory
docker stats n8n-lurwis

# Workflow execution times
# Check n8n metrics endpoint
curl http://localhost:5678/metrics

Scale resources

For Docker:

deploy:
  resources:
    limits:
      cpus: '4'
      memory: 8G
    reservations:
      cpus: '2'
      memory: 4G

Horizontal Scaling

n8n currently has limitations with horizontal scaling due to webhook routing. Use queue mode for multi-instance deployments.

Queue Mode Configuration:

EXECUTIONS_MODE=queue
QUEUE_BULL_REDIS_HOST=your-redis-host
QUEUE_BULL_REDIS_PORT=6379
QUEUE_BULL_REDIS_PASSWORD=your-password

Database Optimization

PostgreSQL Performance

-- Create indexes for common queries
CREATE INDEX idx_pedidos_telefono ON pedidos_picanteria(telefono);
CREATE INDEX idx_pedidos_estado ON pedidos_picanteria(estado_pedido);
CREATE INDEX idx_pedidos_fecha ON pedidos_picanteria(created_at);

-- Vacuum regularly
VACUUM ANALYZE pedidos_picanteria;

Connection Pooling:

# PgBouncer configuration
[databases]
picanteria_db = host=postgres-host port=5432 dbname=picanteria_db

[pgbouncer]
pool_mode = session
max_client_conn = 1000
default_pool_size = 25

Redis Memory Management

# redis.conf
maxmemory 4gb
maxmemory-policy allkeys-lru

# Enable AOF persistence
appendonly yes
appendfsync everysec

MongoDB Optimization

// Create indexes for memory collections
db.historial_pedidos.createIndex({ sessionId: 1, createdAt: -1 });
db.historial_clasificador.createIndex({ sessionId: 1, createdAt: -1 });

// Set TTL for automatic cleanup (30 days)
db.historial_pedidos.createIndex(
  { "createdAt": 1 },
  { expireAfterSeconds: 2592000 }
);

Monitoring & Observability

Application Monitoring

Enable n8n Metrics

N8N_METRICS=true
N8N_METRICS_INCLUDE_DEFAULT_METRICS=true
N8N_METRICS_INCLUDE_WORKFLOW_ID_LABEL=true

Access metrics at: http://localhost:5678/metrics

Configure Prometheus

# prometheus.yml
scrape_configs:
  - job_name: 'n8n'
    static_configs:
      - targets: ['n8n:5678']
    metrics_path: '/metrics'

Setup Grafana Dashboards

Key metrics to monitor:

Workflow execution count
Execution duration
Error rate
Webhook response times
Database connection pool usage

Error Tracking

The workflows include error notification via WhatsApp:

From Workflow Notes: “El ‘Gateaway’ está conectado a un Error Workflow (to notify when this one errors) conectado a mi teléfono de WhatsApp personal.”

Setup Error Workflow:

Create a dedicated error workflow
Use Error Trigger node
Add WhatsApp node with your notification number
Link both main workflows to this error workflow

Log Management

# Docker Compose logging
services:
  n8n:
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "10"

Centralized Logging:

Use ELK Stack (Elasticsearch, Logstash, Kibana)
Or cloud solutions: CloudWatch, Stackdriver, Datadog

Backup & Disaster Recovery

Automated Backups

PostgreSQL Backups
MongoDB Backups
n8n Workflows

#!/bin/bash
# backup-postgres.sh

BACKUP_DIR="/backups/postgres"
DATE=$(date +%Y%m%d_%H%M%S)
FILE="$BACKUP_DIR/picanteria_db_$DATE.sql.gz"

# Create backup
pg_dump -h $POSTGRES_HOST -U $POSTGRES_USER picanteria_db | gzip > $FILE

# Upload to S3
aws s3 cp $FILE s3://your-bucket/backups/postgres/

# Cleanup old backups (keep 30 days)
find $BACKUP_DIR -name "*.sql.gz" -mtime +30 -delete

Cron Schedule:

0 2 * * * /usr/local/bin/backup-postgres.sh

#!/bin/bash
# backup-mongodb.sh

BACKUP_DIR="/backups/mongodb"
DATE=$(date +%Y%m%d_%H%M%S)

# Create backup
mongodump --uri="$MONGODB_CONNECTION_STRING" \
  --db=picanteria_db \
  --out=$BACKUP_DIR/$DATE

# Compress
tar -czf $BACKUP_DIR/mongo_$DATE.tar.gz -C $BACKUP_DIR $DATE
rm -rf $BACKUP_DIR/$DATE

# Upload to S3
aws s3 cp $BACKUP_DIR/mongo_$DATE.tar.gz s3://your-bucket/backups/mongodb/

# Cleanup
find $BACKUP_DIR -name "*.tar.gz" -mtime +30 -delete

#!/bin/bash
# backup-n8n.sh

BACKUP_DIR="/backups/n8n"
DATE=$(date +%Y%m%d_%H%M%S)

# Export workflows via API
curl -u $N8N_USER:$N8N_PASSWORD \
  http://localhost:5678/api/v1/workflows \
  > $BACKUP_DIR/workflows_$DATE.json

# Backup credentials (encrypted)
docker exec n8n tar czf - /home/node/.n8n > $BACKUP_DIR/n8n_data_$DATE.tar.gz

# Upload to S3
aws s3 sync $BACKUP_DIR s3://your-bucket/backups/n8n/

Disaster Recovery Plan

Document Recovery Procedures

Create runbook with:

RTO (Recovery Time Objective): 1 hour
RPO (Recovery Point Objective): 24 hours
Step-by-step restoration process
Contact information for team

Test Recovery Regularly

Monthly drill:

Restore backups to staging environment
Verify data integrity
Test workflow execution
Document any issues

Maintain Hot Standby

For critical deployments:

Secondary n8n instance (passive)
Database read replicas
Automated failover scripts

Performance Optimization

Workflow Optimization

Message Buffering (Already Implemented)

The Receptor workflow uses Redis buffering:

Buffer window: 8 seconds
Purpose: Aggregate rapid messages
TTL: 30 seconds

This prevents message fragmentation and reduces AI API calls.

Database Query Optimization

The Procesador workflow queries are optimized:

-- Uses TRIM for accurate matching
WHERE TRIM(telefono) = TRIM('...')

-- Filters inactive orders
AND estado_pedido NOT IN ('entregado', 'cancelado')

-- Limits results
LIMIT 1

Memory Context Windows

Optimized per agent:

Orders: 25 messages (detailed history)
Reservations: 15 messages
General: 10 messages (fast queries)

API Rate Limiting

Google Gemini:

Free tier: 60 requests/minute
Implement exponential backoff
Use faster models for classification

WhatsApp Business:

Tier 1: 1,000 messages/day
Tier 2: 10,000 messages/day
Monitor usage in Meta dashboard

Deployment Process

Blue-Green Deployment

Prepare Blue environment

# Deploy to blue environment
docker-compose -f docker-compose.blue.yml up -d

# Verify health
curl https://blue.your-domain.com/healthz

Run smoke tests

Test webhook verification
Send test message
Verify database connections
Check AI agent responses

Switch traffic

Update load balancer to route to blue environment:

# Caddy
your-domain.com {
    reverse_proxy blue:5678
}

Monitor and rollback if needed

Watch error rates for 30 minutes
If issues detected, revert to green
Fix issues and retry

Production Checklist

Before going live:

Security

SSL certificates installed and valid
All default passwords changed
Firewall rules configured
Database connections use SSL/TLS
Row Level Security enabled on PostgreSQL
API tokens rotated and secured
Error notifications configured

Infrastructure

Application

Both workflows imported and activated
All credentials configured in n8n
WhatsApp webhook verified with Meta
Database schema migrated
Redis connection tested
AI models responding correctly

Testing

Documentation

Runbooks created for operations team
Disaster recovery plan documented
Escalation procedures defined
Architecture diagrams updated

Maintenance Windows

Planned Maintenance

Schedule:

Weekly: Database optimization (5 minutes)
Monthly: Security updates (30 minutes)
Quarterly: Major version upgrades (2 hours)

Notification:

Announce 48 hours in advance
Use low-traffic windows (3-5 AM local time)
Post status updates during maintenance

Support & Escalation

On-Call Rotation

Tier 1: Automated Alerts

Error workflow sends WhatsApp notifications
Monitoring alerts via email/SMS

Tier 2: Human Response

Review logs and metrics
Apply standard troubleshooting
Escalate if unresolved in 30 minutes

Tier 3: Engineering Team

Deep investigation
Code fixes if needed
Post-mortem after resolution

Post-Deployment

Monitoring Dashboard

Set up Grafana with key metrics

Troubleshooting Guide

Common issues and solutions

Database Schema

Reference for database structure

API Reference

Internal API documentation

Documentation Index

​Production Deployment

​Pre-Deployment Checklist

​Infrastructure Requirements

​Security Hardening

​Network Security

​Authentication & Authorization

​High Availability Architecture

​Recommended Production Architecture

​Container Orchestration

​Scaling Strategy

​Vertical Scaling

​Horizontal Scaling

​Database Optimization

​Monitoring & Observability

​Application Monitoring

​Error Tracking

​Log Management

​Backup & Disaster Recovery

​Automated Backups

​Disaster Recovery Plan

​Performance Optimization

​Workflow Optimization

​API Rate Limiting

​Deployment Process

​Blue-Green Deployment

​Production Checklist

​Security

​Infrastructure

​Application

​Testing

​Documentation

​Maintenance Windows

​Planned Maintenance

​Support & Escalation

​On-Call Rotation

​Post-Deployment

Monitoring Dashboard

Troubleshooting Guide

Database Schema

API Reference

​Additional Resources

Production Deployment

Pre-Deployment Checklist

Infrastructure Requirements

Security Hardening

Network Security

Authentication & Authorization

High Availability Architecture

Recommended Production Architecture

Container Orchestration

Scaling Strategy

Vertical Scaling

Horizontal Scaling

Database Optimization

Monitoring & Observability

Application Monitoring

Error Tracking

Log Management

Backup & Disaster Recovery

Automated Backups

Disaster Recovery Plan

Performance Optimization

Workflow Optimization

API Rate Limiting

Deployment Process

Blue-Green Deployment

Production Checklist

Security

Infrastructure

Application

Testing

Documentation

Maintenance Windows

Planned Maintenance

Support & Escalation

On-Call Rotation

Post-Deployment

Additional Resources