n8n + local LLM on Linux

Do not scrape secrets into community nodes you have not read. API keys in n8n credentials, not in Function node source, not in git.

Linux layout that survives reboot

One user or service account, one compose file or two systemd units: n8n.service, ollama.service (or your runtime). Restart=on-failure. Data directory on a disk you backup. Bind n8n to localhost or a tailnet; do not expose the editor to the open internet without auth.

TLS: terminate at Caddy/nginx or a tunnel you understand. n8n’s editor cookie on HTTP across a cafe Wi-Fi is how you donate workflows.

Models live outside the git repo. Document the exact tag you pulled. “latest” is not a pin. When you upgrade the runtime, run one smoke workflow before you enable cron.

Connecting the LLM without leaking prompts

Local HTTP, no vendor analytics. System prompt and user payload stay on the box. If a node still calls a cloud LLM “as fallback”, say so in the workflow description and in your privacy note. Silent fallback is a lie.

Timeouts: local models stall. Set a deadline and a path for “human queue” rather than retry storms. Log token counts if you must; do not log raw customer PII in n8n executions unless you have a retention policy.

Related: local LLMs in automation, why local vs ChatGPT. One slug per idea; clones stay draft.

What not to automate

Anything you would not put in a staff handbook: refunds without a human, medical advice, “send this email as the CEO”. n8n will happily do it at 03:00. The checklist is editorial, not technical.

Do not publish n8n screenshots that include live credentials. Redact. Do not turn this page into an affiliate hosting grid.

Checklist

1. Two processes, restart policy, pinned model tag.

2. n8n not public without auth.

3. Secrets in credentials store.

4. Timeout + human fallback.

5. Backup of the data volume.

6. No listicle, no stamp H2s.

Reboot test

Enable both units. Reboot the box. The webhook that fired during reboot must either complete or land in the human queue — not vanish. If n8n comes up before the model port is open, the first jobs 500. Add a systemd After= and a healthcheck that waits on the model HTTP before n8n starts cron.

Pin versions in a text file next to the compose: n8n tag, runtime tag, model tag. Upgrades are a change ticket, not a surprise Friday. Backup the volume before the pull.

Do not expose 5678/tcp. Tailscale or SSH tunnel for the editor. Public n8n is a credential dump with extra steps.

Community nodes: read the source or do not install. “AI agent” nodes that call a cloud endpoint by default belong off this URL.

Next

Pin a model tag, add Restart=, run one webhook while you reboot the box. Then blog and the local-LLM sibling articles — not a tools roundup.

Backups and secrets

Back up the n8n volume before every runtime pull. Credentials are not in git. If a community node wants your OpenAI key “just in case”, that node is off this URL. Local means local. Document the model file path and disk free space in the same runbook as DNS MX — both take the site down when ignored.

Disk: weights plus n8n executions will fill a small VPS. Set log retention in n8n and prune old executions. A full disk looks like “AI is down” in Slack. It is ops. Put a disk alert next to the spend cap.