docker-compose + tailscale (n8n example)

docker-compose.yml

version: '3.8'

volumes:
  db_storage:
  redis_storage:
  n8n_storage:
  tailscale-data-n8n:
    driver: local

x-shared: &shared
  restart: always
  image: docker.n8n.io/n8nio/n8n
  environment:
    - N8N_LOG_LEVEL=debug
    - N8N_REINSTALL_MISSING_PACKAGES=true
    # https://docs.n8n.io/hosting/configuration/environment-variables/nodes/
    - NODE_FUNCTION_ALLOW_EXTERNAL=true
    - NODE_FUNCTION_ALLOW_BUILTIN=true
    - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
    - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
    # - N8N_PORT=5678
    - N8N_PROTOCOL=https
    - NODE_ENV=production
    - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/
    - DB_TYPE=postgresdb
    - DB_POSTGRESDB_HOST=postgres
    - DB_POSTGRESDB_PORT=5432
    - DB_POSTGRESDB_DATABASE=${POSTGRES_DB}
    - DB_POSTGRESDB_USER=${POSTGRES_NON_ROOT_USER}
    - DB_POSTGRESDB_PASSWORD=${POSTGRES_NON_ROOT_PASSWORD}
    - EXECUTIONS_MODE=queue
    - QUEUE_BULL_REDIS_HOST=redis
    # https://github.com/n8n-io/n8n/pull/2786
    # - QUEUE_HEALTH_CHECK_ACTIVE=true
  # links:
  #   - postgres
  #   - redis
  volumes:
    - n8n_storage:/home/node/.n8n
  network_mode: service:ts-n8n
  depends_on:
    redis:
      condition: service_healthy
    postgres:
      condition: service_healthy
    ts-n8n:
      condition: service_started

services:
  ts-n8n:
    image: tailscale/tailscale:latest
    hostname: n8n
    environment:
      - TS_AUTHKEY=tskey-client-xxxXXXxxxXXXxxx
      - TS_EXTRA_ARGS=--advertise-tags=tag:container
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/ts-n8n.json
    volumes:
      - tailscale-data-n8n:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
      - ./ts-n8n.json:/config/ts-n8n.json
    cap_add:
      - net_admin
      - sys_module
    restart: unless-stopped

  postgres:
    image: postgres:16
    restart: always
    environment:
      - POSTGRES_USER
      - POSTGRES_PASSWORD
      - POSTGRES_DB
      - POSTGRES_NON_ROOT_USER
      - POSTGRES_NON_ROOT_PASSWORD
    volumes:
      - db_storage:/var/lib/postgresql/data
      - ./init-data.sh:/docker-entrypoint-initdb.d/init-data.sh
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -h localhost -U ${POSTGRES_USER} -d ${POSTGRES_DB}']
      interval: 5s
      timeout: 5s
      retries: 10

  redis:
    image: redis:6-alpine
    restart: always
    volumes:
      - redis_storage:/data
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 5s
      timeout: 5s
      retries: 10

  n8n:
    <<: *shared
    # ports:
    #   - 5678:5678

  n8n-worker:
    <<: *shared
    command: worker
    depends_on:
      - n8n

ts-n8n.json

{
  "TCP": {
    "443": {
      "HTTPS": true
    }
  },
  "Web": {
    "n8n.magic-dns.ts.net:443": {
      "Handlers": {
        "/": {
          "Proxy": "http://127.0.0.1:5678"
        }
      }
    }
  },
  "AllowFunnel": {
    "n8n.magic-dns.ts.net:443": true
  }
}