From e09804f25af095e9fc9a9e7407478447b17cc890 Mon Sep 17 00:00:00 2001
From: usmannasir <usman@cyberpersons.com>
Date: Fri, 7 Nov 2025 21:53:02 +0500
Subject: [PATCH] Fix n8n deployment compatibility with OpenLiteSpeed proxy

- Pin n8n to version 1.86.1 to avoid Origin header validation issues
- Change N8N_HOST from 0.0.0.0 to domain for better compatibility
- Add N8N_PROXY_HOPS=1 to fix X-Forwarded-For errors
- Add N8N_ALLOWED_ORIGINS and N8N_ALLOW_CONNECTIONS_FROM for future compatibility
- Fix SetupN8NVhost to remove malformed Origin header setting

n8n versions 1.87.0+ introduced strict Origin header validation that is
incompatible with OpenLiteSpeed proxy (which doesn't forward Origin headers).
Version 1.86.1 works correctly with OLS and SSE push backend.
---
 plogical/DockerSites.py | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/plogical/DockerSites.py b/plogical/DockerSites.py
index 47d1307a5..d49183edc 100644
--- a/plogical/DockerSites.py
+++ b/plogical/DockerSites.py
@@ -321,6 +321,7 @@ context / {{
   websocket               1
 
   extraHeaders            <<<END_extraHeaders
+  RequestHeader unset X-Forwarded-For
   RequestHeader set X-Forwarded-For $ip
   RequestHeader set X-Forwarded-Proto https
   RequestHeader set X-Forwarded-Host "{domain}"
@@ -1394,7 +1395,7 @@ services:
         }
 
         n8n_config = {
-            'image': 'docker.n8n.io/n8nio/n8n',
+            'image': 'docker.n8n.io/n8nio/n8n:1.86.1',
             'user': 'root',
             'healthcheck': {
                 'test': ["CMD", "wget", "--spider", "http://localhost:5678"],
@@ -1409,7 +1410,7 @@ services:
                 'DB_POSTGRESDB_DATABASE': self.data['MySQLDBName'],
                 'DB_POSTGRESDB_USER': 'postgres',
                 'DB_POSTGRESDB_PASSWORD': self.data['MySQLPassword'],
-                'N8N_HOST': '0.0.0.0',
+                'N8N_HOST': f"{self.data['finalURL']}",
                 'N8N_PORT': '5678',
                 'NODE_ENV': 'development',  # Required for OpenLiteSpeed compatibility - OLS cannot override browser Origin headers which n8n v1.87.0+ validates in production mode
                 'N8N_EDITOR_BASE_URL': f"https://{self.data['finalURL']}",
@@ -1421,7 +1422,10 @@ services:
                 'N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS': 'true',
                 'DB_POSTGRESDB_SCHEMA': 'public',
                 'N8N_PROTOCOL': 'https',
-                'N8N_SECURE_COOKIE': 'true'
+                'N8N_SECURE_COOKIE': 'true',
+                'N8N_PROXY_HOPS': '1',
+                'N8N_ALLOWED_ORIGINS': f"https://{self.data['finalURL']}",
+                'N8N_ALLOW_CONNECTIONS_FROM': '*'
             }
         }