Restrict Editor Access with a VPN (Tailscale or WireGuard)

The n8n editor is a full administrative interface -- anyone who can reach it can create, modify, and delete workflows, access stored credentials, and execute arbitrary code via Code nodes. Exposing the editor to the public internet, even with n8n's built-in authentication, creates unnecessary risk. Placing n8n behind a mesh VPN like Tailscale restricts access to authorized devices only, with zero firewall rule management.

Real-world example: You expose only the webhook path publicly (so external services can trigger workflows) while keeping the editor accessible only through Tailscale.

services:
  n8n:
    image: n8nio/n8n:1.94.1
    restart: unless-stopped
    # No ports exposed to the host -- only accessible via Tailscale

    environment:
      N8N_HOST: n8n.your-tailnet.ts.net
      N8N_PROTOCOL: https
      WEBHOOK_URL: https://webhooks.example.com/

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
```text
```title="Caddyfile"

# Public: Only webhook paths are accessible from the internet

webhooks.example.com {
    @webhooks path /webhook/* /webhook-test/*
    handle @webhooks {
        reverse_proxy n8n:5678
    }
    handle {
        respond "Not Found" 404
    }
}

# Private: Editor accessible only via Tailscale network

n8n.your-tailnet.ts.net {
    reverse_proxy n8n:5678
}
```text
```bash title="Install Tailscale on the host"

# Install Tailscale

curl -fsSL https://tailscale.com/install.sh | sh

# Start Tailscale and enable HTTPS certificates

sudo tailscale up
sudo tailscale cert n8n.your-tailnet.ts.net
```text
This setup gives you a public webhook endpoint for integrations while keeping the editor and API completely invisible to the internet. Team members access the editor through Tailscale, which handles authentication, encryption, and access control.

**Related:** [Set a Unique Encryption Key and Back It Up](../security-best-practices/01-set-a-unique-encryption-key-and-back-it-up.md) | [Configure Payload Size and Binary Data Mode for Large Files](../performance-and-large-files/01-configure-payload-size-and-binary-data-mode-for-large-files.md)