Restrict Editor Access with a VPN (Tailscale or WireGuard)

The n8n editor is a full admin interface: anyone who reaches it can edit workflows, read stored credentials, and run arbitrary code through Code nodes. Rather than exposing it publicly, put n8n behind a mesh VPN such as Tailscale and publish only the webhook paths through a reverse proxy. The editor stays invisible to the internet while external services can still trigger workflows.

Why put the n8n editor behind a VPN?

The n8n editor is a full administrative interface -- anyone who can reach it can create, modify, and delete workflows, access stored credentials, and execute arbitrary code via Code nodes. Exposing the editor to the public internet, even with n8n's built-in authentication, creates unnecessary risk. Placing n8n behind a mesh VPN like Tailscale restricts access to authorized devices only, with zero firewall rule management.

Real-world example: You expose only the webhook path publicly (so external services can trigger workflows) while keeping the editor accessible only through Tailscale.

How do you expose only webhooks while restricting the editor?

services:
  n8n:
    image: n8nio/n8n:1.94.1
    restart: unless-stopped
    # No ports exposed to the host -- only accessible via Tailscale

    environment:
      N8N_HOST: n8n.your-tailnet.ts.net
      N8N_PROTOCOL: https
      WEBHOOK_URL: https://webhooks.example.com/

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data

Caddyfile

# Public: Only webhook paths are accessible from the internet

webhooks.example.com {
    @webhooks path /webhook/* /webhook-test/*
    handle @webhooks {
        reverse_proxy n8n:5678
    }
    handle {
        respond "Not Found" 404
    }
}

# Private: Editor accessible only via Tailscale network

n8n.your-tailnet.ts.net {
    reverse_proxy n8n:5678
}

Install Tailscale on the host

# Install Tailscale

curl -fsSL https://tailscale.com/install.sh | sh

# Start Tailscale and enable HTTPS certificates

sudo tailscale up
sudo tailscale cert n8n.your-tailnet.ts.net

What does this setup give you?

This setup gives you a public webhook endpoint for integrations while keeping the editor and API completely invisible to the internet. Team members access the editor through Tailscale, which handles authentication, encryption, and access control.

Related: Set a Unique Encryption Key and Back It Up · Configure Payload Size and Binary Data Mode for Large Files