n8n Self-Hosting Deployment

The evidence requires fresh secrets on the target host, mode-600 .env handling, no committed secrets, private internal ports, DNS/port preflight, backup guidance, and immediate owner setup, which reduces obvious risk. Eleven points are deducted because it does not require explicit final-user confirmation before SSH, Docker installation, firewall changes, or service launch; deployment performs high-impact remote actions; rollback is only partially safe; init-data.sh interpolates environment values directly into SQL without robust escaping or validation; and attribution consists of links to official documentation without fixed, independently verifiable source evidence.

The evidence provides ordered procedures, mode branching, health checks, TLS retries, and several useful failure explanations. Four points are deducted because this static review cannot reproduce execution; the Caddyfile, env examples, and some referenced materials are absent from the supplied evidence; Docker installation, permissions, firewall, DNS propagation, and startup failures lack sufficiently complete diagnostic branches; and several command/version assumptions are not verified within the assessed path. The score therefore remains below the static ceiling of 10.

The evidence clearly identifies the audience, Linux/SSH/Docker environment, single versus queue modes, trigger semantics, non-fit cases, and required inputs such as domain, email, and timezone. Six points are deducted for limited boundaries around non-Debian hosts, existing services, non-Docker deployments, insufficient privileges, complex networks, and existing n8n instances; core operation depends on Docker images, Let's Encrypt, DNS, and overseas documentation/network services without mainland-China reachability or fallback guidance; and Chinese-language interaction support is not specified.

The evidence includes an orchestrating SKILL.md, mode-specific references, an assets directory, README structure, an MIT license, README version 1.1.0, and official documentation links, giving it a readable information architecture. Seven points are deducted because the selected skill does not clearly identify maintenance ownership, release/update workflow, or a changelog; versioning is only stated in the repository README; several referenced templates and references are absent from the supplied material; installation, FAQ, troubleshooting, and compatibility details still rely on unseen content; and publisher identity is unverified.

The evidence covers the intended lifecycle from preflight through deployment, TLS verification, updates, backup, restore, and hardening, with concrete Compose templates and commands. Ten points are deducted because static reading cannot establish that the commands and templates work with the claimed versions; key assets such as the Caddyfile and env examples are missing, preventing confirmation of a directly usable end-to-end result; queue sizing and recovery complexity, external dependencies, and migration risks still require manual review. The score is therefore limited and remains below the static ceiling of 7.

The evidence links to multiple official n8n documentation paths and supplies health, log, and version checks that provide audit points. Six points are deducted because there are no execution results, CI workflows, committed test suites, or third-party reproduction records; key assets are missing, so cross-checking is incomplete; README claims about testing and production-tested patterns do not establish reproducible evidence for this skill path; and the score remains below the static ceiling of 5.