feat(selfhost): add n8n workflows and MinIO object storage compose profiles (#1219)

[andriypolanski]

Closes #1219

Summary

• Adds two optional self-host Docker Compose profiles from #1219: --profile workflows (n8n automation at :5678) and --profile storage (MinIO S3 API :9000 + console :9001).
• Ships bundled n8n workflow templates under n8n/workflows/ (Slack review notify, daily gate summary, issue auto-triage) for import at http://localhost:5678/workflows/import.
• Documents n8n/MinIO/Litestream→MinIO env vars in .env.example. No src/** changes — review engine has zero dependency on either service.

Maintainer context (JSONbored, Jul 14, 2026)

PR #1234 references this issue but implements an unrelated feature (POST /v1/orb/ingest, an Orb telemetry collector endpoint) — likely a mislink. No n8n or MinIO docker-compose profiles exist in the repo yet; this issue's scope remains fully open.

This PR implements the open scope; it does not touch Orb ingest.

Change

• docker-compose.yml
  • New n8n service (profiles: ["workflows"]) with basic auth, persistent n8n-data volume, and a runtime fail-closed entrypoint when N8N_PASSWORD is unset.
  • New minio service (profiles: ["storage"]) with S3 API + console ports and minio-data volume.
  • Profile header comments + examples updated.
  • Uses soft env defaults (:-) instead of hard :? so default docker compose up stays green when profiles are inactive — same pattern as BROWSERLESS_TOKEN, REES_SHARED_SECRET, and GRAFANA_ADMIN_PASSWORD. Password/credential checks fail closed at container start when the profile is active.
  • MinIO healthcheck omitted: minio/minio:latest is scratch/distroless (no shell/mc), same constraint as Loki in this file.
• n8n/workflows/ — review-slack-notify.json, gate-daily-summary.json, issue-auto-triage.json
• .env.example — n8n, MinIO, and Litestream→MinIO wiring docs
• test/unit/selfhost-compose-workflows-storage.test.ts — structural regression guard (profiles, ports, env posture, templates, .env.example docs)

Closes #1219

---

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• Focused change: compose + env docs + workflow templates + structural tests only.
• No src/** changes (Codecov patch scope clean).
• Linked issue: Closes selfhost(workflows): n8n orchestration + MinIO object storage — automation and artifact persistence #1219.

Validation

• git diff --check
• npm run actionlint (not run — no workflow changes)
• npm run typecheck (not run — no src/** changes)
• npm run test:coverage (not run — no src/** changes)
• npm run test:workers (not run)
• npm run build:mcp / npm run test:mcp-pack (not run)
• npm run ui:openapi:check (not run)
• npm run ui:lint / npm run ui:typecheck / npm run ui:build (not run)
• npm audit --audit-level=moderate
• npm run test -- --run test/unit/selfhost-compose-workflows-storage.test.ts — 10 passing

Run full npm run test:ci before push (required gate).

Safety

• No secrets, wallet details, hotkeys, trust scores, or private rankings exposed.
• Optional services only — zero impact on default stack when profiles inactive.
• No API/OpenAPI/MCP/runtime behavior change.
• No changelog edit.

UI Evidence

No visible UI change. Compose profiles, env documentation, workflow templates, and structural tests only — no screenshots required.

Operator notes

# n8n only (set N8N_PASSWORD in .env first):
docker compose --profile workflows up -d

# MinIO only (set MINIO_ROOT_USER + MINIO_ROOT_PASSWORD in .env first):
docker compose --profile storage up -d

# Both:
docker compose --profile workflows --profile storage up -d

# Point Litestream at local MinIO (with --profile storage + --profile litestream):
# LITESTREAM_ENDPOINT=http://minio:9000
# LITESTREAM_ACCESS_KEY_ID=<MINIO_ROOT_USER>
# LITESTREAM_SECRET_ACCESS_KEY=<MINIO_ROOT_PASSWORD>

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 LoopOver review result - reject/close recommended

_{Review updated: 2026-07-14 14:08:45 UTC}

6 files · 1 AI reviewer · 1 blocker · readiness 100/100 · CI green · clean

🛑 Suggested Action - Reject/Close

Review summary
This PR adds two optional, profile-gated docker-compose services (n8n and MinIO) plus bundled n8n workflow templates and env docs, all correctly closing #1219 with no src/** changes. The soft-default env pattern (`:-` instead of `:?`) with a fail-closed entrypoint check for n8n is consistent with the existing BROWSERLESS_TOKEN/REES_SHARED_SECRET pattern, and the MinIO no-healthcheck rationale matches the existing Loki precedent. The build+boot smoke test failure is the one open question since it's unclear whether it's caused by this change (e.g. YAML anchor/merge issue with `<<: *default-logging` on new services, or a compose validation issue) or a pre-existing flake.

Blockers

• The 'build + boot smoke test' CI check FAILED on this commit — since this diff adds two new compose services with YAML anchors and a multi-line shell entrypoint, verify this isn't caused by a `docker compose config` validation failure (e.g. malformed entrypoint heredoc/quoting) before merging.

Nits — 5 non-blocking

• docker-compose.yml: MinIO's `MINIO_ROOT_USER`/`MINIO_ROOT_PASSWORD` have soft defaults but, unlike n8n, there's no visible fail-closed entrypoint check in the diff — confirm MinIO's own built-in refusal-to-start-without-credentials behavior is actually still true for `minio/minio:latest` rather than silently starting with default/no creds.
• The bundled n8n workflow JSON files use hardcoded fallback URLs (e.g. `http:​//loopover:8787/...`, `https:​//example.com/webhook` in gate-daily-summary.json) — fine as templates but worth a comment noting these are placeholders to be replaced on import.
• docker-compose.yml is now ~1291 lines; consider whether self-host profiles like this could eventually move to an include/overlay file, though this is out of scope for this PR.
• test file comment explains why `docker compose config` isn't shelled out to, which is good — but confirm this test suite doesn't silently pass on a compose file that would fail Docker's own YAML/anchor validation, since that's exactly what the failing smoke test flagged.
• Investigate the failing 'build + boot smoke test' check directly against this commit's compose changes before merging — this is the strongest signal something concrete broke.

Why this is blocked

• The 'build + boot smoke test' CI check FAILED on this commit — since this diff adds two new compose services with YAML anchors and a multi-line shell entrypoint, verify this isn't caused by a `docker compose config` validation failure (e.g. malformed entrypoint heredoc/quoting) before merging.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. The 'build \+ boot smoke test' CI check FAILED on this commit — since this diff adds two new compose services with YAML anchors and a multi-line shell entrypoint, verify this isn't caused by a \`docker compose config\` validation failure \(e.g. malformed entrypoint heredoc/quoting\) before merging.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	✅ Linked	#1219
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 148 registered-repo PR(s), 96 merged, 26 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	andriypolanski; Gittensor profile; 148 PR(s), 26 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	⚠️ ℹ️ Insufficient signal	risk: clean · value: insufficient-signal — Nothing measurable for the structural-improvement analyzers on this PR (e.g. no code files changed). LLM value judgment: moderate — The PR delivers a clearly scoped, issue-linked, purely additive self-host feature (optional compose profiles + templates + docs) with no risk to the core review engine, matching established patterns in the file.

Review context

• Author: andriypolanski
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 148 PR(s), 26 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.07%. Comparing base (e4fd9c1) to head (b3f324b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5772   +/-   ##
=======================================
  Coverage   95.07%   95.07%           
=======================================
  Files         582      582           
  Lines       46216    46216           
  Branches    14820    14820           
=======================================
  Hits        43940    43940           
  Misses       1516     1516           
  Partials      760      760           

Flag	Coverage Δ
shard-1	43.40% <ø> (-0.54%)	⬇️
shard-2	35.95% <ø> (+0.18%)	⬆️
shard-3	32.23% <ø> (-0.02%)	⬇️
shard-4	32.91% <ø> (-0.02%)	⬇️
shard-5	31.33% <ø> (-0.40%)	⬇️
shard-6	44.99% <ø> (+0.34%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (AI reviewers agree on a likely critical defect: The 'build + boot smoke test' CI check FAILED on this commit — since this diff adds two new compose services with YAML anchors and a multi-line shell entrypoint, verify this isn't caused by a `docker compose config` validation failure (e.g. malformed entrypoint heredoc/quoting) before merging.). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.