Admin guide

Admins own the full runtime and commercial configuration of the platform. That includes install decisions, billing credentials, plan design, tenant placement, infrastructure pools, runtime health, and incident response.

• Core setup controls branding, billing credentials, landing-page content, AI provider keys, and docs visibility.
• SaaSForge controls tenants, domains, provisioning jobs, provisioning servers, health checks, backups, runtime dependencies.
• N8NForge controls managed instances, launch metadata, and workflow-template delivery.

Before installing N8Forge, the target server must have a working LAMP/LEMP stack with PHP, a database, a reverse proxy for TLS termination, Docker for n8n runtimes, plus supporting services for queues, caching, and background work. This section guides you through preparing a fresh Ubuntu 24.04 server. Adjust package names if you use Debian or a different version.

The N8Forge app server runs two web-facing services on the same host:

• Caddy listens on ports 80 and 443 (TLS). It reverse-proxies the main N8Forge domain to Apache and also manages dynamic per-tenant site files for n8n instances (written by the SaaSForge provisioning system).
• Apache listens on 127.0.0.1:8080 and serves the N8Forge Laravel application via PHP-FPM. It is never exposed directly to the internet.
• Docker runs n8n containers on allocated host ports (default range 23000+). Caddy reverse-proxies tenant subdomains to these ports.

This separation keeps TLS termination, tenant routing, and application serving each in their own layer.

The following script prepares a fresh Ubuntu 24.04 server. Run it as root or with a sudo-enabled user. It installs every service listed above, applies hardening defaults, and prints a summary at the end.

#!/usr/bin/env bash
set -euo pipefail

###############################################################################
# N8Forge — install-server bootstrap script
#
# Prepares a fresh Ubuntu 24.04 VPS with:
#   PHP 8.3 + extensions, MySQL 8, Apache (loopback :8080), Caddy (80/443),
#   Docker Engine + Compose plugin, Redis, Supervisor, Composer, Node.js.
#
# Usage:
#   sudo bash bootstrap-n8forge.sh
#
# After the script finishes, review the summary, then proceed to the
# N8Forge installation section.
###############################################################################

# ── Config ─────────────────────────────────────────────────────────────────
APP_DOMAIN="${APP_DOMAIN:-app.example.com}"
MYSQL_ROOT_PASSWORD="${MYSQL_ROOT_PASSWORD:-}"
MYSQL_N8FORGE_DATABASE="${MYSQL_N8FORGE_DATABASE:-n8forge}"
MYSQL_N8FORGE_USER="${MYSQL_N8FORGE_USER:-n8forge}"
MYSQL_N8FORGE_PASSWORD="${MYSQL_N8FORGE_PASSWORD:-}"
DEPLOY_USER="${DEPLOY_USER:-deploy}"
PHP_VERSION="${PHP_VERSION:-8.3}"
TIMEZONE="${TIMEZONE:-UTC}"

# Colors for output
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
ok()  { echo -e "${GREEN}[OK]${NC} $1"; }
info(){ echo -e "${YELLOW}[..]${NC} $1"; }
fail(){ echo -e "${RED}[FAIL]${NC} $1"; exit 1; }

# ── Pre-flight checks ──────────────────────────────────────────────────────
[[ $EUID -eq 0 ]] || fail "Run this script as root (or with sudo)."
command -v apt-get &>/dev/null || fail "This script requires apt (Debian/Ubuntu)."

# Detect Ubuntu version
. /etc/os-release
UBUNTU_MAJOR="${VERSION_ID%%.*}"
[[ "$UBUNTU_MAJOR" -ge 22 ]] || fail "Ubuntu 22.04+ required (detected $VERSION_ID)."

# ── 1. System updates & base packages ──────────────────────────────────────
info "Updating system packages ..."
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get upgrade -y -qq
apt-get install -y -qq \
    curl wget gnupg2 ca-certificates lsb-release software-properties-common \
    ufw fail2ban unzip git cron

# Timezone
timedatectl set-timezone "$TIMEZONE"

# Swap (if none exists)
if ! swapon --show | grep -q .; then
    info "Creating 2 GB swap file ..."
    fallocate -l 2G /swapfile
    chmod 600 /swapfile
    mkswap /swapfile
    swapon /swapfile
    echo '/swapfile none swap sw 0 0' >> /etc/fstab
    ok "Swap created."
fi

ok "System packages installed."

# ── 2. PHP ─────────────────────────────────────────────────────────────────
info "Installing PHP $PHP_VERSION and extensions ..."
add-apt-repository -y ppa:ondrej/php
apt-get update -qq
apt-get install -y -qq \
    php${PHP_VERSION} php${PHP_VERSION}-fpm \
    php${PHP_VERSION}-bcmath php${PHP_VERSION}-ctype php${PHP_VERSION}-curl \
    php${PHP_VERSION}-dom php${PHP_VERSION}-fileinfo php${PHP_VERSION}-gd \
    php${PHP_VERSION}-gmp php${PHP_VERSION}-intl php${PHP_VERSION}-mbstring \
    php${PHP_VERSION}-mysql php${PHP_VERSION}-opcache \
    php${PHP_VERSION}-redis php${PHP_VERSION}-xml \
    php${PHP_VERSION}-zip php${PHP_VERSION}-exif

# Tune PHP-FPM for a production Laravel app
sed -i 's/^pm.max_children =.*/pm.max_children = 50/' /etc/php/${PHP_VERSION}/fpm/pool.d/www.conf
sed -i 's/^pm.start_servers =.*/pm.start_servers = 8/' /etc/php/${PHP_VERSION}/fpm/pool.d/www.conf
sed -i 's/^pm.min_spare_servers =.*/pm.min_spare_servers = 4/' /etc/php/${PHP_VERSION}/fpm/pool.d/www.conf
sed -i 's/^pm.max_spare_servers =.*/pm.max_spare_servers = 16/' /etc/php/${PHP_VERSION}/fpm/pool.d/www.conf

systemctl enable php${PHP_VERSION}-fpm
ok "PHP $PHP_VERSION installed."

# ── 3. MySQL ───────────────────────────────────────────────────────────────
info "Installing MySQL 8 ..."
# Pre-seed root password if provided (interactive install otherwise)
if [[ -n "$MYSQL_ROOT_PASSWORD" ]]; then
    debconf-set-selections <<< "mysql-server mysql-server/root_password password $MYSQL_ROOT_PASSWORD"
    debconf-set-selections <<< "mysql-server mysql-server/root_password_again password $MYSQL_ROOT_PASSWORD"
fi
apt-get install -y -qq mysql-server

systemctl enable mysql
systemctl start mysql

# Create application database and user
if [[ -z "$MYSQL_N8FORGE_PASSWORD" ]]; then
    MYSQL_N8FORGE_PASSWORD="$(openssl rand -base64 24)"
    echo -e "\nGenerated MySQL password for '${MYSQL_N8FORGE_USER}': ${MYSQL_N8FORGE_PASSWORD}\n" >> /root/.mysql_credentials
fi

mysql <<SQL
CREATE DATABASE IF NOT EXISTS \`${MYSQL_N8FORGE_DATABASE}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS '${MYSQL_N8FORGE_USER}'@'localhost' IDENTIFIED BY '${MYSQL_N8FORGE_PASSWORD}';
GRANT ALL PRIVILEGES ON \`${MYSQL_N8FORGE_DATABASE}\`.* TO '${MYSQL_N8FORGE_USER}'@'localhost';
FLUSH PRIVILEGES;
SQL

# Secure the installation
mysql --execute="DELETE FROM mysql.user WHERE User=''; DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1'); DROP DATABASE IF EXISTS test; DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%'; FLUSH PRIVILEGES;" || true

ok "MySQL 8 installed. DB '${MYSQL_N8FORGE_DATABASE}' created for user '${MYSQL_N8FORGE_USER}'."

# ── 4. Apache ──────────────────────────────────────────────────────────────
info "Installing Apache with PHP-FPM proxy ..."
apt-get install -y -qq apache2 libapache2-mod-fcgid
a2enmod proxy_fcgi setenvif rewrite
a2enconf php${PHP_VERSION}-fpm

# Listen only on loopback
sed -i 's/^Listen 80$/Listen 127.0.0.1:8080/' /etc/apache2/ports.conf

# Create the N8Forge vhost
cat > /etc/apache2/sites-available/n8forge.conf <<'APACHE'
<VirtualHost 127.0.0.1:8080>
    ServerName _default_

    DocumentRoot /var/www/n8forge/public

    <Directory /var/www/n8forge/public>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    <FilesMatch \.php$>
        SetHandler "proxy:unix:/run/php/php8.3-fpm.sock|fcgi://localhost"
    </FilesMatch>

    ErrorLog ${APACHE_LOG_DIR}/n8forge-error.log
    CustomLog ${APACHE_LOG_DIR}/n8forge-access.log combined
</VirtualHost>
APACHE

a2dissite 000-default
a2ensite n8forge

systemctl enable apache2
ok "Apache configured on 127.0.0.1:8080."

# ── 5. Caddy (reverse proxy for the app + tenant domains) ──────────────────
info "Installing Caddy ..."
apt-get install -y -qq debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list
apt-get update -qq
apt-get install -y -qq caddy

# Create the SaaSForge tenant site directory
mkdir -p /etc/caddy/sites-enabled/saasforge

# Write the main Caddyfile
cat > /etc/caddy/Caddyfile <<CADDY
{
    email admin@${APP_DOMAIN#*.}
    on_demand_tls {
        ask https://${APP_DOMAIN}/saasforge/caddy/on-demand-tls
        burst 5
    }
}

# Main N8Forge app — reverse-proxy to Apache
${APP_DOMAIN} {
    tls {
        on_demand
    }

    encode gzip

    reverse_proxy 127.0.0.1:8080 {
        # Pass the real client IP (Caddy is at the edge, not behind another proxy)
        header_up X-Real-IP {remote_host}
        #header_up X-Forwarded-For {remote_host}
    }
}

import /etc/caddy/sites-enabled/saasforge/*
CADDY

systemctl enable caddy
ok "Caddy installed. App domain: ${APP_DOMAIN}"

# ── 6. Docker ──────────────────────────────────────────────────────────────
info "Installing Docker Engine ..."
for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do
    apt-get remove -y "$pkg" 2>/dev/null || true
done

curl -fsSL https://get.docker.com | bash

# Docker daemon tuning
cat > /etc/docker/daemon.json <<'DOCKER'
{
    "log-driver": "json-file",
    "log-opts": {
        "max-size": "10m",
        "max-file": "3"
    },
    "live-restore": true,
    "storage-driver": "overlay2"
}
DOCKER

systemctl enable docker
systemctl restart docker
ok "Docker Engine installed."

# ── 7. Create deploy user ──────────────────────────────────────────────────
info "Creating deploy user '${DEPLOY_USER}' ..."
id -u "$DEPLOY_USER" &>/dev/null || useradd -m -s /bin/bash "$DEPLOY_USER"
usermod -aG docker "$DEPLOY_USER"

# Create runtime directories
mkdir -p /var/lib/saasforge/runtime
chown -R "${DEPLOY_USER}:${DEPLOY_USER}" /var/lib/saasforge/runtime

# Create the app directory (content placed later)
mkdir -p /var/www/n8forge
chown "${DEPLOY_USER}:www-data" /var/www/n8forge

ok "Deploy user '${DEPLOY_USER}' created."

# ── 8. Composer & Node.js ──────────────────────────────────────────────────
info "Installing Composer ..."
EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"
if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
    echo 'ERROR: Composer installer checksum mismatch' >&2
    rm composer-setup.php
    exit 1
fi
php composer-setup.php --install-dir=/usr/local/bin --filename=composer
rm composer-setup.php
ok "Composer installed."

info "Installing Node.js 20 LTS ..."
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
apt-get install -y -qq nodejs
ok "Node.js $(node --version) installed."

# ── 9. Redis ───────────────────────────────────────────────────────────────
info "Installing Redis ..."
apt-get install -y -qq redis-server
sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf
systemctl enable redis-server
systemctl restart redis-server
ok "Redis installed."

# ── 10. Supervisor (queue worker) ──────────────────────────────────────────
info "Configuring Supervisor for queue worker ..."
apt-get install -y -qq supervisor

        cat > /etc/supervisor/conf.d/n8forge-worker.conf <<SUPERVISOR
[program:n8forge-worker]
process_name=%(program_name)s_%(process_num)02d
command=/usr/bin/php /var/www/n8forge/artisan queue:work redis --sleep=3 --tries=3 --max-time=3600 --timeout=600
directory=/var/www/n8forge
autostart=true
autorestart=true
stopasgroup=true
killasgroup=true
user=${DEPLOY_USER}
numprocs=2
redirect_stderr=true
stdout_logfile=/var/www/n8forge/storage/logs/worker.log
stdout_logfile_maxbytes=10MB
SUPERVISOR

systemctl enable supervisor
ok "Supervisor configured for queue worker."

# ── 11. Firewall ───────────────────────────────────────────────────────────
info "Configuring UFW firewall ..."
ufw --force reset
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable
ok "UFW active — SSH, HTTP, HTTPS allowed."

# ── 12. Kernel tuning ──────────────────────────────────────────────────────
info "Applying kernel tuning ..."
cat > /etc/sysctl.d/99-n8forge.conf <<'SYSCTL'
fs.file-max = 100000
vm.max_map_count = 262144
net.core.somaxconn = 1024
SYSCTL
sysctl --system

# ── 13. Cron (Laravel scheduler) ───────────────────────────────────────────
info "Setting up Laravel scheduler cron job ..."
cat > /etc/cron.d/n8forge-scheduler <<CRON
* * * * * ${DEPLOY_USER} cd /var/www/n8forge && /usr/bin/php artisan schedule:run >> /dev/null 2>&1
CRON
chmod 0644 /etc/cron.d/n8forge-scheduler

# ── Summary ────────────────────────────────────────────────────────────────
echo ""
echo -e "${GREEN}========================================${NC}"
echo -e "${GREEN}  N8Forge — VPS bootstrap complete${NC}"
echo -e "${GREEN}========================================${NC}"
echo ""
echo "  App directory      : /var/www/n8forge"
echo "  App domain         : ${APP_DOMAIN}"
echo ""
echo "  Database           : ${MYSQL_N8FORGE_DATABASE}"
echo "  DB user            : ${MYSQL_N8FORGE_USER}"
echo "  DB password        : ${MYSQL_N8FORGE_PASSWORD:-<set via MYSQL_N8FORGE_PASSWORD>}"
echo "  DB host            : localhost"
echo ""
echo "  Apache (loopback)  : http://127.0.0.1:8080"
echo "  Caddy (public)     : https://${APP_DOMAIN}"
echo ""
echo "  Deploy user        : ${DEPLOY_USER}"
echo "  Runtime root       : /var/lib/saasforge/runtime"
echo ""
echo "  Services enabled:"
echo "    - php${PHP_VERSION}-fpm    : Active"
echo "    - mysql          : Active"
echo "    - apache2        : Active"
echo "    - caddy          : Active"
echo "    - docker         : Active"
echo "    - redis-server   : Active"
echo "    - supervisor     : Active"
echo ""
echo -e "${YELLOW}Next steps:${NC}"
echo "  1. Point DNS for ${APP_DOMAIN} to this server's public IP."
echo "  2. Upload the N8Forge release ZIP into /var/www/n8forge."
echo "  3. Set correct ownership: chown -R \${DEPLOY_USER}:www-data /var/www/n8forge"
echo "  4. Copy and edit the .env file with the database credentials above."
echo "  5. Open https://${APP_DOMAIN}/install in your browser."
echo "  6. Complete the web installer, then proceed to the First-day checklist."
echo ""
echo -e "${RED}Save the database password above. It will not be shown again.${NC}"
echo ""

export APP_DOMAIN=n8forge.yourcompany.com
export MYSQL_N8FORGE_PASSWORD="$(openssl rand -base64 24)"
export DEPLOY_USER=n8forge
sudo -E bash bootstrap-n8forge.sh

• PHP 8.3+ with the Laravel and Wave requirements expected by the packaged app.
• Application database on MySQL, MariaDB, PostgreSQL, or SQLite.
• Queue and scheduler support because provisioning, templates, cleanup, and reminders depend on scheduled work.
• Docker-capable runtime hosts for the local Linux-host driver or any SSH provisioning target.

• Configure Setup for General, Billing, Landing Page, AI, and Authentication.
• Review plans and assign real billing price IDs plus any plan-level delivery mappings.
• Choose the public theme and replace seeded marketing content.
• Enable scheduler execution so provisioning and health automation can run.
• Create provisioning resources such as SSH servers, external databases, and external storage backends if you will not rely only on the default local runtime path.
• Run a real test subscription and confirm it creates a tenant, queues a job, and produces a usable runtime instance page.
or custom domains.

The Core Setup page is the main live configuration surface for branding, billing credentials, marketing content, AI provider keys, and authentication presentation.

Instance resource limits

Every n8n container gets default CPU, memory, and swap limits. These can be overridden per instance from the admin panel.

• Open Automation → Managed Instances → Edit on the instance you want to adjust.
• The Resource Overrides section lets you set CPU, memory, memory swap, and toggle task runners.
• When saved, the instance restarts automatically to apply the new limits.

Metrics collection

Each n8n instance exposes a metrics endpoint that feeds the customer dashboard stat cards, history bars, and the admin Top Resource Consumers widget (shows the 10 instances with highest memory usage).

Metrics are captured automatically when customers view their dashboard. An optional background poller can be enabled via N8NFORGE_METRICS_POLLING=true to collect data across all instances regardless of dashboard activity. Snapshots are stored in the n8nforge_instance_metrics table.

Retention & cleanup

Old snapshots can be pruned automatically to keep the metrics table lean:

• Retention window: controlled by N8NFORGE_METRICS_RETENTION_DAYS (default 60). Rows older than this threshold are candidates for deletion.
• Manual cleanup: php artisan n8nforge:clean-metrics — add --dry-run to preview without deleting.
• Scheduled cleanup: the framework console kernel registers n8nforge:clean-metrics on the daily schedule. Make sure the Laravel scheduler runs every minute via cron: * * * * * cd /path/to/project && php artisan schedule:run.

#!/usr/bin/env bash
set -euo pipefail

DEPLOY_USER="${1:-deploy}"
HOSTNAME="$(hostname -f)"

_has_cmd() { command -v "$1" || return 1; }
_deb_installed() { dpkg -s "$1" || return 1; }
_install_if_missing() {
    local missing=()
    for pkg in "$@"; do
        _deb_installed "$pkg" || missing+=("$pkg")
    done
    [[ ${#missing[@]} -eq 0 ]] || sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq "${missing[@]}"
}

echo "=== 1. System updates ==="
sudo apt-get update -qq
sudo apt-get upgrade -y -qq
_install_if_missing curl ufw unattended-upgrades

if ! swapon --show | grep -q .; then
    sudo fallocate -l 1G /swapfile
    sudo chmod 600 /swapfile
    sudo mkswap /swapfile
    sudo swapon /swapfile
    echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
fi

echo "=== 2. Docker ==="
if ! _has_cmd docker; then
    for pkg in docker.io docker-doc docker-compose podman-docker containerd runc; do
        sudo apt-get remove -y "$pkg" || true
    done
    curl -fsSL https://get.docker.com | sudo bash
fi
_install_if_missing docker-compose-plugin

echo "=== 3. Docker daemon config ==="
sudo mkdir -p /etc/docker
printf '%s\n' '{"log-driver":"json-file","log-opts":{"max-size":"10m","max-file":"3"},"live-restore":true,"storage-driver":"overlay2"}' \
    | sudo tee /etc/docker/daemon.json
if _has_cmd dockerd; then
    sudo systemctl restart docker
fi

echo "=== 4. Caddy ==="
if ! _has_cmd caddy; then
    _install_if_missing debian-keyring debian-archive-keyring apt-transport-https
    sudo mkdir -p /usr/share/keyrings
    if [[ ! -f /usr/share/keyrings/caddy-stable-archive-keyring.gpg ]]; then
        curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
            | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
    fi
    if [[ ! -f /etc/apt/sources.list.d/caddy-stable.list ]]; then
        curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
            | sudo tee /etc/apt/sources.list.d/caddy-stable.list
    fi
    sudo apt-get update -qq
    _install_if_missing caddy
fi

echo "=== 5. Deploy user & runtime dirs ==="
sudo id -u "$DEPLOY_USER" || sudo useradd -m -s /bin/bash "$DEPLOY_USER"
sudo usermod -aG docker "$DEPLOY_USER"
sudo mkdir -p /var/lib/saasforge/runtime
sudo chown -R "$DEPLOY_USER":"$DEPLOY_USER" /var/lib/saasforge/runtime
sudo mkdir -p /etc/caddy/sites-enabled/saasforge

echo "=== 6. Kernel tuning ==="
printf 'fs.file-max = 100000\nvm.max_map_count = 262144\nnet.core.somaxconn = 1024\n' \
    | sudo tee /etc/sysctl.d/99-saasforge.conf
sudo sysctl --system

echo "=== 7. Firewall ==="
if sudo ufw status | grep -q 'Status: active'; then
    for port in ssh 80/tcp 443/tcp; do
        sudo ufw status | grep -q "$port" || sudo ufw allow "$port"
    done
else
    _install_if_missing ufw
    sudo ufw --force reset
    sudo ufw default deny incoming
    sudo ufw default allow outgoing
    sudo ufw allow ssh
    sudo ufw allow 80/tcp
    sudo ufw allow 443/tcp
    sudo ufw --force enable
fi

echo "=== 8. Enable services ==="
sudo systemctl enable --now docker

# Write a minimal Caddyfile so caddy can start
if ! caddy validate --config /etc/caddy/Caddyfile; then
    printf ':80 {\n    respond "SaaSForge provisioning host"\n}\n\nimport /etc/caddy/sites-enabled/saasforge/*\n' \
        | sudo tee /etc/caddy/Caddyfile
fi
cd /etc/caddy && caddy start
echo "Caddy started in /etc/caddy/"

# unattended-upgrades is a timer, not a service
sudo systemctl enable unattended-upgrades || true
sudo systemctl start unattended-upgrades || true

echo "=== 9. Verification ==="
echo -n "Docker: "; sudo -u "$DEPLOY_USER" docker version --format '{{.Server.Version}}'
echo -n "Compose: "; sudo -u "$DEPLOY_USER" docker compose version --short
echo -n "Caddy: "; caddy version
echo -n "UFW: "; sudo ufw status | head -1

echo ""
echo "Host $HOSTNAME ready. Add it as a Provisioning Server in admin.
  Host     : $HOSTNAME
  Port     : 22
  Username : $DEPLOY_USER"

# Example /etc/caddy/Caddyfile excerpt
{
    email admin@example.com

    on_demand_tls {
        ask https://app.example.com/saasforge/caddy/on-demand-tls
    }
}

import /etc/caddy/sites-enabled/saasforge/*

* * * * * cd /path/to/n8forge && /usr/bin/php artisan schedule:run >> /dev/null 2>&1

• Admin → Updates verifies the purchase code, checks for the latest release, and applies downloads when configured.
• php artisan n8forge:update runs pending update tasks for the current install.
• php artisan n8forge:update --download downloads and applies the latest release before migrations and cache refresh.
• ops/scripts/build-mainfiles.sh builds install and update packages.
• ops/scripts/push-demo.sh helps deploy the N8Forge app itself, not tenant runtimes.

• Daily review provisioning jobs, health checks, failed backups, and account notifications. Open the instance page for any degraded workspace.
• After plan changes verify billing IDs, role mapping, and provisioning, database, and storage assignments.
• After server changes confirm SSH credentials, Docker access, proxy paths, and capacity limits.
• After dependency changes validate one real tenant deployment before treating the change as complete.
• Before updates take backups and verify restore confidence for both the app and tenant runtime data.