Upload 3 files

Dockerfile

@@ -0,0 +1,48 @@
+# n8n self-hosted image (Hugging Face Spaces / any Docker host)
+# HF Spaces runs the container as uid 1000 (= "node" user in node images),
+# so we run as node and keep all writable data in /home/node.
+FROM node:24-alpine
+
+USER root
+
+RUN apk add --no-cache \
+    git python3 py3-pip make g++ build-base \
+    cairo-dev pango-dev chromium postgresql-client yt-dlp \
+    tini curl
+
+# Pin a version that really exists. If the build fails with "No matching version",
+# change this to n8n@latest (or run: npm view n8n versions --json  to see valid ones).
+RUN npm install -g n8n@2.42.6
+
+# Writable data folder for uid 1000
+RUN mkdir -p /home/node/.n8n && chown -R node:node /home/node
+
+ENV NODE_OPTIONS="--dns-result-order=ipv4first" \
+    PUPPETEER_SKIP_DOWNLOAD=true \
+    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium \
+    N8N_RUNNERS_ENABLED=true \
+    N8N_PORT=7860 \
+    N8N_LISTEN_ADDRESS=0.0.0.0 \
+    N8N_USER_FOLDER=/home/node \
+    HOME=/home/node \
+    N8N_PROTOCOL=https \
+    N8N_PROXY_HOPS=1 \
+    N8N_DEFAULT_BINARY_DATA_MODE=filesystem \
+    N8N_DIAGNOSTICS_ENABLED=false \
+    N8N_PERSONALIZATION_ENABLED=false \
+    EXECUTIONS_DATA_PRUNE=true \
+    EXECUTIONS_DATA_MAX_AGE=168 \
+    GENERIC_TIMEZONE=Asia/Kolkata \
+    TZ=Asia/Kolkata \
+    NODE_FUNCTION_ALLOW_BUILTIN=* \
+    NODE_FUNCTION_ALLOW_EXTERNAL=*
+
+USER node
+WORKDIR /home/node
+EXPOSE 7860
+
+HEALTHCHECK --interval=60s --timeout=10s --start-period=90s --retries=3 \
+  CMD curl -fs http://127.0.0.1:7860/healthz || exit 1
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["n8n", "start"]

space-variables.env

@@ -0,0 +1,36 @@
+# ============================================================
+# Hugging Face Space > Settings > Variables and secrets
+# (Secrets = hidden values. Variables = normal values.)
+# Replace <user> and <space> with your HF username and Space name.
+# ============================================================
+
+# ---- Variables ----
+N8N_HOST=<user>-<space>.hf.space
+WEBHOOK_URL=https://<user>-<space>.hf.space/
+N8N_EDITOR_BASE_URL=https://<user>-<space>.hf.space/
+
+# ---- Secrets (IMPORTANT) ----
+# Generate once: openssl rand -hex 32   and NEVER change it later,
+# otherwise all saved credentials (Telegram, Google) become unreadable.
+N8N_ENCRYPTION_KEY=<64-char-random-hex>
+
+# ---- Database (so workflows/credentials survive restarts) ----
+# HF disk is wiped on every restart. Use your Supabase / any Postgres:
+DB_TYPE=postgresdb
+DB_POSTGRESDB_HOST=<db-host>
+DB_POSTGRESDB_PORT=5432
+DB_POSTGRESDB_DATABASE=postgres
+DB_POSTGRESDB_USER=<db-user>
+DB_POSTGRESDB_PASSWORD=<db-password>
+DB_POSTGRESDB_SCHEMA=n8n
+DB_POSTGRESDB_SSL_ENABLED=true
+DB_POSTGRESDB_SSL_REJECT_UNAUTHORIZED=false
+
+# ============================================================
+# Space README.md header must contain:
+# ---
+# title: n8n
+# sdk: docker
+# app_port: 7860
+# ---
+# ============================================================

worker.js

@@ -0,0 +1,53 @@
+// Cloudflare Worker: Telegram Bot API proxy
+// Deploy: Cloudflare Dashboard > Workers & Pages > Create > Hello World > Edit code > paste > Deploy
+// Then in n8n Telegram credential set Base URL = https://<your-worker>.workers.dev  (no trailing slash)
+
+const TELEGRAM_API = 'https://api.telegram.org';
+
+export default {
+  async fetch(request) {
+    const url = new URL(request.url);
+
+    // Health check: open the worker URL in a browser, you should see this text
+    if (url.pathname === '/' || url.pathname === '/health') {
+      return new Response('Telegram proxy OK', {
+        status: 200,
+        headers: { 'content-type': 'text/plain' },
+      });
+    }
+
+    // Only allow real Telegram Bot API paths: /bot<TOKEN>/method and /file/bot<TOKEN>/path
+    if (!/^\/(file\/)?bot[^/]+\//.test(url.pathname)) {
+      return new Response('Not allowed', { status: 403 });
+    }
+
+    const target = new URL(TELEGRAM_API + url.pathname + url.search);
+
+    // Rebuild the request so Host/CF headers don't leak to Telegram
+    const headers = new Headers(request.headers);
+    headers.delete('host');
+    headers.delete('cf-connecting-ip');
+    headers.delete('x-forwarded-for');
+    headers.delete('x-real-ip');
+
+    try {
+      const upstream = await fetch(target.toString(), {
+        method: request.method,
+        headers,
+        body: ['GET', 'HEAD'].includes(request.method) ? undefined : request.body,
+        redirect: 'follow',
+      });
+
+      return new Response(upstream.body, {
+        status: upstream.status,
+        statusText: upstream.statusText,
+        headers: upstream.headers,
+      });
+    } catch (err) {
+      return new Response(JSON.stringify({ ok: false, error: String(err) }), {
+        status: 502,
+        headers: { 'content-type': 'application/json' },
+      });
+    }
+  },
+};