3. Public webhook hostname¶

One n8n, two published hostnames, two auth modes.

3.0 Why¶

Callers without a browser cannot complete an interactive login. Stripe, GitHub and a curl from a café have no browser and no password, so on the org hostname from chapter 2 every one of them stops at the sign-in page. That is the org auth mode working as designed, but it also means there is no public endpoint for inbound calls yet.

Two ways out are wrong. Setting the editor app to None does accept those calls, and it also exposes the canvas, the credentials and every workflow you will ever write. Carving out one public path on the org hostname is not on offer either: Edgible auth is a property of the app, that is the hostname, not of a path inside it. With a single hostname you can only choose which side to break: webhooks that reject strangers, or a canvas that accepts them.

Edgible’s answer is that hostnames are cheap and auth modes are per hostname. You point a second app at the same container on port 5678, name it n8n-hooks, and give it None. One process, two hostnames, two auth modes. All WEBHOOK_URL does after that is tell n8n which origin to print on its webhook nodes; the traffic lands on the same process either way.

you, on cellular       https://n8n.<org>.edgible.com        ← org login
                                 │
Ubuntu guest           Edgible serving agent ──► 127.0.0.1:5678
                                 │
                       n8n  (one process · canvas · credentials · workflows)
                                 ▲
Stripe / GitHub        https://n8n-hooks.<org>.edgible.com  ← None   (this chapter)

Where you run this: edgible and the compose edit on the Ubuntu guest; the certificate check in the host browser; the editor re-check on your phone.

3.1 The job¶

Stripe, GitHub, and curl from a café will not pass Edgible org. You add a second application on the same port 5678, named n8n-hooks, with None. Then you tell n8n that webhook URLs are that origin (WEBHOOK_URL). The editor stays n8n.<org>… with org.

Anyone who learns a workflow’s webhook path can hit it. Use a throwaway path, deactivate when done, do not put secrets in the JSON you return.

Done when

edgible app list shows n8n (org) and n8n-hooks (None), both port 5678.
Both certificates are issued.
~/n8n/docker-compose.yml has WEBHOOK_URL=https://n8n-hooks.<org>.edgible.com/ (trailing slash, no :5678).
N8N_EDITOR_BASE_URL / N8N_HOST are the editor host.
docker compose up -d has been run again, and the phone still opens the org editor.
Hello World still loads. Port 5678 not forwarded.

Need first: 2. n8n editor through Edgible. Leave both n8n Docker and hello-world running.

Not this chapter: building a workflow (that is 4 and 5), OpenClaw, or putting the editor on None.

3.2 Create n8n-hooks¶

Same device, same port, different name and auth:

edgible device list
edgible app create existing \
  --name n8n-hooks \
  --port 5678 \
  --auth-modes none \
  --device-id <mini-pc-id>

Wait for the certificate (console → n8n-hooks), same as Hello World.

edgible app list

Copy https://n8n-hooks.YOUR-ORG.edgible.com exactly (no path). If the CLI refuses a second app on 5678, stop. This series needs two hostnames; do not “fix” it by setting the n8n editor app to None.

3.3 Point n8n at the two origins¶

On the VM, edit ~/n8n/docker-compose.yml. Keep the loopback publish. Add/set:

    environment:
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - N8N_PROXY_HOPS=1
      - N8N_HOST=n8n.YOUR-ORG.edgible.com
      - N8N_EDITOR_BASE_URL=https://n8n.YOUR-ORG.edgible.com/
      - WEBHOOK_URL=https://n8n-hooks.YOUR-ORG.edgible.com/
      - GENERIC_TIMEZONE=Australia/Adelaide
      - TZ=Australia/Adelaide
      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true

Replace YOUR-ORG with the labels from edgible app list. Trailing slashes on the two https:// URLs. No :5678 on those URLs.

cd ~/n8n
docker compose up -d
docker compose ps

Smoke test. Hard-refresh the org editor on the phone. Canvas should still load. Webhook nodes will still be empty until chapter 5; you are only setting the base URL.

Verify¶

edgible app list shows n8n (org) and n8n-hooks (None), both port 5678.
Both certificates are issued.
~/n8n/docker-compose.yml has WEBHOOK_URL=https://n8n-hooks.<org>.edgible.com/ (trailing slash, no :5678).
N8N_EDITOR_BASE_URL / N8N_HOST are the editor host.
docker compose up -d has been run again, and the phone still opens the org editor.
Hello World still loads. Port 5678 not forwarded.

Next¶

4. A cron workflow. Series: README.

Last updated 28 August 2026