N8n ignores trust proxy settings in Docker on Google Cloud VM

Questions
1

I am on a Google Cloud VM.
My traffic flow is Cloudflare → Nginx → Docker.
My nginix configuration:

server {

listen 80;

server_name ;

# Redirect all HTTP requests to HTTPS

return 301 https://$host$request_uri;

}

server {

listen 443 ssl http2;

server_name ;

ssl_certificate /etc/letsencrypt/live/industry-trends.org/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/industry-trends.org/privkey.pem;

ssl_session_cache shared:SSL:10m;

ssl_session_timeout 1h;

ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256->

ssl_protocols TLSv1.2 TLSv1.3;

ssl_prefer_server_ciphers on;

# HSTS (optional, but recommended for security)

add_header Strict-Transport-Security “max-age=31536000; includeSubDomains” always;

location / {

proxy_pass local host 5678 address; # <removing the link due to 5 link limit>

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection “upgrade”;

proxy_read_timeout 900s; # Increase if you have long-running workflows

}

}

These are the error logs I keep on getting:

docker logs -f n8n
Permissions 0644 for n8n settings file /home/node/.n8n/config are too wide. This is ignored for now, but in the future n8n will attempt to change the permissions automatically. To automatically enforce correct permissions now set N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true (recommended), or turn this check off set N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=false.
Initializing n8n process
n8n ready on ::, port 5678

There is a deprecation related to your environment variables. Please take the recommended actions to update your configuration:

  • N8N_RUNNERS_ENABLED → Running n8n without task runners is deprecated. Task runners will be turned on by default in a future version. Please set N8N_RUNNERS_ENABLED=true to enable task runners now and avoid potential issues in the future. Learn more: task runner n8n docs

[license SDK] Skipping renewal on init: license cert is not initialized
Version: 1.107.0

Editor is now accessible via:

ValidationError: The ‘X-Forwarded-For’ header is set but the Express ‘trust proxy’ setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users. See Page Redirection for more information.
at Object.xForwardedForHeader (/usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:187:13)
at Object.wrappedValidations. [as xForwardedForHeader] (/usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:398:22)
at Object.keyGenerator (/usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:671:20)
at /usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:724:32
at /usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:704:5 {
code: ‘ERR_ERL_UNEXPECTED_X_FORWARDED_FOR’,
help: ‘https://express-rate-limit.github.io/ERR_ERL_UNEXPECTED_X_FORWARDED_FOR/%E2%80%99
}
(node:7) [DEP0060] DeprecationWarning: The util._extend API is deprecated. Please use Object.assign() instead.
(Use node --trace-deprecation ... to show where the warning was created)
ValidationError: The ‘X-Forwarded-For’ header is set but the Express ‘trust proxy’ setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users. See Page Redirection for more information.
at Object.xForwardedForHeader (/usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:187:13)
at Object.wrappedValidations. [as xForwardedForHeader] (/usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:398:22)
at Object.keyGenerator (/usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:671:20)
at /usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:724:32
at /usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:704:5 {
code: ‘ERR_ERL_UNEXPECTED_X_FORWARDED_FOR’,
help: ‘https://express-rate-limit.github.io/ERR_ERL_UNEXPECTED_X_FORWARDED_FOR/’
}
ValidationError: The ‘X-Forwarded-For’ header is set but the Express ‘trust proxy’ setting is false (default). This could indicate a misconfiguration which would prevent express-rate-limit from accurately identifying users. See Page Redirection for more information.
at Object.xForwardedForHeader (/usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:187:13)
at Object.wrappedValidations. [as xForwardedForHeader] (/usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:398:22)
at Object.keyGenerator (/usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:671:20)
at /usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:724:32
at /usr/local/lib/node_modules/n8n/node_modules/.pnpm/express-rate-limit@7.5.0_express@5.1.0/node_modules/express-rate-limit/dist/index.cjs:704:5 {
code: ‘ERR_ERL_UNEXPECTED_X_FORWARDED_FOR’,
help: ‘https://express-rate-limit.github.io/ERR_ERL_UNEXPECTED_X_FORWARDED_FOR/’
}

Note: I have already tried deleting the Docker volume and have tried multiple n8n versions (1.108.1 and 1.107.0) with the same result.

Any help will be appreciated.

~TIA

2

There are a number of warnings you get, here is what you could try to get rid of em

  • “Permissions … are too wide”
    • set N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true for n8n to auto-correct the permissions (read here)
  • “N8N_RUNNERS_ENABLED” deprecation
    • set N8N_RUNNERS_ENABLED=true for n8n to enable task runners now to be future-proof (read here)
  • “ValidationError: The ‘X-Forwarded-For’ header is set but Express ‘trust proxy’ is false”
    • set N8N_PROXY_HOPS=2 (or 3,4,5… → how ever many proxy hops are between the client and the server for n8n to know how many it should trust. (read here and here)