Hi. I use n8n docker installation, published by nginx (NPM). Forward docker internal ip to port 5678. Access via internet n8n.mydomain.com
When I add telegram trigger
and setuped with my bot integration test show that all working good.
But I add for trigger listening any trggiers from bot and its not detected as event
For container I add support of --tunnel at Portainer
How can I troublshooting this situation?
It looks like your topic is missing some important information. Could you provide the following if applicable.
This is likely an issue with the --tunnel option not working probably because the tunnel server is likely loaded. Please try using cloudflare tunnels or ngrok instead.
Something like this perhaps.
Thanks, I will try this solution. But if my digital ocean server have static ip and domain name is --tunnel options really necessary?
If your server is internet accessible, then you don’t need any of these tunneling options.
However, Telegram only allows webhooks to be on port 80 or 443. So, you’d either need to run this server without SSL (not recommended), or you’d need to setup SSL with a valid domain and a valid certificate.
I delete --tunnel option.
Afther that I have error
As issue I add env option for my domain
Now I dont have errors. But when I start testing app I dont have any event when write text to my telegram bot.
How troubleshooting that?
Oh, now I see that problem not in n8n, its problem with telegram webhook:
https://api.telegram.org/bot70315****************BfXrA2JdEx0/getWebhookInfo
{"ok":true,"result":{"url":"https://n8n.***.com/webhook-test/11b3***********551b1/webhook","has_custom_certificate":false,"pending_update_count":8,"last_error_date":1722287797,"last_error_message":"Wrong response from the webhook: 403 Forbidden","max_connections":40,"ip_address":"1**.***.227.***","allowed_updates":["message"]}}
403 Forbidden
What I do:
I take test webhook URL
and registering webhook
https://api.telegram.org/bot7***************rA2JdEx0/setWebhook?url=https://n8n.****.com/webhook-test/11b3bfcc-*********1b1/webhook
Then trying get webhook info
https://api.telegram.org/bot7031*******rA2JdEx0/getWebhookInfo
{"ok":true,"result":{"url":"https://n8n.***.com/webhook-test/11b3bf*******1b1/webhook","has_custom_certificate":false,"pending_update_count":10,"last_error_date":1722289047,"last_error_message":"Wrong response from the webhook: 403 Forbidden","max_connections":40,"ip_address":"1**.***.227.***"","allowed_updates":["message"]}}
I sucsefully register test webhook, but when I want retrive info I have 403.
When go to https://n8n.***.com/webhook-test/11b3b********1b1/webhook
I have
{"code":404,"message":"The requested webhook \"11b3******1b1/webhook\" is not registered.","hint":"Click the 'Test workflow' button on the canvas, then try again. (In test mode, the webhook only works for one call after you click this button)"}
Don’t forget the webhook-test url is only used when the workflow is running in the UI and not for production background executions.
When you are testing are you also sending a post request to test it?
@Jon Hi!
Can you tell me what else the problem could be?
I added the command “start --tunnel” to docker-compose.yml and the module started listening.
But the trigger doesn’t work even for Production URLs
I figured out the reason why nothing works: the thing is that when I set start --tunnel in docker-compose.yml, my webhook address changes automatically to “hooks.n8n.cloud”. However, the environment variable shows a completely different address.
Above, I cited such references and didn’t even pay attention myself.))
Why does the webhook address change automatically?
For your information, my domain is accessible from the outside
ping
dig
nc -zv 443 and 80 ports
curl -I
Hey @Smacktur,
Don’t use the tunnel option it is there for testing only and it replaces the webhook url with a randomly generated one.
Remove that option and it may start working.
@Jon, Hi!
It doesn’t work without it either. That’s the reason for my appeal(
No problems with webhooks - everything works like clockwork, but Telegram Trigger module doesn’t want to start and I don’t understand why.
Yes I have the same problem (using Cloudflare and self-hosting). Everything else seems to work, but not the Telegram Chat. Would be grateful too if anyone has a solution!
For anyone who is tracking this issue: Problems with Telegram Trigger module · Issue #10485 · n8n-io/n8n · GitHub
Just a quick note, I have closed the GitHub issue as it is already reported here and creating duplicates isn’t going to help.
@SandMan00 can you share your full configuration so we can take a look at it?
@Smacktur can your configuration here that doesn’t work without the tunnel option.
I did a test over the weekend using our Digital Ocean guide on a new digital ocean droplet and the node was working there as expected so I suspect this is going to be a local issue we just need to work out where.
Important note: it doesn’t work for me with the tunnel option either
version: '3'
Services:
n8n:
image: n8nio/n8n:latest
container_name: n8n
restart: unless-stopped
expose:
- “5678”
labels:
traefik.enable: “true”.
traefik.http.routers.n8n-container.tls: “true”
traefik.http.routers.n8n-container.tls.options: “no-strict-sni@file”
traefik.http.routers.n8n-container.rule: “Host(`n8n.ХХХХ.tech`)”
traefik.http.routers.n8n-container.entrypoints: “https”
traefik.http.routers.n8n-container-http.rule: “Host(`n8n.ХХХХ.tech`)”
traefik.http.routers.n8n-container-http.entrypoints: “http”.
traefik.http.routers.n8n-container-http.middlewares: “default-https-redirect@file”.
traefik.http.services.n8n-container.loadbalancer.server.port: “5678”
traefik.http.services.n8n-container.loadbalancer.server.scheme: “http”
environment:
N8N_BASIC_AUTH_ACTIVE: “true”
N8N_BASIC_AUTH_USER: “ХХХХ”.
N8N_BASIC_AUTH_PASSWORD: “ХХХХ”
N8N_HOST: “n8n.ХХХХ.tech”
N8N_PORT: “5678”
N8N_PROTOCOL: “https”
NODEJS_PREFER_IPV4: true
NODE_ENV: “production”
WEBHOOK_URL: “https://n8n.ХХХХ.tech/”
GENERIC_TIMEZONE: “ХХХХ”
export N8N_LOG_LEVEL: “debug”
export N8N_LOG_OUTPUT: “file”
export N8N_LOG_FILE_LOCATION: “./n8n/logs/n8n.log”
export N8N_LOG_FILE_MAXSIZE: “50”
export N8N_LOG_FILE_MAXCOUNT: “60”
volumes:
- /opt/docker-n8n/n8n:/home/node/.n8n
- /n8n-local-files:/files
version: '3.8'
x-container: &container
restart: always
logging:
options:
max-size: "200k"
max-file: "10"
services:
traefik:
<<: *container
image: ${TRAEFIK_IMAGE_NAME:-traefik}:${TRAEFIK_IMAGE_TAG:-v2.4}
network_mode: host
env_file:
- traefik.env
command: >-
healthcheck:
test: traefik healthcheck
volumes:
- ./volumes/traefik/etc/traefik:/etc/traefik:ro
- /var/run/docker.sock:/var/run/docker.sock
- traefik-acme:/etc/traefic-acme
#### labels are dynamic configs as well
labels:
# Enable traefik for this container
- traefik.enable=true
# required when "network_mode: host", "expose:" will be ignored
- traefik.http.services.traefik-api.loadbalancer.server.port=${TRAEFIK_PORT:-8080}
# Enable Traefik api and Traefik dashboard
- traefik.http.routers.traefik-api.tls=true
- traefik.http.routers.traefik-api.tls.options=no-strict-sni@file
# - traefik.http.routers.traefik-api.tls.certresolver=internal-acme
- traefik.http.routers.traefik-api.rule=Host(`$TRAEFIK_FQDN`) && (PathPrefix(`/api`, `/dashboard`) || Path(`/`))
- traefik.http.middlewares.traefik-redirect-dashboard.redirectregex.regex=^https:\\\\/\\\\/([^\\\\/]+)\\\\/?$$ # Redirect from "/"
- traefik.http.middlewares.traefik-redirect-dashboard.redirectregex.replacement=https://$$1/dashboard/ # Redirect to "/dashboard/"
- traefik.http.routers.traefik-api.entrypoints=api
- traefik.http.routers.traefik-api.service=api@internal
- traefik.http.routers.traefik-api.middlewares=traefik-auth@docker,traefik-redirect-dashboard@docker
- traefik.http.middlewares.traefik-auth.basicauth.realm=Please authenticate
- traefik.http.middlewares.traefik-auth.basicauth.removeheader=true
- traefik.http.middlewares.traefik-auth.basicauth.usersfile=/etc/traefik/htpasswd/api
# Enable /metrics
# required when "network_mode: host", "expose:" will be ignored
- traefik.http.services.traefik-metrics.loadbalancer.server.port=${TRAEFIK_PORT:-8080}
- traefik.http.routers.traefik-metrics.tls=true
- traefik.http.routers.traefik-metrics.tls.options=no-strict-sni@file
# - traefik.http.routers.traefik-metrics.tls.certresolver=internal-acme
- traefik.http.routers.traefik-metrics.rule=Host(`$TRAEFIK_FQDN`) && Path(`/metrics`)
- traefik.http.routers.traefik-metrics.entrypoints=api
- traefik.http.routers.traefik-metrics.service=prometheus@internal
volumes:
traefik-acme:
I guess the first thing to do here is update your environment options as they are a bit dated.
Can you change your entire environment block to…
environment:
NODEJS_PREFER_IPV4: true
WEBHOOK_URL: https://n8n.ХХХХ.tech
GENERIC_TIMEZONE: ХХХХ
N8N_LOG_LEVEL: debug
N8N_LOG_OUTPUT: file
N8N_LOG_FILE_LOCATION: ./n8n/logs/n8n.log
N8N_LOG_FILE_MAXSIZE: 50
N8N_LOG_FILE_MAXCOUNT: 60
N8N_PROXY_HOPS: 1
This removes the old BASIC_AUTH option and options that you don’t need.
When it comes to Traefik I can see basicauth options does this apply to the n8n urls or is it just for the traefik dashboard? I assume it is the dashboard but I am not that familiar with the settings of Traefik.
As another quick test I have just setup n8n with Traefik using the below…
version: "3.7"
services:
traefik:
image: "traefik"
restart: always
command:
- "--api=true"
- "--api.insecure=true"
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.web.http.redirections.entryPoint.to=websecure"
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.mytlschallenge.acme.tlschallenge=true"
- "--certificatesresolvers.mytlschallenge.acme.email=me@my-internal-domain.com"
- "--certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json"
ports:
- "80:80"
- "443:443"
volumes:
- traefik_data:/letsencrypt
- /var/run/docker.sock:/var/run/docker.sock:ro
n8n:
image: docker.n8n.io/n8nio/n8n
restart: always
ports:
- "127.0.0.1:5678:5678"
labels:
- traefik.enable=true
- traefik.http.routers.n8n.rule=Host(`n8n.my-internal-domain.com`)
- traefik.http.routers.n8n.tls=true
- traefik.http.routers.n8n.entrypoints=web,websecure
- traefik.http.routers.n8n.tls.certresolver=mytlschallenge
- traefik.http.middlewares.n8n.headers.SSLRedirect=true
- traefik.http.middlewares.n8n.headers.STSSeconds=315360000
- traefik.http.middlewares.n8n.headers.browserXSSFilter=true
- traefik.http.middlewares.n8n.headers.contentTypeNosniff=true
- traefik.http.middlewares.n8n.headers.forceSTSHeader=true
- traefik.http.middlewares.n8n.headers.SSLHost=my-internal-domain.com
- traefik.http.middlewares.n8n.headers.STSIncludeSubdomains=true
- traefik.http.middlewares.n8n.headers.STSPreload=true
- traefik.http.routers.n8n.middlewares=n8n@docker
environment:
- N8N_HOST=n8n.my-internal-domain.com
- N8N_PORT=5678
- N8N_PROTOCOL=https
- NODE_ENV=production
- WEBHOOK_URL=https://n8n.my-internal-domain.com/
- GENERIC_TIMEZONE=Europe/London
volumes:
- n8n_data:/home/node/.n8n
volumes:
traefik_data:
external: true
n8n_data:
external: true
When sending this…
In n8n I see this…
Under my webhook for the Telegram trigger I have the correct URL
If I check the /getWebhookInfo and output it to jq to make it nicer to read I can see the URL and IP.
I wonder if maybe the issue is with the proxy redirection, It would be interesting to see if you get the same result if you simplify the setup and use our example compose file (or the one above) and see if that works that would then confirm if it is an issue in your traefik config or something else.
