Configure n8n OAuth redirects behind Caddy

[sidey79]

What changed

• explicitly forward the public host and protocol from Caddy to n8n
• document the required WEBHOOK_URL and N8N_PROXY_HOPS settings for the separate n8n stack
• extend the isolated n8n mock and endpoint policy checks for OAuth callbacks
• verify callback query preservation, allowed methods, and protection of unrelated REST endpoints

Why

A self-hosted n8n instance behind Caddy can otherwise advertise http://localhost:5678/rest/oauth2-credential/callback, which is only valid for a truly local development instance. Google OAuth needs the externally reachable HTTPS callback URL, while the remaining n8n REST API must stay private.

Impact

After the documented n8n environment settings are applied, credentials can use https://workflow.<CADDY_SUBDOMAIN>/rest/oauth2-credential/callback. The existing narrow public callback route remains limited to GET, HEAD, and OPTIONS; POST and unrelated /rest/* endpoints are not exposed.

Validation

• bash scripts/test-auth-protected-endpoints.sh caddy/Caddyfile
• bash scripts/test-auth-endpoints-e2e.sh
• shell syntax checks for both auth test scripts
• Python compile check for tests/e2e/mock_n8n.py
• git diff --check
• Caddyfile successfully adapted with Caddy 2.11.4; full standalone validation cannot provision the repository's private production PKI files in the isolated container

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 16f6d3175c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".