A platform with twelve building blocks is only as useful as the links between them. Think of Slack alerts when mail lands in quarantine, ERPNext tickets from Wazuh alerts, or onboarding mails when Keycloak creates a new user. Without that workflow glue, every platform stays a pile of loose tools. SecTepe.Comm solves this with two building blocks: n8n and a custom bus gateway.
n8n: Workflow Automation That Can Compete with Code
n8n is a self-hosted workflow engine, much like Zapier or Make. There is one key difference: all data stays on-premise. These features matter in a company setting:
- 200+ built-in nodes: AWS, Azure, GCP, Slack, Teams, GitHub, GitLab, Jira, Mailcow, Keycloak, ERPNext, and Nextcloud are all included.
- Function node: JavaScript code for logic that the standard nodes don't cover. Secrets come from a vault, not from hardcoded values.
- Self-hosted workflow storage: workflows are stored as JSON in Postgres. You can version them with Git.
- Triggers: webhook, cron, mail, database polling, MQTT, and Kafka.
- Run history: you can audit every run, with input, output, and errors. This matters for compliance evidence.
The Bus Gateway: The Missing Piece for True Event-Driven Work
On its own, n8n is pull-based. A workflow polls the source, or something fires a webhook. With twenty services, this soon means hundreds of single webhook setups. That is a nightmare to maintain. So SecTepe.Comm puts an event bus in between:
- Central event layout: every service sends events to the bus gateway. Examples: a mail verdict, a new user, a Wazuh alert, or a paid ERPNext invoice.
- Topic-based routing: workflows subscribe to topic patterns, not webhooks. New workflows need no changes to the services.
- Schema checks: every event has a fixed schema. Bad events are rejected, so they can't break workflows.
- Idempotency keys: the bus drops duplicate events, for example after a service restart.
- Audit sink: every event also lands in the audit log. You can trace everything that happens in the system.
Three Real Workflows We See Every Day
1. Mail Quarantine → Slack Notification → ERPNext Ticket
The mail security gateway fires the event mail.verdict.malicious. The bus routes it to the n8n workflow "quarantine triage". This workflow:
- posts a Slack message in #sec-ops,
- creates an ERPNext ticket with the mail metadata,
- assigns it to the operator on shift.
2. Keycloak User Created → Mailcow Mailbox + Nextcloud Account + Element Account
HR creates a user in Keycloak. The event identity.user.created starts the n8n workflow "onboarding". It sets up a mailbox in Mailcow, assigns a Nextcloud quota, creates a Matrix account, and sends a welcome mail. What used to take "2 hours of onboarding clicks per user" now takes "60 seconds, fully automatic".
3. Wazuh Alert → CTI Lookup → Automatic Block List Extension
Wazuh spots a suspicious IP. The event siem.alert.suspicious_ip starts a workflow that runs a CTI stack lookup. If MISP finds a match, the IP goes straight onto the Mailcow blacklist, the AdGuard blocklist, and the Coraza deny list. Blocking takes three seconds, not 30 minutes of manual work.
What's Hard About a Bus Gateway
We learned three things from two years of running it:
- Schema discipline is a must. If you "decide on event schemas later", you will have a graveyard of broken workflows six months on.
- Backpressure needs to be planned early. Without rate limiting, a storm of Wazuh alerts can knock over every workflow downstream.
- Replay is required. If a workflow has been down for an hour, the bus must be able to send the missed events again.
Conclusion
Platform building blocks are only as useful as the links between them. n8n is a mature workflow engine. Add a bus gateway as the event routing layer, and a set of tools becomes one connected operations framework. Compare that to Zapier, with its US cloud, per-action pricing, and no audit trail. Here, the company gets an automation layer that is self-hosted, EU-sovereign, and fully auditable. As a bonus, you can read and change every workflow in an emergency.