Workflow automation for manufacturing

Place each tool in the zone that matches its job before writing a single flow. Business-side n8n belongs in the IT zone, where it can reach MES, ERP and ticketing APIs and where its credentials live in the same controlled store as other enterprise secrets. Edge Node-RED belongs close to the machines, either in a DMZ or in a cell zone, because it reads PLC, historian and sensor data that should not depend on an internet path or a central server to keep running. The decision to make first is which zone owns each credential, since whoever holds a PLC or MES login effectively controls that equipment. Any flow that bridges the two zones crosses a conduit, and that crossing is where most of the risk sits. Document each conduit with its source, destination, protocol, direction and owner, then filter it at the firewall so that only the required ports and endpoints pass. The ISA/IEC 62443 series, which sets the security requirements for industrial automation and control systems, is the usual reference for zone and conduit design, and NIST SP 800-82 Rev. 3 covers the same ground for operational technology. Confirm with your OT security team which of these frameworks your plant already follows before drawing the diagram.

Defaults differ between tools, so check each one rather than assuming it is safe. Apache NiFi binds to 127.0.0.1 when no security configuration is provided, which keeps its UI on the loopback interface, but a production deployment must be configured deliberately for its authentication provider and bind address. For n8n in queue mode, the main instance's encryption key must be shared with every worker and webhook processor so they can decrypt stored credentials. If workers run in a different zone from the main instance, that key has to cross the conduit, so treat it as a secret with its own storage, rotation and access list. Confirm with your implementation partner exactly where each worker runs and who can read that key before the first worker is deployed.

Every flow needs a named owner before the integrator hands over, and that owner must be a person inside the plant or IT organization who can approve changes. Partners often build flows that plant engineers later edit directly in the Node-RED or n8n editor to adjust a set point, add a machine or fix a mapping. Without a written ownership record, nobody knows which version is running on the line or who is accountable when a change breaks a shift report. Confirm the owner, the backup owner and the approval path for each flow, and record them alongside the flow's purpose and the systems it touches.

Version control is what makes that ownership enforceable. n8n's pricing page places environments with Git in the Business and Enterprise plans, so confirm whether the plant's chosen plan includes it before assuming promotion from a test environment to production is available. For Apache NiFi, the registry clients for GitHub and GitLab are documented by the project, which lets flow versions be committed and promoted, though the team must still define who may commit and who may deploy. Ask the integrator to deliver flows in a repository, with exported definitions, environment-specific settings kept out of the flow files and a documented promotion step that a plant engineer can run.

The NiFi upgrade path is a planning item in its own right. NiFi 1.28 is the last minor release of the 1.x series, and the project states that 1.x cannot be maintained further because it depends on Jetty 9.4, Spring Framework 5.3 and AngularJS 1.8. The migration guidance requires upgrading to NiFi 1.27.0 before moving to 2.0.0, and it changes the flow configuration file from flow.xml.gz to flow.json.gz. Plants running older NiFi flows should inventory the flows, check the variable registry and distributed map cache usage that changed in 2.0, and schedule the upgrade with the integrator or internal owner before the flows are needed for a change window.

Start with zone and conduit documentation: ask the partner to show, for a past project, how it documented zones and conduits under the ISA/IEC 62443 series, and which requirements of ANSI/ISA-62443-3-2-2020 its risk assessment covered. Ask who decides which flows may cross from the plant network to the business network, how that rule is enforced (firewall policy, one-way data diode or broker), and whether the flow runtime sits in the zone it serves. Ask how the partner locks down the editors: for Node-RED, whether the editor is bound to loopback or a management network, whether adminAuth is configured with hashed passwords, and whether the HTTP endpoints are restricted. For n8n, ask how SSO and access roles are set, and confirm which features need a paid plan, since SSO, environments with Git and log streaming are listed for Business and Enterprise plans on the n8n pricing page.

Next, ask how credentials and the n8n encryption key are held across zones. In queue mode, workers need the main instance's encryption key to read stored credentials, so ask where that key lives, who can read it, and how it is rotated without breaking worker access. Ask how flow changes are approved, exported and versioned, and whether editing on the plant is blocked in favor of a promotion path from a test environment. Ask how failures reach an operator on shift, not only an inbox, and who receives alerts when a flow stops reading a PLC or MES endpoint. Finally, ask how custom nodes are maintained and patched, and request the handover package in writing: architecture diagrams, network rules, key custody records, runbooks, owner per flow, and a dated patch schedule.

Ask for named owners after handover too. The partner should state which flows the plant team will maintain, which it will keep under retainer, and how the in-house team proves it can edit a flow safely before the partner leaves. Confirm the scope of any retainer in writing, since ongoing support is contracted separately from the fixed-scope implementation.