Self-Hosted Workflow Automation With a Local LLM

A website contact form that receives 1,000 submissions a month has a dropdown labeled "Topic" and a free-text box. If 600 people pick a sensible topic, a plain rule routes them for free. The other 400 choose "Other" and write a paragraph, and that is where a language model earns its place: read the paragraph, pick a queue, pull out a phone number or order reference. An n8n AI workflow, self-hosted next to a local model, does this without the paragraph ever leaving your network.

The pieces and how they connect

A self-hosted automation setup with a local model has three parts:

• The automation tool. n8n is a common choice: a visual editor where each step is a node, with integrations for mail, databases and webhooks.
• The model server. Ollama, llama.cpp server or vLLM on the same machine or the LAN.
• Your existing systems. The mailbox, the ticketing tool, the database.

The model never talks to your systems directly. The workflow passes it text, gets text or JSON back, and the workflow decides what to do next. That separation is the main design advantage over handing a model a set of tools and letting it decide, which is the approach described in what AI agents can realistically do on-premise.

Check the license before you build a product on it

n8n is source-available, not open source in the OSI sense. Its main license, the Sustainable Use License in the project's LICENSE.md, says you may use or modify the software "only for your own internal business purposes or for non-commercial or personal use", and may distribute it to others only free of charge for non-commercial purposes. Source files with .ee. in the filename or .ee in a directory name sit under a separate enterprise license. Automating your own back office fits the internal-use terms. Reselling hosted workflows to customers may not, so put that question to whoever reviews your software licenses. This is general information, not legal advice.

Pointing n8n at a local model

n8n's AI features are built from root nodes (the step that does the work) and sub-nodes (the model, a parser, a memory). The model sub-node for a local Ollama server is the Ollama Chat Model, configured through an Ollama credential. According to the Ollama credential docs, the base URL defaults to http://localhost:11434.

That default is the first thing to break in a Docker setup. Inside the n8n container, localhost means the container itself, not the host where Ollama runs. The docs suggest trying 127.0.0.1 when connecting to a local server and, when n8n and Ollama run in separate containers, changing OLLAMA_HOST to an address the other container can reach. Putting both containers on one Docker network and using the service name as the host is usually the cleanest fix.

Choosing the model step

n8n offers several AI root nodes. Each fits a different job, and picking the narrowest one makes the output easier to branch on.

Node	What it returns	Good for
Text Classifier	The item, routed to one output per category	Sorting messages, forms, tickets
Information Extractor	A JSON object matching a schema you define	Pulling fields out of free text
Basic LLM Chain	Text, or parsed output if a parser is attached	Drafting, summarizing, rewriting
AI Agent	The result of a model calling tools in a loop	Open-ended tasks, with more risk

For the contact form, the Text Classifier is the natural fit. Each category has a name and a description, and the node docs note that the description is what tells the model what the category means. Write them like instructions to a new employee: "sales: a prospect asking about price or a quote, not an existing customer".

The Information Extractor takes a schema in one of three ways: attribute descriptions, a JSON example, or a hand-written JSON Schema. With the JSON example option, the docs say every field is treated as mandatory, which forces the model to invent a value when the text has none. For optional fields such as an order number, write the JSON Schema by hand and mark them optional. The general problem of getting a local model to emit valid JSON, and the constrained decoding options in each runtime, is covered in getting reliable JSON out of a local LLM.

Branching on the model's output

Route on fields, not on prose

A workflow should branch on a small set of known values. If a Basic LLM Chain returns "This looks like a sales enquiry, probably", an IF node checking for the word "sales" will misfire sooner or later. Either use the Text Classifier, which gives one output connection per category, or attach a Structured Output Parser and branch on a field such as label with a Switch node.

Decide what happens to the item nobody claims

The Text Classifier has an option called When No Clear Match. Its default is Discard Item, which drops the item. In a contact form workflow that means a confused customer's message disappears without trace. Change it to Output on Extra, 'Other' Branch and send that branch to a person, for example as a task in the shared inbox. The same thinking applies to any model step: every path through the workflow should end somewhere a human can see it.

Add a confidence gate where mistakes are expensive

A misrouted sales lead costs a forwarded email; a wrongly approved invoice costs money. Where the downstream action is costly, ask the model for a confidence field alongside the label and send anything below "high" to review. Treat that field as a hint, not a calibrated probability; models are often confidently wrong. The real check is measuring misroutes on a test set, as shown in email triage with a private LLM.

Error handling for a model step

A model step can time out, return malformed output, or return valid output that is wrong. n8n has three tools for the first two.

Per-node settings. Every node has a Settings tab. Retry On Fail reruns a failed node, which handles a model server that was briefly overloaded or restarting. On Error offers Stop Workflow, Continue, and Continue (using error output). The last one adds an error branch to the node, so a failed classification can go straight to the human review queue instead of stopping everything.

Output repair. The Text Classifier has an Enable Auto-Fixing option that sends schema parsing errors back to the model to correct, and the Basic LLM Chain can use an Auto-fixing Output Parser. Each repair is another model call, so frequent repairs signal a bad prompt or schema.

An error workflow. Per the error handling docs, a separate workflow that starts with an Error Trigger node can be set in a workflow's settings and runs whenever an execution fails. It receives the error message, the last node executed and, when the execution was saved, a link to it. One error workflow can serve many workflows. Use it to alert the team.

Execution logs hold your data

n8n saves execution data, and for a model step that includes the full prompt and response. For customer messages or invoices, that history is another store of sensitive text. The execution data docs state that pruning is on by default, with EXECUTIONS_DATA_MAX_AGE defaulting to 336 hours (14 days) and EXECUTIONS_DATA_PRUNE_MAX_COUNT defaulting to 10,000. Setting EXECUTIONS_DATA_SAVE_ON_SUCCESS to none keeps only failed runs, which are the ones you need for debugging. Decide this deliberately and write it into the retention policy.

When a plain rule beats the model

The model step is the slowest, least predictable node in the workflow. Put a rule in front of it wherever a rule can decide.

Back to the contact form. Suppose a classification call takes about 3 seconds on your hardware (measure your own). Sending all 1,000 submissions to the model costs 1,000 x 3 = 3,000 seconds of GPU time a month. Routing the 600 with a usable dropdown value by a Switch node, and sending only the 400 free-text ones to the model, costs 400 x 3 = 1,200 seconds. The bigger gain is that 600 items now route the same way every time, with nothing to evaluate or retrain.

Rules win when:

• The answer is already a field. A dropdown, a sender domain, a form ID, an attachment type.
• The pattern is fixed. Invoice numbers, postcodes, order IDs and dates in a known format are better matched with a regular expression than extracted by a model.
• The action is irreversible or financial. Paying, deleting, sending to a customer. Let the model propose; let a rule or a person approve.

The model wins on free text written by people who ignore your categories, where an occasional misroute costs little.

Keep the model away from actions driven by outside text

A workflow that reads outside email or form text and then calls a node that writes, sends or deletes based on the model's output can be steered by instructions planted in that text. Keep the model's output to labels and fields that a Switch node maps to a fixed set of actions, and do not let it compose the parameters of a destructive call. The broader risk is explained in how prompt injection works. A sound first build is a workflow where every model-driven branch ends in a draft, a label or a task for a person, and only after a few weeks of logged results does any branch act on its own.

Frequently asked questions

Can n8n run fully offline with a local model?

The core runtime and an Ollama model on the same network do not need the internet to execute a workflow. Integrations that call cloud services still do, and installing community nodes or pulling new models needs a connection or a manual transfer. By default n8n also sends diagnostics and checks for versions and templates; its isolation docs list N8N_DIAGNOSTICS_ENABLED=false, N8N_VERSION_NOTIFICATIONS_ENABLED=false and N8N_TEMPLATES_ENABLED=false, among others, to stop that. Test with outbound traffic blocked before relying on it.

Should one model server be shared by several workflows?

It can be, but a burst from one workflow slows every other model step. Give time-sensitive workflows Retry On Fail, run bulk jobs off-hours, and watch the error workflow for repeated timeouts before buying more hardware.

Should the AI Agent node be used for routine routing?

Usually not. An agent decides which tools to call, which adds steps that can go wrong and makes behavior harder to predict. For a task with a known shape, a classifier or extractor followed by fixed branches is easier to test and to trust.