Global Shipping AI Workflow Automation PoC

Owned the infrastructure, observability, and performance-verification tracks of a four-week n8n workflow-automation PoC for a global shipping company. I bootstrapped a five-VM greenfield architecture running n8n Community Edition in Queue Mode, and built a Grafana Alloy remote_write observability stack. I ran the hybrid-OCR prompt PoC for MSDS document-verification automation and single-handedly performed k6-based performance and load testing. I also wired up the MS Teams AI chatbot and its human-in-the-loop approval gate. Separately from the PoC environment, I reproduced the same stack with Terraform on an internal AWS account so the team could build and verify workflows outside the closed network.

Architecture

InfoGrab Logistics & Shipping

2026.06 - 2026.07

Global Shipping Company

Tech Stack

n8n Queue Mode Terraform AWS EC2 IAM SSM Parameter Store Route53 Docker PostgreSQL Redis Grafana Prometheus Loki Grafana Alloy MS Teams HITL OCR k6 MCP

Highlights

Bootstrapped an n8n Community Edition Queue Mode greenfield architecture across five VMs — separated PostgreSQL and Redis queues, pinned image versions for reproducible deployment
Single-handedly built a Grafana Alloy remote_write observability stack — Grafana, Prometheus, Loki, and a Redis exporter to surface workflow execution and queue state
MSDS document-verification automation — ran a hybrid prompt PoC cross-checking general OCR against an LLM, and operated the live workflow deployment
Ran two rounds of k6 load testing single-handedly — round one showed the throughput ceiling came from a conservative concurrency setting rather than resources; round two found memory was consumed by a separate task runner rather than the worker, relocating the guardrail, and scaled concurrency to 120 to derive a recommended setting
Wired up the MS Teams AI chatbot and its human-in-the-loop approval gate — validated MCP integration and notification delivery
Reproduced the same stack on an internal AWS account with Terraform, separate from the PoC environment — EC2, instance IAM role, SSM Parameter Store, and Route53 declared as code, giving the team a standing workspace to build and verify workflows outside the closed network

Key Tasks

PoC Infrastructure (Queue Mode)

Distributed n8n Community Edition Queue Mode across five VMs — separate main, worker, PostgreSQL, Redis, and observability nodes
Reproducible bootstrap via pinned image versions and environment templates
Asynchronous workload processing on a Redis queue for concurrent-execution scaling

Observability Stack

Configured Grafana Alloy in a remote_write push model — the agent ships metrics and logs to a central stack
Dashboards for workflow execution, queue backlog, and resource usage via Grafana, Prometheus, Loki, and a Redis exporter

MSDS Document-Verification Automation

Ran a hybrid prompt PoC combining general OCR extraction with LLM cross-verification
Iterated prompts through a live fetch → edit → deploy workflow operations loop

Performance Verification and Teams / HITL

Designed k6 load scenarios, authored the run guide, and delivered both rounds of measured results
Round two modelled the real workload (external wait + parsing CPU + document memory), surfacing the parsing cost round one had missed
Deliberately exceeded the memory guardrail to verify that only the task runner restarts while host and worker stay up
Wired the MS Teams AI chatbot and human-in-the-loop approval gate; validated MCP integration and notifications

AWS Sandbox (Terraform, separate track)

Built a standing team workspace outside the PoC environment — the same stack reproduced in a scaled-down form on an internal AWS account
EC2, EIP, security group, Route53 A record, and instance IAM role declared in Terraform, with an encrypted root volume
Secrets held as six SecureString parameters in SSM Parameter Store — the instance role may read only its dedicated prefix, and KMS decryption is scoped to requests made through SSM
No secret value lands in Terraform state, the repository, or chat
Account lock on the provider, so plan and apply are refused from any other account
Shell access via SSM Session Manager, so no keys had to be distributed; container ports are not published to the host and only the reverse proxy serves 80/443
Let's Encrypt issued automatically by the reverse proxy — verified after boot by a 200 health check, a valid certificate, and a ready worker confirming the queue wiring

삶을 기록하는 두 축

Architecture