Snipe-IT asset agreement automation

How it works

1. IT checks a laptop or phone out (or back in) in Snipe-IT, as they already do.
2. n8n confirms the event against Snipe-IT’s own activity log, fills in the right agreement and sends it through Documenso: the employee signs first, then the IT admin who did the handover.
3. Once both have signed, the PDF is attached to the asset in Snipe-IT and backed up to Google Drive, in a folder per asset.
4. Rejections, agreements left unsigned and workflow failures reach IT by email. Snipe-IT is never changed automatically.

Built twice, compared

n8n Cloud has no fixed IP address, so an IP allowlist can’t protect Snipe-IT’s API. In the first version, the API had its own hostname that required mutual TLS: a client certificate signed by a private CA, plus a least-privilege API token. Every webhook is treated as a signal only and verified against Snipe-IT’s own records before anything is sent.

I then rebuilt it with n8n self-hosted next to Snipe-IT and compared the two. The API calls never leave the server (Snipe-IT’s audit trail shows an internal address instead of a shared public IP), the API hostname is gone, only one webhook path is public, and it added no compute cost. Every system now runs on one business timezone, so agreement dates and signing times match the audit trail. The self-hosted version is the one the Terraform rebuild will codify.

Stack

Status

• AWS infrastructure, built by hand in the console●done
• Signing automation on n8n Cloud, secured with mutual TLS●done
• Self-hosted n8n rebuild and comparison●done
• Terraform rebuild of the infrastructure●in progress