The self-hosted n8n setup guide.

Any provider works — Hetzner, DigitalOcean, AWS Lightsail. Start with 2 vCPU / 4 GB RAM / 40 GB SSD running Ubuntu 24.04 LTS; that handles tens of thousands of executions a month for roughly $20. Point a DNS A record (e.g. n8n.yourdomain.com) at the server, then harden the basics.

# as root, first login
adduser n8nadmin && usermod -aG sudo n8nadmin
ufw allow OpenSSH && ufw allow 80,443/tcp && ufw enable

# disable root + password SSH login
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart ssh

Docker plus the Compose plugin is the entire runtime. One script, official source.

curl -fsSL https://get.docker.com | sh
usermod -aG docker n8nadmin
docker --version && docker compose version

SQLite is fine for testing; production gets PostgreSQL. Create /opt/n8n/docker-compose.yml with two services and named volumes so data survives container replacement.

services:
  postgres:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_USER: n8n
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: n8n
    volumes:
      - pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n8n"]
      interval: 5s
      retries: 10

  n8n:
    image: docker.n8n.io/n8nio/n8n
    restart: unless-stopped
    ports:
      - "127.0.0.1:5678:5678"
    environment:
      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_USER: n8n
      DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}
      N8N_HOST: n8n.yourdomain.com
      N8N_PROTOCOL: https
      WEBHOOK_URL: https://n8n.yourdomain.com/
      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
      GENERIC_TIMEZONE: America/Los_Angeles
    volumes:
      - n8n_data:/home/node/.n8n
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  pg_data:
  n8n_data:

Secrets live in an .env file next to the compose file — never in the YAML. The encryption key protects every stored credential; lose it and every saved credential is unrecoverable. Back it up somewhere that is not this server.

cd /opt/n8n
cat > .env << 'EOF'
POSTGRES_PASSWORD=$(openssl rand -hex 24)
N8N_ENCRYPTION_KEY=$(openssl rand -hex 24)
EOF
chmod 600 .env

docker compose up -d
docker compose logs -f n8n   # wait for "Editor is now accessible"

n8n listens on localhost only; Caddy terminates TLS in front of it and renews Let's Encrypt certificates automatically. Two lines of config — this is why we prefer it over nginx + certbot for single-app servers.

apt install -y caddy

# /etc/caddy/Caddyfile
n8n.yourdomain.com {
    reverse_proxy 127.0.0.1:5678
}

systemctl reload caddy
# https://n8n.yourdomain.com now serves the editor — create the owner account immediately

Three things to back up: the Postgres database, the n8n data volume, and the .env file. Nightly cron, 14-day retention, and — this part everyone skips — restore it once to prove it works.

# /opt/n8n/backup.sh
#!/usr/bin/env bash
set -euo pipefail
STAMP=$(date +%F)
BACKUP_DIR=/opt/n8n/backups
mkdir -p "$BACKUP_DIR"
docker compose -f /opt/n8n/docker-compose.yml exec -T postgres \
  pg_dump -U n8n n8n | gzip > "$BACKUP_DIR/n8n-db-$STAMP.sql.gz"
docker run --rm -v n8n_n8n_data:/data -v "$BACKUP_DIR":/backup alpine \
  tar czf "/backup/n8n-data-$STAMP.tar.gz" -C /data .
find "$BACKUP_DIR" -mtime +14 -delete

# install: chmod +x backup.sh, then
# crontab -e → 0 3 * * * /opt/n8n/backup.sh
# ship the backups off-box: rclone, S3, or Borg

n8n releases weekly. Update on your schedule, not latest-tag roulette: read the release notes, back up first, then pull and restart. Pin a version tag if you need change control.

cd /opt/n8n
./backup.sh                  # always before updating
docker compose pull
docker compose up -d         # recreates with the new image
docker image prune -f