Self-Host n8n: Docker Compose, PostgreSQL and Caddy on a VPS

Want to self-host n8n instead of using the cloud version? This guide shows you step by step how to install n8n on a VPS, run it with PostgreSQL as the database and make it reachable via a reverse proxy with HTTPS. Current server prices are in the n8n calculator and the VPS comparison.

Important: Self-hosting requires basic Linux, Docker and network configuration skills. Mistakes can lead to data loss or security holes.

Why self-host n8n?

n8n Cloud is convenient because the provider handles hosting, updates and operations. Billing there is by executions; an execution is one complete run of a workflow (n8n website, as of Nov 8, 2026). Check the current pricing page before you decide, because plan names and prices can change.

Prices for a VPS with 2 to 4 GB RAM are in the n8n calculator and the VPS comparison. On your own server, CPU, RAM and database limit how much runs. You decide where your data lives.

Without a license key, n8n runs as the Community Edition with no license fee; business and enterprise features need a paid license key (n8n docs, as of Nov 8, 2026). n8n is under the Sustainable Use License, which limits use to your own internal business purposes and non-commercial or personal use (n8n repo, as of Nov 8, 2026).

Cost comparison: self-hosting vs. n8n Cloud

Privacy and GDPR

If your workflows process customer data, email addresses or form data, server location matters. On your own server the data sits where you ordered the server. If you process other people's data, you remain responsible for GDPR compliance; usually that includes a data processing agreement with the host.

Executions on your own server

On n8n Cloud, every complete workflow run counts as an execution (n8n website, as of Nov 8, 2026). A schedule trigger every 5 minutes starts 8,640 runs in 30 days by arithmetic. On your own server, CPU, RAM and database limit the number of runs.

Hardware requirements

Before you start, know what hardware you need. The table is RackDiff guidance, not a vendor figure; the values follow the n8n calculator:

n8n gives no general minimum. For OEM installations, n8n gives 320 MB to 2 GB of memory as a guide, derived from n8n Cloud (n8n docs, as of Nov 8, 2026). Large JSON and binary data, many nodes, Code nodes, manual runs and parallel workflows need more memory; process large data in smaller batches (n8n docs, as of Nov 8, 2026).

Which VPS for n8n? Four providers at a glance

You need a VPS that runs Docker (e.g. with KVM virtualization) and a system Docker supports, such as Ubuntu 24.04 or 22.04 LTS (Docker docs, as of Nov 8, 2026). The four providers from the RackDiff catalog below are alphabetical; prices are in the n8n calculator.

Contabo Cloud VPS

Contabo uses KVM virtualization; Cloud VPS plans start at 4 vCPU and 8 GB RAM, with locations in Europe, the UK, the Americas, Asia and Australia (Contabo website, as of Nov 8, 2026). More on Contabo.

Hetzner Cloud

Hetzner Cloud offers a REST API and a CLI plus integrations for Ansible, Terraform and Kubernetes (Hetzner website, as of Nov 8, 2026). The n8n guide for Hetzner suggests the CPX11 server type, with the n8n Assistant at least 4 GB RAM and 2 vCPU (n8n docs, as of Nov 8, 2026). More on Hetzner.

IONOS VPS

IONOS offers support by phone, chat or email around the clock; you choose the server location when ordering (EU, US, UK). The VPS S+ plan has 1 vCore, 2 GB RAM and 60 GB NVMe (IONOS website, as of Nov 8, 2026). More on IONOS.

Strato Linux V-Server

STRATO belongs to IONOS Group SE (Strato website, as of Nov 8, 2026). A 24/7 hotline can be booked for a fee; OS reinstall, an upstream firewall, VNC console and rescue system are in the customer login; Strato names two data centers in Europe and data storage only in the EU (Strato website, as of Nov 8, 2026). More on Strato.

Direct comparisons

Two pairs of these providers side by side: Contabo vs. Hetzner and IONOS vs. Strato.

Step 1: Set up the VPS

After ordering you get an IP address and, depending on the provider, a root password or access via a stored SSH key. Connect via SSH:

ssh root@your-server-ip

Then update the system and install basic packages:

apt update && apt upgrade -y
apt install -y curl wget git ufw

First create your own user. Working as root is unsafe:

adduser n8nuser
usermod -aG sudo n8nuser

Then switch to the new user:

su - n8nuser

Step 2: Install Docker

For production with a database, n8n names Docker Compose (n8n docs, as of Nov 8, 2026). Install Docker Engine from the apt repository; Docker does not recommend the convenience script for production (Docker docs, as of Nov 8, 2026).

To use Docker without sudo, add your user to the docker group. The group grants root-level privileges (Docker docs, as of Nov 8, 2026):

sudo usermod -aG docker $USER
newgrp docker

Check that Docker and Docker Compose work:

docker --version
docker compose version

Without Docker, n8n can also be installed with npm and Node.js 20.19 to 24.x; the npm install is marked deprecated from n8n 3.0 (n8n docs, as of Nov 8, 2026).

Step 3: Start n8n with Docker Compose (production setup)

By default n8n uses SQLite; for a production instance n8n recommends PostgreSQL (n8n docs, as of Nov 8, 2026). Supported are PostgreSQL 17 and 18, version 16 for compatibility (n8n docs, as of Nov 8, 2026).

The basis is the official PostgreSQL example from the n8n-hosting repository (n8n repo, as of Nov 8, 2026):

git clone https://github.com/n8n-io/n8n-hosting.git
cp -r n8n-hosting/docker-compose/withPostgres ~/n8n && cd ~/n8n

Change the default passwords in .env. Then adjust three things:

1. Port local only: Ports published by Docker bypass ufw (Docker docs, as of Nov 8, 2026). Replace the n8n service's port line 5678:5678 with 127.0.0.1:5678:5678, as in the n8n docs' Compose example (n8n docs, as of Nov 8, 2026).
2. Domain and webhooks: set N8N_HOST, N8N_PROTOCOL=https and N8N_WEBHOOK_URL. N8N_WEBHOOK_URL is the base URL for webhooks behind a reverse proxy; WEBHOOK_URL is deprecated since 2.35.0 (n8n docs, as of Nov 8, 2026).
3. Your own key: set N8N_ENCRYPTION_KEY. It encrypts credentials before they're stored (n8n docs, as of Nov 8, 2026).

For the n8n service this looks like (port line replaced, environment entries added):

    ports:
      - "127.0.0.1:5678:5678"
    environment:
      - N8N_HOST=n8n.your-domain.com
      - N8N_PROTOCOL=https
      - N8N_WEBHOOK_URL=https://n8n.your-domain.com/
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
      - GENERIC_TIMEZONE=Europe/Berlin

Generate the key with openssl rand -hex 32 and add it as N8N_ENCRYPTION_KEY=… to .env. Keep it safe: without this key, backed-up credentials can't be decrypted (n8n docs, as of Nov 8, 2026).

Start the setup and check that both containers run:

docker compose up -d
docker compose ps

After step 4, n8n is reachable at https://n8n.your-domain.com. On first access you create the owner account (n8n docs, as of Nov 8, 2026).

Step 4: Reverse proxy with Caddy

n8n should not be reachable directly on port 5678. The n8n docs show Traefik in the Compose example and Caddy in the Hetzner guide (n8n docs, as of Nov 8, 2026). This setup uses Caddy; Caddy gets certificates from Let's Encrypt or ZeroSSL by default and renews them (Caddy docs, as of Nov 8, 2026).

Install Caddy from the package repository for Debian and Ubuntu (Caddy docs, as of Nov 8, 2026).

Edit the Caddy configuration at /etc/caddy/Caddyfile:

n8n.your-domain.com {
    reverse_proxy 127.0.0.1:5678 {
        flush_interval -1
    }
}

flush_interval -1 comes from the Caddy example in the n8n docs and turns off response buffering (Caddy docs, as of Nov 8, 2026).

Make sure your DNS A record points to your server's IP. Then reload the configuration:

sudo systemctl reload caddy

Troubleshooting: If Caddy gets no certificate, check that ports 80 and 443 are reachable from outside and that the DNS record points to your server IP (Caddy docs, as of Nov 8, 2026).

Security

A publicly reachable server needs basic hardening. Here are three basic system-level measures; n8n names more, such as a security audit, two-factor login and restricting the public API (n8n docs, as of Nov 8, 2026).

Firewall with ufw

ufw is Ubuntu's default firewall configuration tool and initially disabled (Ubuntu Server docs, as of Nov 8, 2026). You installed it in step 1:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80
sudo ufw allow 443
sudo ufw enable

Now SSH (port 22), HTTP (port 80) and HTTPS (port 443) are reachable from outside. Port 5678 is bound locally only (127.0.0.1); that's needed because ports published by Docker bypass ufw (Docker docs, as of Nov 8, 2026).

Fail2ban against brute force

fail2ban blocks IP addresses with too many failed login attempts:

sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status

The last command shows which jails are active. fail2ban doesn't cover logins to n8n itself without a dedicated jail; for that, n8n has two-factor login.

Keep the system updated

Apply security updates regularly. Automatic updates are the easiest way:

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Security updates are then installed automatically. You update the Docker images (n8n, PostgreSQL) yourself (see next section).

Backups and updates

Back up n8n data

A full backup includes the .n8n folder and the external database, backed up with its own tools (n8n docs, as of Nov 8, 2026). Back up the .env with the N8N_ENCRYPTION_KEY too.

cd ~/n8n
mkdir -p backups

# Database while running (user and database from your .env)
docker compose exec -T postgres pg_dump -U <POSTGRES_USER> <POSTGRES_DB> > backups/n8n-db-$(date +%Y%m%d).sql

# n8n data (volume name from your Compose file, in ~/n8n e.g. n8n_n8n_storage)
docker run --rm \
  -v n8n_n8n_storage:/data \
  -v $(pwd)/backups:/backup \
  alpine tar czf /backup/n8n-data-$(date +%Y%m%d).tar.gz -C /data .

cp .env backups/env-$(date +%Y%m%d)

-T is needed because docker compose exec otherwise allocates a terminal (Docker docs, as of Nov 8, 2026). Set up a cron job that runs the backup daily and deletes backups after 30 days.

You download single workflows as a JSON file from the workflow menu. The file holds only names and IDs of credentials, no secrets (n8n docs, as of Nov 8, 2026).

Update n8n

n8n ships a new minor version almost every week (n8n docs, as of Nov 8, 2026). Update at least monthly and check the release notes for breaking changes first (n8n docs, as of Nov 8, 2026).

The flow: make a backup, raise the n8n version in the Compose file or .env, then:

cd ~/n8n
docker compose pull
docker compose down
docker compose up -d
docker compose logs -f n8n --tail 50

This sequence matches the Docker guide in the n8n docs (n8n docs, as of Nov 8, 2026). Data stays in the Docker volumes.

Conclusion

With this setup you have an n8n installation that:

• uses PostgreSQL as its database
• renews certificates automatically via Caddy
• starts automatically after reboots
• is secured by firewall, a locally bound port and fail2ban
• stores your data in volumes you can back up

Server costs depend on the VPS you choose; current prices are in the n8n calculator and the VPS comparison.

More Self-Hosting Guides

VPS Vergleich 2026

Anbieter und Tarife im Überblick

Lesen

Hetzner vs Contabo

Tarife, Abrechnung und Standorte

Lesen

Pterodactyl Panel Setup

Game Panel auf eigenem VPS

Lesen

WireGuard VPN Setup

Eigenes VPN mit wg-easy

Lesen