You can run n8n on a Linux VPS as a Docker Compose stack managed through Portainer. A reliable production layout keeps n8n’s port 5678 private, puts a reverse proxy such as Traefik on public ports 80 and 443, stores /home/node/.n8n on persistent storage, and keeps the n8n encryption key and database credentials outside the public Compose file.
Antihost offers VPS plans with one-click n8n, NVMe storage and a 14-day free trial.
The practical sequence is: harden the VPS, install Docker and Portainer CE, deploy the n8n stack in Stacks → Add stack, point a dedicated DNS name at the VPS, configure HTTPS and webhook URLs, verify health and persistence, then establish tested backups and an update/rollback routine.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What the finished setup looks like
Your VPS runs Docker. Portainer provides the administration interface, while a Docker Compose stack runs n8n and its persistent data volume. A reverse proxy receives browser traffic and webhook calls on ports 80 and 443, redirects HTTP to HTTPS, and forwards approved requests to n8n on port 5678 over the private Docker network.
- Public edge: DNS points a dedicated subdomain to the VPS public IPv4 address. The reverse proxy terminates TLS and renews certificates.
- Application: n8n listens on port 5678. Keep that port off the public interface; expose it only to the reverse proxy, or bind it to loopback for local diagnostics.
- Persistent state: a named volume or bind mount at
/home/node/.n8nholds the SQLite database and n8n encryption key used by the official example. - Administration: Portainer’s default HTTPS interface uses port 9443. Protect this surface as carefully as SSH because Docker-socket access is effectively host-level control.
This arrangement is different from installing n8n directly on the host. Recreating a container does not remove data when the volume is mounted, and the Compose file gives another administrator a reproducible description of the deployment.
#1 Best Overall
- 12th Intel Alder Lake N95 Processor – The GMKtec G3 S Mini PC is powered by the 12th Gen Intel N95 processor with 4 cores, 4 threads, 6MB cache and a burst frequency up to 3.4GHz. Compared with N100/N5105/N5100/N5095, the N95 delivers up to 36% overall performance improvement. Perfect for routine tasks, office work, and home entertainment, this compact mini desktop is more convenient than traditional bulky PCs.
- 8GB RAM & 256GB SSD Storage – Pre-installed with 8GB DDR4 memory and a fast 256GB M.2 2242 SSD, the G3 S mini desktop offers quicker startup, smoother multitasking, and faster file transfers. Enjoy seamless performance whether you’re working on multiple applications, browsing, or streaming content.
- Rich Interfaces & Connectivity – The G3 S mini computer comes equipped with USB 3.2 (up to 10Gbps), dual HDMI 2.0 (4K@60Hz), and a 3.5mm audio jack. With support for WiFi 5, Bluetooth 5.0, and Gigabit Ethernet (RJ45 1000MbE), it connects easily with monitors, projectors, printers, office equipment, and other peripherals, making it versatile for both home and business use.
- Dual 4K Display Support – Featuring upgraded Intel UHD Graphics (up to 1000MHz), the G3 S supports 4K video playback and AV1 decoding for a smooth viewing experience. With dual HDMI outputs, you can connect two 4K@60Hz displays simultaneously, enabling efficient multitasking for work and entertainment.
- GMKTEC WARRANTY - GMKtec offers a 3-year limited warranty (1 year replacement + 2 years parts replacement) for each mini PC, starting from the date of the purchase effective on all sales starting Oct. 2026. All defects due to design and workmanship are covered. With a professional after sales team always ready to attend to your needs, you can simply relax and enjoy your mini PC
Choose the VPS before installing anything
CPU and memory
The current n8n Docker Compose documentation lists at least 4 GB of RAM and 2 vCPUs for the full setup that includes the Assistant sandbox. That is a documented baseline for that stack, not a promise that every workflow needs exactly that size. Lightweight personal automations may use less, while concurrent executions, large binary files, Code nodes, queues, and database services need more headroom.
| Resource | What to check | Why it matters |
|---|---|---|
| RAM | Use 4 GB or more for the documented full Compose setup; leave operating-system and proxy headroom. | Workflow concurrency and large payloads can exhaust memory before CPU becomes a bottleneck. |
| vCPUs | Use at least 2 vCPUs for the documented baseline. | Parallel executions, database work, and encryption benefit from CPU headroom. |
| Storage | Prefer SSD-backed storage and size it for execution data, logs, database growth, snapshots, and backups. | Slow or full disks cause failed executions and can prevent Docker from restarting services. |
| Network | Confirm public IPv4 availability, sufficient egress, and the region closest to users or external APIs. | Webhooks require inbound reachability; API-heavy workflows are affected by latency and egress limits. |
| Recovery features | Check snapshots, image backups, firewall controls, and off-site backup destinations. | A VPS snapshot is useful for host recovery but should not replace an application-level restore test. |
No independent uptime, adoption, cost, or performance benchmark establishes a universal VPS size. Treat resource selection as an operational decision: start with documented headroom, watch RAM, CPU, disk, and execution duration, then resize from observed load.
Network and provider controls
Before deployment, verify that the provider lets you create firewall rules and reverse-DNS or DNS records as needed. You need inbound SSH during administration, HTTP and HTTPS for the reverse proxy, and a way to restrict Portainer’s 9443 interface to your office IP, VPN, or another trusted network. Do not expose n8n’s 5678 port publicly.
Harden the Linux VPS
Complete these host-level steps before opening the n8n editor to the internet. Exact package commands vary by distribution, so use the current instructions for your chosen Linux release.
- Create a non-root administrator and install an SSH public key. Confirm that a second terminal can log in with the new account before changing SSH settings.
- Apply operating-system updates and enable automatic security updates if they fit your maintenance policy.
- Configure the host firewall. Allow SSH from trusted source addresses where possible, and allow TCP 80 and 443 for the reverse proxy. Keep 5678 closed to the internet. Allow 9443 only from an administration network, or leave it behind a VPN.
- Install Docker Engine and Docker Compose v2 from the distribution or Docker’s current instructions. The n8n Compose documentation requires both.
- Record the host’s public IP and confirm that your DNS provider can create an A record for the n8n subdomain.
Do not treat a provider firewall as a substitute for the host firewall. Use both layers when available, and review rules after every change to networking or the reverse proxy.
Install Portainer CE
Portainer CE runs as a Docker container. Its Linux installation requires a working Docker installation and sudo access. The default Portainer UI is exposed on port 9443.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #2
- 【AMD Ryzen 3 5300U CPU: Outperforms N150 & 3500U】 BOSGAME E5 mini PC is powered by the TSMC 7nm FinFET architecture AMD Ryzen 3 5300U processor (4 Cores, 8 Threads, up to 3.8GHz boost, 6MB total cache). Compared to low-end Intel N150 or 3500U chips which only have 4 single threads and throttle under load, the 5300U delivers over 30% faster multi-core speed. Run 30+ browser tabs, large Excel sheets, and Zoom meetings simultaneously without system lag.
- 【8GB DDR4 RAM & 256GB NVMe SSD Storage】 Installed with high-speed 8GB DDR4 dual-channel memory and a fast 256GB M.2 2280 SSD, eliminating slow boot times and application loading delays. To accommodate growing data requirements, the upgradeable hardware design features dual SODIMM slots that allow you to expand memory up to 64GB RAM, ensuring smooth operation during heavy multitasking.
- 【High-Capacity Dual M.2 SSD Storage Expansion】 Never worry about running out of space for your business files. In addition to the pre-installed 256GB system drive, the motherboard houses an extra empty internal M.2 2280 NVMe PCIe 3.0 slot. This allows you to easily add a second solid-state drive for up to an additional 2TB of storage capacity (upgrades not included) without needing to remove or reinstall the original operating system.
- 【Radeon 6-Core Graphics & Triple 4K Displays】 Integrated with official AMD Radeon Graphics (6 Graphics Cores, 1500 MHz frequency) for casual gaming, photo editing, and crisp 4K media decoding. Featuring 1x HDMI 2.0 port, 1x DisplayPort, and 1x Full-Function Type-C port, the E5 outputs true 4K@60Hz resolution to three monitors at once. This multi-screen setup eliminates constant window-switching for traders, programmers, and office workers.
- 【Dual 2.5GbE LAN Ports for Advanced Networking】 Experience fast wired network transmission speeds up to 2500Mbps without lagging or buffering. The integration of dual 2.5 Gigabit Ethernet ports (powered by Realtek RTL8125 controller) makes this compact computer an exceptional hardware choice for tech enthusiasts. Easily configure it into software routers, hardware firewalls (pfSense, OpnSense), home NAS servers, or local homelabs.
Create a persistent Portainer data volume and start the container. Replace the image tag with a release you have tested rather than blindly tracking a moving tag:
docker volume create portainer_data
docker run -d
--name portainer
--restart=always
-p 9443:9443
-v /var/run/docker.sock:/var/run/docker.sock
-v portainer_data:/data
portainer/portainer-ce:${PORTAINER_TAG}- Open
https://SERVER_IP:9443and complete the initial administrator setup. A first-connection certificate warning can occur before you put Portainer behind your own proxy. - Confirm that Portainer shows the local Docker environment as available.
- Restrict 9443 with the firewall or a private network. If you later proxy Portainer, keep the direct administrative port restricted rather than leaving two public paths.
The Docker-socket mount is powerful: anyone who gains effective control of Portainer can generally control containers and the host. Use a strong administrator password, protect the account with your organization’s available controls, update Portainer, and review its audit and access settings.
Prepare secrets and the Compose stack
Keep variable values out of the public file
Portainer allows environment variables to be entered separately from the Compose definition. Use that facility for the domain name, time zone, database password, and especially N8N_ENCRYPTION_KEY. Do not commit those values to a public Git repository or paste them into documentation.
The encryption key is not interchangeable. Credentials encrypted by n8n cannot be used after a restore if the original key is lost, even when the database files are intact.
Recommended Free Tools
Create a proxy network
If Traefik is running in another stack, create one shared Docker network once on the host:
docker network create proxyAttach both Traefik and n8n to that external network. If you run both services in one Compose project, define the network there instead. The important property is that the proxy can reach n8n by its container service name while n8n’s application port remains private.
Rank #3
- 【MAX 7735U High Performance 】Powered by the AMD Ryzen 7 7735U (8-Core, 16-Thread, boost up to 4.75GHz), this Beelink SER5 MAX mini PC delivers robust performance for daily office tasks, including spreadsheet editing, PPT creation, email management, coding and web browsing. It effortlessly handles photo and video editing via PS, PR and Lightroom, and runs popular esports titles such as LoL, CSGO and DOTA 2 at excellent settings.
- 【High‑Speed Memory & Storage】 Equipped with 24GB high-speed LPDDR5 RAM and a blazing-fast 500GB M.2 2280 PCIe 4.0 SSD, this BEELINK 7735U MINI PC supports seamless heavy multitasking. It features expandable storage up to 8TB, letting you store massive project archives and local files without worry.
- 【4K Triple Display & Radeon 680M Graphics】 Built-in AMD Radeon 680M Graphics (12-Core, 2200MHz) brings outstanding graphic performance for design work and buttery-smooth 4K HDR video playback. This BEELINK SER5 MINI PC supports triple 4K monitors via HDMI, DP and USB-C port, allowing you to run trading dashboards, spreadsheets and design drafts side-by-side to boost your productivity.
- 【Cooling & Full Connectivity】 This BEELINK SER5 7735U MINI PC adopts an upgraded dual‑cooling system with heatsink and cooling fan that boosts heat dissipation by 19% while keeping noise below 32dB for quiet operation. Equipped with WiFi 6, Bluetooth 5.4 and 2.5G RJ45 Ethernet port, it delivers stable, lag‑free connections ideal for office work, home media and home‑server use.
- 【Lifetime Technical Support】Ryzen 7 mini pc Package Included:1* Beelink Ser5 7735U Mini PC,1* HDMI Cables( 100cm),1* Power adapter,1* User manual,1* Mounting bracket.If you want to set up automatic startup,please contact us.All of our mini pc obtained FCC,CE ROSH Certifications.We Offer 1 Year Free Warranty,and 7 Days/24 Hours Serving,and lifetime technical issue assistance without worrying about quality,just email to our customer service team.
Deploy n8n from Portainer
- In Portainer, open Stacks → Add stack and give the stack a name such as
n8n. - Choose the Web editor to paste Compose, upload a file, or use a Git-based Compose deployment. Portainer also supports templates for deploying an entire stack.
- Enter the secret and environment values in Portainer’s environment-variable section. Keep the Compose definition suitable for review without exposing credentials.
- Deploy the stack, then open the stack details page to confirm that the container reaches a running state.
This minimal definition gives n8n persistent storage and connects it to a proxy network. It binds 5678 only to loopback so the host can perform a local health check; the reverse proxy reaches the service through Docker networking. Replace the image variable with a tested n8n release tag.
services:
n8n:
image: n8nio/n8n:${N8N_IMAGE_TAG}
restart: unless-stopped
ports:
- "127.0.0.1:5678:5678"
environment:
N8N_HOST: ${N8N_HOST}
N8N_PROTOCOL: https
WEBHOOK_URL: https://${N8N_HOST}/
GENERIC_TIMEZONE: ${GENERIC_TIMEZONE}
N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
volumes:
- n8n_data:/home/node/.n8n
networks:
- proxy
labels:
- traefik.enable=true
- traefik.http.routers.n8n.rule=Host(`${N8N_HOST}`)
- traefik.http.routers.n8n.entrypoints=websecure
- traefik.http.routers.n8n.tls=true
- traefik.http.routers.n8n.tls.certresolver=${TRAEFIK_CERT_RESOLVER}
- traefik.http.services.n8n.loadbalancer.server.port=5678
volumes:
n8n_data:
networks:
proxy:
external: trueThe labels assume a Traefik deployment that watches Docker labels, has a websecure entry point, and defines the certificate resolver named by TRAEFIK_CERT_RESOLVER. If your proxy uses a file provider or a different resolver name, configure the router in that provider instead of copying labels unchanged. Do not publish 5678 on a public interface merely to make routing work.
SQLite or PostgreSQL?
The mounted /home/node/.n8n directory includes the SQLite database in the basic arrangement. For production workloads, n8n’s Compose documentation recommends evaluating PostgreSQL instead of SQLite. PostgreSQL adds another service and another backup target, but it is a better fit when execution volume, concurrency, or operational requirements outgrow a single-file database.
Choose deliberately:
- SQLite: simplest stack and easiest initial deployment; back up the complete n8n data volume and coordinate backups with n8n activity.
- PostgreSQL: plan database credentials, persistent database storage, upgrades, and separate database backups. Keep the n8n data volume because it still contains application configuration and the encryption key.
Do not switch databases by changing one environment value on a live instance. Plan a migration, take a restorable backup, and verify workflow and credential access before retiring the old database.
Point DNS at the VPS and enable HTTPS
- Create a dedicated A record such as
n8n.example.netpointing to the VPS public IP. Use a name reserved for this service rather than sharing the root domain with unrelated applications. - Wait for the record to resolve from outside the VPS. Check both the expected address and any conflicting old record.
- Configure Traefik or another reverse proxy with public entry points on 80 and 443. Redirect the HTTP entry point to HTTPS.
- Configure automatic certificate issuance and renewal. The proxy should store its certificate data on a persistent volume; the official n8n example uses a separate volume for Traefik certificate data.
- Set
N8N_HOSTto the exact DNS name,N8N_PROTOCOL=https, andWEBHOOK_URLto the public HTTPS URL. These values ensure that editor links and webhook registrations use the externally reachable scheme and host. - Route the proxy to the n8n container on port 5678 over the shared Docker network.
n8n’s SSL guidance recommends placing a reverse proxy such as Traefik or a network load balancer in front of the instance. The proxy handles certificate renewal and encryption in transit; you remain responsible for encryption at rest, such as encrypted VPS disks, encrypted partitions, or provider-level disk encryption.
Free tools Windows power users keep installed
One-click scans. No signup required.
Test certificate issuance before importing important workflows. A wrong A record, blocked port 80, an incorrect certificate-resolver name, or a proxy that cannot write its certificate volume will usually prevent automatic issuance.
Rank #4
- MINI PC COMPUTER OFFICE LIGHT GAMING - GMKtec Nucbox G10 Series is equipped with the Ryzen 5 3500U, a 64-bit quad-core mid-range performance x86 mobile microprocessor. This processor is based on AMD's Zen+ microarchitecture and is fabricated on a 12 nm process. The 3500U operates at a base frequency of 2.1 GHz with a TDP of 15 W and a Boost frequency of 3.7 GHz. This APU supports up to 32 GB of dual-channel DDR4-2400 memory and incorporates Radeon Vega 8 Graphics operating at up to 1.2 GHz. 20% Multi-core Performance increase over previous Ryzen 3 models such as 4300U. 35% performance increase over the Intel N-series N95/N97/N150.
- RYZEN 5 3500U vs RYZEN 3 4300U COMPARISON - Why Choose Ryzen 5 3500U: Better multi-threaded performance: More threads, better suited for multitasking and demanding applications. Better graphics: With Vega 8, it's superior for casual gaming, video playback, and GPU-intensive tasks. Overall higher performance: Higher boost clock and better ability to handle a variety of workloads, from light gaming to productivity tasks. So, if you're looking for a more balanced processor with stronger multitasking capabilities and better GPU performance, the Ryzen 5 3500U would be the clear choice.
- 16GB DUAL CHANNEL DDR4 + 512GB SSD - Installed with DDR4 16GB SO-DIMM RAM Dual Channel (2x8GB) and a 512GB SSD, the Nucbox G10 mini pc supports memory expansion to 64GB RAM. Featured with Dual M.2 2280 PCIe 3.0 slots, supports dual storage slot expansion to 16TB SSD (2*8TB). (Upgrades not included) This model supports a configurable TDP-down of 12 W and TDP-up of 35 W.
- UNLEASH RAW PERFORMANCE MODE 25W - Dominate demanding tasks with the AMD Ryzen 5 3500U processor. When switched to Performance Mode in the BIOS (press "Esc" key repeatedly during boot, save then exit), this mini PC delivers superior multi-core processing power, significantly outperforming Intel N-series chips in CPU-intensive applications, multitasking, and creative workloads.
- MINI DESKTOP COMPUTER WITH TRIPLE DISPLAY SCREEN - Nucbox G10 integrates AMD Radeon Vega 8 1200 MHz GPU to deliver powerful graphics processing power to easily handle video editing, and playback, or casual gaming. And it can connect to 3 display screens simultaneously via HDMI 2.1 TMDS/ DPv1.4/ TYPE-C.
Verify the deployment before importing workflows
- Check Portainer: the stack and n8n container should show a running status rather than a restart loop.
- Read logs: inspect the n8n and reverse-proxy logs for database errors, permission failures, certificate errors, and repeated crashes.
- Test the editor: open the HTTPS DNS name in a private browser window and confirm that the editor loads without mixed-content or redirect loops.
- Test the health endpoint: the n8n Compose guide demonstrates
curl -sf http://localhost:5678/healthz. Run that on the host only when 5678 is bound to loopback as in the example, or execute the check inside the container when the port is not published. - Test a webhook: create a harmless workflow, activate it, call its HTTPS webhook URL from an external network, and confirm one execution.
- Test persistence: stop and recreate the n8n container from Portainer. Confirm that users, workflows, and credentials remain available.
- Test the proxy path: verify that HTTP redirects to HTTPS, the certificate renewer can write its storage, and the proxy cannot reach unrelated containers.
Do these checks before importing business-critical workflows. A green container status alone does not prove that DNS, webhook callbacks, volumes, certificates, and credential decryption all work.
Back up n8n so a restore is possible
What must be protected
- The complete n8n data volume mounted at
/home/node/.n8n. - The exact n8n encryption key, stored separately in a protected secret store or encrypted backup.
- The PostgreSQL database and its configuration if you use PostgreSQL.
- The Compose file and environment-variable names, without publishing their secret values.
- Traefik’s certificate storage if you want to preserve issued certificates and resolver state, although certificates can generally be reissued after a clean rebuild.
A volume-only backup may restore files but still leave stored credentials unusable when the encryption key is missing or changed. Back up the key before upgrades and before moving the stack to another VPS.
Make and test a volume archive
For a named volume, an archive can be created with a temporary container. Adjust the backup destination to an encrypted, off-site location:
docker run --rm
-v n8n_data:/data:ro
-v "$PWD":/backup
alpine:3 tar czf /backup/n8n-data.tgz -C /data .Coordinate the archive with workflow activity: stopping n8n briefly gives the simplest point-in-time copy for SQLite. If you use PostgreSQL, use a database-aware dump or snapshot procedure in addition to the n8n volume archive.
Prove the restore
- Provision an isolated test host or namespace with the same Docker and Compose approach.
- Restore the volume and the exact encryption key.
- Start n8n with a test DNS name and verify that workflows open, credentials decrypt, and a test webhook executes.
- Record the restore time and any manual steps. A backup that has never been restored is an assumption, not a recovery plan.
Operate and update the stack safely
Pin releases and plan rollback
Use tested image tags for n8n, Portainer, and Traefik rather than silently accepting untested changes. Portainer can indicate whether images are current, but an update indicator is not a substitute for a change plan. Before upgrading, back up the n8n volume, encryption key, database, and relevant proxy data; record the currently running image tags; and know how to redeploy those tags if the new version fails.
Monitor the limits that cause incidents
- Disk: watch Docker layers, execution data, database growth, logs, and backup space.
- RAM: investigate container restarts, operating-system memory pressure, and workflows that process large files.
- CPU: identify sustained saturation and long-running concurrent executions.
- Certificates: alert before expiry and check that the proxy’s certificate storage remains writable.
- Backups: monitor backup completion and periodically perform a restore test.
Limit administration exposure
Keep Portainer’s 9443 path behind a firewall, VPN, or trusted source list wherever practical. Use separate administrative credentials, update the host and containers, and review who can deploy stacks. Because Portainer controls Docker through the socket, treat it as a privileged control plane rather than an ordinary web dashboard.
Troubleshoot common failures
| Symptom | Likely cause | Fix |
|---|---|---|
| DNS name does not open | A record points to the wrong address, propagation is incomplete, or port 80/443 is blocked. | Resolve the name from an external network, compare it with the VPS IP, and check both provider and host firewalls. |
| Certificate is not issued | HTTP challenge traffic cannot reach the proxy, the resolver name is wrong, or certificate storage is not writable. | Confirm public port 80, the Traefik resolver configuration, DNS, and the persistent certificate volume; inspect proxy logs. |
| Editor redirects repeatedly | The public scheme or host does not match n8n’s settings, or the proxy is forwarding the wrong headers. | Set N8N_HOST, N8N_PROTOCOL=https, and WEBHOOK_URL to the exact HTTPS name and review proxy forwarding. |
| Webhooks show an internal URL | WEBHOOK_URL is missing or still uses HTTP, an IP address, or an old domain. |
Correct the variable, redeploy the stack, and reactivate workflows so registrations use the public HTTPS endpoint. |
| Container restarts after deployment | Invalid environment values, insufficient memory, a permission problem, or an unavailable database. | Read the n8n logs in Portainer, check host memory and volume permissions, and validate every secret and database setting. |
| Workflows disappear after recreation | The volume was not mounted, the volume name changed, or the stack was deployed in a different project. | Inspect the container’s mounts, use a stable named volume, and verify persistence with a controlled recreate before importing data. |
| Credentials cannot be decrypted after restore | The original encryption key was not restored or was replaced. | Restore the exact key that encrypted the data; do not generate a new key for an existing database. |
| Local health check fails | 5678 is not bound to loopback, n8n is still starting, or the container is unhealthy. | Run the check inside the container or publish loopback as shown, wait for startup, and inspect logs and resource pressure. |
| Portainer is unreachable | Port 9443 is blocked, the container stopped, or access is limited to a trusted network. | Check the container status locally, review firewall rules, and connect through the allowed administration path rather than opening 9443 broadly. |
How to compare VPS options for n8n
Price alone is a poor selector for an automation server. Compare offers against the workload and recovery requirements:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute| Comparison axis | Questions to ask |
|---|---|
| RAM and vCPU headroom | Does the plan meet the documented 4 GB/2 vCPU baseline for the full setup, with room for your workflows and proxy? |
| SSD and storage limits | Is storage SSD-backed, expandable, and large enough for execution data and backups? |
| Snapshots and off-site backups | Can you create consistent snapshots, export them, and store application backups in another location? |
| Network | Is a public IPv4 included, what are egress limits, and is the region suitable for your APIs and users? |
| Firewall controls | Can you restrict SSH and Portainer while leaving only the reverse proxy publicly reachable? |
| Support and recovery | How quickly can the provider recover a failed host, and can you rebuild independently from your backups? |
| Total monthly cost | Include the VPS, additional storage, snapshots, off-site backup storage, bandwidth, and any separate DNS service. |
The best provider is the one whose controls match your recovery plan, not necessarily the one with the lowest advertised monthly price.
Quick Recap
Production readiness checklist
- Docker Engine and Compose v2 are installed and updated.
- The VPS has a non-root administrator, SSH-key access, updates, and layered firewall rules.
- The n8n stack is deployed through Portainer with a persistent
/home/node/.n8nvolume. - n8n’s 5678 port is private; only the reverse proxy’s intended public ports are open.
- A dedicated DNS A record resolves to the VPS public IP.
- Traefik or another reverse proxy redirects HTTP to HTTPS and renews certificates.
N8N_HOST,N8N_PROTOCOL, andWEBHOOK_URLmatch the public HTTPS name.- The encryption key and database credentials are stored securely outside the public Compose file.
- Health, editor, webhook, certificate, and persistence tests pass.
- Backups include the n8n data volume, encryption key, database when applicable, and necessary Compose configuration.
- A restore has been performed in an isolated environment.
- Image tags are pinned, resources are monitored, and rollback steps are documented.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
