For a production n8n installation, run n8n and PostgreSQL as separate Docker Compose services, persist both PostgreSQL’s data directory and /home/node/.n8n, keep credentials and the encryption key outside version control, and put n8n behind a TLS-terminating reverse proxy. PostgreSQL stores n8n’s application data; the .n8n directory stores essential user data, including the encryption key that makes saved credentials usable after a restart or restore.
Antihost offers VPS plans with one-click n8n, NVMe storage and a 14-day free trial.
The procedure below gives you a repeatable deployment, readiness checks, HTTPS and webhook settings, backup and restore steps, and the upgrade cautions that commonly turn a seemingly healthy container into a broken production instance.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What the production architecture should contain
A practical Compose deployment has four layers:
- n8n: the application container that executes workflows and serves the editor and webhook endpoints.
- PostgreSQL: the production-oriented database for installations with more than a handful of users or workflows running continuously. SQLite is appropriate for trying n8n, not for this operating model.
- Persistent storage: one volume for PostgreSQL’s data directory and another for
/home/node/.n8n. - HTTPS entry point: a reverse proxy or load balancer that terminates TLS and forwards requests to n8n over the private container network.
PostgreSQL and n8n should communicate on an internal Compose network. The database should not be exposed to the public internet. The proxy is the public-facing component; n8n’s container port can remain private to that network.
Prerequisites and decisions to make first
Host and Docker requirements
Use a Linux host or virtual machine with Docker Engine and the Docker Compose plugin installed. Create a dedicated directory for the deployment and restrict access to the files containing secrets. You do not need a published CPU, memory, throughput, or uptime number to choose a “production size” from the available guidance; workload, execution concurrency, workflow design, and retention determine sizing, so measure your own instance after deployment.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Choose image versions deliberately
Pin reviewed n8n and PostgreSQL image tags in an environment file instead of using an unbounded latest tag. Record the tags and the procedure used to upgrade them. A PostgreSQL major-version change is an upgrade project: a data directory written by one major version may not be opened by another major version without the appropriate PostgreSQL upgrade process.
Choose the public name before enabling OAuth
Decide the final HTTPS hostname, such as automation.example.com, before registering OAuth applications or activating external webhooks. The hostname, protocol, and webhook URL configured in n8n must match the address users and third-party services actually reach through the proxy.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Create the deployment files
1. Create a protected .env file
Compose reads substitutions from .env. Put database credentials, the encryption key, image tags, and the public URL settings there. Keep this file out of version control and restrict its filesystem permissions.
N8N_IMAGE_TAG=reviewed-n8n-version
POSTGRES_IMAGE_TAG=reviewed-postgres-version
POSTGRES_USER=n8n_app
POSTGRES_PASSWORD=replace-with-a-long-random-password
POSTGRES_DB=n8n
N8N_ENCRYPTION_KEY=replace-with-a-long-stable-random-key
N8N_HOST=automation.example.com
N8N_PROTOCOL=https
WEBHOOK_URL=https://automation.example.com/Generate a high-entropy value for N8N_ENCRYPTION_KEY with a trusted local secret generator, then store the same value in your deployment secret store or protected environment file. Never rotate this key casually: existing credentials were encrypted with it and must be decrypted with the original value after recreation, migration, or restore.
2. Add compose.yml
The following layout gives PostgreSQL a persistent volume, sets PGDATA explicitly, checks readiness with pg_isready, and prevents n8n from starting until the database health check passes.
Rank #2
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
services:
postgres:
image: postgres:${POSTGRES_IMAGE_TAG}
restart: unless-stopped
environment:
POSTGRES_USER: ${POSTGRES_USER}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
POSTGRES_DB: ${POSTGRES_DB}
PGDATA: /var/lib/postgresql/data
volumes:
- n8n_postgres_data:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
interval: 10s
timeout: 5s
retries: 10
networks:
- n8n_internal
n8n:
image: docker.n8n.io/n8nio/n8n:${N8N_IMAGE_TAG}
restart: unless-stopped
environment:
DB_TYPE: postgresdb
DB_POSTGRESDB_HOST: postgres
DB_POSTGRESDB_PORT: 5432
DB_POSTGRESDB_DATABASE: ${POSTGRES_DB}
DB_POSTGRESDB_USER: ${POSTGRES_USER}
DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}
N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
N8N_HOST: ${N8N_HOST}
N8N_PROTOCOL: ${N8N_PROTOCOL}
WEBHOOK_URL: ${WEBHOOK_URL}
volumes:
- n8n_data:/home/node/.n8n
depends_on:
postgres:
condition: service_healthy
expose:
- "5678"
networks:
- n8n_internal
volumes:
n8n_postgres_data:
n8n_data:
networks:
n8n_internal:The $$ characters in the health-check command are intentional. They stop Compose from substituting the variables on the host and allow the PostgreSQL container to read its own POSTGRES_USER and POSTGRES_DB values. The service name postgres is the hostname n8n uses on the internal network.
Free tools Windows power users keep installed
One-click scans. No signup required.
PGDATA=/var/lib/postgresql/data is worth keeping even when the path looks conventional. PostgreSQL 18 changed its default data-directory location; omitting this setting can make an existing volume appear empty after an image change. Treat the setting as part of the storage contract rather than an optional cosmetic variable.
Start n8n and verify the dependency chain
- Change into the directory containing
.envandcompose.yml. - Check the rendered configuration without starting containers:
docker compose config. Confirm that the database host ispostgres, the volume mounts are present, and the public URL values are correct. Do not paste the rendered output into a public issue because it can contain secrets. - Start both services in the background:
docker compose up -d. - Inspect service status:
docker compose ps. PostgreSQL should report a healthy state before n8n is considered ready. - Read startup logs if needed:
docker compose logs -f postgres n8n. Look for successful database connection messages and for errors such as authentication failures or an invalid encryption key. - Connect the reverse proxy to the n8n service on the internal network and open the configured HTTPS hostname. Complete the initial owner setup only after the proxy and URL settings are in place.
The health check controls startup ordering; it is not a substitute for monitoring. Keep collecting container health, restart events, PostgreSQL logs, disk usage, and workflow execution failures after launch.
Put n8n behind HTTPS and preserve callback URLs
Terminate TLS at a proxy
Use a reverse proxy such as Traefik or an equivalent load balancer in front of n8n. The proxy obtains and renews the certificate, accepts public HTTPS traffic, and forwards it to n8n on the private network. Do not publish PostgreSQL’s port. If the host does not need direct access to n8n, avoid publishing port 5678 publicly as well.
Keep the external settings consistent
N8N_HOST must be the public hostname, N8N_PROTOCOL must be https, and WEBHOOK_URL must be the complete public HTTPS base address. Do not set these values to the container name, an internal IP address, or the proxy’s private listener.
Rank #3
- Pi5 8GB Pack: RasTech Pi 5 8GB kit includes 1 x Pi5 8GB board ,1 x 64GB Card, 2 x Card Readers,1 x Active Cooler,1 x Case for Pi5, 2 x 4K Micro HD Out Cable,1 x GaN 27W 5A USB-C Power supply,1 x Screwdriver and 1 x instructions.
- Pi5 8GB Board: The Pi5 board is equipped with a 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz and an 800MHz VideoCore VII GPU with support for OpenGL ES 3.1 and Vulkan 1.2, which delivers a significant increase in graphics performance. Dual HD Out 4Kp60 display outputs and a built-in dual 4-channel MIPI camera/display transceiver provide state-of-the-art camera support. The Pi 5 offers a 2-3 times increase in CPU performance compare to Pi4.
- Important Graphics Features: Equipped with an 800MHz VideoCore VII GPU and providing better graphics performance, suitable for multimedia applications,gaming,and graphics intensive tasks.Provides 1 UART interface,1 card slot that supports high-speed operation, 2 USB. 3 0.5 ports that support synchronous 0Gbps operation,2 USB 2.0 port ports,2 4Kp60 display outputs that support HDR.Built-in dedicated dual 4-channel 1Gbps MIPI DSI/CSI connectors,triple the total bandwidth.
- Cooling Kit for Pi 5: Compatible with Active Cooler for Raspberry Pi5, It can provide Pi 5 board with better cooling effect in using. The Case can accurately access usb-c power jack,Micro HD Out ports, usb ports, Ethernet jack, card slot, power button, 4-lane MIPI DSI/CSI connectors and so on, and it also supports installation of cooling fan.
- 64GB Card Kit and GaN 27W USB-C Power Supply: With extra 64GB card to store more files and card readers for multiple medium, keep better performance for Raspberry Pi 5, 27W USB C Power Supply is Compatible with Pi5 8GB, offers a variety of output voltage options, including 5.1V at 5A, 9.0V at 3.0A, 12.0V at 2.25A, and 15.0V at 1.8A, providing for different device requirements.
After the proxy is live, compare every OAuth redirect URI and webhook callback configured with external services against the same public address. A mismatch commonly produces OAuth “redirect URI” errors, webhook requests sent to an unreachable HTTP address, or callbacks that land on the proxy but are rejected by n8n. If you change the hostname later, update the proxy, n8n variables, OAuth registrations, and third-party webhook settings as one change.
Understand what must be persisted
| Storage | What it contains | Production action |
|---|---|---|
PostgreSQL volume at /var/lib/postgresql/data |
n8n’s application database and workflow-related records | Persist it, monitor free space, and include it in database backups |
n8n volume at /home/node/.n8n |
Essential n8n user data, including the credentials encryption key | Persist it and back it up with the database |
| Compose file and protected environment or secret store | Image tags, connection settings, public URL, and secret references | Version the non-secret configuration; protect secret material separately |
A database dump without the .n8n material is incomplete. Restoring rows while losing the encryption key can leave saved credentials present but undecryptable. Conversely, restoring the key without the matching database does not recreate workflows or users. Plan the two stores as one recovery set.
Protect secrets and the encryption key
- Do not commit
.env, database passwords, API keys, orN8N_ENCRYPTION_KEYto Git. - Use a deployment secret store where available, or a root-readable environment file with restrictive permissions.
- Use a non-default PostgreSQL username, database name, and password.
- Keep the encryption key stable across container recreation, host migration, rollback, and restore.
- Limit who can read Docker Compose files and inspect container environments.
Changing the PostgreSQL password requires updating both PostgreSQL and n8n’s connection settings. Changing the encryption key is a data migration, not routine secret rotation; perform it only with a documented procedure that can re-encrypt existing credentials.
Back up PostgreSQL and n8n storage together
Logical PostgreSQL dump
Run a regular logical dump from the Compose project. The following pattern writes a SQL dump on the host while avoiding an interactive terminal:
docker compose exec -T postgres pg_dumpall -U "$POSTGRES_USER" > n8n-backup.sqlRun it from a shell where the PostgreSQL variables are available, or substitute the protected database user explicitly without exposing the password in shell history. Store the dump in protected backup storage and apply your normal retention and encryption policy.
Rank #4
- CanaKit Raspberry Pi 5 Essentials Starter Kit
Archive the .n8n volume
Back up the volume that is mounted at /home/node/.n8n at the same recovery point as the database dump. One Docker-based approach is:
docker run --rm
-v n8n_data:/source:ro
-v "$PWD":/backup
alpine tar czf /backup/n8n-data.tgz -C /source .Use the actual volume name shown by docker volume ls; Compose may prefix it with the project directory name. If you store the encryption key in an external secret manager rather than the volume, export and protect that secret through the same backup process.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTest recovery instead of trusting a successful dump
- Create an isolated test project with separate container names and a separate network.
- Restore the PostgreSQL dump into a clean PostgreSQL data store.
- Restore the
.n8narchive, or provide the exact originalN8N_ENCRYPTION_KEY. - Start n8n with the restored connection settings and the same public URL pattern, using an isolated hostname if callbacks must be tested.
- Open representative workflows, confirm that stored credentials decrypt, and execute test workflows that exercise the integrations you depend on.
The canonical setup guidance defines the data that must be restored but does not publish a universal recovery-time objective or sizing benchmark. Set those targets from your own business requirements and measure the restore procedure you actually use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Upgrade safely
Routine n8n image updates
Review the n8n release notes and your own workflow compatibility, back up both persistent stores, then pull and recreate the n8n service with the reviewed tag. Keep the previous image tag documented so you can roll back the container if the application upgrade exposes a workflow or integration problem.
PostgreSQL major-version changes
Do not change a PostgreSQL major tag as if it were a routine patch. PostgreSQL cannot open a data directory created by an older major version directly. Before the change:
Best Value
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
- Take and verify a logical dump.
- Confirm that the
PGDATAsetting and volume mount are intentional. - Read the PostgreSQL upgrade documentation for the chosen path.
- Practice the upgrade or dump-and-restore process in an isolated environment.
- Keep the original volume untouched until the new instance is verified.
A direct image-tag change can fail with an incompatible-data-directory error, while an incorrect data path can make a healthy old volume look newly initialized. Both failures are avoidable when the storage path and upgrade method are documented first.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Moving an existing SQLite installation
Adding PostgreSQL to a new Compose file does not automatically move data from an existing SQLite-based n8n installation. Treat the change as an explicit export/import migration. Preserve the original .n8n directory and its encryption key, create the PostgreSQL instance, follow n8n’s supported migration procedure, and verify users, workflows, credentials, and executions before decommissioning SQLite. Keep a rollback copy of the original data until the PostgreSQL instance has passed those checks.
Operational hardening after launch
- Network exposure: expose only the proxy publicly; keep PostgreSQL and the n8n service on the internal network whenever possible.
- File permissions: restrict access to
.env, backup archives, and any file containing the encryption key. - Disk monitoring: alert on PostgreSQL volume growth, backup failures, and insufficient host space before writes fail.
- Restart behavior: use a restart policy, but investigate repeated restarts rather than treating them as recovery.
- Change records: document image tags, proxy configuration, environment variables, backup locations, and the exact restore command.
- Restore evidence: retain the date and result of the last successful recovery test.
Self-managed Compose versus a managed alternative
Running this stack yourself gives direct control over the database, volumes, network boundaries, proxy, and restore process. A managed alternative can reduce server and database administration, but it moves decisions about backups, upgrade windows, TLS, scaling, and data residency to the provider. Compare the operating models before choosing:
| Concern | Self-managed Compose and PostgreSQL | Managed alternative |
|---|---|---|
| Database operations | You patch PostgreSQL, monitor storage, and execute upgrades. | The provider performs some or all database maintenance according to its service scope. |
| Backups and restore | You control dump schedules, volume archives, retention, and recovery tests. | Backup policy and restore access depend on the provider; verify that the encryption-key material is covered. |
| TLS and networking | You configure the reverse proxy, certificates, firewall, and callback routing. | The service may supply ingress and certificates, but you still verify public URLs and OAuth settings. |
| Upgrades | You own image review, maintenance windows, rollback, and PostgreSQL major-version work. | The provider owns some upgrades, while application compatibility remains your responsibility. |
| Scaling | You plan worker, queue, database, and host capacity as demand grows. | Scaling options are constrained by the service plan and architecture. |
| Secrets | You choose and operate the secret store and access controls. | You rely on the provider’s secret-management controls and shared-responsibility model. |
| Cost | Server, storage, database administration, backups, and operator time are your costs. | These costs are bundled into service pricing; compare the total monthly amount and operational value. |
Troubleshooting common failures
n8n starts before PostgreSQL
Check docker compose ps and the PostgreSQL health-check output. Confirm that pg_isready can use the configured database and user, then verify that n8n has depends_on with condition: service_healthy. A container start order without a readiness condition is not sufficient.
Database authentication errors
Compare POSTGRES_USER, POSTGRES_PASSWORD, and POSTGRES_DB with the corresponding DB_POSTGRESDB_* values. Remember that changing environment variables does not rewrite an already initialized PostgreSQL database; update the database account deliberately or restore a matching volume.
Credentials fail to decrypt
Verify that the restored or recreated n8n container has the original N8N_ENCRYPTION_KEY and that the .n8n volume is mounted at exactly /home/node/.n8n. A database-only restore cannot replace this key.
OAuth redirects or webhooks use the wrong address
Check the proxy’s public hostname, N8N_HOST, N8N_PROTOCOL, and WEBHOOK_URL as one set. Remove internal hostnames and HTTP callback URLs from external provider configurations, then retry the authorization or webhook delivery.
The PostgreSQL volume appears empty after an image change
Inspect the mounted path and the PGDATA value. PostgreSQL 18’s changed default directory is a common cause of an apparent empty volume. Stop the service before changing mounts, preserve the original volume, and follow the major-version upgrade procedure rather than initializing a second database unintentionally.
Quick Recap
Production go-live checklist
- Reviewed n8n and PostgreSQL image tags are pinned and documented.
- PostgreSQL uses non-default credentials and is not publicly exposed.
- The PostgreSQL data volume and
/home/node/.n8nare persistent. PGDATAis explicitly set to the intended data path.- PostgreSQL has a
pg_isreadyhealth check, and n8n waits for a healthy dependency. - The reverse proxy terminates TLS and forwards to the private n8n service.
- External host, protocol, webhook URL, OAuth redirects, and third-party callbacks agree.
- The encryption key and database secrets are outside version control.
- Database dumps and
.n8nbackups are produced on a schedule. - An isolated restore has confirmed credential decryption and representative workflow execution.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
