You can run n8n on a Linux VPS with Docker Compose, but a production deployment is more than starting a container. You need a DNS record, a reverse proxy that terminates HTTPS, persistent storage for n8n’s database and encryption key, firewall rules, backups, and a repeatable update process.
Antihost offers VPS plans with one-click n8n, NVMe storage and a 14-day free trial.
n8n recommends self-hosting for expert operators. A configuration mistake can cause data loss, security problems, or downtime, so use n8n Cloud instead if you do not already manage Linux servers, containers, networking, and recovery procedures.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How the deployment fits together
A typical single-VPS installation has two Docker Compose services:
- n8n: the automation application and its built-in SQLite database.
- Reverse proxy: Traefik or Caddy, exposed on ports 80 and 443, handling certificates and forwarding requests to n8n.
Internet traffic reaches the proxy, not the n8n container directly. The proxy redirects HTTP to HTTPS and routes the public hostname to n8n on port 5678. In the Traefik pattern, n8n is bound to 127.0.0.1:5678:5678, while Traefik publishes ports 80 and 443. This keeps the application off the public network interface.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The default single-VPS design uses SQLite. It is a straightforward baseline for one instance, but you remain responsible for resource management, backups, upgrades, security, and any future scaling work.
Decide whether self-hosting is appropriate
Skills you need
Before deploying, make sure you can administer a Linux VPS over SSH, install Docker Engine and Docker Compose, manage DNS, read container logs, restrict firewall exposure, protect secrets, and restore data from a backup. You should also understand how your workflows handle credentials, webhooks, files, and binary data.
Recommended Free Tools
What n8n does not provide for you
- A universal VPS size or guaranteed performance target.
- A backup schedule that fits every workload.
- Automatic recovery from a lost volume or damaged server.
- Operational ownership of upgrades, firewalling, monitoring, or scaling.
Choose CPU, memory, disk, backup frequency, and recovery time objectives from the number and type of workflows you run. The official deployment material does not publish a universal minimum VPS specification or uptime percentage.
Prepare the Linux VPS
Install Docker and verify the tools
Install Docker Engine and the Docker Compose plugin using the instructions for your Linux distribution. Verify both commands before creating the application:
docker --version
docker compose versionCreate a non-root administrator
Create a dedicated administrative user rather than doing routine work as root. Where your VPS provider supports it, use SSH-key authentication; it is safer than relying on a password alone. Keep direct SSH access limited to the accounts and source addresses you actually need.
Create a dedicated project directory
Use a directory that only contains this deployment, such as n8n-compose. Keep the Compose file, environment file, proxy configuration, and any local bind-mounted directories together so they can be backed up and reviewed as one unit.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Point DNS at the VPS and narrow the firewall
Create the public hostname
Create an A record for a dedicated subdomain, for example:
n8n.example.comPoint that record to the VPS’s public IP address. Use the same hostname consistently in your environment file, proxy configuration, webhook URL, and browser access. Wait for the record to resolve before troubleshooting certificate issuance.
Allow only the required inbound ports
For the documented Caddy and Traefik patterns, allow inbound TCP ports 80 and 443. Port 80 is needed for HTTP-to-HTTPS handling and certificate challenges; port 443 carries encrypted traffic. Keep n8n’s port 5678 private behind the proxy. Restrict SSH separately according to your access policy.
Define the environment settings
Create an environment file in the project directory and protect it from other users. A typical set of values is:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesDOMAIN_NAME=example.com
SUBDOMAIN=n8n
GENERIC_TIMEZONE=Europe/Berlin
[email protected]What each value controls
DOMAIN_NAMEandSUBDOMAINcombine to form the public hostname, such asn8n.example.com.GENERIC_TIMEZONEcontrols timezone-sensitive scheduling behavior. Choose the IANA timezone that matches the schedules you intend to run.SSL_EMAILsupplies the certificate contact address in the Traefik example.
The environment also needs production HTTPS settings and the public webhook address. n8n documents N8N_WEBHOOK_URL for current versions; the documentation notes that versions before 2.30.0 use WEBHOOK_URL instead. Set the value to the externally reachable HTTPS URL, not the internal container name.
Choose Traefik or Caddy for HTTPS
Traefik
The official Traefik Compose pattern runs n8n and Traefik together. Traefik listens on ports 80 and 443, redirects HTTP to HTTPS, obtains certificates through an ACME TLS challenge, and routes the configured hostname to n8n. Its certificate state is stored in a persistent traefik_data volume.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
The sample includes an HSTS setting of STSSeconds=315360000. That number is a configuration value in the example, not a measured security result. Do not enable long-lived HSTS until the hostname will reliably remain HTTPS-only.
Caddy
The Caddy pattern uses a Caddyfile that maps the public hostname to n8n:5678. Caddy obtains and renews certificates automatically and stores its state in a persistent data volume. This approach has a simpler routing file, while Traefik expresses routing and certificate behavior through Compose labels and service configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Decision point | Traefik | Caddy |
|---|---|---|
| Routing style | Compose service configuration and proxy labels | Dedicated Caddyfile mapping the hostname to n8n:5678 |
| TLS handling | ACME certificate issuance and HTTP-to-HTTPS redirection | Automatic certificate management and renewal |
| Persistent proxy data | traefik_data volume in the official example |
Caddy data volume in the documented pattern |
| Public ports | 80 and 443 | 80 and 443 |
Pick one proxy, not both. The important properties are the same: terminate TLS at the edge, route only the intended hostname, keep n8n private, and persist certificate state.
Bring up the Compose stack
- Check DNS: confirm that the chosen hostname resolves to the VPS IP.
- Review secrets: verify the environment file permissions and confirm that no credentials are committed to a public repository.
- Review routing: confirm that the proxy targets the n8n service on port 5678 and that the HTTPS hostname matches the n8n webhook URL.
- Start in detached mode:
sudo docker compose up -d - Inspect startup: use
sudo docker compose psandsudo docker compose logsto check that both services remain running and that certificate issuance succeeds. - Open the HTTPS hostname: browse to the public URL and create the n8n owner account when prompted.
To stop containers without deleting volumes, run:
sudo docker compose stopStopping the stack preserves data. Avoid commands that remove volumes unless you have a verified backup and deliberately intend to destroy the stored state.
Understand what must be persistent
n8n’s application volume
Mount a persistent volume at /home/node/.n8n. n8n documents this directory as containing the SQLite database file and the encryption key. Losing it can mean losing workflow data, credentials, and the ability to decrypt stored secrets. Include the volume in every backup and migration plan.
Proxy certificate state
Persist the proxy’s data separately: traefik_data for the Traefik example or the corresponding Caddy data volume. Losing certificate state can force certificate reissuance and may trigger rate limits or temporary HTTPS failures during recovery.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Intentional host file access
The official example mounts a host directory named local-files to /files for workflows that intentionally read or write shared files. It sets:
N8N_RESTRICT_FILE_ACCESS_TO=/filesThis limits file access to the designated path. Do not add broad host mounts merely for convenience; every bind mount expands the impact of a compromised or unsafe workflow.
Database and binary-storage choices
SQLite for a single VPS
The documented Compose deployment has no separate database service, so n8n uses its built-in SQLite database. This minimizes moving parts and is a sensible starting point for one instance with moderate demands. It does not remove the need for tested backups, disk monitoring, or a plan for growth.
When to evaluate another database
If workload volume, concurrency, availability requirements, or scaling plans exceed what a single SQLite-backed container can comfortably support, evaluate n8n’s database and scaling documentation before changing architecture. A separate database introduces its own credentials, backups, network controls, upgrades, and failure modes.
External S3 binary storage
n8n documents external S3 binary storage as a self-hosted Enterprise feature. AWS S3 is supported. Cloudflare R2 and Backblaze B2 are described as S3-compatible alternatives, but n8n does not officially support them. Configure an S3 lifecycle policy because n8n delegates binary-data pruning to the object store; without lifecycle rules, old binary objects can accumulate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Secure the installation before exposing workflows
Run n8n’s security audit
Run the audit from the CLI with n8n audit, or use the authenticated /audit API endpoint or the n8n node. The audit checks:
- Unused credentials.
- Risky SQL expressions.
- Nodes that access the filesystem.
- Official nodes classified as risky.
- Community or custom nodes.
- Unprotected webhooks.
- Missing security settings.
- Whether the instance is outdated.
Review each finding in the context of the workflow. Removing an unused credential, protecting a webhook, or restricting a filesystem path can reduce exposure without changing the whole deployment.
Protect secrets and the owner account
- Use a strong, unique owner password and protect recovery information.
- Restrict permissions on the environment file and any encryption-key backup.
- Keep n8n behind the proxy; do not publish port 5678 directly to the internet.
- Limit firewall rules to the proxy ports and the administrative access you require.
- Treat community nodes and custom code as untrusted until reviewed.
Backups and recovery
Back up the n8n volume containing /home/node/.n8n, the proxy certificate volume, the Compose file, the environment template, and any intentionally mounted local-files data. Store backups outside the VPS and protect them as carefully as the live encryption key.
A backup is not a recovery plan until you have restored it. Test that a clean server can recreate the containers, restore the n8n volume, restore proxy state or obtain new certificates, and bring the hostname back online. Choose backup frequency from how much workflow history and credential data you can afford to lose; the official guidance does not prescribe one interval.
Update n8n without blindly tracking latest
n8n releases a new minor version most weeks. Its stable channel is intended for production, while beta contains the newest potentially unstable release. The official Docker Compose and DigitalOcean documentation listed stable 2.43.4 and beta 2.44.0 when checked on October 13, 2026; these labels are volatile and should be rechecked immediately before an upgrade.
- Read the release notes and check compatibility with your nodes and integrations.
- Take and verify a backup of the n8n and proxy volumes.
- Pin the image version you intend to test rather than relying on an unreviewed moving tag.
- Pull the selected image and recreate the stack with
sudo docker compose up -d. - Check logs, the owner interface, scheduled executions, credentials, and at least one representative webhook.
- Keep the previous image available until the new version has passed your checks.
If an upgrade fails, stop the stack, preserve logs, restore the last known-good image and volumes, and investigate before trying again. Never delete the data volume as a first troubleshooting step.
Common failure points
The certificate is not issued
Confirm that DNS resolves to the VPS, ports 80 and 443 are reachable, the proxy is running, and the configured hostname exactly matches the browser URL. Certificate challenges cannot succeed if another service occupies the required ports or if the firewall blocks them.
Webhooks show the wrong URL
Check the public HTTPS hostname and the N8N_WEBHOOK_URL setting. On n8n versions before 2.30.0, use WEBHOOK_URL as documented for those releases. The value must be externally reachable; an internal Docker service name will produce unusable webhook addresses.
Credentials cannot be decrypted after a move
Restore the original /home/node/.n8n data and its encryption key together. Starting a fresh data directory creates a different key, so copying only the database is insufficient.
Files are inaccessible
Verify that the host directory is mounted to /files, that the workflow uses the container path rather than the host path, and that N8N_RESTRICT_FILE_ACCESS_TO=/files matches the intended location. Check filesystem permissions for the container user.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Practical production checklist
- Dedicated DNS A record resolves to the VPS.
- Only required inbound ports are open; n8n’s 5678 port is private.
- HTTPS works through Traefik or Caddy and renewals are observable.
/home/node/.n8nand proxy certificate state are persistent.- Environment files and encryption-key backups are access-controlled.
- The n8n owner account uses a strong unique password.
n8n auditfindings have been reviewed.- Backups are stored off-server and a restore has been tested.
- Updates are pinned, tested, and reversible.
- Any S3 binary store has an appropriate lifecycle policy.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
