docker --version\r\ndocker compose version<\/code><\/pre>\nYou should see version numbers for both, with no errors.<\/p>\n
Step 5: Choose your database \u2014 SQLite vs PostgreSQL<\/b><\/h2>\n
n8n needs somewhere to store your workflows, credentials, and execution logs. By default it uses SQLite<\/b> \u2014 a database that’s just a single file, with zero setup required. For local testing, that’s genuinely fine.<\/p>\n
For a production deployment reachable from the internet, this guide uses PostgreSQL<\/b> instead. Here’s the actual reasoning, not just “best practice”:<\/p>\n\n- SQLite writes to a single file with limited concurrent-write handling. Under real traffic \u2014 several workflows firing at once, webhooks arriving while you’re editing in the UI \u2014 that can lead to “database is locked” errors.<\/li>\n
- If you ever want to scale n8n beyond one instance (n8n’s “queue mode,” for handling heavier workloads), Postgres is a hard requirement, not an option. Starting with it now avoids a painful migration later.<\/li>\n
- Backups are more straightforward and standard with Postgres \u2014 you can use conventional tools like pg_dump rather than carefully copying a live SQLite file.<\/li>\n<\/ul>\n
If your use case is genuinely light (a personal instance with a handful of workflows), SQLite will work and you can skip the Postgres parts of the compose file below. This guide includes Postgres because you told us this is for real production use.<\/p>\n
Step 6: Create your project folder and environment file<\/b><\/h2>\n
Create a directory to hold everything:<\/p>\n
mkdir ~\/n8n-server && cd ~\/n8n-server\r\nmkdir local-files\r\n<\/code><\/pre>\nlocal-files will be shared between n8n and your server’s filesystem \u2014 useful if you ever use n8n’s “Read\/Write Files from Disk” node.<\/p>\n
Now generate an encryption key. n8n uses this to encrypt every credential (API keys, passwords) you store in it:<\/p>\n
openssl rand -hex 32<\/code><\/pre>\nCopy the output somewhere safe right now \u2014 write it down outside the server too<\/b> (a password manager is ideal). This is the single most important value in this whole setup: if you lose it, every stored credential becomes permanently unreadable, with no recovery path. This isn’t a scare tactic \u2014 it’s how the encryption is designed to work, and it’s worth the thirty seconds of caution.<\/p>\n
Create a .env file to hold your settings and secrets in one place:<\/p>\n
nano .env<\/code><\/pre>\nPaste this in, replacing the placeholder values with your own:<\/p>\n
# Your domain (must match the DNS A record you created in Step 2)\r\nDOMAIN_NAME=n8n.yourdomain.com\r\n\r\n# Timezone \u2014 find yours at https:\/\/en.wikipedia.org\/wiki\/List_of_tz_database_time_zones\r\nTIMEZONE=Etc\/UTC\r\n\r\n# Postgres credentials \u2014 pick your own strong password\r\nPOSTGRES_USER=n8n\r\nPOSTGRES_PASSWORD=change-this-to-a-strong-password\r\nPOSTGRES_DB=n8n\r\n\r\n# The key you generated with `openssl rand -hex 32` above\r\nN8N_ENCRYPTION_KEY=paste-your-generated-key-here<\/code><\/pre>\nSave and exit (in nano: Ctrl+O, Enter, then Ctrl+X).<\/p>\n
Lock the file down so only your user can read it \u2014 it contains passwords:<\/p>\n
chmod 600 .env<\/code><\/pre>\nStep 7: Write the Docker Compose file<\/b><\/h2>\n
This is the file that tells Docker what to run and how the pieces connect. Create it:<\/p>\n
nano docker-compose.yml<\/code><\/pre>\nPaste in the following:<\/p>\n
services:\r\n postgres:\r\n image: postgres:16\r\n restart: unless-stopped\r\n environment:\r\n - POSTGRES_USER=${POSTGRES_USER}\r\n - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}\r\n - POSTGRES_DB=${POSTGRES_DB}\r\n volumes:\r\n - postgres_data:\/var\/lib\/postgresql\/data\r\n healthcheck:\r\n test: [\"CMD-SHELL\", \"pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}\"]\r\n interval: 5s\r\n timeout: 5s\r\n retries: 10\r\n\r\n n8n:\r\n image: docker.n8n.io\/n8nio\/n8n\r\n restart: unless-stopped\r\n ports:\r\n - \"127.0.0.1:5678:5678\"\r\n environment:\r\n - N8N_HOST=${DOMAIN_NAME}\r\n - N8N_PROTOCOL=https\r\n - N8N_PORT=5678\r\n - WEBHOOK_URL=https:\/\/${DOMAIN_NAME}\/\r\n - N8N_PROXY_HOPS=1\r\n - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}\r\n - GENERIC_TIMEZONE=${TIMEZONE}\r\n - TZ=${TIMEZONE}\r\n - DB_TYPE=postgresdb\r\n - DB_POSTGRESDB_HOST=postgres\r\n - DB_POSTGRESDB_PORT=5432\r\n - DB_POSTGRESDB_DATABASE=${POSTGRES_DB}\r\n - DB_POSTGRESDB_USER=${POSTGRES_USER}\r\n - DB_POSTGRESDB_PASSWORD=${POSTGRES_PASSWORD}\r\n volumes:\r\n - n8n_data:\/home\/node\/.n8n\r\n - .\/local-files:\/files\r\n depends_on:\r\n postgres:\r\n condition: service_healthy\r\n\r\nvolumes:\r\n postgres_data:\r\n n8n_data:<\/code><\/pre>\nA few lines deserve explanation, because copy-pasting without understanding them is exactly how people get stuck later:<\/p>\n
\n- “127.0.0.1:5678:5678”<\/b> \u2014 this binds n8n’s port to localhost only, not to the public internet. Combined with the firewall from Step 3, this means the only<\/i> path into n8n is through Nginx. Someone can’t bypass your SSL certificate and login screen by hitting your-ip:5678 directly.<\/li>\n
- WEBHOOK_URL<\/b> \u2014 this is the single most common source of confusion in n8n self-hosting. Without it, n8n guesses its own public address and frequently gets it wrong when running behind a proxy, which means webhook nodes generate URLs containing localhost \u2014 completely unreachable from the outside. Setting it explicitly avoids that entirely.<\/li>\n
- N8N_PROXY_HOPS=1<\/b> \u2014 tells n8n that requests pass through exactly one reverse proxy (your Nginx) before reaching it, so it correctly reads the visitor’s real IP and protocol instead of Nginx’s internal ones.<\/li>\n
- depends_on: condition: service_healthy<\/b> \u2014 makes sure n8n waits for Postgres to actually be ready to accept connections, not just for the container to have started. This avoids a race condition on first boot.<\/li>\n
- The <\/b>n8n_data<\/b> volume<\/b> \u2014 this is where n8n stores things that live outside the database: your encryption key backup, installed community nodes, and binary file data. Losing this volume without a backup means losing that data, so it’s included in the backup steps later.<\/li>\n<\/ul>\n
Step 8: Install and configure Nginx<\/b><\/h2>\n
Install Nginx:<\/p>\n
sudo apt install -y nginx<\/code><\/pre>\nCreate a configuration file for your n8n site:<\/p>\n
sudo nano \/etc\/nginx\/sites-available\/n8n<\/code><\/pre>\nPaste this in (replace n8n.yourdomain.com with your actual domain):<\/p>\n
server {\r\n listen 80;\r\n server_name n8n.yourdomain.com;\r\n\r\n client_max_body_size 50M;\r\n\r\n location \/ {\r\n proxy_pass http:\/\/127.0.0.1:5678;\r\n proxy_http_version 1.1;\r\n proxy_set_header Upgrade $http_upgrade;\r\n proxy_set_header Connection \"upgrade\";\r\n proxy_set_header Host $host;\r\n proxy_set_header X-Real-IP $remote_addr;\r\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\n proxy_set_header X-Forwarded-Proto $scheme;\r\n proxy_read_timeout 300s;\r\n }\r\n}<\/code><\/pre>\nTwo details worth calling out:<\/p>\n
\n- The <\/b>Upgrade<\/b>\/<\/b>Connection “upgrade”<\/b> headers<\/b> are there for WebSockets. n8n’s editor uses a WebSocket connection for live updates while you’re building a workflow \u2014 without these two lines, the interface loads but silently loses real-time features, which is a confusing bug to track down after the fact.<\/li>\n
- client_max_body_size 50M<\/b> raises Nginx’s default upload limit, since workflows that handle files or larger payloads can otherwise get rejected before they even reach n8n.<\/li>\n<\/ul>\n
Enable the site and check the config for typos:<\/p>\n
sudo ln -s \/etc\/nginx\/sites-available\/n8n \/etc\/nginx\/sites-enabled\/\r\nsudo nginx -t<\/code><\/pre>\nIf it says syntax is ok and test is successful, reload Nginx:<\/p>\n
sudo systemctl reload nginx<\/code><\/pre>\nStep 9: Get a free SSL certificate with Let’s Encrypt<\/b><\/h2>\n
Install Certbot along with its Nginx plugin, which will edit your config automatically:<\/p>\n
sudo apt install -y certbot python3-certbot-nginx<\/code><\/pre>\nRequest and install the certificate:<\/p>\n
sudo certbot --nginx -d n8n.yourdomain.com<\/code><\/pre>\nCertbot will ask for an email (for renewal notices) and whether to redirect HTTP to HTTPS \u2014 say yes. If this step fails with a “connection refused” or timeout error, it almost always means your DNS record from Step 2 hasn’t propagated yet. Wait a while and try again.<\/p>\n
Certbot’s certificates expire every 90 days, but it installs an automatic renewal job for you. You can double-check it’s set up correctly with a dry run:<\/p>\n
sudo certbot renew --dry-run<\/code><\/pre>\nStep 10: Launch n8n<\/b><\/h2>\n
Back in your project folder, start everything:<\/p>\n
cd ~\/n8n-server\r\ndocker compose up -d<\/code><\/pre>\nThe -d runs it in the background. Watch the logs to make sure both containers start cleanly:<\/p>\n
docker compose logs -f<\/code><\/pre>\nYou should see Postgres report it’s ready to accept connections, followed by n8n starting up and listening on port 5678. Press Ctrl+C to stop watching the logs (this doesn’t stop the containers).<\/p>\n
Check both containers are actually running:<\/p>\n
docker compose ps<\/code><\/pre>\nBoth n8n-server-postgres-1 and n8n-server-n8n-1 should show a status of Up (and healthy for Postgres).<\/p>\n
Step 11: Open n8n and create your account<\/b><\/h2>\n
Visit https:\/\/n8n.yourdomain.com in your browser. You should see a valid padlock icon (thanks to Certbot) and n8n’s setup screen.<\/p>\n
This first screen creates your owner account<\/b> \u2014 n8n’s built-in login system, not a separate password you configure through environment variables. (Older guides mention a N8N_BASIC_AUTH_ACTIVE variable; that mechanism was removed from current n8n versions in favor of this proper account system, so don’t be confused if you see it referenced elsewhere.)<\/p>\n
Enter your email and a password (at least 8 characters, with one number and one capital letter), and you’re in. From here you can invite additional users under Settings \u2192 Users<\/b> if others need access.<\/p>\nStep 12: Updating n8n safely<\/b><\/h2>\n
n8n ships new releases frequently. To update:<\/p>\n
cd ~\/n8n-server\r\ndocker compose pull\r\ndocker compose up -d\r\n<\/code><\/pre>\nThis pulls the newest image and recreates only the containers that changed, leaving your data volumes untouched. Before updating across a major<\/i> version (e.g. 1.x to 2.x), skim n8n’s release notes for breaking changes \u2014 most minor updates are safe to apply without reading anything, but major versions occasionally require a manual step.<\/p>\nBacking up your data<\/b><\/h2>\n
Two things need backing up regularly: the Postgres database, and the n8n_data volume (which holds your encryption key backup and any binary file data).<\/p>\n
A simple backup script:<\/p>\n
#!\/bin\/bash\r\nBACKUP_DIR=~\/n8n-backups\/$(date +%Y-%m-%d)\r\nmkdir -p \"$BACKUP_DIR\"\r\n\r\ncd ~\/n8n-server\r\n\r\n# Dump the Postgres database\r\ndocker compose exec -T postgres pg_dump -U n8n n8n > \"$BACKUP_DIR\/n8n-db.sql\"\r\n\r\n# Back up the n8n_data volume\r\ndocker run --rm -v n8n-server_n8n_data:\/data -v \"$BACKUP_DIR\":\/backup alpine \\\r\n tar czf \/backup\/n8n_data.tar.gz -C \/data .<\/code><\/pre>\nSave this as backup.sh, make it executable with chmod +x backup.sh, and consider scheduling it with cron to run daily. Also keep a copy of your .env file somewhere safe outside the server \u2014 it holds your encryption key, and without it a restored database is useless.<\/p>\n
![\"n8n](\"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/07\/8b53be0e-1223-408b-b46f-78f8e4afcdc6.png\" "\\"\\"")
<\/p>\n