\n| A<\/td>\n | n8n<\/td>\n | your_vps_ip_address<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n This makes n8n.yourdomain.com resolve to your server.<\/p>\n \n- DNS changes take time to propagate \u2014 anywhere from a few minutes to a few hours, depending on your provider. You can move on to the next steps while you wait; you’ll only need the DNS to be live by the time you start n8n itself.<\/li>\n<\/ol>\n
Step 3: Connect to Your VPS via SSH<\/h2>\nOpen a terminal on your own computer and connect using the IP address from your HostNoc email:<\/p>\n ssh root@your_vps_ip_address<\/code><\/pre>\nThe first time you connect, you’ll see a message asking you to confirm the server’s fingerprint \u2014 type yes and press Enter. Then paste in the root password from your email when prompted.<\/p>\nHeads up:\u00a0 <\/strong>nothing appears on screen while you type or paste the password \u2014 no dots, no cursor movement. That’s normal password-masking behavior in SSH, not a bug. Just paste it and press Enter.<\/span>\n\nIf everything worked, your prompt will change to something like root@your-server-name:~#. You’re in.<\/p>\n Step 4: Update the Server and Do Basic Housekeeping<\/h2>\nBefore installing anything, update the system so you’re not building on outdated packages:<\/p>\n apt update && apt upgrade -y<\/code><\/pre>\nThis refreshes the list of available packages and installs any pending security updates. Press through any prompts with the default option if asked.<\/p>\n Open the firewall for the ports you’ll actually need<\/h3>\nUbuntu ships with ufw (Uncomplicated Firewall) available. Enabling it and explicitly allowing only the ports n8n’s setup needs is a simple, meaningful security improvement:<\/p>\n ufw allow OpenSSH\r\nufw allow 80\/tcp\r\nufw allow 443\/tcp\r\nufw enable<\/code><\/pre>\n\n- Port 22 (via OpenSSH) keeps your SSH access open \u2014 allow this first, or you’ll lock yourself out.<\/li>\n
- Port 80 is needed briefly for Let’s Encrypt’s certificate verification and to redirect HTTP to HTTPS.<\/li>\n
- Port 443 is your actual HTTPS traffic.<\/li>\n<\/ul>\n
Notice n8n’s own port, 5678, isn’t opened here at all \u2014 that’s intentional and explained in Step 6.<\/p>\n Step 5: Install Docker and Docker Compose<\/h2>\nDocker isn’t preinstalled on a fresh Ubuntu VPS, so you’ll add it using Docker’s official installation script, which handles adding the correct repository for your Ubuntu version automatically:<\/p>\n curl -fsSL https:\/\/get.docker.com -o get-docker.sh\r\nsh get-docker.sh<\/code><\/pre>\nOnce it finishes, confirm both Docker and Docker Compose (which ships as a plugin with modern Docker installs) are available:<\/p>\n docker –version<\/p>\n docker compose version<\/p>\n You should see version numbers printed for both. If either command isn’t found, re-run the install script \u2014 it’s safe to run more than once.<\/p>\n Step 6: Set Up n8n With Docker Compose<\/h2>\nThis is the core of the guide. You’ll create three things: a folder for your project, an environment file with your settings, and a Docker Compose file that tells Docker what to run.<\/p>\n 6.1 Create your project folder<\/h3>\nmkdir n8n-compose\r\ncd n8n-compose<\/code><\/pre>\n6.2 Create the .env file<\/h3>\nThis file holds your personal settings \u2014 your domain, timezone, and the email used for SSL certificates. Create it with a text editor:<\/p>\n nano .env<\/code><\/pre>\nPaste in the following, replacing the values with your own:<\/p>\n # The top-level domain to serve from\r\nDOMAIN_NAME=yourdomain.com\r\n\r\n# The subdomain to serve n8n on \u2014 combined with DOMAIN_NAME this\r\n# gives you https:\/\/n8n.yourdomain.com\r\nSUBDOMAIN=n8n\r\n\r\n# Timezone used by n8n's Cron and scheduling nodes\r\nGENERIC_TIMEZONE=Asia\/Karachi\r\n\r\n# Email address used for your free SSL certificate (Let's Encrypt\r\n# sends renewal notices here if something goes wrong)\r\nSSL_EMAIL=you@example.com<\/code><\/pre>\nSave and exit nano with Ctrl+O, then Enter, then Ctrl+X.<\/p>\nA note on the timezone:\u00a0 <\/strong>use a valid IANA timezone name like Asia\/Karachi, Europe\/London, or America\/New_York. If you’re unsure of your exact one, Asia\/Karachi covers Pakistan Standard Time.<\/span>\n\n6.3 Create the shared files folder<\/h3>\nmkdir local-files<\/code><\/pre>\nThis gives n8n a folder on your actual server that its workflows can read from and write to (useful for nodes like \u201cRead\/Write Files from Disk\u201d). Creating it manually \u2014 rather than letting Docker create it automatically \u2014 ensures it has the correct ownership from the start.<\/p>\n 6.4 Create the Docker Compose file<\/h3>\nnano compose.yaml<\/code><\/pre>\nPaste in the following exactly as-is. This is n8n’s own officially documented Compose configuration \u2014 it runs two containers: Traefik (handles HTTPS and routing) and n8n itself.<\/p>\n services:\r\n traefik:\r\n image: \"traefik\"\r\n restart: always\r\n command:\r\n - \"--api.insecure=true\"\r\n - \"--providers.docker=true\"\r\n - \"--providers.docker.exposedbydefault=false\"\r\n - \"--entrypoints.web.address=:80\"\r\n - \"--entrypoints.web.http.redirections.entryPoint.to=websecure\"\r\n - \"--entrypoints.web.http.redirections.entrypoint.scheme=https\"\r\n - \"--entrypoints.websecure.address=:443\"\r\n - \"--certificatesresolvers.mytlschallenge.acme.tlschallenge=true\"\r\n - \"--certificatesresolvers.mytlschallenge.acme.email=${SSL_EMAIL}\"\r\n - \"--certificatesresolvers.mytlschallenge.acme.storage=\/letsencrypt\/acme.json\"\r\n ports:\r\n - \"80:80\"\r\n - \"443:443\"\r\n volumes:\r\n - traefik_data:\/letsencrypt\r\n - \/var\/run\/docker.sock:\/var\/run\/docker.sock:ro\r\n \r\n n8n:\r\n image: docker.n8n.io\/n8nio\/n8n\r\n restart: always\r\n ports:\r\n - \"127.0.0.1:5678:5678\"\r\n labels:\r\n - traefik.enable=true\r\n - traefik.http.routers.n8n.rule=Host(`${SUBDOMAIN}.${DOMAIN_NAME}`)\r\n - traefik.http.routers.n8n.tls=true\r\n - traefik.http.routers.n8n.entrypoints=web,websecure\r\n - traefik.http.routers.n8n.tls.certresolver=mytlschallenge\r\n - traefik.http.middlewares.n8n.headers.SSLRedirect=true\r\n - traefik.http.middlewares.n8n.headers.STSSeconds=315360000\r\n - traefik.http.middlewares.n8n.headers.browserXSSFilter=true\r\n - traefik.http.middlewares.n8n.headers.contentTypeNosniff=true\r\n - traefik.http.middlewares.n8n.headers.forceSTSHeader=true\r\n - traefik.http.middlewares.n8n.headers.SSLHost=${DOMAIN_NAME}\r\n - traefik.http.middlewares.n8n.headers.STSIncludeSubdomains=true\r\n - traefik.http.middlewares.n8n.headers.STSPreload=true\r\n - traefik.http.routers.n8n.middlewares=n8n@docker\r\n environment:\r\n - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true\r\n - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}\r\n - N8N_PORT=5678\r\n - N8N_PROTOCOL=https\r\n - NODE_ENV=production\r\n - WEBHOOK_URL=https:\/\/${SUBDOMAIN}.${DOMAIN_NAME}\/\r\n - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}\r\n - TZ=${GENERIC_TIMEZONE}\r\n volumes:\r\n - n8n_data:\/home\/node\/.n8n\r\n - .\/local-files:\/files\r\n \r\nvolumes:\r\n n8n_data:\r\n traefik_data:<\/code><\/pre>\nSave and exit the same way: Ctrl+O, Enter, Ctrl+X.<\/p>\n What this file is actually doing (in plain English)<\/h3>\n\n- traefik service: <\/strong>listens on ports 80 and 443 (the ones you opened in the firewall), automatically redirects any HTTP visitor to HTTPS, and requests\/renews your SSL certificate from Let’s Encrypt without you ever touching Certbot manually.<\/li>\n
- n8n service: <\/strong>runs n8n itself, but notice the port mapping \u2014 127.0.0.1:5678:5678 means n8n is only reachable from inside the server, not directly from the internet. The only way in is through Traefik. This is why you didn’t open port 5678 in your firewall earlier; it was never meant to be public.<\/li>\n
- volumes: <\/strong>n8n_data is where n8n stores its database file and its encryption key (the key that protects your saved credentials) \u2014 this is the single most important thing to back up, covered in Step 9. traefik_data stores your SSL certificate so it isn’t re-requested every time the container restarts.<\/li>\n<\/ul>\n
Step 7: Launch n8n<\/h2>\nWith your .env and compose.yaml files both in the n8n-compose folder, start everything with:<\/p>\n sudo docker compose up -d<\/code><\/pre>\nThe -d flag runs the containers in the background so they keep running after you close your terminal. The first run will take a minute or two as Docker downloads the Traefik and n8n images.<\/p>\n Check that both containers are running:<\/p>\n docker compose ps<\/code><\/pre>\nYou should see two entries \u2014 traefik and n8n \u2014 both showing a status of Up.<\/p>\n Step 8: Open n8n and Create Your Owner Account<\/h2>\nGive DNS and the SSL certificate a minute to settle, then visit:<\/p>\n https:\/\/n8n.yourdomain.com<\/code><\/pre>\n(using your actual domain and subdomain from the .env file).<\/p>\n The first time you load it, n8n will ask you to set up an owner account \u2014 an email address, name, and password for the main admin user of your instance. This is your own local account; it isn’t sent anywhere. Fill it in and you’ll land on the n8n editor, ready to build workflows.<\/p>\n If the page doesn’t load, don’t panic \u2014 jump to the Troubleshooting section below before assuming something’s broken.<\/p>\n Step 9: Keep n8n Updated and Backed Up<\/h2>\nA working n8n instance isn’t \u201cinstall once and forget.\u201d Two habits will save you real pain later.<\/p>\n Updating n8n<\/h2>\nn8n releases new versions frequently. To update, from inside your n8n-compose folder:<\/p>\n docker compose pull\r\ndocker compose up -d<\/code><\/pre>\nThis pulls the latest image and recreates the container \u2014 your data in n8n_data isn’t touched.<\/p>\nAlways back up before updating,\u00a0 <\/strong>especially before a major version jump. Check n8n’s release notes if you’re several versions behind, since major updates occasionally include breaking changes.<\/span>\n\nBacking up your data<\/h2>\nYour entire n8n instance \u2014 workflows, credentials, and the encryption key that unlocks them \u2014 lives in the n8n_data Docker volume. Back it up periodically:<\/p>\n docker run --rm -v n8n-compose_n8n_data:\/data -v $(pwd):\/backup ubuntu \\\r\ntar czf \/backup\/n8n_data_backup_$(date +%F).tar.gz -C \/data .<\/code><\/pre>\nStore that .tar.gz file somewhere off the server \u2014 downloaded locally, or synced to cloud storage. If your VPS ever fails, this backup plus your compose.yaml and .env files are everything you need to restore n8n elsewhere.<\/p>\n
|
![\"\"](\"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/07\/n8n-hostnoc.webp\" "\\"\\"")
<\/p>\n