n8n Self-Hosted 2026: Docker Setup + Security Guide

Run n8n yourself on a small rented cloud computer (a VPS) for $5-20/month and you get unlimited automations that run as often as you want, with no charge per task — unlike Zapier, which bills you per task from $19.99/month, or Make.com, which caps how much you can run. Getting it going takes 30-60 minutes using two free tools (Docker Compose to run everything, and Caddy to safely handle the web connection). It is the best fit for tech-savvy teams doing 5,000+ runs a month, or any business that has to keep data private — think healthcare, legal, and finance. If nobody on your team wants to look after a server, pay for the Cloud version ($20/month) instead.

n8n is a tool for building automations — little assistants that do repetitive work for you — and you can run it on your own server for free. There is no charge each time an automation runs and no monthly fee for the software; all you pay for is the rented cloud computer it lives on (a VPS, usually $5-30/month). It plugs into 400+ apps and services, lets you drop in your own JavaScript when you need to, and keeps all of your data firmly in your own hands.

This guide walks you through the whole thing: from getting Docker installed at the start, to locking the setup down so it is safe, plus real automation examples you can copy and tweak for your own business.

“n8n is a fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.” — n8n.io official site

“Self-hosting gives you full control over your data and workflows. Run unlimited executions on your own infrastructure.” — n8n Self-Hosting Documentation

Why Self-Host?

“n8n is a fair-code licensed workflow automation tool that lets you self-host, modify, and deploy as you see fit.” — n8n.io official documentation

Self-hosted n8n by the numbers

• Hetzner CX11 VPS: $5/month (2 vCPU, 4GB RAM)
• DigitalOcean droplet: $6/month (1 vCPU, 1GB RAM)
• AWS EC2 t3.small: $15/month (2 vCPU, 2GB RAM)
• n8n Cloud Starter equivalent: $20/month
• n8n Cloud Pro equivalent: $50/month
• Savings vs Cloud (annual): $180-$540/year
• ROI break-even: 1-3 months for any business with 5+ active workflows
• CPU usage idle: 1-3% on a 2-vCPU VPS
• CPU usage during workflow execution: 15-40% spike
• Memory usage idle: ~200MB
• Memory usage with 10 active workflows: ~400-600MB
• Disk space for 1 year of execution logs: ~5-10GB
• Backup size (daily compressed): ~100-500MB
• Docker image size: ~500MB

The Cost Argument

Say your automations run 5,000 times a month. Here is what each option would cost you:

Once you are running 10,000+ times a month the gap gets even wider, simply because running it yourself never charges you by the task. Want to see the plans, run limits, and what each tool is best at, all lined up next to each other? Check the n8n vs Make vs Zapier 2026 comparison.

The Data Control Argument

When you run it yourself, none of your data ever leaves your own equipment. Every time an automation runs, every password it uses to log into other apps, every bit of customer information — it all stays on your server and nowhere else. For businesses in healthcare, legal, or finance, or anyone who has to keep data private, that is not just a nice bonus — it is something you simply have to have.

The Flexibility Argument

When you run it yourself, nobody puts limits on what you can do:

• Build as many automations as you want
• Run them as often as you want
• Add as many team members as you want
• Drop in your own JavaScript or Python code wherever you need it
• Pull in extra code libraries other people have built
• Reach straight into your database when you have to
• Let AI assistants use outside tools on their own, through something called MCP (a shared “language” that lets an AI safely operate other software). This is what powers AI-assistant automations — for example, Safari MCP lets an AI drive your web browser using logins you already have. One heads-up: most of these browser tools quietly break on fancy text editors like LinkedIn and Notion unless you add a workaround made for that editor

Prerequisites

Before you start, here is what you will need:

• A rented cloud computer (a VPS) — from Hetzner, DigitalOcean, Contabo, or any similar company
  • The least you can get away with: 2 processors, 2 GB memory, 20 GB disk (~$5-10/month)
  • What we suggest: 2 processors, 4 GB memory, 40 GB disk (~$10-20/month)
• A web address (a domain) pointed at your server, so it can have a secure HTTPS connection
• A little comfort with the command line — you will be typing text commands into your server rather than clicking buttons
• Docker and Docker Compose already installed on the server (these are the tools that run everything)

Step 1: Server Setup and Docker Installation

First, connect to your server from your own computer (that connection is called SSH) and install Docker on it. The commands below update the server, install Docker and its helper tool, and then confirm both are ready — you can copy them one block at a time:

# Update system packages
sudo apt update && sudo apt upgrade -y

# Install Docker
curl -fsSL https://get.docker.com | sh

# Add your user to the docker group
sudo usermod -aG docker $USER

# Install Docker Compose plugin
sudo apt install docker-compose-plugin -y

# Verify installation
docker --version
docker compose version

Step 2: Docker Compose Configuration

Make a folder to keep everything in, and move into it. This command creates that folder and then steps inside it:

mkdir -p /opt/n8n && cd /opt/n8n

Now create a file called docker-compose.yml. Think of it as the instruction sheet that tells Docker exactly how to run n8n — which version to use, which door (port) to open, the login details, and so on:

version: "3.8"

services:
  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    ports:
      - "5678:5678"
    environment:
      # Basic configuration
      - N8N_HOST=n8n.yourdomain.com
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://n8n.yourdomain.com/

      # Security
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=admin
      - N8N_BASIC_AUTH_PASSWORD=your-strong-password-here

      # Database (SQLite by default, PostgreSQL recommended for production)
      - DB_TYPE=sqlite

      # Timezone
      - GENERIC_TIMEZONE=UTC
      - TZ=UTC

      # Execution settings
      - EXECUTIONS_DATA_PRUNE=true
      - EXECUTIONS_DATA_MAX_AGE=168  # 7 days

    volumes:
      - n8n_data:/home/node/.n8n

volumes:
  n8n_data:
    driver: local

Now start it up. This one command tells Docker to read that instruction sheet and get n8n running quietly in the background:

docker compose up -d

n8n is now up and running, listening on door number 5678. Before you actually open it in a browser, though, you need to add a secure connection (HTTPS) — that is the next step.

Step 3: Reverse Proxy with Caddy (Automatic HTTPS)

To make n8n reachable safely over the web, you want a piece of software sitting in front of it that handles the secure connection for you. Caddy is the easiest choice: it acts as that front door and, on its own, sets up the padlock (HTTPS) using free security certificates — no cost, no manual steps. You can add it to your Docker setup or just install it on its own like this:

sudo apt install -y caddy

Next, create or open the file /etc/caddy/Caddyfile. This short file simply tells Caddy: “when someone visits this web address, quietly pass them through to n8n”:

n8n.yourdomain.com {
    reverse_proxy localhost:5678 {
        flush_interval -1
    }
}

Then restart Caddy so it picks up what you just wrote:

sudo systemctl restart caddy

From here Caddy takes care of the padlock for you — it fetches the security certificate that makes HTTPS work, and renews it before it ever expires, so you never have to think about it. Your n8n is now live at https://n8n.yourdomain.com.

Another option: If you would rather use Nginx, it can do the same front-door job, paired with a free tool called certbot to handle the HTTPS padlock. For this particular setup, though, Caddy is the simpler road.

Step 4: PostgreSQL for Production (Recommended)

n8n needs somewhere to store its records, and it comes with a small built-in filing system called SQLite. That is fine while you are just testing. But once this is doing real work for your business, you want something sturdier that can handle a lot more without buckling — a well-known database called PostgreSQL. The updated instruction sheet below adds PostgreSQL alongside n8n and tells n8n to use it instead:

version: "3.8"

services:
  postgres:
    image: postgres:16
    container_name: n8n-postgres
    restart: unless-stopped
    environment:
      - POSTGRES_USER=n8n
      - POSTGRES_PASSWORD=your-db-password-here
      - POSTGRES_DB=n8n
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n8n"]
      interval: 10s
      timeout: 5s
      retries: 5

  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "5678:5678"
    environment:
      - N8N_HOST=n8n.yourdomain.com
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://n8n.yourdomain.com/

      # PostgreSQL
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - DB_POSTGRESDB_PASSWORD=your-db-password-here

      # Security
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=admin
      - N8N_BASIC_AUTH_PASSWORD=your-strong-password-here

      # Timezone
      - GENERIC_TIMEZONE=UTC
      - TZ=UTC

      # Execution settings
      - EXECUTIONS_DATA_PRUNE=true
      - EXECUTIONS_DATA_MAX_AGE=168

    volumes:
      - n8n_data:/home/node/.n8n

volumes:
  n8n_data:
    driver: local
  postgres_data:
    driver: local

Step 5: Security Hardening

When you run things yourself, keeping them safe is on you rather than on some company. Here are the basics you should not skip:

Firewall

A firewall is like a bouncer for your server: it only lets in the kinds of traffic you approve and turns everyone else away. The commands below open just the three doors you actually need — one for you to log in (SSH) and two for web traffic — switch the bouncer on, and then specifically slam shut the door n8n runs on so nobody can reach it directly, only through your secure front door:

# Allow only SSH, HTTP, and HTTPS
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

# Block direct access to n8n port (only via reverse proxy)
sudo ufw deny 5678/tcp

Environment Variables Security

Do not write your real passwords directly into the docker-compose.yml instruction sheet on a live setup — it is too easy for them to leak that way. Instead, keep all your secrets in a separate, private file named .env, like this:

# /opt/n8n/.env
N8N_BASIC_AUTH_USER=admin
N8N_BASIC_AUTH_PASSWORD=your-very-strong-password
DB_POSTGRESDB_PASSWORD=your-db-password
N8N_ENCRYPTION_KEY=a-random-32-character-string

Then, in docker-compose.yml, point to those secrets by name instead of spelling them out. The ${...} bits below just mean “grab this value from the private file”:

environment:
  - N8N_BASIC_AUTH_PASSWORD=${N8N_BASIC_AUTH_PASSWORD}
  - DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD}
  - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}

Automatic Backups

A backup is just a saved copy you can fall back on if something goes wrong. The short script below makes one automatically: it saves a copy of all your automations, saves a copy of your database, and then tidies up by deleting any copies older than a week so they do not pile up:

#!/bin/bash
# /opt/n8n/backup.sh
BACKUP_DIR="/opt/n8n/backups"
DATE=$(date +%Y%m%d_%H%M%S)

mkdir -p $BACKUP_DIR

# Export n8n workflows
docker exec n8n n8n export:workflow --all --output="/home/node/.n8n/backups/workflows_${DATE}.json"

# Backup PostgreSQL
docker exec n8n-postgres pg_dump -U n8n n8n > "${BACKUP_DIR}/db_${DATE}.sql"

# Keep only last 7 days
find $BACKUP_DIR -type f -mtime +7 -delete

echo "Backup completed: ${DATE}"

You do not want to remember to run that by hand every day, so set it to run on its own. “cron” is your server’s built-in alarm clock for tasks — this line tells it to run the backup every night at 3 AM:

# Run backup daily at 3 AM
0 3 * * * /opt/n8n/backup.sh

Automatic Updates

Keeping n8n up to date is worth doing regularly. This little script grabs the newest version and restarts n8n so it starts using it — you can run it whenever you want the latest release:

#!/bin/bash
# /opt/n8n/update.sh
cd /opt/n8n

# Pull latest image
docker compose pull

# Restart with new image
docker compose up -d

echo "n8n updated to latest version"

Step 6: Queue Mode for High-Volume Setups

Once you are running a lot — say 100+ times a day — it helps to stop cramming all the work into one place. Queue Mode fixes that by lining jobs up in a to-do list and letting several helpers work through them side by side, which keeps things steady under load. A small tool called Redis holds that list. The instruction sheet below adds Redis, switches n8n into this mode, and adds one of those helpers (a “worker”):

services:
  redis:
    image: redis:7-alpine
    container_name: n8n-redis
    restart: unless-stopped
    volumes:
      - redis_data:/data

  n8n:
    # ... (previous config)
    environment:
      # ... (previous env vars)
      - EXECUTIONS_MODE=queue
      - QUEUE_BULL_REDIS_HOST=redis
      - QUEUE_BULL_REDIS_PORT=6379

  n8n-worker:
    image: n8nio/n8n:latest
    container_name: n8n-worker
    restart: unless-stopped
    command: worker
    environment:
      # Same DB and Redis config as main n8n
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD}
      - EXECUTIONS_MODE=queue
      - QUEUE_BULL_REDIS_HOST=redis
      - QUEUE_BULL_REDIS_PORT=6379
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
    volumes:
      - n8n_data:/home/node/.n8n

volumes:
  redis_data:
    driver: local

Q2 2026 Update: What Changed for Self-Hosted Deployments

Three things changed in the second quarter of 2026 that matter if you run n8n yourself:

1. Version 1.115 gave bots a built-in memory (April 2026) — you can now let your bot remember earlier parts of a conversation just by ticking a box in the AI Agent step; it supports a few different ways of storing that memory. Before this, you had to hand-write code to pull that off. As a result, building bots that keep track of context — like ones that route people to the right place or handle a back-and-forth support chat — dropped from 3-5 weeks of work to 1-2 weeks. Release notes.
2. The cost of using AI dropped 40-60% (the “AI” here means the large language models — the brains behind smart bots) — Claude Haiku 4.5, GPT-4o-mini, and Gemini Flash now cost just $0.001-$0.005 for every thousand words or so they handle. A setup running 200 AI bot conversations a day (roughly 800 calls to the AI) went from $400-1,200/month down to $80-200/month. Suddenly a bunch of automations that were “too pricey for a small business” just three months ago make sense again.
3. WhatsApp phone calls are now officially supported, with new building blocks (March 2026) — if you use the official WhatsApp connection, you can build flows that actually place calls: collect someone’s details, hand off to an AI assistant, place a call, and book them into a calendar. What used to be a six-month custom engineering job is now a 1-2 week automation.

Quick tip, May 2026: if you run n8n yourself and you have not taken a fresh look at which of your automations use AI since February, you are probably wasting money. The price of the AI part has dropped far more than the price of the servers, so that is where the real savings are hiding right now.

Real-World Workflow Examples

1. Lead Capture to CRM + WhatsApp Notification

What kicks it off: Someone fills in the contact form on your website (the form quietly pings n8n the moment it is submitted)

What happens next:

1. n8n grabs what they typed — name, email, phone, message
2. It adds them as a new contact in your customer list (HubSpot / Airtable / Pipedrive)
3. It sends the person a WhatsApp message confirming you got their enquiry (our WhatsApp bot for business guide covers how to connect WhatsApp)
4. It pings your sales team on Slack or WhatsApp so they know
5. It drops the person into an automatic email follow-up sequence

That is 5-10 minutes of copy-pasting saved on every single lead — and no enquiry ever slips through the cracks.

2. Appointment Reminders

What kicks it off: A timer — this one runs itself once every hour

What happens next:

1. It looks in your calendar or booking tool for any appointments coming up in the next 24 hours
2. It sets aside the ones that have not been reminded yet
3. It sends each of those customers a WhatsApp reminder
4. It notes down that the reminder went out, so nobody gets pestered twice
5. If a customer replies “cancel,” it updates the booking for you automatically

The result: far fewer no-shows, and you never lift a finger.

3. Invoice Automation

What kicks it off: You mark a deal as “Won” in your customer list

What happens next:

1. It pulls the details of that deal
2. It creates the invoice in your accounting software
3. It emails the invoice to the customer
4. If they have not paid after 7 days, it sends a polite reminder
5. It updates the deal to show whether it has been paid

4. Customer Support Triage

What kicks it off: A new message lands from a customer, by WhatsApp or email

What happens next:

1. It reads the customer’s message
2. It uses AI (OpenAI/Claude) to work out what the message is actually about — a billing question, a technical problem, or a general enquiry — and sort it accordingly. That is the simple version; for bots that can go further and handle several steps by themselves, see AI agents for business
3. It checks your help articles to see if there is a ready answer
4. If it is confident it found the right answer, it replies on its own
5. If not, it hands the conversation to the right person on your team inside Chatwoot (our Chatwoot vs Intercom comparison explains why we prefer Chatwoot; 5% off Cloud with code ACHIYAEN)
6. It keeps a record of the whole thing in your customer list

Common Configuration Tips

Settings Worth Turning On

These are a few optional tweaks you can add to your setup. Each line adjusts one thing — how long n8n waits on slow services, how much detail it writes to its logs, how big a file it will accept, where it keeps its files, and whether it sends anonymous usage stats back home. The # lines are just plain-English notes explaining each one:

# Increase webhook timeout for slow APIs
N8N_DEFAULT_TIMEOUT=300

# Better error logging
N8N_LOG_LEVEL=info

# Allow larger payloads (for file processing)
N8N_PAYLOAD_SIZE_MAX=64

# Custom user folder (for multiple instances)
N8N_USER_FOLDER=/home/node/.n8n

# Disable usage telemetry (optional, privacy)
N8N_DIAGNOSTICS_ENABLED=false

Handy Commands to Keep Around

Sometimes it is quicker to type a command than to click through the screens. These few let you save all your automations to a file, load them back in, reset the admin password if you get locked out, and check which version you are on:

# Export all workflows
docker exec n8n n8n export:workflow --all --output=/home/node/.n8n/export.json

# Import workflows
docker exec n8n n8n import:workflow --input=/home/node/.n8n/export.json

# Reset admin password
docker exec n8n n8n user-management:reset

# Check n8n version
docker exec n8n n8n --version

When to Use the Managed Cloud Instead

Running it yourself is not the right call for everyone. Go with n8n Cloud instead when:

• Nobody to run the server: There is no one on your team who is comfortable looking after a Linux server
• You need official paperwork: You need a recognised security certification (like SOC 2) to satisfy clients or regulators, and Cloud comes with it
• You want to start today: You would rather be running in 5 minutes than spend an hour setting up
• It can never go down: Your business cannot afford even a short pause for maintenance
• You want someone to call: You want official support from the n8n team when something goes wrong

The Cloud version starts at $20/month and takes the hosting, updates, secure connection, and support off your plate. It is the exact same software with the exact same abilities — the only difference is that someone else looks after the machinery.

Maintenance Checklist

Once it is up and running, a little regular attention keeps it healthy:

• Every week: Skim the logs for any automations that failed, and read through any error alerts
• Every month: Update to the newest version, and clear out automations you no longer use
• Every few months: Make sure your backups actually work by restoring one onto a test setup, give your server’s security a once-over, and renew the HTTPS padlock if it did not renew itself
• Whenever needed: Give your server more power if things start running slowly

April 2026 Update: New Features Worth Knowing

Three things have changed since this guide first went up that make running it yourself nicer:

1. Version 1.70+ has a ready-made Gemini 3 building block — before, you had to wire up a general-purpose connector by hand and format everything yourself. Now there is a purpose-built block that just handles it, including replies that stream in bit by bit and inputs that mix text with images.
2. Queue Mode got steadier in 1.70 — fewer automations getting “stuck” partway through long jobs. If you have found yourself restarting those helper processes now and then, updating should cut that down.
3. “Task Runners” are now stable and ready for real use — these run any custom Python or JavaScript in a walled-off space of their own, which fixes a real safety worry: code from strangers running in the same place as everything else. Well worth using for any automation that is open to the public and takes input from users.

Quick tip, April 2026: try not to fall more than a couple of versions behind the latest release. The n8n team changes things gradually rather than all at once, so if you let it drift 6+ versions behind, catching up later becomes a real headache.

Getting Started

Running n8n yourself gives you a seriously capable automation engine for a tiny fraction of what the pay-monthly services charge. Getting it going takes 30-60 minutes, and after that it mostly looks after itself.

If you are comfortable enough to follow this guide, you can absolutely run the whole thing yourself. And if you would rather have someone else handle the setup and build your automations for you, that is exactly what we do.

We set up and look after automation systems for businesses — the server, the security, building the actual automations, and keeping everything running afterwards. You pay once for the setup, with no monthly software fees.

Get a free consultation or message us on WhatsApp to talk through what you want to automate. Our business automation service page and pricing tiers page have the details on how we deliver. Hiring from abroad? See hire an n8n expert for international pricing and how we work across time zones.