n8n Self-Hosted 2026: Docker Setup + Security Guide

You can run n8n on a rented cloud server, but “self-hosted” does not mean cost-free or limitless. Hosting, backups, monitoring, external APIs, and staff time still cost money, and capacity depends on the server and workflow design. The Community Edition has its own licence terms, while Zapier and Make use different task-based plans. Self-hosting suits teams that can operate a server or have a clear data-residency reason. If nobody on the team wants that responsibility, compare the current n8n Cloud plan instead.

n8n (I may earn a commission) is a tool for building automations, and its Community Edition can run on your own server under n8n’s licence terms. The platform does not use the same per-task billing model as Zapier, but you still pay for the server, backups, monitoring, maintenance, external APIs, and any commercial features you use. It connects to many apps and services, supports custom JavaScript, and gives the operator control over where workflow data is stored.

This guide walks you through the whole thing: from getting Docker installed at the start, to locking the setup down so it is safe, plus real automation examples you can copy and tweak for your own business.

“n8n is a fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.” — n8n.io official site

The n8n self-hosting documentation explains how to run n8n on infrastructure you control. Practical execution capacity still depends on the server, workflow design, concurrency settings, and applicable licence terms.

Why Self-Host?

“n8n is a fair-code licensed workflow automation tool that lets you self-host, modify, and deploy as you see fit.” — n8n.io official documentation

Self-hosted n8n by the numbers

• Hetzner CX11 VPS: $5/month (2 vCPU, 4GB RAM)
• DigitalOcean droplet: $6/month (1 vCPU, 1GB RAM)
• AWS EC2 t3.small: $15/month (2 vCPU, 2GB RAM)
• n8n Cloud Starter equivalent: $20/month
• n8n Cloud Pro equivalent: $50/month
• Annual cost comparison: calculate from the current cloud plan, hosting, backups, and staff time
• Break-even point: depends on workflow volume, maintenance effort, and the services each workflow calls
• CPU usage at idle: measure on the chosen VPS because nodes, worker mode, and background services change the baseline
• CPU usage during workflow execution: varies by node type, concurrency, and payload size; measure it under your own load
• Memory usage at idle: approximately 200MB in this planning example; measure the actual deployment
• Memory usage with 10 active workflows: approximately 400-600MB in this planning example
• Disk space for one year of execution logs: approximately 5-10GB, depending on payloads and retention
• Backup size (daily compressed): about 100-500MB
• Docker image size: about 500MB

The Cost Argument

Say your automations run 5,000 times a month. Here is what each option would cost you:

Once you are running 10,000+ times a month the gap gets even wider, simply because running it yourself never charges you by the task. Want to see the plans, run limits, and what each tool is best at, all lined up next to each other? Check the n8n vs Make vs Zapier 2026 comparison.

The Data Control Argument

When you run it yourself, none of your data ever leaves your own equipment. Every time an automation runs, every password it uses to log into other apps, every bit of customer information — it all stays on your server and nowhere else. For businesses in healthcare, legal, or finance, or anyone who has to keep data private, that is not just a nice bonus — it is something you simply have to have.

The Flexibility Argument

When you run it yourself, nobody puts limits on what you can do:

• Build as many automations as you want
• Run them as often as you want
• Add as many team members as you want
• Drop in your own JavaScript or Python code wherever you need it
• Pull in extra code libraries other people have built
• Reach straight into your database when you have to
• Let AI assistants use outside tools on their own, through something called MCP (a shared “language” that lets an AI safely operate other software). This is what powers AI-assistant automations — for example, Safari MCP lets an AI drive your web browser using logins you already have. One heads-up: most of these browser tools quietly break on fancy text editors like LinkedIn and Notion unless you add a workaround made for that editor

Prerequisites

Before you start, here is what you will need:

• A rented cloud computer (a VPS) — from Hetzner, DigitalOcean, Contabo, or any similar company
  • The least you can get away with: 2 processors, 2 GB memory, 20 GB disk (about $5-10/month)
  • What we suggest: 2 processors, 4 GB memory, 40 GB disk (about $10-20/month)
• A web address (a domain) pointed at your server, so it can have a secure HTTPS connection
• A little comfort with the command line — you will be typing text commands into your server rather than clicking buttons
• Docker and Docker Compose already installed on the server (these are the tools that run everything)

Step 1: Server Setup and Docker Installation

First, connect to your server from your own computer (that connection is called SSH) and install Docker on it. The commands below update the server, install Docker and its helper tool, and then confirm both are ready — you can copy them one block at a time:

# Update system packages
sudo apt update && sudo apt upgrade -y

# Install Docker
curl -fsSL https://get.docker.com | sh

# Add your user to the docker group
sudo usermod -aG docker $USER

# Install Docker Compose plugin
sudo apt install docker-compose-plugin -y

# Verify installation
docker --version
docker compose version

Step 2: Docker Compose Configuration

Make a folder to keep everything in, and move into it. This command creates that folder and then steps inside it:

mkdir -p /opt/n8n && cd /opt/n8n

Now create a file called docker-compose.yml. Think of it as the instruction sheet that tells Docker exactly how to run n8n — which version to use, which door (port) to open, the login details, and so on:

version: "3.8"

services:
  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    ports:
      - "5678:5678"
    environment:
      # Basic configuration
      - N8N_HOST=n8n.yourdomain.com
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://n8n.yourdomain.com/

      # Security
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=admin
      - N8N_BASIC_AUTH_PASSWORD=your-strong-password-here

      # Database (SQLite by default, PostgreSQL recommended for production)
      - DB_TYPE=sqlite

      # Timezone
      - GENERIC_TIMEZONE=UTC
      - TZ=UTC

      # Execution settings
      - EXECUTIONS_DATA_PRUNE=true
      - EXECUTIONS_DATA_MAX_AGE=168  # 7 days

    volumes:
      - n8n_data:/home/node/.n8n

volumes:
  n8n_data:
    driver: local

Now start it up. This one command tells Docker to read that instruction sheet and get n8n running quietly in the background:

docker compose up -d

n8n is now up and running, listening on door number 5678. Before you actually open it in a browser, though, you need to add a secure connection (HTTPS) — that is the next step.

Step 3: Reverse Proxy with Caddy (Automatic HTTPS)

To make n8n reachable safely over the web, you want a piece of software sitting in front of it that handles the secure connection for you. Caddy is the easiest choice: it acts as that front door and, on its own, sets up the padlock (HTTPS) using free security certificates — no cost, no manual steps. You can add it to your Docker setup or just install it on its own like this:

sudo apt install -y caddy

Next, create or open the file /etc/caddy/Caddyfile. This short file simply tells Caddy: “when someone visits this web address, quietly pass them through to n8n”:

n8n.yourdomain.com {
    reverse_proxy localhost:5678 {
        flush_interval -1
    }
}

Then restart Caddy so it picks up what you just wrote:

sudo systemctl restart caddy

From here Caddy takes care of the padlock for you — it fetches the security certificate that makes HTTPS work, and renews it before it ever expires, so you never have to think about it. Your n8n is now live at https://n8n.yourdomain.com.

Another option: If you would rather use Nginx, it can do the same front-door job, paired with a free tool called certbot to handle the HTTPS padlock. For this particular setup, though, Caddy is the simpler road.

Step 4: PostgreSQL for Production (Recommended)

n8n needs somewhere to store its records, and it comes with a small built-in filing system called SQLite. That is fine while you are just testing. But once this is doing real work for your business, you want something sturdier that can handle a lot more without buckling — a well-known database called PostgreSQL. The updated instruction sheet below adds PostgreSQL alongside n8n and tells n8n to use it instead:

version: "3.8"

services:
  postgres:
    image: postgres:16
    container_name: n8n-postgres
    restart: unless-stopped
    environment:
      - POSTGRES_USER=n8n
      - POSTGRES_PASSWORD=your-db-password-here
      - POSTGRES_DB=n8n
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n8n"]
      interval: 10s
      timeout: 5s
      retries: 5

  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "5678:5678"
    environment:
      - N8N_HOST=n8n.yourdomain.com
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://n8n.yourdomain.com/

      # PostgreSQL
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - DB_POSTGRESDB_PASSWORD=your-db-password-here

      # Security
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=admin
      - N8N_BASIC_AUTH_PASSWORD=your-strong-password-here

      # Timezone
      - GENERIC_TIMEZONE=UTC
      - TZ=UTC

      # Execution settings
      - EXECUTIONS_DATA_PRUNE=true
      - EXECUTIONS_DATA_MAX_AGE=168

    volumes:
      - n8n_data:/home/node/.n8n

volumes:
  n8n_data:
    driver: local
  postgres_data:
    driver: local

Step 5: Security Hardening

When you run things yourself, keeping them safe is on you rather than on some company. Here are the basics you should not skip:

Firewall

A firewall is like a bouncer for your server: it only lets in the kinds of traffic you approve and turns everyone else away. The commands below open just the three doors you actually need — one for you to log in (SSH) and two for web traffic — switch the bouncer on, and then specifically slam shut the door n8n runs on so nobody can reach it directly, only through your secure front door:

# Allow only SSH, HTTP, and HTTPS
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

# Block direct access to n8n port (only via reverse proxy)
sudo ufw deny 5678/tcp

Environment Variables Security

Do not write your real passwords directly into the docker-compose.yml instruction sheet on a live setup — it is too easy for them to leak that way. Instead, keep all your secrets in a separate, private file named .env, like this:

# /opt/n8n/.env
N8N_BASIC_AUTH_USER=admin
N8N_BASIC_AUTH_PASSWORD=your-very-strong-password
DB_POSTGRESDB_PASSWORD=your-db-password
N8N_ENCRYPTION_KEY=a-random-32-character-string

Then, in docker-compose.yml, point to those secrets by name instead of spelling them out. The ${...} bits below just mean “grab this value from the private file”:

environment:
  - N8N_BASIC_AUTH_PASSWORD=${N8N_BASIC_AUTH_PASSWORD}
  - DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD}
  - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}

Automatic Backups

A backup is just a saved copy you can fall back on if something goes wrong. The short script below makes one automatically: it saves a copy of all your automations, saves a copy of your database, and then tidies up by deleting any copies older than a week so they do not pile up:

#!/bin/bash
# /opt/n8n/backup.sh
BACKUP_DIR="/opt/n8n/backups"
DATE=$(date +%Y%m%d_%H%M%S)

mkdir -p $BACKUP_DIR

# Export n8n workflows
docker exec n8n n8n export:workflow --all --output="/home/node/.n8n/backups/workflows_${DATE}.json"

# Backup PostgreSQL
docker exec n8n-postgres pg_dump -U n8n n8n > "${BACKUP_DIR}/db_${DATE}.sql"

# Keep only last 7 days
find $BACKUP_DIR -type f -mtime +7 -delete

echo "Backup completed: ${DATE}"

You do not want to remember to run that by hand every day, so set it to run on its own. “cron” is your server’s built-in alarm clock for tasks — this line tells it to run the backup every night at 3 AM:

# Run backup daily at 3 AM
0 3 * * * /opt/n8n/backup.sh

Automatic Updates

Keeping n8n up to date is worth doing regularly. This little script grabs the newest version and restarts n8n so it starts using it — you can run it whenever you want the latest release:

#!/bin/bash
# /opt/n8n/update.sh
cd /opt/n8n

# Pull latest image
docker compose pull

# Restart with new image
docker compose up -d

echo "n8n updated to latest version"

Step 6: Queue Mode for High-Volume Setups

Once you are running a lot — say 100+ times a day — it helps to stop cramming all the work into one place. Queue Mode fixes that by lining jobs up in a to-do list and letting several helpers work through them side by side, which keeps things steady under load. A small tool called Redis holds that list. The instruction sheet below adds Redis, switches n8n into this mode, and adds one of those helpers (a “worker”):

services:
  redis:
    image: redis:7-alpine
    container_name: n8n-redis
    restart: unless-stopped
    volumes:
      - redis_data:/data

  n8n:
    # ... (previous config)
    environment:
      # ... (previous env vars)
      - EXECUTIONS_MODE=queue
      - QUEUE_BULL_REDIS_HOST=redis
      - QUEUE_BULL_REDIS_PORT=6379

  n8n-worker:
    image: n8nio/n8n:latest
    container_name: n8n-worker
    restart: unless-stopped
    command: worker
    environment:
      # Same DB and Redis config as main n8n
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD}
      - EXECUTIONS_MODE=queue
      - QUEUE_BULL_REDIS_HOST=redis
      - QUEUE_BULL_REDIS_PORT=6379
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
    volumes:
      - n8n_data:/home/node/.n8n

volumes:
  redis_data:
    driver: local

Q2 2026 Update: What Changed for Self-Hosted Deployments

Three things changed in the second quarter of 2026 that matter if you run n8n yourself:

1. Version 1.115 added built-in memory options for AI agents (April 2026). The AI Agent step can use supported memory backends instead of requiring every project to hand-write the storage layer. This can simplify bots that route people or keep context during support chats, but implementation time still depends on the workflow and data model. Source: n8n release notes.
2. The cost of using AI dropped 40-60% (the “AI” here means the large language models — the brains behind smart bots) — Claude Haiku 4.5, GPT-4o-mini, and Gemini Flash now cost just $0.001-$0.005 for every thousand words or so they handle. A setup running 200 AI bot conversations a day (roughly 800 calls to the AI) went from $400-1,200/month down to $80-200/month. Suddenly a bunch of automations that were “too pricey for a small business” just three months ago make sense again.
3. WhatsApp calling gained official building blocks (March 2026). With the official WhatsApp connection, a workflow can collect details, hand off to an AI assistant, place a call, and book a calendar slot. The feature removes some custom integration work, but it does not establish a universal delivery timeline.

Quick tip, May 2026: if you run n8n yourself and you have not taken a fresh look at which of your automations use AI since February, you are probably wasting money. The price of the AI part has dropped far more than the price of the servers, so that is where the real savings are hiding right now.

Q3 2026 Update: Version 2.x and the licensing question

Checked against the n8n release feed and license documentation, August 2026.

n8n is on the 2.x line now. The current release is n8n@2.35.7, published August 21, 2026 (n8n releases). If your docker-compose.yml still pins n8nio/n8n:1.x, you are on a line that no longer receives feature work. Check what you are actually running before you plan anything else:

docker exec -it n8n n8n --version     # what you run today
docker compose pull && docker compose up -d   # after you have taken a database backup

⚠️ Do not jump a major version on a live instance without a backup and a staging pass. Take the Postgres dump from the maintenance checklist below first, restore it somewhere disposable, upgrade that, and only then touch production.

The licensing question nobody asks until it matters

The single most common misunderstanding about self-hosted n8n: people assume “open source” means “I can run this for my clients and bill them for it.” It does not. n8n ships under the Sustainable Use License, a fair-code license the company created in 2022, and it carries three explicit limits:

“You may use or modify the software only for your own internal business purposes or for non-commercial or personal use. You may distribute the software or provide it to others only if you do so free of charge for non-commercial purposes. You may not alter, remove, or obscure any licensing, copyright, or other notices of the licensor in the software.” — n8n Sustainable Use License

What this means in practice. Running n8n on your own server to automate your own business is squarely allowed — that is what this whole guide is about. Standing up an n8n instance and selling access to it as your product is not. The line sits at “internal business purposes”: automating your company’s own work is internal; hosting it as a service for paying customers is not.

Agencies and consultants sit in the grey area and should read the license themselves rather than trust a blog post — including this one. If your model involves hosting n8n for clients, n8n sells an embed licence for exactly that case, and asking them directly costs nothing.

Real-World Workflow Examples

1. Lead Capture to CRM + WhatsApp Notification

What kicks it off: Someone fills in the contact form on your website (the form quietly pings n8n the moment it is submitted)

What happens next:

1. n8n grabs what they typed — name, email, phone, message
2. It adds them as a new contact in your customer list (HubSpot / Airtable (I may earn a commission) / Pipedrive)
3. It sends the person a WhatsApp message confirming you got their enquiry (our WhatsApp bot for business guide covers how to connect WhatsApp)
4. It pings your sales team on Slack or WhatsApp so they know
5. It drops the person into an automatic email follow-up sequence

That is 5-10 minutes of copy-pasting saved on every single lead — and no enquiry ever slips through the cracks.

2. Appointment Reminders

What kicks it off: A timer — this one runs itself once every hour

What happens next:

1. It looks in your calendar or booking tool for any appointments coming up in the next 24 hours
2. It sets aside the ones that have not been reminded yet
3. It sends each of those customers a WhatsApp reminder
4. It notes down that the reminder went out, so nobody gets pestered twice
5. If a customer replies “cancel,” it updates the booking for you automatically

The result: far fewer no-shows, and you never lift a finger.

3. Invoice Automation

What kicks it off: You mark a deal as “Won” in your customer list

What happens next:

1. It pulls the details of that deal
2. It creates the invoice in your accounting software
3. It emails the invoice to the customer
4. If they have not paid after 7 days, it sends a polite reminder
5. It updates the deal to show whether it has been paid

4. Customer Support Triage

What kicks it off: A new message lands from a customer, by WhatsApp or email

What happens next:

1. It reads the customer’s message
2. It uses AI (OpenAI/Claude) to work out what the message is actually about — a billing question, a technical problem, or a general enquiry — and sort it accordingly. That is the simple version; for bots that can go further and handle several steps by themselves, see AI agents for business
3. It checks your help articles to see if there is a ready answer
4. If it is confident it found the right answer, it replies on its own
5. If not, it hands the conversation to the right person on your team inside Chatwoot (I may earn a commission) (our Chatwoot vs Intercom comparison explains why we prefer Chatwoot; 5% off Cloud with code ACHIYAVS)
6. It keeps a record of the whole thing in your customer list

Common Configuration Tips

Settings Worth Turning On

These are a few optional tweaks you can add to your setup. Each line adjusts one thing — how long n8n waits on slow services, how much detail it writes to its logs, how big a file it will accept, where it keeps its files, and whether it sends anonymous usage stats back home. The # lines are just plain-English notes explaining each one:

# Increase webhook timeout for slow APIs
N8N_DEFAULT_TIMEOUT=300

# Better error logging
N8N_LOG_LEVEL=info

# Allow larger payloads (for file processing)
N8N_PAYLOAD_SIZE_MAX=64

# Custom user folder (for multiple instances)
N8N_USER_FOLDER=/home/node/.n8n

# Disable usage telemetry (optional, privacy)
N8N_DIAGNOSTICS_ENABLED=false

Handy Commands to Keep Around

Sometimes it is quicker to type a command than to click through the screens. These few let you save all your automations to a file, load them back in, reset the admin password if you get locked out, and check which version you are on:

# Export all workflows
docker exec n8n n8n export:workflow --all --output=/home/node/.n8n/export.json

# Import workflows
docker exec n8n n8n import:workflow --input=/home/node/.n8n/export.json

# Reset admin password
docker exec n8n n8n user-management:reset

# Check n8n version
docker exec n8n n8n --version

When to Use the Managed Cloud Instead

Running it yourself is not the right call for everyone. Go with n8n Cloud (I may earn a commission) instead when:

• Nobody to run the server: There is no one on your team who is comfortable looking after a Linux server
• You need official paperwork: You need a recognised security certification (like SOC 2) to satisfy clients or regulators, and Cloud comes with it
• You want to start today: You would rather be running in 5 minutes than spend an hour setting up
• It can never go down: Your business cannot afford even a short pause for maintenance
• You want someone to call: You want official support from the n8n team when something goes wrong

The Cloud version starts at $20/month and takes the hosting, updates, secure connection, and support off your plate. It is the exact same software with the exact same abilities — the only difference is that someone else looks after the machinery.

Maintenance Checklist

Once it is up and running, a little regular attention keeps it healthy:

• Every week: Skim the logs for any automations that failed, and read through any error alerts
• Every month: Update to the newest version, and clear out automations you no longer use
• Every few months: Make sure your backups actually work by restoring one onto a test setup, give your server’s security a once-over, and renew the HTTPS padlock if it did not renew itself
• Whenever needed: Give your server more power if things start running slowly

April 2026 Update: New Features Worth Knowing

Three things have changed since this guide first went up that make running it yourself nicer:

1. Version 1.70+ has a ready-made Gemini 3 building block — before, you had to wire up a general-purpose connector by hand and format everything yourself. Now there is a purpose-built block that just handles it, including replies that stream in bit by bit and inputs that mix text with images.
2. Queue Mode got steadier in 1.70 — fewer automations getting “stuck” partway through long jobs. If you have found yourself restarting those helper processes now and then, updating should cut that down.
3. “Task Runners” are now stable and ready for real use — these run any custom Python or JavaScript in a walled-off space of their own, which fixes a real safety worry: code from strangers running in the same place as everything else. Well worth using for any automation that is open to the public and takes input from users.

Quick tip, April 2026: try not to fall more than a couple of versions behind the latest release. The n8n team changes things gradually rather than all at once, so if you let it drift 6+ versions behind, catching up later becomes a real headache.

Getting Started

Running n8n (I may earn a commission) yourself gives you a seriously capable automation engine for a tiny fraction of what the pay-monthly services charge. Getting it going takes 30-60 minutes, and after that it mostly looks after itself.

If you are comfortable enough to follow this guide, you can absolutely run the whole thing yourself. And if you would rather have someone else handle the setup and build your automations for you, that is exactly what we do.

We set up and look after automation systems for businesses — the server, the security, building the actual automations, and keeping everything running afterwards. You pay once for the setup, with no monthly software fees.

Book an introductory call or message us on WhatsApp to talk through what you want to automate. Our business automation service page and pricing tiers page have the details on how we deliver. Hiring from abroad? See hire an n8n expert for international pricing and how we work across time zones.