Self-hosting n8n with Docker: complete setup guide

This page may contain affiliate links.

n8n is the automation tool that finally made me stop paying a monthly subscription for something I could run myself. It is a node-based workflow builder — think Zapier or Make, but open source and yours to keep. The cloud version is genuinely convenient, but if you have a spare mini PC, a NAS or a cheap VPS, self-hosting gives you unlimited executions, no per-task billing, and your data staying on your own tin. The catch is that "just run the Docker image" hides a fair bit of work. This guide covers the bits that actually matter: persistent storage, encryption keys, HTTPS, backups, and the mistakes that cost people their workflows.

What you actually need before you start

You need a machine that stays on. A Raspberry Pi 5 with 8GB RAM handles light n8n use fine; a mini PC with an Intel N100 and 16GB is a much more comfortable experience if you plan on running anything heavy. If you would rather not have hardware humming in the corner, any UK VPS provider will do — a 2GB RAM instance is the realistic minimum, 4GB if you want headroom.

You also need Docker and Docker Compose installed. On a Debian or Ubuntu box that is:

curl -fsSL https://get.docker.com | sh

Then add your user to the docker group so you are not typing sudo forever: sudo usermod -aG docker $USER, and log out and back in.

One more thing people skip: a domain name. You can run n8n on a bare IP address, but webhooks and OAuth callbacks get awkward fast. A .co.uk domain costs a few pounds a year and makes everything downstream simpler.

The docker-compose file that works

Do not use the single docker run command from the docs. Use Compose so upgrades and restarts are sane. Create a folder, drop in a docker-compose.yml, and put this in it:

services:
n8n:
image: docker.n8n.io/n8nio/n8n
restart: unless-stopped
ports:
- "5678:5678"
environment:
- N8N_HOST=n8n.yourdomain.co.uk
- N8N_PORT=5678
- N8N_PROTOCOL=https
- WEBHOOK_URL=https://n8n.yourdomain.co.uk/
- GENERIC_TIMEZONE=Europe/London
- N8N_ENCRYPTION_KEY=put_a_long_random_string_here
- N8N_RUNNERS_ENABLED=true
volumes:
- ./n8n_data:/home/node/.n8n

Two of those lines are load-bearing. N8N_ENCRYPTION_KEY encrypts every stored credential — if you let n8n generate one and then lose the volume, your saved API keys become unreadable. Set it yourself, back it up somewhere separate, and never change it. GENERIC_TIMEZONE=Europe/London stops your scheduled workflows firing at odd hours, which is a genuinely annoying bug to chase.

The ./n8n_data volume mapping is what makes your workflows survive a container rebuild. Without it, docker compose down is a data loss event.

Bring it up with docker compose up -d and check the logs with docker compose logs -f n8n. You should see it report that the editor is ready.

Putting HTTPS in front of it

Do not expose port 5678 to the internet directly. You will get scanned, and n8n's login is one password away from everything you have connected to it.

The cleanest approach is Caddy, which handles Let's Encrypt certificates automatically. Add a Caddy service to the same Compose file, point your domain's DNS at the box, and give it a two-line Caddyfile:

n8n.yourdomain.co.uk {
reverse_proxy n8n:5678
}

Caddy sorts the certificate, renewal and HTTP-to-HTTPS redirect on its own. If you are running this at home behind a router, you will need to forward ports 80 and 443 to the machine — and if your ISP uses CGNAT, port forwarding will not work at all. In that case, use a Cloudflare Tunnel instead, which punches out rather than in, and skip the port forwarding entirely.

Once HTTPS is up, set N8N_SECURE_COOKIE=true in your environment variables. It is a small thing that prevents session hijacking on public Wi-Fi.

Backups, upgrades and the boring bits that save you

Your entire n8n install is the n8n_data folder plus your encryption key. Back both up, and test that the backup actually restores — an untested backup is a rumour, not a backup.

A simple cron job that tars the folder nightly is enough for most people:

0 3 * * * tar -czf /backups/n8n-$(date +\%F).tar.gz /home/you/n8n/n8n_data

Rotate them so you keep the last fortnight and no more. If you want off-site copies, point that folder at a cloud sync tool or an external drive. A modest USB SSD is plenty for this — something like a Samsung T7 portable SSD works well for local backups, though any reliable drive will do.

Upgrading is two commands: docker compose pull then docker compose up -d. Read the release notes first — occasionally a major version changes how credentials or nodes behave, and you want to know before you find out the hard way. Pin your image to a specific version tag rather than latest if you value predictability.

If you would rather skip the blank-canvas problem entirely, we put together n8n Starter Workflows — plug-and-play templates you import in minutes, covering the common jobs people actually want automated. It is the done-for-you version of the first week you would otherwise spend building from scratch, and it starts from £9.

Common gotchas worth knowing up front

Webhooks will not work until WEBHOOK_URL matches your public HTTPS address exactly, trailing slash included. Get this wrong and external services will call a URL that does not exist, with no obvious error.

If you run n8n behind a reverse proxy, large file uploads can fail silently. Nginx has a default body size limit that catches people out; Caddy is more forgiving.

Memory is the other one. n8n itself is not heavy, but a workflow that pulls a large dataset into memory will happily eat a 2GB VPS. Watch docker stats for a week before you trust it with anything important.

Finally, set up the owner account immediately after first launch. If you leave the setup page open on a public URL, anyone who finds it can claim your instance.

Self-hosting n8n is one of those projects that takes an afternoon and then quietly saves you money every month afterwards. Get the encryption key and backups right, put HTTPS in front of it, and it will run unattended for months. The rest — the workflows themselves — is where the actual value lives, and that is a much more enjoyable problem to solve than fighting Docker networking.