How to Self-Host n8n on a VPS (Docker + Automatic HTTPS)

How to Self-Host n8n on a VPS (Docker + Automatic HTTPS)

by

Self-hosting n8n is the single highest-leverage infrastructure move for anyone running automation at volume. Per-task pricing on hosted platforms punishes exactly the behavior you want — more automation — while a self-hosted instance on a small VPS costs the same whether it runs a hundred executions a month or a hundred thousand.

This is the setup we run in production (our instance orchestrates content pipelines, research systems, and publishing across an entire portfolio), distilled to a clean install you can complete in under an hour. Basic comfort with a terminal is assumed; nothing here requires deep server expertise.

What you need

  • A VPS. A small instance — 2 vCPU, 4GB RAM — from a provider like Hetzner, DigitalOcean, or Vultr runs solo-builder workloads comfortably; entry-level instances in this class are typically in the $5–15/month range. Start small; resizing later is trivial.
  • A domain or subdomain (e.g. n8n.yourdomain.com) pointed at the server’s IP — needed for HTTPS, which n8n requires for webhooks and OAuth credentials to work properly.
  • Ubuntu LTS as the OS image — the default choice with the most documentation.

The architecture: Docker + a reverse proxy

Run n8n in Docker with Caddy in front of it. Docker keeps n8n isolated and updatable in one command; Caddy handles HTTPS automatically — it obtains and renews certificates with zero configuration beyond your domain name. This is the exact shape of our production setup and the reason updates take us minutes.

Step 1: Base server hygiene

apt update && apt upgrade -y
ufw allow OpenSSH && ufw allow 80 && ufw allow 443 && ufw enable

Updates plus a firewall that admits only SSH and web traffic. Two minutes, non-negotiable.

Step 2: Install Docker

curl -fsSL https://get.docker.com | sh

Step 3: The compose file

Create a folder and a docker-compose.yml:

services:
  n8n:
    image: n8nio/n8n:latest
    restart: unless-stopped
    environment:
      - N8N_HOST=n8n.yourdomain.com
      - WEBHOOK_URL=https://n8n.yourdomain.com/
      - GENERIC_TIMEZONE=Africa/Nairobi
    volumes:
      - n8n_data:/home/node/.n8n

  caddy:
    image: caddy:2
    restart: unless-stopped
    ports: ["80:80", "443:443"]
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data

volumes:
  n8n_data:
  caddy_data:

And a Caddyfile beside it:

n8n.yourdomain.com {
    reverse_proxy n8n:5678
}

Set your timezone to your own (schedules fire in this timezone — a classic gotcha).

Step 4: Launch

docker compose up -d

Visit https://n8n.yourdomain.com — you’ll get n8n’s setup screen to create the owner account. HTTPS is already live courtesy of Caddy.

The three habits that keep it healthy

1. Backups you’ve actually tested

Everything that matters lives in the n8n_data volume — workflows, credentials, execution history. Two layers: snapshot the volume (or the whole VPS — most providers offer scheduled snapshots for a small fee), and periodically export critical workflows as JSON to storage that isn’t this server. A backup you’ve never restored is a hypothesis, not a backup.

2. Updates on your schedule

docker compose pull && docker compose up -d

That’s the whole update. Do it deliberately — read the n8n release notes for breaking changes before major version jumps, and snapshot first. “Latest” is convenient; pinning a version tag in the compose file is calmer for production.

3. Watch the execution history

n8n stores execution logs; prune old ones (settings exist for auto-pruning) so the database doesn’t balloon, and check failed executions weekly. Better: build a small error workflow that messages you on failure — the self-hosted equivalent of a smoke alarm.

When to size up

Signals it’s time for more RAM/CPU: executions queueing at your busiest hour, memory errors on large data workflows, or the editor getting sluggish. Resizing a VPS is usually a reboot-level operation. Most solo operations never outgrow the small tier — we run a substantial portfolio on modest hardware precisely because workflows are mostly waiting on external APIs, not burning CPU.

Frequently asked questions

Is self-hosting safe for credentials?

n8n encrypts stored credentials, and your attack surface is a firewalled server serving HTTPS. Keep the OS updated, use SSH keys instead of passwords, and don’t expose ports beyond 80/443/SSH. That baseline is stronger than most people’s SaaS password habits.

Can I migrate from n8n cloud later?

Yes — workflows export as JSON and import cleanly. Credentials must be re-entered (they don’t export, by design). Migrating early beats migrating after you have fifty workflows.

What does this cost all-in?

The VPS (typically $5–15/month at this size), the domain you likely already own, and zero for the software. Compare that against per-task pricing at pipeline volume and the math makes itself. Verify current provider pricing — figures here are planning ranges as of mid-2026.

Now build something on it: the beginner tutorial with importable starter workflow · or compare platforms first in n8n vs Zapier vs Make.