Self-host n8n: guide for Ubuntu 24.04 with Docker and HTTPS

Self-host n8n on a VPS: set up Docker, Docker Compose and Caddy with HTTPS, plus environment variables, updates, backups and security hardening.

HostOn team19 October 20269 min read

To self-host n8n you need a VPS running Ubuntu 24.04, a subdomain such as n8n.your-company.ch, Docker with Docker Compose and a reverse proxy that obtains the HTTPS certificate. This guide follows the official n8n documentation (as of October 2026, n8n 2.x) and uses Caddy as the reverse proxy. With some Linux experience, n8n is online in about an hour; after that, updates, backups and security are your job.

What is n8n?

n8n is a workflow automation tool. In a visual editor you connect services such as e-mail, Google Sheets, CRM, accounting, webhooks or AI models into workflows: a new contact form entry lands in the CRM automatically, an invoice is filed as a PDF, a report goes out by e-mail every Monday. Where no ready-made node exists, HTTP requests and your own JavaScript or Python code fill the gap.

Why self-host n8n?

Data control: workflows, credentials and execution data stay on your server. That makes it easier to meet requirements from the Swiss Data Protection Act (FADP) and customer contracts.
Cost: the Community Edition is free. You pay for the server, not for the number of executions.
Freedom: your own community nodes, any environment variables and direct access to internal systems on the same network.
But: you are responsible for operation, updates, backups and security. n8n itself explicitly recommends self-hosting for people with server experience.

Criterion	n8n Cloud	Self-hosted (VPS)
Operation and updates	n8n	You
Where data is stored	n8n’s infrastructure	Your server
Pricing model	Subscription by plan, with execution limits	Server costs, no licence fees for the Community Edition
Limits	Plan limits for executions and RAM	Your server’s capacity
Skills needed	none for operation	Linux, Docker, DNS, backups

Requirements

A VPS with Ubuntu 24.04 LTS and root or sudo access via SSH.
Memory: 2 GB RAM and 1 to 2 vCPU are enough to start. For n8n Assistant with its sandbox, the documentation states at least 4 GB RAM and 2 vCPU.
Storage: 25 GB is enough to start. By default n8n deletes execution data after 336 hours (14 days); you can change this with the EXECUTIONS_DATA_MAX_AGE variable.
A domain where you can set DNS records, for example for n8n.your-company.ch.
An e-mail address for the Let’s Encrypt certificate.

Step 1: prepare the server and set up the firewall

sudo apt update && sudo apt upgrade -y
sudo adduser yourname
sudo usermod -aG sudo yourname
Add an SSH key for the new user, then log in again as yourname.
sudo ufw allow OpenSSH
sudo ufw allow 80
sudo ufw allow 443
sudo ufw enable

Step 2: install Docker and Docker Compose

Install Docker from Docker’s official package repository, not the older Ubuntu package docker.io. The commands match the guide on docs.docker.com for Ubuntu 24.04 (Noble):

sudo apt install ca-certificates curl git
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
Create the file /etc/apt/sources.list.d/docker.sources (sudo nano /etc/apt/sources.list.d/docker.sources) with these five lines: Types: deb / URIs: https://download.docker.com/linux/ubuntu / Suites: noble / Components: stable / Signed-By: /etc/apt/keyrings/docker.asc
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
Check: docker --version and docker compose version, then sudo docker run hello-world

Step 3: set the DNS record

At your DNS provider, create an A record for the subdomain, for example n8n.your-company.ch, pointing to your VPS’s IPv4 address. Wait until the record resolves (test with ping n8n.your-company.ch). Only then can Caddy obtain the certificate.

Step 4: set up n8n with Caddy

n8n provides a ready-made configuration repository with Docker Compose and Caddy. Caddy obtains and renews the Let’s Encrypt certificate automatically.

cd ~ && git clone https://github.com/n8n-io/n8n-docker-caddy.git
cd n8n-docker-caddy
sudo docker volume create caddy_data
sudo docker volume create n8n_data
nano .env and adjust the values (see below).
nano caddy_config/Caddyfile and in the first line replace the placeholder with n8n.your-company.ch.
nano docker-compose.yml and, in the n8n service, change the port line 5678:5678 to 127.0.0.1:5678:5678.
sudo docker compose up -d
Open https://n8n.your-company.ch in your browser and create the owner account.

Tip: The change to 127.0.0.1:5678 matters: Docker publishes ports past the UFW firewall. Without it, n8n would also be reachable unencrypted at http://IP-address:5678. Caddy reaches n8n internally over the Docker network and does not need the port.

The most important environment variables

DATA_FOLDER=/home/yourname/n8n-docker-caddy – path to the cloned folder.
DOMAIN_NAME=your-company.ch and SUBDOMAIN=n8n – together they give the address https://n8n.your-company.ch.
GENERIC_TIMEZONE=Europe/Zurich – time zone for schedules (Schedule Trigger).
SSL_EMAIL=it@your-company.ch – contact address for the certificate.
In docker-compose.yml the repository already sets N8N_HOST, N8N_PROTOCOL=https and WEBHOOK_URL so that webhook addresses correctly start with https.
Optionally add under environment: TZ=Europe/Zurich, N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true (as in the official Compose template) and N8N_DIAGNOSTICS_ENABLED=false if you do not want to send telemetry to n8n.

Updates: keep n8n and the server current

n8n releases a new minor version almost every week. The image without a version tag (latest) is the stable version for production; the next tag is an unstable pre-release. To update:

Make a backup first (see next section).
cd ~/n8n-docker-caddy
sudo docker compose pull
sudo docker compose down
sudo docker compose up -d
Briefly test your workflows. Before larger version jumps, read the release notes and breaking changes.

Ubuntu itself needs updates too. Install security updates automatically with sudo apt install unattended-upgrades and check regularly whether a reboot is required.

Backing up n8n data

Everything important lives in the Docker volume n8n_data: the SQLite database with workflows and executions, and the encryption key n8n uses to encrypt your credentials. Without this key, backed-up credentials are worthless. So back up in two ways:

Export as files: sudo docker compose exec -u node n8n n8n export:workflow --backup --output=/files/backup/workflows/
sudo docker compose exec -u node n8n n8n export:credentials --backup --output=/files/backup/credentials/
The exports end up on the server in the folder local_files/backup. Credentials stay encrypted.
Whole volume: sudo docker compose stop, then sudo docker run --rm -v n8n_data:/data -v $(pwd):/backup alpine tar czf /backup/n8n_data-$(date +%F).tar.gz -C /data . and then sudo docker compose start.
Copy the backups to another system with rsync or scp; do not leave them only on the VPS.

Tip: Also store the encryption key in your password manager. It is in the file config in the n8n_data volume (show it with sudo docker compose exec n8n cat /home/node/.n8n/config).

Security: what you have to secure yourself

Firewall: open only ports 22, 80 and 443; bind port 5678 to 127.0.0.1 only.
SSH: key-only login; set PasswordAuthentication no in /etc/ssh/sshd_config.
You do not need basic auth: since n8n 1.0 the built-in user management protects the interface. Enable two-factor authentication in your personal settings.
Updates: update the n8n image, the Caddy image and Ubuntu regularly. Security issues in n8n are fixed in new versions.
Webhooks: protect production webhooks with header or token checks, as they can be reached without logging in.
Community nodes: install only from trusted sources, because they run with n8n’s permissions.

Which VPS suits n8n?

A small server is enough for a few dozen workflows. At HostOn you choose Ubuntu 24.04 directly when ordering. VPS CORE 1 (1 vCPU, 2 GB RAM, 25 GB SSD) for CHF 11.90 per month is enough to start; VPS CORE 2 (2 vCPU, 4 GB RAM, 50 GB SSD) for CHF 19.90 per month gives you headroom for many workflows or n8n Assistant. Both are unmanaged and can be cancelled monthly: you handle installation, updates and backups of n8n yourself, as described above.

Choose a VPS for n8n

n8nDockerVPSAutomationUbuntu

Frequently asked questions on this topic

Yes. The self-hosted n8n Community Edition runs without a licence key and free of charge, with almost all features. You only pay for the server; some features for larger teams are part of the paid Business and Enterprise editions.

n8n itself is lightweight: the smallest n8n Cloud plans run on 320 MiB RAM. With the operating system, Docker and a reverse proxy, 2 GB RAM is a sensible start; for many parallel workflows or n8n Assistant (the documentation asks for at least 4 GB RAM and 2 vCPU) plan for more.

No. Since n8n 1.0, user management is built in and basic auth has been removed. On first access you create an owner account; you should also enable two-factor authentication.

In the project folder, run docker compose pull, docker compose down and docker compose up -d one after the other. Make a backup first and read the release notes before larger version jumps.

The stored credentials can then no longer be decrypted and have to be entered again. That is why you should back up the Docker volume n8n_data, or the key itself, in a safe place.

The built-in SQLite database is enough to start with. With many executions, several users or if you later want queue mode with multiple workers, PostgreSQL is the better choice.