Your n8n, self-hosted on a server you control

What you need before you start

• A Linux server with Docker and Docker Compose. n8n's guide links Docker's own install instructions for each distribution.
• A domain you can add a DNS record to. You will point a subdomain, such as n8n.yourcompany.com, at the server. The HTTPS certificate is requested for that name, so the record has to exist before you start.
• An email address for the certificate, and the time zone your schedules should run in.
• Someone who will own it. n8n's own guide says self-hosting is for people comfortable setting up servers and containers, scaling and security, and suggests n8n Cloud otherwise.

Up and running, step by step

1. Check Docker and Docker Compose both answer on the server.
2. Add an A record for your subdomain that points to the server's IP address.
3. Create a folder for the project, with a local-files folder inside it. That is where n8n can read and write files.
4. Create a .env file holding your domain and subdomain, the time zone and your email, as below.
5. Copy compose.yaml exactly as n8n's Docker Compose guide gives it. It runs n8n behind Traefik, a small web server that fetches the HTTPS certificate and passes traffic to n8n.
6. Start everything, then open your HTTPS address right away.

docker --version
docker compose version
mkdir n8n-compose && cd n8n-compose
mkdir local-files

# contents of .env
DOMAIN_NAME=yourcompany.com
SUBDOMAIN=n8n
GENERIC_TIMEZONE=America/New_York
SSL_EMAIL=you@yourcompany.com

# after adding compose.yaml from n8n's guide:
sudo docker compose up -d

Claim the owner account immediately. Whoever opens a fresh n8n first sees the sign-up screen for the owner, and n8n offers no way to switch the login off. Pick a password of eight characters or more with at least one digit and one uppercase letter.

The one file you cannot lose

The first time n8n starts, it creates a random encryption key and keeps it in its data folder. Every password and API key you save in n8n is encrypted with it. Restore your workflows somewhere without that key, and the saved logins cannot be read, so every connection has to be set up again.

Two ways to stay safe: back up n8n's whole data volume, key included, or choose your own key with the N8N_ENCRYPTION_KEY setting and keep a copy in your password manager. A simple backup stops n8n for a moment and packs its data into one file you can copy away:

sudo docker compose stop
sudo docker run --rm --volumes-from n8n-compose-n8n-1 -v "$(pwd)":/backup ubuntu tar cvf /backup/n8n-backup.tar /home/node/.n8n
sudo docker compose up -d

Keeping it safe

• Only the web ports face the internet. n8n's guide publishes n8n's own port 5678 to the server itself and lets Traefik answer on ports 80 and 443. Leave that as it is.
• Do not count on ufw to close Docker ports. Docker's documentation explains that traffic to a port Docker publishes is routed before ufw's rules run, so a ufw rule will not hide it. Publishing to 127.0.0.1, as the guide does, is what keeps n8n private.
• Files stay in their folder. The guide also keeps n8n's file nodes inside local-files.
• Update on purpose. n8n puts out a new minor release almost every week. To update, run sudo docker compose pull, then sudo docker compose down and sudo docker compose up -d in the project folder. To stay on a version you have tested, add its exact version number after the image name in compose.yaml, so n8nio/n8n becomes n8nio/n8n: followed by that number.

As your automations grow

n8n starts on SQLite, a database kept in a single file, which is plenty for one team's workflows. It also keeps a record of every run. By default it deletes records older than 14 days or beyond 10,000 runs, but SQLite reuses that freed space rather than giving it back to the disk unless you run a VACUUM; turning on DB_SQLITE_VACUUM_ON_STARTUP makes n8n compact the file whenever it starts.

When one n8n can no longer keep up, queue mode splits the work: the main n8n receives triggers and webhooks, Redis lines up the jobs, and worker processes run them. Every worker needs EXECUTIONS_MODE=queue and the same encryption key, and n8n's docs call queue mode on SQLite not recommended and a distributed setup over it unsupported, so switch to Postgres first. Workers can live on the same server or on more servers, and our managed Kubernetes in New York runs the control plane while the workers stay servers of your own.

Why a dedicated server?

Because n8n holds the keys to everything it connects to, and it has to answer webhooks at any hour. On our container servers the machine is yours alone, with root access and no virtual layer in between, so nobody else's workload shares the hardware your saved logins live on.

Your server is ready about 30 minutes after payment is verified. The port is unmetered, so workflows that move files and data all day never run into a traffic allowance. There is no contract, one month is the default term, and our team answers by phone, live chat and email around the clock.

Check the licence first

n8n is free to self-host, but not free to resell. Its Sustainable Use License lets you run it inside your own business, or personally and not for profit. Handing n8n itself to other people is allowed only when it is free and not for profit, and the enterprise features, in files marked .ee., need a paid licence. If you plan to run automations for paying clients, read the licence before you build on it.

Questions people ask

Do I need a domain name to self-host n8n?

For the official setup, yes. n8n's Docker Compose guide serves it over HTTPS only, at a subdomain such as n8n.yourcompany.com, and the certificate is issued for that name. A public HTTPS address is also what lets other services deliver webhooks to your workflows.

Can I turn off the n8n login?

No. Current versions of n8n give you no supported switch for turning the login screen off. That is why you should set up the owner login the minute the instance comes up, before anyone else finds it.

What do I lose if the encryption key is gone?

Your saved credentials. n8n encrypts every saved password and API key with that key, so without it they cannot be read and each connection has to be entered again. Back up the data volume or keep your own N8N_ENCRYPTION_KEY somewhere safe.

When should I move from SQLite to Postgres?

Before switching on queue mode, since n8n advises against running it on SQLite, or once your run history grows large. Keep the n8n data volume after the move, because the key lives there.

Can I offer n8n to my own customers?

Not as a paid service under the default licence. The Sustainable Use License allows internal business, non-commercial and personal use, and sharing n8n with others only for free and non-commercially. Talk to n8n about a commercial licence first.

How fast can I start?

With root access, a server is ready around 30 minutes after your payment clears verification. Installing Docker and starting n8n is a handful of commands from there.