keepcalculator

06 Numbers and Powers

Self-Host n8n with Portainer on a VPS

Card No. 06·4362 · Updated · Standard formula, shown below

This guide walks you through installing n8n, a workflow automation tool, on your own VPS using Portainer, a lightweight container management UI. You’ll end up with a self-hosted n8n instance that you can access from anywhere, with automatic restarts and easy updates. Before starting, you need a VPS with Docker installed and a domain name pointing to its IP address (optional but recommended for HTTPS).

What You’ll Need

  • A VPS with at least 1 GB RAM and 20 GB disk space (Ubuntu 22.04 or Debian 12 recommended).
  • Root or sudo access to the VPS.
  • Docker and Docker Compose installed on the VPS.
  • Portainer installed and running (Community Edition is fine).
  • A domain name (e.g., n8n.example.com) with an A record pointing to your VPS’s public IP – needed for HTTPS via Let’s Encrypt.

Step-by-Step

  1. Create a directory for n8n data. SSH into your VPS and run: mkdir -p /opt/n8n-data. This folder will hold n8n’s database and encryption keys.
  2. Open Portainer. Go to http://YOUR_VPS_IP:9000 in your browser. If it’s your first time, set an admin password and finish the initial setup.
  3. Create a new stack. In Portainer, go to Stacks > Add stack. Name it n8n.
  4. Paste the Docker Compose configuration. In the Web editor tab, paste the following: 
    version: '3.8'

services:
  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    ports:
      - "5678:5678"
    environment:
      - N8N_HOST=n8n.example.com
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://n8n.example.com/
      - GENERIC_TIMEZONE=UTC
      - N8N_ENCRYPTION_KEY=your-random-32-char-key
    volumes:
      - /opt/n8n-data:/home/node/.n8n

    Replace n8n.example.com with your actual domain, and set N8N_ENCRYPTION_KEY to a strong random string (you can generate one with openssl rand -hex 16). If you don’t have a domain yet, use N8N_HOST=localhost and N8N_PROTOCOL=http for testing.

  5. Deploy the stack. Click Deploy the stack. Portainer will pull the n8n image and start the container. Wait a minute for the first start.
  6. Verify n8n is running. In your browser, go to http://YOUR_VPS_IP:5678. You should see the n8n setup page. Complete the owner account creation.
  7. Set up a reverse proxy (recommended for production). For HTTPS, add a reverse proxy like Traefik or Nginx. With Traefik, you can add labels to the stack. Here’s an example using Traefik v2: 
    version: '3.8'

services:
  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    networks:
      - traefik
    environment:
      - N8N_HOST=n8n.example.com
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://n8n.example.com/
      - GENERIC_TIMEZONE=UTC
      - N8N_ENCRYPTION_KEY=your-random-32-char-key
    volumes:
      - /opt/n8n-data:/home/node/.n8n
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.n8n.rule=Host(`n8n.example.com`)"
      - "traefik.http.routers.n8n.entrypoints=websecure"
      - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
      - "traefik.http.services.n8n.loadbalancer.server.port=5678"

networks:
  traefik:
    external: true

    Make sure your Traefik network is named traefik and has a Let’s Encrypt resolver configured. Then redeploy the stack.

  8. Access n8n via your domain. Once the reverse proxy is up, visit https://n8n.example.com. You should see the n8n login page. Log in with the credentials you created earlier.
  9. Set up automatic backups (optional). The /opt/n8n-data folder contains all your workflows and credentials. Schedule a daily cron job to copy this folder to a safe location, e.g., tar -czf /backups/n8n-$(date +%F).tar.gz /opt/n8n-data.

Common Mistakes

  • Using HTTP when HTTPS is configured. If you set N8N_PROTOCOL=https but access via HTTP, n8n will redirect or break. Always match the protocol.
  • Forgetting to set the encryption key. If you omit N8N_ENCRYPTION_KEY, n8n generates one on first start. If you later recreate the container, the key changes and you can’t decrypt your credentials. Set it explicitly and keep it safe.
  • Not using a reverse proxy for production. Exposing n8n directly on port 5678 without TLS is insecure. Always put it behind a proxy with HTTPS.
  • Running out of disk space. n8n logs and database can grow. Monitor disk usage and clean up old logs if needed.
  • Using a weak timezone. Set GENERIC_TIMEZONE to your local timezone to avoid schedule confusion.

Tips

  • Pin the image version. Instead of latest, use a specific version tag like n8nio/n8n:1.30.0 to avoid unexpected breaking changes.
  • Use a dedicated user. For better security, create a non-root user on the VPS and give it ownership of /opt/n8n-data.
  • Enable automatic updates. In Portainer, you can set up a webhook that triggers a stack update when a new image is pushed. Or simply redeploy the stack after pulling the latest image.
  • Keep your workflows in Git. Use n8n’s export feature to save workflows as JSON files and version them in a repository.
  • Use environment variables for secrets. Avoid hardcoding API keys in workflow nodes; use n8n’s credential system or environment variables.

Troubleshooting

  • Can’t access n8n on port 5678. Check if the container is running: docker ps. If not, view logs: docker logs n8n. Also ensure your firewall allows incoming connections on that port (or on 443 if using a proxy).
  • HTTPS certificate errors. If using Traefik, check the Traefik logs for certificate issuance errors. Make sure your domain resolves to the VPS IP and that ports 80 and 443 are open.
  • n8n starts but shows a blank page. This often happens when the encryption key changes. Restore the original key or reset n8n by deleting the /opt/n8n-data contents (backup first!).
  • Webhooks don’t work. Ensure WEBHOOK_URL is set to the full public URL (e.g., https://n8n.example.com/). Also check that the reverse proxy forwards the Host header correctly.
  • Slow performance. n8n can be memory-hungry. Check memory usage with free -h. If you’re low on RAM, consider adding swap space or upgrading the VPS.

Frequently Asked Questions

Do I need a domain name to self-host n8n?

No, you can access n8n via http://YOUR_VPS_IP:5678. However, a domain is required for HTTPS and to avoid browser security warnings.

How do I update n8n to a new version?

In Portainer, go to your stack, click Editor, change the image tag if needed, and click Update the stack. Portainer will pull the new image and recreate the container.

Can I use SQLite or PostgreSQL with n8n?

By default, n8n uses SQLite, which is fine for small to medium usage. For production, you can switch to PostgreSQL by adding a database service and setting DB_TYPE=postgresdb and related variables.

How do I back up my n8n data?

Copy the entire /opt/n8n-data folder. Stop the container first to ensure consistency, or use a database dump if using PostgreSQL. Store the backup offsite.

Is it safe to expose n8n to the internet?

With HTTPS and strong passwords, it’s reasonably safe. For extra security, enable two-factor authentication on your n8n account and consider IP whitelisting via the reverse proxy.

Can I run n8n on a Raspberry Pi?

Yes, n8n supports ARM architecture. Use the n8nio/n8n:latest image which includes multi-arch support. Ensure you have at least 1 GB RAM.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →