How to Self Host n8n Workflow Automation on a Linux VPS

Your automations are doing great, until the bill shows up. Add a few more workflows, hit a spike in runs and your cloud plan starts charging you for every single task. On top of that, your customer data and API keys sit on someone else’s server, under limits you never picked.

That’s why so many people choose to self host n8n. You get unlimited workflows, full control over your data and one flat monthly cost. Sounds good, right?

The catch is that most guides skip the messy parts, like Docker, HTTPS, webhooks and backups. This one doesn’t. By the end, you’ll have n8n running on a Linux VPS, locked down with SSL and ready to work. No DevOps degree needed. Just follow along and your automation engine will be live before your coffee gets cold.

Why Self Host n8n Instead of Using the Cloud Plan?

Cloud plans are easy, no doubt. But they get pricey fast and you’re stuck with their execution limits. When you run it yourself, you pay only for the server. Run 100 workflows or 10,000. The price stays the same.

Here’s the quick difference:

Factor	n8n Cloud	Self-Hosted n8n
Cost	Grows with usage	Flat monthly VPS fee
Data control	Stored on their servers	Stored on your server
Execution limits	Plan-based caps	Only your server’s power
Maintenance	Handled for you	You handle it
Scaling	Upgrade your plan	Upgrade your VPS

What You Need Before You Start

Good news: the shopping list is short. You need:

●      A Linux VPS with 2 vCPU and 2–4 GB RAM

●      Ubuntu 22.04 or newer

●      A domain or subdomain, like n8n.yourdomain.com

●  SSH access to your server

●      An A record in your DNS that points your subdomain to the server’s IP

Start with a reliable Linux VPS server so your workflows don’t stall when things get busy. Choose a plan with SSD storage, since n8n logs add up over time.

How to Install n8n on a Linux VPS: Step by Step

Work through these steps in order. Each one gives you the command to run and a quick check, so you know it worked before you move on. Replace n8n.yourdomain.com, YOUR_SERVER_IP and n8nadmin with your own details.

New to servers? Our guide on Linux server hosting benefits, setup and buying tips can help if any command feels confusing.

Step 1: Point Your Domain to the Server

Do this first, because DNS can take a while to update and you’ll need it for SSL later. In your DNS panel, add an A record with the name n8n and your server’s IP as the value. Then check it from your own computer:

You should see your server’s IP in the answer. If you don’t, give it a few minutes and try again.

Step 2: Connect to Your VPS With SSH

Open a terminal (PowerShell on Windows) and log in as root with the details from your VPS provider:

Type yes the first time it asks about the server’s fingerprint.

Step 3: Update the System

Install the latest packages and security fixes before you add anything else:

Real output from our test install: Ubuntu 22.04 fetching and installing updates.

If a new kernel was installed, reboot with reboot and log back in.

Step 4: Create a Non-Root User

Working as root all day is risky. Create a normal user with sudo rights for everything that follows:

Check it: run su – n8nadmin, then sudo whoami. It should print root.

Step 5: Set Up SSH Keys and Turn Off Password Logins

Passwords can be guessed. Keys practically can’t. On your own computer, not the server, create a key and copy it to the new user:

Windows doesn’t have ssh-copy-id, so run this in PowerShell instead:

Open a second terminal and log in with ssh n8nadmin@YOUR_SERVER_IP. If it works without a password, turn off root and password logins:

The file name starts with 00 on purpose. SSH uses the first value it reads, and some VPS images ship a 50-cloud-init.conf file that turns password logins back on. Check it: ssh root@YOUR_SERVER_IP should now be refused. From here on, log in as n8nadmin.

Step 6: Turn On the Firewall

Allow only SSH, HTTP and HTTPS. Add the SSH rule first, or you’ll lock yourself out:

The firewall is active with only SSH, HTTP and HTTPS allowed.

You should see OpenSSH, 80/tcp and 443/tcp listed as ALLOW.

Step 7: Install Fail2ban and Automatic Security Updates

Fail2ban bans IPs that keep failing SSH logins, and unattended upgrades installs Ubuntu security fixes for you:

Fail2ban is watching SSH logins.

Choose Yes when it asks about automatic updates. Check Fail2ban with sudo fail2ban-client status sshd.

Step 8: Add Swap (Optional, for 2 GB Servers)

Swap gives n8n breathing room when a big workflow runs. Skip this if your server has 4 GB of RAM or more:

Check it with free -h. The Swap line should show 2.0Gi.

Step 9: Install Docker and Docker Compose

Docker keeps n8n separate from the rest of your server and makes updates easy. These are the commands from Docker’s official guide for Ubuntu:

Let your user run Docker without sudo, then log out and back in so the change applies:

Check it with docker --version and docker compose version. Both should print a version number. Keep the docker group to people you trust, because it gives root-level power on the server.

Docker and Docker Compose installed and ready.

Step 10: Create the n8n Folder and Encryption Key

An example key. Yours will be different, so never copy this one.

The last command prints a random key. n8n uses it to encrypt every credential you save, so copy it into your password manager now. If you ever lose it, n8n can’t read your saved credentials, even from a backup.

Step 11: Create the .env File

Open the file with nano .env and paste this, using your own values:

Save with Ctrl+O, exit with Ctrl+X, then lock the file so only your user can read it:

Step 12: Create the docker-compose.yml File

Open it with nano docker-compose.yml and paste:

Why some of these settings matter:

●      127.0.0.1:5678 keeps n8n private. Docker skips UFW rules for published ports, so writing just 5678 would expose n8n to the whole internet, firewall or not.

●      n8nio/n8n:2.45.6 pins an exact version, so an update only happens when you choose. Check the latest stable number in the n8n docs before you start.

●      N8N_WEBHOOK_URL is the name from n8n 2.30 onwards. Older versions use WEBHOOK_URL.

●      N8N_PROXY_HOPS=1 tells n8n it sits behind Nginx, so it sees real visitor IPs.

●      The n8n_data volume keeps your workflows safe. Skip it and a restart wipes your data.

Step 13: Start n8n and Check It’s Running

n8n 2.45.6 running and ready behind your domain.

You should see the n8n container with the status Up, and a log line saying the editor is accessible. Press Ctrl+C to leave the logs. Don’t open port 5678 in your firewall. n8n is only reachable inside the server for now, and Nginx will handle the outside world in the next step.

Step 14: Install Nginx as a Reverse Proxy

Nginx gives n8n a proper web address and passes traffic to port 5678 on the server:

Paste this, with your own subdomain:

The Upgrade and Connection lines keep the live editor working, and turning off buffering stops long workflow runs from hanging. Enable the site and test the config:

Nginx accepts the config and passes requests to n8n.

You should see “syntax is ok” and “test is successful” before the reload.

Step 15: Get a Free SSL Certificate With Certbot

Many apps only send webhooks to HTTPS links, so this step isn’t optional:

The last command tests automatic renewal. If it says the renewal succeeded, Certbot will renew the certificate for you from now on.

Step 16: Create Your Owner Account and Turn On 2FA

Open https://n8n.yourdomain.com and create the owner account straight away. Until you do, anyone who finds the address could claim it first. Then go to Settings > Personal and turn on two-factor authentication.

The owner account screen you’ll see on first visit.

A few more checks to finish locking it down:

●      Confirm port 5678 only listens on the server. You should see 127.0.0.1:5678:

n8n listens on 127.0.0.1 only, so it isn’t open to the internet.

●      Protect public webhooks with Header Auth or Basic Auth in the Webhook node, so only your apps can trigger them.

●      Not using the n8n API? Add – N8N_PUBLIC_API_DISABLED=true to the environment list and run docker compose up -d again.

●      Run n8n’s built-in security audit now and then:

Step 17: Set Up Automatic Backups

Create a backup script with nano ~/n8n-backup.sh:

Stopping n8n for a few seconds keeps the database consistent while it’s copied, and the trap line starts it again even if the copy fails. Old backups are deleted after 14 days. Make it runnable and open your cron jobs:

A test run of the backup script and the backup file it created.

Add this line at the bottom to run it every night at 3 AM, then save:

Keep a copy off the server too, so one failed disk can’t take everything:

To restore, replace the date with the backup you want:

Test your backup once and read the NCSC small organizations backup guide from the UK’s National Cyber Security Center for easy tips. A backup you’ve never restored is just a hope.

Step 18: Update n8n Safely

Run a backup first, read the n8n release notes, change the version number in docker-compose.yml, then:

Pulling the pinned version and restarting n8n.

Keep an eye on resources every week or so:

If RAM stays above 80% or the disk is nearly full, it’s time to upgrade your VPS.

Troubleshooting Common n8n Install Problems

502 Bad Gateway in the browser. Nginx can’t reach n8n. Run docker compose ps in ~/n8n and check the container is Up, then read docker compose logs n8n for errors.

Webhook URLs show http or localhost. Check N8N_HOST in .env, then run docker compose up -d so n8n picks up the change.

Certbot can’t get a certificate. Your DNS isn’t pointing at the server yet, or port 80 is blocked. Check with nslookup n8n.yourdomain.com and sudo ufw status.

“Permission denied” when you run docker. Log out and back in after adding yourself to the docker group.

The editor keeps showing “Connection lost”. The Upgrade and Connection lines are missing from the Nginx config. Add them and run sudo systemctl reload nginx.

Credentials fail to decrypt after a restore. The N8N_ENCRYPTION_KEY in .env doesn’t match the one the backup was made with. Put the original key back.

Locked out of SSH. Use the web console in your VPS panel to log in and fix the file in /etc/ssh/sshd_config.d/.

Your Self-Hosted Automation Engine Is Ready to Roll

Running automations shouldn’t feel like renting your own workflows. Once you self host n8n, your workflows, credentials and logs live on a server you control and your costs stay flat no matter how much you automate. No more shock bills or guessing who can see your data.

Step by step, you installed and deployed n8n. Pick your own server, save the Docker image, add Nginx for SSL, back it up and n8n will support your growing needs, from a couple of workflows to several hundred.

Ready to launch? Grab a fast, reliable VPS from DashRDP and get your first workflow live today. Build it once, back it up often and let your automations do the heavy lifting while you focus on growth.

FAQs