How to Self-Host n8n with Docker Compose on Ubuntu 24.04

A developer published a step-by-step guide for self-hosting n8n 2.41.6 on Ubuntu 24.04 using Docker Compose, PostgreSQL 18, an external n8nio/runners task runner, and Caddy for HTTPS. The setup keeps n8n bound to 127.0.0.1:5678 behind Caddy on ports 80 and 443, and warns that Docker-published ports bypass UFW, so a publicly exposed 5678 stays reachable even when UFW denies it. It also notes that n8n 1.0 removed the N8N_BASIC_AUTH variables and that n8n 3.0 supports Docker-based installs only.

Originally published by Arct Cloud: How to Self-Host n8n with Docker Compose on Ubuntu 24.04 https://www.arct.cloud/tutorials/self-host-n8n . This article was prepared with AI assistance. Product references were removed and formatting adjusted for this DEV edition. TL;DR: n8nio/runners task runner and PostgreSQL 18, with Caddy in front for HTTPS on ports 80 and 443. 127.0.0.1:5678 only. Docker-published ports bypass UFW, so a public 5678 stays open even when UFW denies it. N8N ENCRYPTION KEY , N8N WEBHOOK URL and N8N PROXY HOPS=1 . WEBHOOK URL in n8n 2.35.0, and n8n 1.0 removed the N8N BASIC AUTH variables. .env . n8n 3.0 supports Docker-based installs only. Applies to: Ubuntu 24.04 LTS · n8n 2.41.6 · PostgreSQL 18 · Caddy 2.11.7 · Docker Compose 5.6.0 · checked October 2026 n8n is a fair-code workflow automation platform that connects apps, APIs and AI models in visual workflows started by webhooks, schedules or other triggers. This tutorial self-hosts n8n 2.41.6 on Ubuntu 24.04 with Docker Compose, PostgreSQL 18, an external task runner and Caddy for HTTPS, then covers updates and backups. A VPS gives your webhooks a public HTTPS address that stays reachable when your own computer is off. docker group. Follow n8n.example.com that points to your server's IP address, for example 203.0.113.10 . Commands run as the sudo user. Replace values written in capitals, such as YOUR DOMAIN , with your own. Four components run on the server. Only Caddy accepts connections from the internet: | Component | Runs as | Port | Reachable from | |---|---|---|---| | Caddy | systemd service on the host | 80, 443 | Internet | | n8n | n8nio/n8n:2.41.6 container | 5678 | 127.0.0.1 only | | Task runner | n8nio/runners:2.41.6 container | none | Compose network | | PostgreSQL | postgres:18 container | 5432 | Compose network | The task runner executes Code node tasks in its own container and connects to n8n's task broker on port 5679. n8n's docs recommend this external mode for production, because internal mode runs user code next to n8n and its stored credentials. The three images are about 620 MB compressed, and n8n deletes execution data older than 14 days by default. n8n's one-line installer at get.n8n.io uses SQLite and serves plain HTTP on port 5678. This tutorial writes the Compose file by hand for a public server. Caddy needs ports 80 and 443 to get a TLS certificate, often called an SSL certificate, and to serve n8n. Allow SSH before you enable UFW, or the current session drops: sudo ufw allow OpenSSH sudo ufw allow 80/tcp sudo ufw allow 443/tcp sudo ufw enable sudo ufw status Type y if UFW asks to confirm. The output looks similar to this: Status: active To Action From -- ------ ---- OpenSSH ALLOW Anywhere 80/tcp ALLOW Anywhere 443/tcp ALLOW Anywhere OpenSSH v6 ALLOW Anywhere v6 80/tcp v6 ALLOW Anywhere v6 443/tcp v6 ALLOW Anywhere v6 Do not open 5678. Step 4 publishes n8n on the loopback address, and Caddy reaches it there. Compose reads variables from a .env file in the project directory. Create the directory: mkdir ~/n8n cd ~/n8n Replace YOUR DOMAIN with your subdomain, such as n8n.example.com , and YOUR TIMEZONE with a time zone name, such as Europe/Berlin . Then run the block. It writes the file and generates four random secrets, and umask 077 inside the parentheses makes .env readable only by your user: umask 077 cat .env <<EOF N8N VERSION=2.41.6 N8N DOMAIN=YOUR DOMAIN GENERIC TIMEZONE=YOUR TIMEZONE POSTGRES USER=postgres POSTGRES PASSWORD=$ openssl rand -hex 24 POSTGRES DB=n8n POSTGRES NON ROOT USER=n8n POSTGRES NON ROOT PASSWORD=$ openssl rand -hex 24 N8N ENCRYPTION KEY=$ openssl rand -hex 32 N8N RUNNERS AUTH TOKEN=$ openssl rand -hex 32 EOF N8N ENCRYPTION KEY encrypts every credential n8n stores. Without it, a restored database cannot decrypt your credentials, so save a copy in your password manager. n8n connects as a PostgreSQL user without superuser rights. This script, from n8n's withPostgres example, creates that user. Open a new file: nano init-data.sh Paste the script, then save with Ctrl+O and exit with Ctrl+X: bash /bin/bash set -e; if -n "${POSTGRES NON ROOT USER:-}" && -n "${POSTGRES NON ROOT PASSWORD:-}" ; then psql -v ON ERROR STOP=1 --username "$POSTGRES USER" --dbname "$POSTGRES DB" <<-EOSQL CREATE USER ${POSTGRES NON ROOT USER} WITH PASSWORD '${POSTGRES NON ROOT PASSWORD}'; GRANT ALL PRIVILEGES ON DATABASE ${POSTGRES DB} TO ${POSTGRES NON ROOT USER}; GRANT CREATE ON SCHEMA public TO ${POSTGRES NON ROOT USER}; EOSQL else echo "SETUP INFO: No Environment variables given " fi The PostgreSQL image runs scripts in /docker-entrypoint-initdb.d once, when the database volume is empty. A later change to the passwords in .env does not update the database. The Compose file defines the three containers, their volumes and the n8n settings: nano compose.yaml Paste this file, then save and exit: services: postgres: image: postgres:18 restart: unless-stopped environment: POSTGRES USER: ${POSTGRES USER} POSTGRES PASSWORD: ${POSTGRES PASSWORD} POSTGRES DB: ${POSTGRES DB} POSTGRES NON ROOT USER: ${POSTGRES NON ROOT USER} POSTGRES NON ROOT PASSWORD: ${POSTGRES NON ROOT PASSWORD} PGDATA: /var/lib/postgresql/data volumes: - db storage:/var/lib/postgresql/data - ./init-data.sh:/docker-entrypoint-initdb.d/init-data.sh:ro healthcheck: test: "CMD-SHELL", "pg isready -h localhost -U ${POSTGRES USER} -d ${POSTGRES DB}" interval: 5s timeout: 5s retries: 10 n8n: image: n8nio/n8n:${N8N VERSION} restart: unless-stopped ports: - "127.0.0.1:5678:5678" environment: DB TYPE: postgresdb DB POSTGRESDB HOST: postgres DB POSTGRESDB PORT: "5432" DB POSTGRESDB DATABASE: ${POSTGRES DB} DB POSTGRESDB USER: ${POSTGRES NON ROOT USER} DB POSTGRESDB PASSWORD: ${POSTGRES NON ROOT PASSWORD} N8N ENCRYPTION KEY: ${N8N ENCRYPTION KEY} N8N HOST: ${N8N DOMAIN} N8N PROTOCOL: https N8N WEBHOOK URL: https://${N8N DOMAIN}/ N8N PROXY HOPS: "1" N8N ENFORCE SETTINGS FILE PERMISSIONS: "true" GENERIC TIMEZONE: ${GENERIC TIMEZONE} TZ: ${GENERIC TIMEZONE} N8N RUNNERS MODE: external N8N RUNNERS AUTH TOKEN: ${N8N RUNNERS AUTH TOKEN} N8N RUNNERS BROKER LISTEN ADDRESS: 0.0.0.0 volumes: - n8n storage:/home/node/.n8n depends on: postgres: condition: service healthy n8n-runner: image: n8nio/runners:${N8N VERSION} restart: unless-stopped environment: N8N RUNNERS AUTH TOKEN: ${N8N RUNNERS AUTH TOKEN} N8N RUNNERS TASK BROKER URI: http://n8n:5679 depends on: - n8n volumes: db storage: n8n storage: What the main settings do: 127.0.0.1:5678:5678 publishes n8n on loopback only. PostgreSQL and the task broker publish no host ports. N8N HOST set the public address. Without them, webhook URLs show http://localhost:5678/ . N8N PROXY HOPS: "1" trusts the X-Forwarded- headers from one reverse proxy. PGDATA keeps PostgreSQL 18 data inside the volume, since version 18 changed its default data path. N8N VERSION , because the runner and n8n versions must match. Pull the images and start the stack in the background: docker compose up -d PostgreSQL starts first. n8n waits for its health check, creates its tables, and then starts. Check the n8n log after a minute: docker compose logs --no-log-prefix n8n | grep -A1 "accessible via" Editor is now accessible via: https://n8n.example.com If the command prints nothing, n8n is still starting. Run it again after 30 seconds. The reverse proxy terminates TLS on port 443 and forwards requests to 127.0.0.1:5678 . The n8n editor receives live updates over WebSockets by default, so the proxy must pass them through. Use one of the two options. Caddy obtains and renews TLS certificates automatically. Ubuntu 24.04 and 26.04 ship Caddy 2.6.2, so install the current release from Caddy's apt repository: sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list sudo chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg sudo chmod o+r /etc/apt/sources.list.d/caddy-stable.list sudo apt update sudo apt install caddy The package starts Caddy as a systemd service named caddy . Replace the default site configuration: sudo nano /etc/caddy/Caddyfile Delete the existing lines and paste this, with your domain in place of YOUR DOMAIN : YOUR DOMAIN { reverse proxy 127.0.0.1:5678 { flush interval -1 } } Caddy proxies WebSockets and sets the X-Forwarded-For , X-Forwarded-Proto and X-Forwarded-Host headers by default. flush interval -1 , from n8n's own Caddyfile, sends responses to the browser without buffering. Validate the file and reload Caddy: sudo caddy validate --config /etc/caddy/Caddyfile sudo systemctl reload caddy The validate output ends with Valid configuration . If the server already runs Nginx with a Certbot certificate, as in the Nginx, PostgreSQL, and Redis guide https://www.arct.cloud/blog/install-nginx-postgresql-redis-ubuntu-24-04 , use this location block in the server block for YOUR DOMAIN . Ubuntu's Nginx packages, 1.24 on 24.04 and 1.28 on 26.04, need proxy http version 1.1 for the WebSocket upgrade. client max body size 16m raises Nginx's 1 MB default request body limit to match n8n's default 16 MiB payload limit: location / { proxy pass http://127.0.0.1:5678; proxy http version 1.1; proxy set header Upgrade $http upgrade; proxy set header Connection "upgrade"; proxy set header Host $host; proxy set header X-Forwarded-For $proxy add x forwarded for; proxy set header X-Forwarded-Host $host; proxy set header X-Forwarded-Proto $scheme; proxy buffering off; proxy read timeout 3600s; client max body size 16m; } Test the configuration with sudo nginx -t , then apply it with sudo systemctl reload nginx . Open https://YOUR DOMAIN in your browser. n8n shows the owner setup form, and the first person to complete it becomes the instance owner. Until you complete this form, anyone who opens the address can claim the instance, so do this step immediately after Step 6. Enter your email address, name and a strong password. n8n removed basic auth in version 1.0, and no supported setting turns off the login screen. Without SMTP settings, you send invite links by hand and users cannot reset their passwords. List the running services: docker compose ps --services --status running The output lists n8n , n8n-runner and postgres . Check that n8n is connected to the database and ready: curl -s http://127.0.0.1:5678/healthz/readiness {"status":"ok"} From your own computer, confirm that port 5678 is closed to the internet: curl --max-time 5 http://YOUR SERVER IP:5678 Replace YOUR SERVER IP with the server's address, such as 203.0.113.10 . The request fails or times out; a page means the port is public. Check memory use per container: docker stats --no-stream --format "table {{.Name}}\t{{.MemUsage}}" Memory use rises with large JSON or binary data, Code nodes, workflows that run at the same time, and manual executions, because n8n copies their data for the editor. n8n releases a new minor version most weeks, and its docs recommend updating at least once a month. Back up first, because n8n migrates the database when a new version starts. Find the current stable number on n8n's GitHub releases page https://github.com/n8n-io/n8n/releases , where beta builds are marked as pre-releases. Set it in .env , recreate the containers and remove the old images: cd ~/n8n sed -i 's/^N8N VERSION=. /N8N VERSION=YOUR NEW VERSION/' .env docker compose pull docker compose up -d docker image rm n8nio/n8n:YOUR OLD VERSION n8nio/runners:YOUR OLD VERSION Replace YOUR NEW VERSION with the stable release number and YOUR OLD VERSION with the version you replaced, which grep N8N VERSION .env shows before the change. The runner image reads the same line, and docker image rm deletes the two old images. Read the v3.0 breaking changes https://docs.n8n.io/changelog/v30-breaking-changes.md before you move from 2.x to 3.0. This setup already uses Docker and an external task runner. In 3.0, the default Code node task timeout drops from 300 to 60 seconds. postgres:18 pulls PostgreSQL minor releases. A new major version needs a dump and restore; changing the image tag alone fails with database files are incompatible with server . A complete n8n backup has two parts: the PostgreSQL database and the .n8n folder in the n8n storage volume. Keep the .env file with them, because it holds the encryption key and the database passwords: mkdir -p ~/n8n-backups cd ~/n8n STAMP=$ date +%F-%H%M docker compose exec -T postgres pg dump -U postgres -d n8n -Fc ~/n8n-backups/n8n-db-$STAMP.dump docker compose cp n8n:/home/node/.n8n ~/n8n-backups/n8n-files-$STAMP cp .env compose.yaml init-data.sh ~/n8n-backups/ chmod -R go-rwx ~/n8n-backups pg dump -Fc writes a compressed dump while n8n keeps running, and docker compose cp copies the folder out of the container. STAMP holds the date and time, so two runs on the same day write separate files. To run the backup on a schedule, save the commands in a script such as ~/n8n/backup.sh with /bin/bash as the first line, make it executable with chmod +x ~/n8n/backup.sh , and call the script from cron or a systemd timer. Do not paste the commands into a crontab line, because cron treats % as a line break. Copy ~/n8n-backups to another machine, for example with rsync over SSH. To restore the database on the same server, stop n8n and the runner, load the dump, and start them again: docker compose stop n8n n8n-runner docker compose exec -T postgres pg restore -U postgres -d n8n --clean --if-exists < ~/n8n-backups/n8n-db-YOUR TIMESTAMP.dump docker compose start n8n n8n-runner Replace YOUR TIMESTAMP with the date and time in the backup file name. Never run docker compose down -v in this project: -v deletes both volumes. | Symptom | Cause | Fix | |---|---|---| | Caddy returns 502 and logs dial tcp 127.0.0.1:5678: connect: connection refused | n8n is stopped or still starting | docker compose ps , then docker compose logs n8n | | Database is not ready in the browser, or There was an error initializing DB in the n8n log | PostgreSQL is down or rejects the n8n user | docker compose logs postgres , and compare the passwords in .env | | password authentication failed for user "n8n" | The database volume is older than the passwords in .env , so init-data.sh did not set them | On a new install with no workflows: docker compose down , docker volume rm n8n db storage , then docker compose up -d | | Mismatching encryption keys. The encryption key in the settings file /home/node/.n8n/config does not match the N8N ENCRYPTION KEY env var. | N8N ENCRYPTION KEY in .env changed after the first start | Put the original key back in .env , then docker compose up -d | | Browser certificate error on YOUR DOMAIN | The DNS A record points elsewhere, or port 80 is closed | getent hosts YOUR DOMAIN , sudo ufw status , sudo journalctl -u caddy -n 50 | n8n's sizing example lists 320 MB to 2 GB of memory for n8n, and an idle n8n Cloud instance uses about 100 MB. PostgreSQL and the task runner add to that, and large files or Code nodes raise it. The n8n Assistant sandbox needs at least 4 GB RAM and 2 vCPU. Yes, the self-hosted Community Edition is free to use under the Sustainable Use License, a fair-code license n8n created in 2022. It allows internal business, personal and non-commercial use, and n8n describes the code as source-available. Set N8N VERSION in the .env file to the new release, then run docker compose pull and docker compose up -d in the project folder. The task runner image uses the same tag. Back up the database first, because n8n migrates it on start. Use PostgreSQL on a server that runs workflows all day. n8n's Docker Compose guide calls SQLite fine for trying things out and recommends Postgres for production. Existing SQLite data does not move to Postgres on its own. n8n builds webhook URLs from N8N PROTOCOL, N8N HOST and N8N PORT unless N8N WEBHOOK URL is set. Behind a reverse proxy, set N8N WEBHOOK URL to your HTTPS address and N8N PROXY HOPS to 1. N8N WEBHOOK URL replaced WEBHOOK URL in n8n 2.35.0. Yes. The n8n image runs under Docker Desktop and serves the editor at http://localhost:5678 http://localhost:5678 . Outside services cannot reach webhooks on a laptop without a tunnel, so workflows that receive webhooks run on a server with a public HTTPS address. Licensed under CC BY-NC-SA 4.0 https://creativecommons.org/licenses/by-nc-sa/4.0/ .