How to Deploy n8n on a VPS: Production Setup with Nginx and SSL (2026)

# From your local machine, check if DNS has propagated
nslookup n8n.yourdomain.com
# or
dig n8n.yourdomain.com +short
# Expected output: your VPS IP address

# Update package index
sudo apt update && sudo apt upgrade -y

# Install Docker using the official convenience script
curl -fsSL https://get.docker.com | sudo sh

# Add your user to the docker group (avoids needing sudo for every docker command)
sudo usermod -aG docker $USER

# Apply the group change without logging out
newgrp docker

# Verify Docker is running
docker --version
docker compose version

Docker version 27.x.x
Docker Compose version v2.x.x

mkdir -p ~/n8n && cd ~/n8n

nano ~/n8n/.env

# Your domain (the subdomain you pointed at this VPS)
N8N_HOST=n8n.yourdomain.com
N8N_PORT=5678
N8N_PROTOCOL=https
WEBHOOK_URL=https://n8n.yourdomain.com

# Generate a random encryption key: openssl rand -hex 16
N8N_ENCRYPTION_KEY=replace_with_32_char_random_string

# Basic auth to protect the n8n UI
N8N_BASIC_AUTH_ACTIVE=true
N8N_BASIC_AUTH_USER=admin
N8N_BASIC_AUTH_PASSWORD=replace_with_strong_password

# PostgreSQL database
DB_TYPE=postgresdb
DB_POSTGRESDB_HOST=postgres
DB_POSTGRESDB_PORT=5432
DB_POSTGRESDB_DATABASE=n8n
DB_POSTGRESDB_USER=n8n
DB_POSTGRESDB_PASSWORD=replace_with_db_password

# Timezone
GENERIC_TIMEZONE=Europe/London

openssl rand -hex 16

nano ~/n8n/docker-compose.yml

version: '3.8'

volumes:
  n8n_data:
  postgres_data:

services:
  postgres:
    image: postgres:15-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: n8n
      POSTGRES_USER: n8n
      POSTGRES_PASSWORD: ${DB_POSTGRESDB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -h localhost -U n8n -d n8n']
      interval: 5s
      timeout: 5s
      retries: 10

  n8n:
    image: n8nio/n8n:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:5678:5678"
    environment:
      - N8N_HOST=${N8N_HOST}
      - N8N_PORT=${N8N_PORT}
      - N8N_PROTOCOL=${N8N_PROTOCOL}
      - WEBHOOK_URL=${WEBHOOK_URL}
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
      - N8N_BASIC_AUTH_ACTIVE=${N8N_BASIC_AUTH_ACTIVE}
      - N8N_BASIC_AUTH_USER=${N8N_BASIC_AUTH_USER}
      - N8N_BASIC_AUTH_PASSWORD=${N8N_BASIC_AUTH_PASSWORD}
      - DB_TYPE=${DB_TYPE}
      - DB_POSTGRESDB_HOST=${DB_POSTGRESDB_HOST}
      - DB_POSTGRESDB_PORT=${DB_POSTGRESDB_PORT}
      - DB_POSTGRESDB_DATABASE=${DB_POSTGRESDB_DATABASE}
      - DB_POSTGRESDB_USER=${DB_POSTGRESDB_USER}
      - DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD}
      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}
    volumes:
      - n8n_data:/home/node/.n8n
    depends_on:
      postgres:
        condition: service_healthy

sudo apt install -y nginx certbot python3-certbot-nginx

sudo nano /etc/nginx/sites-available/n8n

server {
    listen 80;
    server_name n8n.yourdomain.com;

    location / {
        proxy_pass http://localhost:5678;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;
    }
}

# Enable the site
sudo ln -s /etc/nginx/sites-available/n8n /etc/nginx/sites-enabled/n8n

# Test the Nginx configuration
sudo nginx -t
# Expected: configuration file test is successful

# Reload Nginx
sudo systemctl reload nginx

sudo certbot --nginx -d n8n.yourdomain.com

curl -I https://n8n.yourdomain.com
# Expected: HTTP/2 200 or HTTP/2 401 (if basic auth is enabled)

cd ~/n8n && docker compose up -d

docker compose ps

NAME             STATUS
n8n-postgres-1   Up (healthy)
n8n-n8n-1        Up

https://n8n.yourdomain.com

curl -X POST https://n8n.yourdomain.com/webhook-test/your-webhook-path \
  -H "Content-Type: application/json" \
  -d '{"test": "hello"}'

# Allow SSH, HTTP, and HTTPS only
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable

# Verify rules
sudo ufw status

Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
Nginx Full                 ALLOW       Anywhere

# Create a dated backup of both volumes
docker run --rm \
  -v n8n_n8n_data:/n8n \
  -v n8n_postgres_data:/postgres \
  -v $(pwd)/backups:/backup \
  alpine sh -c "tar czf /backup/n8n-backup-$(date +%Y%m%d).tar.gz /n8n /postgres"

0 2 * * 0 cd ~/n8n && docker run --rm -v n8n_n8n_data:/n8n -v n8n_postgres_data:/postgres -v $(pwd)/backups:/backup alpine sh -c "tar czf /backup/n8n-backup-$(date +\%Y\%m\%d).tar.gz /n8n /postgres"

cd ~/n8n

# Pull the latest n8n image
docker compose pull

# Restart with the new image (zero-downtime swap)
docker compose up -d --no-deps n8n

# Verify which version is now running
docker compose exec n8n n8n --version