You can run n8n on your own Linux VPS by installing Docker, managing the host with Portainer CE, deploying an n8n Compose stack, and placing n8n behind an HTTPS reverse proxy such as Traefik. The reliable sequence is: harden the server, deploy Portainer, create a persistent n8n stack, point a subdomain at the VPS, issue a certificate, verify health, and test backups before importing important workflows.
Antihost offers VPS plans with one-click n8n, NVMe storage and a 14-day free trial.
What this setup includes
The deployment has four layers. The VPS supplies CPU, memory, storage, a public IP address, and firewall controls. Docker runs the containers. Portainer provides a web interface for deploying and operating the Compose stack. Traefik accepts public HTTP and HTTPS traffic, redirects HTTP to HTTPS, renews certificates, and forwards requests to n8n on its private container port.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →n8n stores its application data under /home/node/.n8n. With the default SQLite configuration, that directory contains the database and the n8n encryption key. A persistent named volume or bind mount is therefore essential; deleting and recreating a container must not delete this data.
Choose the VPS before installing anything
Baseline resources
The current n8n Docker Compose documentation specifies at least 4 GB of RAM and 2 vCPUs for the full setup that includes the Assistant sandbox. That is a documented baseline for that stack, not a universal minimum for every n8n workload. A small number of light, infrequent workflows may need less, while concurrent executions, large payloads, browser automation, queues, or additional services require more headroom.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Use a Linux VPS with a current Docker Engine and Docker Compose v2. Select SSD-backed storage, enough capacity for execution data and logs, and a provider that offers snapshots or a practical off-site backup route. Confirm that the region serves your users and webhook callers well, that IPv4 is available if your DNS and integrations require it, and that the provider supplies usable firewall controls and support.
VPS selection checklist
- At least 2 vCPUs and 4 GB RAM for the documented full Compose setup.
- SSD storage with room for the n8n data volume, Docker images, logs, and backups.
- A public IPv4 address or a confirmed IPv6 design for every integration that needs callbacks.
- Provider snapshots plus a separate off-site backup destination.
- Firewall rules that let you expose only the services you intend to publish.
- A region and network policy suitable for your users, APIs, and webhook providers.
Harden the host and install Docker
Start with a supported Linux distribution, update its packages, create an administrative user with sudo access, and use key-based SSH authentication where possible. Enable the host firewall and allow SSH only from the addresses or VPN path you actually use. Public web traffic will later use ports 80 and 443; do not publish n8n’s internal port 5678 to the internet.
Install Docker Engine and the Compose v2 plugin using the current instructions for your distribution. Verify both components before opening Portainer:
docker version
docker compose version
sudo systemctl enable --now dockerThe exact package names vary by distribution. The important prerequisite is a working Docker installation that your sudo-enabled account can use.
Install Portainer CE safely
Portainer CE runs as a Docker container and its Linux installation requires Docker and sudo access. Its default HTTPS interface is exposed on port 9443. A typical installation creates a persistent data volume and mounts the Docker socket:
docker volume create portainer_data
docker run -d --name portainer --restart=always
-p 9443:9443
-v /var/run/docker.sock:/var/run/docker.sock
-v portainer_data:/data
portainer/portainer-ceUse the current Portainer CE image reference from its documentation, and pin a tag or digest that you have tested rather than relying on an unbounded latest tag in production. Open https://SERVER_IP:9443 from a trusted network, create the first administrator account, and complete the local Docker environment setup.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
The Docker socket gives Portainer privileged control over the host. Treat the Portainer account as root-level administration: use a strong unique password, protect the port with a firewall or VPN where practical, keep Portainer updated, and do not expose its login page broadly just because n8n itself is public.
Prepare the domain and secrets
Choose a dedicated hostname such as automation.example.com. Create an A record that points to the VPS public IP and wait for it to resolve before requesting a certificate. If you use a provider proxy, verify that its mode and origin settings still permit the ACME challenge and websocket traffic required by your configuration.
Keep environment values out of a public Compose file. Portainer lets you enter variables separately when creating a stack, and it can deploy from a Git repository. Store the following values in Portainer’s environment-variable section or in a protected secret-management process:
| Variable | Purpose |
|---|---|
N8N_HOST |
The complete public hostname used by the editor and webhooks. |
N8N_PROTOCOL |
Set to https when Traefik terminates TLS. |
WEBHOOK_URL |
The externally reachable HTTPS base URL used when n8n generates webhook links. |
N8N_ENCRYPTION_KEY |
A long, random, stable key used to encrypt stored credentials. |
TZ and GENERIC_TIMEZONE |
The timezone used by the container and scheduled workflows. |
TRAEFIK_ACME_EMAIL |
The email address supplied to the certificate authority for ACME registration. |
N8N_IMAGE_TAG and TRAEFIK_IMAGE_TAG |
Tested image tags or digests selected for controlled upgrades. |
Generate the encryption key once, record it in a password manager or encrypted backup, and never rotate it casually. A backup of the data volume without the matching key may restore workflow definitions but leave encrypted credentials unusable.
Deploy the Compose stack in Portainer
In Portainer, open Stacks, choose Add stack, give the stack a name such as n8n, and paste or upload the Compose file. Portainer also supports Git-based Compose deployment, which makes the configuration reproducible and easier for another operator to recover. Enter the variables separately, then deploy the stack.
The following example uses Traefik for HTTP-to-HTTPS redirection and certificate management. It keeps n8n’s port private, persists both n8n data and certificate data, and leaves image versions under Portainer’s control.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
services:
traefik:
image: traefik:${TRAEFIK_IMAGE_TAG}
restart: unless-stopped
command:
- --providers.docker=true
- --providers.docker.exposedbydefault=false
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --entrypoints.web.http.redirections.entrypoint.to=websecure
- --entrypoints.web.http.redirections.entrypoint.scheme=https
- --certificatesresolvers.le.acme.email=${TRAEFIK_ACME_EMAIL}
- --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
- --certificatesresolvers.le.acme.httpchallenge=true
- --certificatesresolvers.le.acme.httpchallenge.entrypoint=web
ports:
- 80:80
- 443:443
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- traefik_data:/letsencrypt
networks:
- proxy
n8n:
image: n8nio/n8n:${N8N_IMAGE_TAG}
restart: unless-stopped
environment:
- N8N_HOST=${N8N_HOST}
- N8N_PROTOCOL=https
- WEBHOOK_URL=https://${N8N_HOST}/
- N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
- TZ=${TZ}
- GENERIC_TIMEZONE=${GENERIC_TIMEZONE}
volumes:
- n8n_data:/home/node/.n8n
networks:
- proxy
labels:
- traefik.enable=true
- traefik.http.routers.n8n.rule=Host(`${N8N_HOST}`)
- traefik.http.routers.n8n.entrypoints=websecure
- traefik.http.routers.n8n.tls.certresolver=le
- traefik.http.services.n8n.loadbalancer.server.port=5678
volumes:
n8n_data:
traefik_data:
networks:
proxy:Set N8N_IMAGE_TAG and TRAEFIK_IMAGE_TAG to versions you have tested. The labels tell Traefik to route only the n8n service. There is no host mapping for port 5678, so direct access to the editor bypassing HTTPS is not created.
SQLite or PostgreSQL?
The basic stack uses SQLite inside the persistent n8n directory and is straightforward for a small installation. n8n’s Compose documentation recommends evaluating PostgreSQL for production workloads. PostgreSQL adds another service, credentials, storage, and backup responsibility, but it is the direction to consider when execution volume, concurrency, or operational requirements outgrow a single SQLite file.
Whichever database you choose, keep the database credentials out of the published Compose file, persist the database storage, and include it in the backup and restore procedure. Do not switch database backends during an upgrade without following n8n’s documented migration process.
Bring the service online and verify it
- In Portainer, open the stack and confirm both the Traefik and n8n containers show a running state.
- Open the container logs. Look for n8n startup completion and for Traefik messages indicating that the router and certificate resolver loaded successfully.
- From a machine that can resolve the hostname, visit
https://automation.example.com. Confirm that the browser shows a valid certificate and that the n8n editor loads. - On the VPS, test n8n’s health endpoint with
curl -sf http://localhost:5678/healthzonly if you have deliberately made that internal endpoint reachable from the host. Otherwise run the equivalent check from inside the container or use the service health check provided by your Compose configuration. - Create a harmless test workflow, run it manually, and trigger a webhook from an external network. This verifies DNS, TLS, proxy routing, and callback reachability together.
- Recreate the n8n container from Portainer and confirm that the test workflow, users, and credentials remain present. This is the minimum persistence test before importing important automations.
HTTPS, webhooks, and proxy details
n8n’s SSL guidance recommends a reverse proxy such as Traefik or a network load balancer in front of the n8n instance. The proxy terminates TLS, redirects HTTP to HTTPS, and handles certificate renewal. n8n must still know its public URL: set N8N_HOST, N8N_PROTOCOL=https, and an HTTPS WEBHOOK_URL that ends with the path your integrations use.
A certificate can be valid while a webhook is still broken. Webhook providers must resolve the same public hostname, reach port 443, and receive a response through the router. If an integration reports a private IP, an HTTP URL, or a connection timeout, inspect the generated webhook URL and the VPS firewall before changing the workflow.
Protect data in transit and at rest
- Expose only the proxy’s public HTTP and HTTPS ports. Keep n8n’s 5678 port on the private Docker network.
- Restrict Portainer’s 9443 administration port to a trusted IP range or VPN when possible.
- Use HTTPS for the editor and every webhook callback. n8n places responsibility for encryption in transit on the self-hosted operator.
- Protect the encryption key, database passwords, Portainer credentials, and SSH keys independently from the VPS.
- Use encrypted partitions or provider-level disk encryption for data at rest, as recommended in n8n’s self-hosting guidance.
- Review Docker socket access as privileged host control, not as an ordinary application permission.
Back up workflows, credentials, and certificates
Back up the complete n8n data volume, not just exported workflow JSON. The volume contains the SQLite database and the encryption key used to unlock credentials. Also back up the Traefik certificate storage if you want to preserve the current ACME state, and keep an independent copy of the encryption key in an encrypted password manager or offline encrypted storage.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Before a planned upgrade, stop executions or place the stack in a maintenance window, then create a consistent volume backup. The following pattern archives a named volume to a directory on the host; replace the volume and destination with the names shown in your Portainer environment:
docker run --rm
-v n8n_data:/data:ro
-v /srv/backups:/backup
alpine tar czf /backup/n8n-data-backup.tgz -C /data .Copy that archive off the VPS. A snapshot stored only on the same host does not protect against host loss. Schedule backups, retain multiple generations, and periodically restore one to an isolated test stack. A backup is operationally real only when you can recover the editor, decrypt a stored credential, and execute a test workflow.
Updates and rollback
Pin a tested n8n and Traefik image tag or digest. Read the release notes, back up the data volume and encryption key, and update one controlled change at a time. Portainer can show whether images are current, but an update indicator is not a compatibility test or a rollback plan.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Record the current image tags, Compose file, environment values, and volume names.
- Run and verify a fresh backup, including the encryption key.
- Pull the new images and redeploy the stack from Portainer.
- Inspect logs, open the HTTPS editor, run a test workflow, and test one webhook.
- If the upgrade fails, redeploy the previous tested image tags and restore the backup only if data migration requires it.
Keep Docker, Portainer, and the host operating system updated as separate maintenance tasks. Schedule them so a failed host update cannot be confused with an n8n application change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failures and fixes
The domain does not open
Check that the A record points to the current VPS IP, that the VPS firewall allows ports 80 and 443, and that Traefik is running. A stale DNS record or a provider-level firewall can prevent the request from ever reaching the proxy.
Certificate issuance fails
Confirm that the hostname resolves publicly, port 80 reaches Traefik for the HTTP challenge, and another service is not occupying the port. Inspect Traefik logs for the ACME error, correct the DNS or firewall condition, and retry after the authority’s rate limits permit it.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Traefik returns a 502
Check that n8n is running on the same Docker network as Traefik and that the service label points to port 5678. If n8n repeatedly restarts, inspect its own logs for an invalid environment value, an unwritable volume, or insufficient memory.
Recommended Free Tools
The editor loads but webhooks fail
Verify WEBHOOK_URL, N8N_HOST, and N8N_PROTOCOL. Test from outside the VPS, not only from the server itself, and confirm the integration is using the HTTPS hostname rather than a private address.
Credentials cannot be decrypted after a restore
Restore the exact n8n encryption key that was used when the credentials were created. Restoring only the data volume or generating a new key produces an installation that cannot read the old encrypted values.
Data disappears after redeployment
Inspect the stack’s volume name and mount path. The n8n container must mount the persistent volume at /home/node/.n8n; recreating a container with a new anonymous volume starts with a different database.
Portainer is unreachable
Check that the container is running, port 9443 is allowed from your administration network, and the host firewall is not blocking it. If the port is intentionally private, connect through the approved VPN or management tunnel instead of opening it publicly.
Deployment choices to compare
Before committing to a VPS or operating model, compare the factors that affect recovery and day-to-day work:
| Decision | What to evaluate | Why it matters |
|---|---|---|
| VPS capacity | RAM and vCPU headroom, SSD performance, and storage growth | Determines whether concurrent executions and logs can run without memory pressure or disk exhaustion. |
| Provider resilience | Snapshots, off-site backup options, region, IPv4 availability, and support quality | Controls how quickly you can recover from a failed host or unavailable region. |
| Network security | Firewall controls and the ability to restrict administration traffic | Lets you keep Portainer and SSH private while exposing only the reverse proxy. |
| Database | SQLite simplicity versus evaluating PostgreSQL for production workloads | Changes the backup, scaling, and migration work you must operate. |
| Deployment source | Portainer editor, uploaded Compose file, or Git-based Compose deployment | A reproducible file and separated variables make updates and host recovery easier. |
| Operations | Logs, health checks, tested image tags, rollback procedure, and restore tests | Prevents a green container status from being mistaken for a working automation service. |
When this architecture is a good fit
Portainer-managed Docker Compose is a practical fit when you want control of the VPS, a visual administration layer, and a configuration that can be recreated from one stack definition. It is less suitable if nobody can maintain Linux security, monitor disk and memory, protect secrets, or test restores. Self-hosting transfers those responsibilities to you; the convenience of a graphical interface does not remove them.
For a dependable first launch, keep the design small: one hardened VPS, one private n8n service, Traefik for public HTTPS, persistent volumes, separated secrets, and an off-site backup that you have actually restored. Expand to PostgreSQL or additional execution capacity only when the workflow load and recovery requirements justify the extra moving parts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
