The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →You can run n8n with Docker Compose without Traefik by making NGINX or Caddy the only public-facing service. Keep n8n listening privately on port 5678 inside a shared Docker network, terminate HTTPS at the proxy, and set n8n’s public webhook URL explicitly. This arrangement prevents webhook links from exposing localhost:5678, preserves editor WebSockets, and leaves certificate management in one clearly defined component.
Antihost offers VPS plans with one-click n8n, NVMe storage and a 14-day free trial.
The practical choice is straightforward: use Caddy when you want the smallest configuration and automatic certificate issuance and renewal; use NGINX when your host already standardizes on it or you need granular routing, headers, access controls, buffering, and logs.
As an Amazon Associate I earn from qualifying purchases.
What changes when Traefik is removed
The official n8n Compose pattern places an n8n container behind a separate Traefik container. n8n listens internally on port 5678, while Traefik owns the host’s public ports 80 and 443, routes requests, and handles TLS. Replacing Traefik does not change n8n’s application port or data directory. It changes which service performs public routing and certificate work.
The target topology is:
Internet (HTTPS :443)
|
NGINX or Caddy
|
Docker network: n8n:5678Only the proxy should bind host ports 80 and 443. Do not publish n8n’s 5678 port to the public interface when the proxy shares its Docker network. The proxy reaches n8n by the Compose service name, n8n, rather than by localhost. Inside a container, localhost means that same container, not the n8n service.
#1 Best Overall
Keep the persistent volume mounted at /home/node/.n8n. The official Compose example uses this path for n8n’s SQLite database and encryption key, so removing or changing it can make an apparently healthy container look like a new installation after a restart.
Prepare the Compose project
1. Keep n8n private
Start with your existing official n8n Compose file. Remove Traefik’s service, labels, and related certificate configuration. Leave the n8n service attached to a user-defined network and remove any host mapping such as 5678:5678. The proxy service must join that same network.
2. Give the proxy the public ports
Publish port 80 for HTTP challenges and redirects, and port 443 for HTTPS, from NGINX or Caddy only. Point a DNS A or AAAA record for the chosen hostname, such as n8n.example.com, at the server before requesting a certificate. The host firewall must allow inbound TCP 80 and 443.
3. Validate the rendered configuration
Run:
docker compose configInspect the rendered output for the expected services, shared network, volume, and port bindings. This catches duplicate host ports, misspelled network names, and environment variables that were accidentally placed outside the n8n service.
Rank #2
Option A: Put n8n behind Caddy
Caddy is the shorter path when you want automatic HTTPS. n8n’s official deployment guides use a Caddyfile that proxies the Compose service name and disables response buffering for n8n’s streaming behavior:
n8n.example.com {
reverse_proxy n8n:5678 {
flush_interval -1
}
}How the Caddy setup works
- Place Caddy and n8n on the same Docker network. The name
n8ninreverse_proxy n8n:5678must exactly match the n8n Compose service name. - Mount the Caddyfile into the Caddy container and persist Caddy’s data directory so issued certificates survive container recreation.
- Publish Caddy’s ports 80 and 443 on the host. Do not publish n8n’s 5678 port.
- Confirm that DNS resolves
n8n.example.comto the server and that both public ports are reachable. Caddy’s automatic certificate issuance depends on that reachability. - Start the stack and watch Caddy’s logs for certificate issuance and upstream connection errors. Once the certificate is ready, browse to the HTTPS hostname.
Caddy automatically creates and manages SSL/TLS certificates, so you do not need to wire Certbot into the Compose stack. Certificate storage still needs persistence; otherwise a recreated proxy may have to obtain certificates again and could hit certificate-authority rate limits.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11When Caddy is the better fit
- You want a very small proxy configuration.
- You prefer automatic certificate issuance and renewal.
- The server is dedicated to this stack or has only a few simple virtual hosts.
- You do not need extensive custom buffering, access-policy, or header rules.
Option B: Put n8n behind NGINX
NGINX is a strong choice when it is already the standard proxy on the host, when several applications share one listener, or when operators need explicit control over routing, logs, headers, buffering, and access restrictions. A representative HTTPS server block is:
server {
listen 443 ssl http2;
server_name n8n.example.com;
ssl_certificate /etc/letsencrypt/live/n8n.example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/n8n.example.com/privkey.pem;
location / {
proxy_pass http://n8n:5678;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
}
}The conditional WebSocket map belongs in the NGINX http block, not inside server or location:
Rank #3
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}Why each NGINX directive matters
proxy_pass http://n8n:5678sends requests across the Docker network to n8n’s internal listener.proxy_http_version 1.1is required for upgraded connections.Host,X-Real-IP, and theX-Forwarded-*headers preserve the public hostname, client address, and original HTTPS scheme.UpgradeandConnectionexplicitly forward WebSocket negotiation. NGINX does not forward these hop-by-hop headers automatically.- The certificate and key paths must point to files available inside the proxy container, not merely files on the host.
Certificate operations with NGINX
Unlike Caddy, NGINX does not obtain or renew certificates by itself. Use an ACME client such as Certbot or another approved automation process, then mount the resulting certificate files into the NGINX container. Reload NGINX after renewal so workers begin using the new certificate. Keep the private key readable only by the accounts and containers that require it.
Set n8n’s public URL and proxy trust
n8n builds webhook URLs from its protocol, host, and port. Its internal port remains 5678, but users and webhook providers reach the service over public HTTPS on port 443. Set the public values explicitly in the n8n service:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
environment:
- N8N_HOST=n8n.example.com
- N8N_PORT=5678
- N8N_PROTOCOL=https
- N8N_WEBHOOK_URL=https://n8n.example.com/
- N8N_PROXY_HOPS=1N8N_WEBHOOK_URL is the current variable. The older WEBHOOK_URL name is deprecated from n8n 2.35.0. The trailing slash in the example is intentional; use the exact public base URL that should appear in generated webhook links.
The final reverse proxy must set X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto. Set N8N_PROXY_HOPS to the number of trusted proxies between the client and n8n. A direct Caddy-or-NGINX-to-n8n path uses 1. If a cloud load balancer or another proxy sits in front, increase the value to match the complete trusted chain and ensure every hop preserves the forwarding headers. Trusting too few hops can produce incorrect scheme or client-IP detection; trusting too many can let an untrusted client spoof proxy headers.
TLS, redirects, and exposure rules
n8n recommends placing a reverse proxy or network load balancer in front of the instance for TLS termination and certificate renewal. Direct TLS inside n8n is possible with N8N_SSL_CERT and N8N_SSL_KEY, but then you must handle renewal, secure key mounting, and reloads yourself. For most Compose deployments, terminating TLS at Caddy or NGINX keeps those responsibilities separate from the application.
- Create the DNS A or AAAA record before certificate issuance.
- Allow ports 80 and 443 through the host firewall and any upstream security group.
- Publish only the proxy’s 80/443 bindings; keep 5678 on the internal Docker network.
- Use one canonical HTTPS hostname in the proxy configuration and in
N8N_WEBHOOK_URL. - Redirect plain HTTP to HTTPS after the ACME HTTP challenge requirements are satisfied.
Verify the deployment before using production webhooks
- Run
docker compose configand confirm the expected services, network, ports, and persistent volumes. - Resolve the hostname from an external network and verify that it returns the server’s public IP.
- Confirm that Caddy has obtained a certificate or that NGINX has loaded the intended certificate and key.
- Run
curl -I https://n8n.example.com/. The response should be from the HTTPS proxy rather than an internal address. - Open the n8n editor. Check the browser console and network panel for mixed-content warnings, redirect loops, or failed WebSocket requests.
- Create a test workflow with a webhook trigger. Its displayed URL should use
https://n8n.example.com/, neverhttp://localhost:5678, an internal service name, or port 5678. - For NGINX, inspect an applicable upgrade request and confirm a
101 Switching Protocolsresponse. A failed upgrade usually indicates a missing HTTP/1.1 or Upgrade/Connection header. - Restart the stack. Verify that workflows, credentials, and the encryption key remain available and that proxy certificate storage persists.
NGINX or Caddy: choose by operating model
| Decision factor | Caddy | NGINX |
|---|---|---|
| Configuration size | Small Caddyfile with a direct reverse proxy rule | Longer server and location configuration with explicit headers |
| Certificate issuance and renewal | Automatic certificate creation and management | Separate ACME client and reload process |
| Existing host standard | Best when introducing a focused proxy for this stack | Best when NGINX already fronts other applications |
| Routing and policy control | Simple by default | Detailed access, buffering, header, and routing policies |
| Operations and observability | Fewer moving parts for a single hostname | Familiar logs and mature controls in multi-application environments |
Both choices require the same n8n environment variables, shared Docker network, forwarding headers, DNS, firewall rules, and persistent n8n volume. The proxy choice does not remove the need to configure n8n’s public URL.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Troubleshoot the common failures
Webhook URLs still show localhost or port 5678
Check that N8N_HOST, N8N_PROTOCOL, and N8N_WEBHOOK_URL are under the n8n service, then recreate the container so the changed environment is loaded. Confirm that the value uses the public hostname and HTTPS. Also verify that the proxy sends the three required forwarding headers.
The editor redirects repeatedly or reports mixed content
Usually the proxy is serving HTTPS while n8n believes the request is HTTP. Set N8N_PROTOCOL=https, forward X-Forwarded-Proto $scheme in NGINX (or the equivalent automatically supplied by Caddy), and remove competing proxy rules that rewrite the scheme or host.
Best Value
- Docker, Docker Swarm, Docker Compose, Programmer, Developer, Coding, Programming, Software Engineer, Code, DevOps, Deploy, Deployment, Kubernetes, Salt, Puppet, Chef, Terraform, Container, AWS, Azure, Cloud, Geek, Funny, Computer, Software, Tech, IT
- Integration, Scrum, Compile, Compilation, Science, Bug, Debug, Python, Linux, Java, Javascript, Scala, Dotnet, Kotlin
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
The page loads but live updates disconnect
For NGINX, verify HTTP/1.1 and both WebSocket headers, plus the map directive. For Caddy, keep the documented flush_interval -1 reverse-proxy option. Check proxy logs for upstream resets and make sure both services are on the same Docker network.
The proxy returns 502 Bad Gateway
From the proxy container, confirm that the hostname n8n resolves and that n8n is listening on 5678. A 502 commonly means the services are on different networks, the Compose service was renamed without updating the proxy, or n8n is still starting. Do not change the upstream to localhost:5678; that points back to the proxy container.
Recommended Free Tools
Certificate issuance fails
Check public DNS, port 80 and 443 reachability, firewall rules, and any upstream load balancer. Caddy cannot complete automatic issuance if the hostname does not resolve to the server or the challenge port is blocked. With NGINX, inspect the ACME client’s challenge path and mount the resulting files at the exact paths used in the server block.
Backups, upgrades, and recovery
Back up the volume mounted at /home/node/.n8n before upgrading n8n or changing proxy configuration. That directory contains the SQLite database and encryption key used to decrypt stored credentials. Back up proxy configuration and certificate storage as separate assets so a proxy rebuild does not erase routing rules or certificate state.
After an upgrade, rerun the verification checklist: render the Compose file, inspect the generated webhook URL, test the editor, exercise a webhook, and restart the stack. Keep the proxy and n8n logs available during the first request after a change; they quickly reveal DNS failures, rejected upgrades, incorrect forwarding headers, and certificate problems.
Bottom line
Removing Traefik is safe when you preserve the underlying boundaries: n8n stays private on port 5678, one proxy owns public ports 80 and 443, both containers share a Docker network, and n8n is told its real HTTPS hostname through N8N_WEBHOOK_URL. Choose Caddy for automatic TLS and minimal configuration; choose NGINX for an established multi-application proxy with fine-grained operational control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
