Install n8n on a VPS with Docker Compose

Before you start

The n8n page says that n8n recommends self-hosting for expert users. Mistakes can cause data loss, security problems and time when n8n does not operate. If you do not have experience with servers, n8n recommends n8n Cloud. To compare the two, read n8n Cloud vs self-hosted.

On Oct 26, 2026, the n8n page gave 2.44.7 as the current stable version. It says to use the stable version for your real work. It also says that the beta version can be unstable.

To select a server size, read how much RAM and CPU n8n needs.

Step 1: Install Docker and Docker Compose

The install steps are different for each Linux distribution. Use the Docker pages Install Docker Engine and Install the Docker Compose plugin for your distribution. Then, to make sure that Docker and Docker Compose are available, type:

docker --version
docker compose version

Step 2 (optional): Run Docker without sudo

This step is optional. It lets a user run Docker without the sudo command. For the user that you are logged in as (if that user has sudo access), run:

sudo usermod -aG docker ${USER}
exec sg docker newgrp

For a different user, type this, and put that user name in place of <USER_TO_RUN_DOCKER>:

sudo usermod -aG docker <USER_TO_RUN_DOCKER>

That user must then run exec sg docker newgrp in each of the sessions that are open. To make sure that your session has the docker group, type:

groups

Step 3: Make an A record for your server

To open n8n on the internet or on a network, give n8n its own name below your DOMAIN_NAME. This name is the SUBDOMAIN value of step 4. The name must point at your server. Add an A record:

Step 4: Make the .env file

Make a project folder for the n8n settings and the Docker Compose file, and go into it:

mkdir n8n-compose
cd n8n-compose

In the n8n-compose folder, make a file with the name .env. Put in this text, and change the values to your data:

# DOMAIN_NAME and SUBDOMAIN together determine where n8n will be reachable from
# The top level domain to serve from
DOMAIN_NAME=example.com

# The subdomain to serve from
SUBDOMAIN=n8n

# The above example serve n8n at: https://n8n.example.com

# Optional timezone to set which gets used by Cron and other scheduling nodes
# New York is the default value if not set
GENERIC_TIMEZONE=Europe/Berlin

# The email address to use for the TLS/SSL certificate creation
[email protected]

Step 5: Make the local-files folder

In the project folder, make a folder with the name local-files. n8n and the server use this folder to share files.

mkdir local-files

The n8n page says that the Docker Compose file can make this folder, but when you make it yourself, the folder gets the correct owner and permissions.

Step 6: Make the compose.yaml file

Make a file with the name compose.yaml, and put in this text:

services:
  traefik:
    image: "traefik"
    restart: always
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.mytlschallenge.acme.tlschallenge=true"
      - "--certificatesresolvers.mytlschallenge.acme.email=${SSL_EMAIL}"
      - "--certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - traefik_data:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock:ro

  n8n:
    image: n8nio/n8n
    restart: always
    ports:
      - "127.0.0.1:5678:5678"
    labels:
      - traefik.enable=true
      - traefik.http.routers.n8n.rule=Host(`${SUBDOMAIN}.${DOMAIN_NAME}`)
      - traefik.http.routers.n8n.tls=true
      - traefik.http.routers.n8n.entrypoints=web,websecure
      - traefik.http.routers.n8n.tls.certresolver=mytlschallenge
      - traefik.http.middlewares.n8n.headers.SSLRedirect=true
      - traefik.http.middlewares.n8n.headers.STSSeconds=315360000
      - traefik.http.middlewares.n8n.headers.browserXSSFilter=true
      - traefik.http.middlewares.n8n.headers.contentTypeNosniff=true
      - traefik.http.middlewares.n8n.headers.forceSTSHeader=true
      - traefik.http.middlewares.n8n.headers.SSLHost=${DOMAIN_NAME}
      - traefik.http.middlewares.n8n.headers.STSIncludeSubdomains=true
      - traefik.http.middlewares.n8n.headers.STSPreload=true
      - traefik.http.routers.n8n.middlewares=n8n@docker
    environment:
      - N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
      - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - NODE_ENV=production
      - N8N_WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/
      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}
      - TZ=${GENERIC_TIMEZONE}
      - N8N_RESTRICT_FILE_ACCESS_TO=/files
    volumes:
      - n8n_data:/home/node/.n8n
      - ./local-files:/files

volumes:
  n8n_data:
  traefik_data:

The n8n page says that N8N_WEBHOOK_URL is available from n8n 2.30.0. For an earlier version, use WEBHOOK_URL.

This file starts two parts, n8n and traefik. Traefik gets the security files for the https:// address and sends the requests to n8n. n8n keeps its database file and its encryption key in n8n_data. Traefik keeps these security files in traefik_data. In n8n, use the path /files to read and write the local-files folder.

Step 7: Start n8n

To start n8n, type:

sudo docker compose up -d

To stop n8n and Traefik, type:

sudo docker compose stop

Step 8: Open n8n

Open the address that the SUBDOMAIN and DOMAIN_NAME values in your .env file make. With the example values, the address is https://n8n.example.com. n8n opens only with a secure https:// address. If you cannot open n8n, examine the network settings of your server and the A record from step 3.

After you install n8n, read How to back up n8n, and what each host includes and How to update n8n safely, and who patches what. If n8n shows localhost in a webhook address, read n8n webhook URL shows localhost? Setup fixes.

FAQ

Which official pages does this guide use?

The n8n page "Use Docker Compose" gives steps 1 to 8. For step 1, that page links to two pages of the Docker documentation: "Install Docker Engine" and "Install the Docker Compose plugin". We read the three pages on Oct 26, 2026. This guide does not add steps that are not on these pages.

Where does n8n keep its data in this setup?

The n8n page says that n8n keeps its database file and its encryption key in n8n_data. This name is in the compose.yaml file of step 6. We read this on Oct 26, 2026.

Can I open n8n with an http:// address after this install?

No. The n8n page says that n8n opens only with a secure https:// address. If you cannot open n8n, the page tells you to examine the network settings of your server and the A record of your domain name (step 3). We read this on Oct 26, 2026.