Summary: Use Docker Compose + PostgreSQL + a reverse proxy (Caddy/Nginx) with HTTPS. Set an encryption key, schedule backups, and restrict access.

Prerequisites

  • A Linux VPS with Docker and Docker Compose.
  • A domain or subdomain, e.g. n8n.example.com.
  • Basic terminal knowledge.

Example docker-compose.yml (condensed)

services:
  postgres:
    image: postgres:16
    restart: always
    environment:
      POSTGRES_USER: n8n
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: n8n
    volumes:
      - pgdata:/var/lib/postgresql/data

  n8n:
    image: docker.n8n.io/n8nio/n8n
    restart: always
    ports:
      - "127.0.0.1:5678:5678"
    environment:
      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_DATABASE: n8n
      DB_POSTGRESDB_USER: n8n
      DB_POSTGRESDB_PASSWORD: ${DB_PASSWORD}
      N8N_HOST: n8n.example.com
      N8N_PROTOCOL: https
      WEBHOOK_URL: https://n8n.example.com/
      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
      GENERIC_TIMEZONE: Asia/Jakarta
    volumes:
      - n8n_data:/home/node/.n8n
    depends_on:
      - postgres

volumes:
  pgdata:
  n8n_data:

Secrets live in a .env file, not in a repository. Check n8n's documentation for current variable names for your version.

Steps

  1. Prepare the server, firewall (open only 80/443), and a non-root user.
  2. Create .env with strong passwords and a random N8N_ENCRYPTION_KEY; store a backup of it safely.
  3. Run docker compose up -d.
  4. Set up a reverse proxy with automatic HTTPS certificates (Caddy/Let's Encrypt).
  5. Create the owner account and enable 2FA if available.

Security Checklist

  • HTTPS required; do not expose port 5678 directly.
  • Encryption key backed up separately (without it, credentials cannot be decrypted).
  • Webhooks protected with authentication/secret.
  • Update regularly after testing in staging.
  • Restrict admin access (VPN/IP allowlist where possible).
  • Credentials with least privilege.
  • Prune old execution data automatically so the database does not bloat.

Backup and Recovery

  • Daily PostgreSQL dump to separate storage (object storage).
  • Export workflows to Git (versioning).
  • Test restoration periodically; a backup that was never tested may not work.

Monitoring

Watch uptime, disk/RAM usage, and failed workflows. Send alerts to Slack/WhatsApp through a separate n8n workflow.

Scaling

For high volume use queue mode with Redis and several workers; read the official documentation.

FAQ

What is the minimum VPS spec?

A small VPS is enough for light loads; add resources as parallel executions and data size grow.

Is it safe for sensitive data?

It can be, if hardened and access is restricted. Also consider the Indonesian Personal Data Protection Law for personal data.

Next steps

Hand installation, hardening, and n8n maintenance to Oneflux.