Install n8n with Docker: Step-by-Step Docker Compose Setup

Before building anything permanent, confirm the image runs. This container is removed the moment you stop it, so nothing is persisted:

docker run -it --rm \
  --name n8n \
  -p 5678:5678 \
  docker.n8n.io/n8nio/n8n

Open http://localhost:5678 (or the server IP on port 5678) and you should see the owner account setup screen. Stop the container with Ctrl+C once you have seen it — the real install starts at Step 2.

Keep everything for the instance in one folder so backups and migrations are a single directory copy. Generate a strong encryption key now and store it in your password manager before you go any further:

mkdir -p ~/n8n && cd ~/n8n
openssl rand -hex 32   # copy this value, it is your N8N_ENCRYPTION_KEY
openssl rand -hex 24   # and this one for the database password

Losing the encryption key means every saved credential in your backups becomes unreadable. It is the single most commonly regretted omission in a self-hosted n8n setup.

Docker Compose reads this file automatically. Never commit it to a repository:

# ~/n8n/.env
POSTGRES_PASSWORD=paste-the-second-random-string
N8N_ENCRYPTION_KEY=paste-the-first-random-string
N8N_HOST=n8n.yourdomain.com
GENERIC_TIMEZONE=Europe/Berlin

This is the production-ready stack: n8n plus PostgreSQL, both with named volumes, a health check so n8n waits for the database, and execution pruning enabled from day one. Note that the n8n port is bound to 127.0.0.1 — the reverse proxy in Step 6 is what faces the internet.

services:
  postgres:
    image: postgres:16
    restart: unless-stopped
    environment:
      - POSTGRES_USER=n8n
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=n8n
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U n8n']
      interval: 10s
      timeout: 5s
      retries: 5

  n8n:
    image: docker.n8n.io/n8nio/n8n:latest
    restart: unless-stopped
    ports:
      - '127.0.0.1:5678:5678'
    environment:
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - DB_POSTGRESDB_PASSWORD=${POSTGRES_PASSWORD}
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
      - N8N_HOST=${N8N_HOST}
      - N8N_PROTOCOL=https
      - N8N_PORT=5678
      - WEBHOOK_URL=https://${N8N_HOST}/
      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}
      - EXECUTIONS_DATA_PRUNE=true
      - EXECUTIONS_DATA_MAX_AGE=168
    volumes:
      - n8n_data:/home/node/.n8n
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  postgres_data:
  n8n_data:

Bring everything up in the background and watch the logs until n8n reports it is listening:

docker compose up -d
docker compose logs -f n8n

A healthy start ends with a line confirming the editor is available on port 5678. If the container restarts in a loop, the logs almost always name the offending environment variable directly.

n8n should not be exposed on a raw port. Caddy is the shortest path to working TLS because it requests and renews Let's Encrypt certificates on its own. Create a two-line Caddyfile:

n8n.yourdomain.com {
  reverse_proxy 127.0.0.1:5678
}

Then reload Caddy. Nginx and Traefik work just as well if you already run one — the only requirement is that the proxy forwards WebSocket upgrade headers, otherwise the editor loads but live execution updates never appear.

A nightly database dump pushed off the server, plus the encryption key held separately, is the whole recovery story. Add this to cron:

0 3 * * * cd ~/n8n && docker compose exec -T postgres \
  pg_dump -U n8n n8n | gzip > ~/backups/n8n-$(date +\%F).sql.gz

Copy those dumps to object storage or a second machine — a backup that only exists on the server it protects is not a backup. Exporting important workflows as JSON occasionally gives you a second, database-independent copy.