How to Self-Host n8n: Complete Guide to Installation, Security, Webhooks, and Remote Access

What Is n8n?

n8n (pronounced "nodemation") is an open-source, fair-code workflow automation platform. It was first released in 2019 and has grown to over 230,000 active users. In mid-2025, n8n's valuation reached $1.5 billion, driven by its rapid growth and expanding enterprise user base. It provides a node-based visual editor where each node represents an integration or function. You connect nodes on a canvas to build automation workflows, and you can write JavaScript or Python inside Code nodes when visual nodes are not enough.

n8n supports over 400 integrations natively and gives you access to 900+ community workflow templates. It is also the most AI-native automation platform currently available, with nearly 70 dedicated nodes for LangChain, LLM orchestration, RAG pipelines, and AI agents.

n8n vs Zapier vs Make: Which Should You Choose?

Before committing to self-hosting n8n, it is worth understanding how it compares to the two major cloud alternatives. The differences are fundamental, not just cosmetic.

System Requirements

Installation Method 1: Docker Compose with PostgreSQL (Recommended)

Docker Compose is the method recommended by n8n for most self-hosting scenarios. It isolates n8n and its database in containers, makes upgrades a one-command operation, and handles all dependency management automatically.

Step 1: Install Docker

# Linux (Ubuntu, Debian):
curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker $USER
# Log out and back in for the group change to take effect

# Verify:
docker --version
docker compose version

Expected output:

Docker version 27.x.x, build xxxxxxx
Docker Compose version v2.x.x

Step 2: Generate the encryption key

The N8N_ENCRYPTION_KEY is the most critical configuration value in any n8n deployment. n8n uses it to encrypt all credentials (API keys, OAuth tokens, passwords) before storing them in the database. Generate it now, before first launch, and store it somewhere safe:

openssl rand -hex 32

Expected output (yours will be different):

a3f8d2e1b4c7f9a0e2d5c8b1a4f7e0d3c6b9a2e5d8c1b4f7a0e3d6c9b2a5f8e1

Step 3: Create the project directory and .env file

mkdir ~/n8n && cd ~/n8n

cat > .env << 'EOF'
# Database
POSTGRES_USER=n8n
POSTGRES_PASSWORD=change_this_db_password
POSTGRES_DB=n8n

# n8n Core (replace with your actual values)
N8N_ENCRYPTION_KEY=your_64_hex_key_from_step_2
N8N_HOST=localhost
N8N_PORT=5678
N8N_PROTOCOL=http

# Timezone (change to your timezone)
GENERIC_TIMEZONE=Europe/Istanbul
TZ=Europe/Istanbul

# Execution data pruning (recommended for production)
EXECUTIONS_DATA_PRUNE=true
EXECUTIONS_DATA_MAX_AGE=168
EOF

Step 4: Create docker-compose.yml

cat > docker-compose.yml << 'EOF'
version: "3.8"

services:

  postgres:
    image: postgres:16
    container_name: n8n-postgres
    restart: unless-stopped
    env_file: .env
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h localhost -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10

  n8n:
    image: docker.n8n.io/n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    ports:
      - "5678:5678"
    env_file: .env
    environment:
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=${POSTGRES_DB}
      - DB_POSTGRESDB_USER=${POSTGRES_USER}
      - DB_POSTGRESDB_PASSWORD=${POSTGRES_PASSWORD}
      - N8N_HOST=${N8N_HOST}
      - N8N_PORT=${N8N_PORT}
      - N8N_PROTOCOL=${N8N_PROTOCOL}
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}
      - TZ=${TZ}
      - EXECUTIONS_DATA_PRUNE=${EXECUTIONS_DATA_PRUNE}
      - EXECUTIONS_DATA_MAX_AGE=${EXECUTIONS_DATA_MAX_AGE}
      - N8N_RUNNERS_ENABLED=true
    volumes:
      - n8n_data:/home/node/.n8n
      - ./local-files:/files
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  postgres_data:
  n8n_data:
EOF

# Create the shared files directory:
mkdir -p ./local-files

Step 5: Start n8n

docker compose up -d

Docker pulls the images and starts both containers. Check status:

docker compose ps

Expected output:

NAME           IMAGE                          STATUS
n8n            docker.n8n.io/n8nio/n8n:latest  Up 30 seconds
n8n-postgres   postgres:16                    Up 30 seconds (healthy)

Open http://localhost:5678 in your browser. The n8n setup wizard asks you to create the first owner account. Fill in your name, email, and password. This is not basic auth — it is n8n's built-in user management system.

# View live logs to confirm n8n started correctly:
docker compose logs -f n8n

Expected startup log:

n8n ready on 0.0.0.0, port 5678
Version: 1.xx.x
Workflow execution: running in main mode

Installation Method 2: Raspberry Pi with npm

The Raspberry Pi 4 (4 GB RAM) and Raspberry Pi 5 are excellent platforms for running a personal or small-team n8n instance. The npm installation method is lightweight and uses less RAM than Docker, which is important on a Pi. n8n requires Node.js v20.19 or higher. The default apt repository on Raspberry Pi OS ships with older versions, so you need to install Node.js manually.

Step 1: Check your architecture

uname -m

Expected output:

# Raspberry Pi 4 / 5 with 64-bit OS:
aarch64

# Raspberry Pi 3 / 4 with 32-bit OS:
armv7l

For the best experience, use the 64-bit version of Raspberry Pi OS (available in Raspberry Pi Imager). n8n runs on both armv7l and aarch64, but 64-bit is more stable and better supported.

Step 2: Install Node.js v20 via NodeSource

sudo apt update && sudo apt upgrade -y

# Add NodeSource repository for Node.js 20.x:
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs

# Verify:
node --version
npm --version

Expected output:

v20.x.x
10.x.x

Step 3: Configure npm global directory (avoid sudo issues)

mkdir -p ~/.npm-global
npm config set prefix '~/.npm-global'
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc
source ~/.bashrc

Step 4: Install n8n

npm install -g n8n

Installation takes 2-5 minutes on a Pi 4. Expected completion output:

added 589 packages in 3m
npm notice created a lockfile as package-lock.json. You should commit this file.

# Verify:
n8n --version

Expected output:

1.xx.x

Step 5: Create an environment file

mkdir -p ~/.n8n
cat > ~/.n8n/.env << 'EOF'
N8N_ENCRYPTION_KEY=your_64_hex_key_here
DB_TYPE=sqlite
GENERIC_TIMEZONE=Europe/Istanbul
TZ=Europe/Istanbul
EXECUTIONS_DATA_PRUNE=true
EXECUTIONS_DATA_MAX_AGE=168
N8N_RUNNERS_ENABLED=true
EOF

For SQLite (default, fine for personal use on Pi), no additional database setup is needed. The database is stored at ~/.n8n/database.sqlite.

Step 6: Test n8n starts correctly

export $(cat ~/.n8n/.env | xargs)
n8n start

Expected startup output:

n8n ready on 0.0.0.0, port 5678
Version: 1.xx.x

Open http://<pi-ip>:5678 from another device on the same network. Complete the setup wizard. Then stop n8n with Ctrl+C and set it up as a background service.

Step 7: Run n8n as a background service

You have two options: PM2 (recommended for Pi) or systemd.

npm install -g pm2

# Start n8n with PM2 (loads env from .env file):
pm2 start n8n --name n8n -- start --env-file ~/.n8n/.env

# Save the process list:
pm2 save

# Generate systemd startup script (run the printed command):
pm2 startup

# Useful PM2 commands:
pm2 list          # Show all processes and their status
pm2 logs n8n      # Live logs
pm2 restart n8n   # Restart n8n
pm2 stop n8n      # Stop n8n

sudo tee /etc/systemd/system/n8n.service << 'EOF'
[Unit]
Description=n8n Workflow Automation
After=network.target

[Service]
Type=simple
User=pi
WorkingDirectory=/home/pi
EnvironmentFile=/home/pi/.n8n/.env
ExecStart=/home/pi/.npm-global/bin/n8n start
Restart=on-failure
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable n8n
sudo systemctl start n8n
sudo systemctl status n8n

Critical Environment Variables Explained

Most n8n configuration is done via environment variables. Understanding the critical ones is the difference between a stable production instance and a fragile deployment that breaks silently.

Securing Your n8n Instance

Complete the setup wizard

Open http://localhost:5678 immediately after starting n8n for the first time. The wizard asks for:

• First name and last name
• Email address (used as login username)
• Password (minimum 8 characters, mixed case and numbers)

After completing the wizard, n8n requires login to access the editor. You can invite additional users from Settings → Users.

Block environment variable access in nodes

By default, Code nodes and Execute Command nodes can access environment variables, which may include your database password and encryption key. Block this in production:

# Add to your .env:
N8N_BLOCK_ENV_ACCESS_IN_NODE=true

Set execution timeout

Without a timeout, stuck workflows consume memory and CPU indefinitely, eventually crashing the instance:

# Add to your .env:
# Maximum execution time in seconds (3600 = 1 hour):
EXECUTIONS_TIMEOUT=3600
EXECUTIONS_TIMEOUT_MAX=7200

Receiving Webhooks: How n8n Webhooks Work

Webhooks are one of the most powerful n8n features. The Webhook node creates an HTTP endpoint on your n8n instance that external services can call to trigger workflows. To use webhooks with external services (GitHub, Stripe, Twilio, Shopify, etc.), n8n must be reachable from the internet with a public URL.

Test vs Production webhook URLs

Every Webhook node in n8n has two URLs visible in the node panel:

Building a webhook workflow

Practical Workflow Examples

Expose n8n to the Internet with Localtonet

For webhooks to work with external services, n8n must be reachable from the internet. Localtonet creates an encrypted outbound tunnel from your machine to a public HTTPS endpoint. No port forwarding required, works behind CGNAT, and the tunnel URL becomes your permanent webhook base URL.

# Linux / Raspberry Pi:
curl -fsSL https://localtonet.com/install.sh | sh

# Verify:
localtonet --version

localtonet --authtoken YOUR_TOKEN_HERE

# Add to your .env file:
WEBHOOK_URL=https://myflows.localto.net/
N8N_PROTOCOL=https
N8N_HOST=myflows.localto.net
N8N_PROXY_HOPS=1

# Docker Compose:
docker compose restart n8n

# PM2 on Raspberry Pi:
pm2 restart n8n

# systemd:
sudo systemctl restart n8n

Production URL: https://myflows.localto.net/webhook/your-path

sudo localtonet --install-service --authtoken YOUR_TOKEN_HERE
sudo localtonet --start-service --authtoken YOUR_TOKEN_HERE

# Check status:
sudo localtonet --status-service

Backing Up n8n: Workflows, Credentials, and Database

n8n stores everything in three places: the database (PostgreSQL or SQLite), the data directory (/home/node/.n8n in Docker, ~/.n8n on npm), and the encryption key in your environment. All three must be backed up together. If you have the database but lost the encryption key, credentials are gone. If you have the encryption key but lost the database, workflows are gone.

CLI export commands

n8n provides CLI commands to export workflows and credentials as JSON files. These are portable and can be imported into any n8n instance.

# Docker Compose: export all workflows to a JSON file:
docker exec -u node n8n n8n export:workflow --all --output=/files/workflows-backup.json

# Docker Compose: export all credentials (encrypted with N8N_ENCRYPTION_KEY):
docker exec -u node n8n n8n export:credentials --all --output=/files/credentials-backup.json

# npm / Raspberry Pi: export all workflows:
n8n export:workflow --all --output=~/n8n-backup/workflows-backup.json

# npm / Raspberry Pi: export credentials (encrypted):
n8n export:credentials --all --output=~/n8n-backup/credentials-backup.json

Full backup script (Docker Compose)

#!/bin/bash
# Save as ~/n8n/backup.sh
# Add to cron: 0 3 * * * ~/n8n/backup.sh

BACKUP_DIR=~/n8n-backups/$(date +%F)
mkdir -p "$BACKUP_DIR"

cd ~/n8n

# Export workflows:
docker exec -u node n8n n8n export:workflow --all \
  --output=/files/workflows.json
cp ./local-files/workflows.json "$BACKUP_DIR/"

# Export credentials (encrypted):
docker exec -u node n8n n8n export:credentials --all \
  --output=/files/credentials.json
cp ./local-files/credentials.json "$BACKUP_DIR/"

# Dump PostgreSQL database:
docker exec n8n-postgres pg_dump \
  -U n8n -d n8n > "$BACKUP_DIR/n8n-db.sql"

# Back up the .env file (contains encryption key!):
cp .env "$BACKUP_DIR/.env.backup"

echo "Backup complete: $BACKUP_DIR"

# Keep only last 14 days of backups:
find ~/n8n-backups -maxdepth 1 -type d -mtime +14 -exec rm -rf {} +

Import (restore) commands

# Docker Compose: import workflows:
docker exec -u node n8n n8n import:workflow --input=/files/workflows.json

# Docker Compose: import credentials:
docker exec -u node n8n n8n import:credentials --input=/files/credentials.json

# npm: import workflows:
n8n import:workflow --input=~/n8n-backup/workflows-backup.json

# npm: import credentials:
n8n import:credentials --input=~/n8n-backup/credentials-backup.json

Updating n8n

n8n releases a new minor version almost every week. The stable tag always points to the latest production release. Update regularly to get security fixes and new features.

cd ~/n8n

# Pull latest image:
docker compose pull n8n

# Restart with new image:
docker compose up -d n8n

# Check the new version:
docker exec n8n n8n --version

# Stop n8n:
pm2 stop n8n   # or: sudo systemctl stop n8n

# Update:
npm update -g n8n

# Verify new version:
n8n --version

# Start n8n:
pm2 start n8n   # or: sudo systemctl start n8n

Troubleshooting

Frequently Asked Questions