Deploy to Hetzner

This hosting guide shows you how to self-host n8n on a Hetzner cloud server. It uses:

• Caddy (a reverse proxy) to allow access to the Server from the internet.

• Docker Compose to create and define the application components and how they work together.

Once n8n is up and running, an optional last section covers adding n8n Assistant.

Self-hosting knowledge prerequisites

Self-hosting n8n requires technical knowledge, including:

• Setting up and configuring servers and containers

• Managing application resources and scaling

• Securing servers and applications

• Configuring n8n

n8n recommends self-hosting for expert users. Mistakes can lead to data loss, security issues, and downtime. If you aren't experienced at managing servers, n8n recommends n8n Cloud.

Stable and Beta versions

n8n releases a new minor version most weeks. The stable version is for production use. beta is the most recent release. The beta version may be unstable. To report issues, use the forum.

Current stable: 2.43.7 Current beta: 2.44.3

Create a server

1. Log in to the Hetzner Cloud Console.

2. Select the project to host the server, or create a new project by selecting + NEW PROJECT.

3. Select + CREATE SERVER on the project tile you want to add it to.

You can change most of the settings to suit your needs, but as this guide uses Docker to run the application, under the Image section, select "Docker CE" from the APPS tab.

Type

When creating the server, Hetzner asks you to choose a plan. For most usage levels, the CPX11 type is enough. If you plan to add n8n Assistant, choose a plan with at least 4 GB RAM / 2 vCPU instead. CPX11 doesn't have enough headroom once the sandbox is added.

SSH keys

Hetzner lets you choose between SSH and password-based authentication. SSH is more secure. The rest of this guide assumes you are using SSH.

Log in to your server

The rest of this guide requires you to log in to the server using a terminal with SSH. Refer to Access with SSH/rsync/BorgBackup for more information. You can find the public IP in the listing of the servers in your project.

Install Docker Compose

The Hetzner Docker app image doesn't have Docker compose installed. Install it with the following commands:

apt update && apt -y upgrade
apt install docker-compose-plugin

Clone configuration repository

Docker Compose, n8n, and Caddy require a series of folders and configuration files. You can clone these from this repository into the root user folder of the server. The following steps will tell you which file to change and what changes to make.

Clone the repository with the following command:

git clone https://github.com/n8n-io/n8n-docker-caddy.git

And change directory to the root of the repository you cloned:

cd n8n-docker-caddy

Default folders and files

The host operating system (the server) copies the two folders you created to Docker containers to make them available to Docker. The two folders are:

• caddy_config: Holds the Caddy configuration files.

• local_files: A folder for files you upload or add using n8n.

Create Docker volume

To persist the Caddy cache between restarts and speed up start times, create a Docker volume that Docker reuses between restarts:

docker volume create caddy_data

Create a Docker volume for the n8n data:

sudo docker volume create n8n_data

Set up DNS

n8n typically operates on a subdomain. Create a DNS record with your provider for the subdomain and point it to the IP address of the server. The exact steps for this depend on your DNS provider, but typically you need to create a new "A" record for the n8n subdomain. DigitalOcean provide An Introduction to DNS Terminology, Components, and Concepts.

Open ports

n8n runs as a web application, so the server needs to allow incoming access to traffic on port 80 for non-secure traffic, and port 443 for secure traffic.

Open the following ports in the server's firewall by running the following two commands:

sudo ufw allow 80
sudo ufw allow 443

If you add n8n Assistant later, its sandbox services stay internal to the Compose network. You don't need to open any additional ports for them.

Configure n8n

n8n needs some environment variables set to pass to the application running in the Docker container. The example .env file contains placeholders you need to replace with values of your own.

Open the file with the following command:

nano .env

The file contains inline comments to help you know what to change.

Refer to Environment variables for n8n environment variables details.

The Docker Compose file

The Docker Compose file (docker-compose.yml) defines the services the application needs, in this case Caddy and n8n. There's no separate database service. n8n uses its built-in SQLite database by default.

• The Caddy service definition defines the ports it uses and the local volumes to copy to the containers.

• The n8n service definition defines the ports it uses, the environment variables n8n needs to run (some defined in the .env file), and the volumes it needs to copy to the containers.

The Docker Compose file uses the environment variables set in the .env file, so you shouldn't need to change it's content, but to take a look, run the following command:

nano docker-compose.yml

Configure Caddy

Caddy needs to know which domains it should serve, and which port to expose to the outside world. Edit the Caddyfile file in the caddy_config folder.

nano caddy_config/Caddyfile

Change the placeholder subdomain to yours. If you followed the steps to name the subdomain n8n, your full domain is similar to n8n.example.com. The n8n in the reverse_proxy setting tells Caddy to use the service definition defined in the docker-compose.yml file:

n8n.<domain>.<suffix> {
    reverse_proxy n8n:5678 {
      flush_interval -1
    }
}

Start Docker Compose

Start n8n and Caddy with the following command:

docker compose up -d

This may take a few minutes.

Test your setup

In your browser, open the URL formed of the subdomain and domain name defined earlier. Enter the user name and password defined earlier, and you should be able to access n8n.

Stop n8n and Caddy

You can stop n8n and Caddy with the following command:

sudo docker compose stop

Optional: Add n8n Assistant

n8n Assistant needs a sandbox to run code in. You can add the same sandbox stack used in the Docker Compose guide to this setup. A few things are worth knowing before you start:

• This sandbox is suitable for local development and testing. The stack below uses n8n's own bundled sandbox (n8n-sandbox). Since a DigitalOcean droplet with a public domain is often a real deployment, consider Daytona instead if this is going to production.

• Resize if needed. The sandbox runner uses Docker-in-Docker, which needs more headroom than n8n alone. Make sure you provision at least 4 GB RAM / 2 vCPU.

• No networking changes required. Caddy only ever proxies n8n itself; the sandbox services stay internal to the Compose network and don't need DNS, firewall, or Caddyfile changes.

1. Add the sandbox secrets to .env, alongside the variables already there:

   # Sandbox service secrets — pick your own values
   SANDBOX_API_KEYS=change-me-api-key
   SANDBOX_API_RUNNER_REGISTRATION_TOKEN=change-me-registration-token
   SANDBOX_API_RUNNER_API_KEY=change-me-runner-key
   
   # Web search: secret for the bundled SearXNG instance — pick your own value
   SEARXNG_SECRET=change-me-searxng-secret

2. Create a searxng-settings.yml file alongside your other config files (the stock SearXNG image only serves HTML; this turns on the JSON API n8n's web search needs):

   use_default_settings: true
   search:
     formats:
       - html
       - json

3. Open docker-compose.yml and add the sandbox and search services alongside the existing caddy and n8n services:

   volumes:
     sandbox-tls:
   
   services:
     sandbox-certs:
       image: ghcr.io/n8n-io/n8n-sandbox-service-api:latest
       user: '0:0'
       entrypoint: ['sh', '-c']
       command:
         - >
           bootstrap-mtls.sh --out-dir /tls --api-san sandbox-api
           --control-san-prefix sandbox-runner &&
           chown -R sandbox-api:sandbox-api /tls/api
       environment:
         NUM_RUNNERS: '1'
       volumes:
         - sandbox-tls:/tls
   
     sandbox-api:
       image: ghcr.io/n8n-io/n8n-sandbox-service-api:latest
       depends_on:
         sandbox-certs:
           condition: service_completed_successfully
       environment:
         SANDBOX_API_KEYS: ${SANDBOX_API_KEYS}
         SANDBOX_API_RUNNER_REGISTRATION_TOKEN: ${SANDBOX_API_RUNNER_REGISTRATION_TOKEN}
         SANDBOX_API_RUNNER_API_KEY: ${SANDBOX_API_RUNNER_API_KEY}
         SANDBOX_API_GRPC_TLS_CERT_FILE: /tls/api/grpc-server.crt
         SANDBOX_API_GRPC_TLS_KEY_FILE: /tls/api/grpc-server.key
         SANDBOX_API_GRPC_TLS_CLIENT_CA_FILE: /tls/api/ca.crt
         SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_CA_FILE: /tls/api/ca.crt
         SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_CERT_FILE: /tls/api/control-grpc-api-client.crt
         SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_KEY_FILE: /tls/api/control-grpc-api-client.key
         SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_SERVER_NAME: sandbox-runner-1
       volumes:
         - sandbox-tls:/tls:ro
       healthcheck:
         test: ["CMD", "wget", "-qO-", "http://localhost:8080/healthz"]
         interval: 5s
         timeout: 3s
         retries: 5
         start_period: 10s
       # Never publish 8080/9090 — Caddy never routes to this service, and it shouldn't.
   
     sandbox-runner-1:
       image: ghcr.io/n8n-io/n8n-sandbox-service-runner-dind:latest
       privileged: true
       depends_on:
         sandbox-api:
           condition: service_healthy
       environment:
         SANDBOX_RUNNER_API_KEYS: ${SANDBOX_API_RUNNER_API_KEY}
         SANDBOX_RUNNER_REGISTRATION_TOKEN: ${SANDBOX_API_RUNNER_REGISTRATION_TOKEN}
         SANDBOX_RUNNER_API_GRPC_ADDR: sandbox-api:9090
         SANDBOX_RUNNER_HTTP_BASE_URL: http://sandbox-runner-1:8080
         SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR: ':9091'
         SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR: sandbox-runner-1:9091
         SANDBOX_RUNNER_ID: runner-1
         SANDBOX_RUNNER_DOCKER_SANDBOX_IMAGE: ghcr.io/n8n-io/n8n-sandbox-service-sandbox:latest
         SANDBOX_RUNNER_REGISTRATION_GRPC_CA_FILE: /tls/runner/ca.crt
         SANDBOX_RUNNER_REGISTRATION_GRPC_CERT_FILE: /tls/runner/grpc-client.crt
         SANDBOX_RUNNER_REGISTRATION_GRPC_KEY_FILE: /tls/runner/grpc-client.key
         SANDBOX_RUNNER_REGISTRATION_GRPC_SERVER_NAME: sandbox-api
         SANDBOX_RUNNER_CONTROL_GRPC_TLS_CERT_FILE: /tls/runner/control-grpc-server.crt
         SANDBOX_RUNNER_CONTROL_GRPC_TLS_KEY_FILE: /tls/runner/control-grpc-server.key
         SANDBOX_RUNNER_CONTROL_GRPC_TLS_CLIENT_CA_FILE: /tls/runner/ca.crt
       volumes:
         - sandbox-tls:/tls:ro
       # Never expose this container's ports publicly — it runs privileged Docker-in-Docker.
   
     searxng:
       image: ghcr.io/searxng/searxng:latest
       environment:
         SEARXNG_SECRET: ${SEARXNG_SECRET}
       volumes:
         - ./searxng-settings.yml:/etc/searxng/settings.yml:ro
       # Internal-only: n8n reaches it by service name. Never publish its port, and don't route Caddy to it.

4. Add the matching sandbox variables to the existing n8n service's environment block:

   environment:
    # ...your existing N8N_HOST, N8N_PORT, etc. stay as they are
    - N8N_ENABLED_MODULES=instance-ai
    - N8N_INSTANCE_AI_SANDBOX_ENABLED=true
    - N8N_INSTANCE_AI_SANDBOX_PROVIDER=n8n-sandbox
    - N8N_SANDBOX_SERVICE_URL=http://sandbox-api:8080
    - N8N_SANDBOX_SERVICE_API_KEY=${SANDBOX_API_KEYS}
    - N8N_INSTANCE_AI_SEARXNG_URL=http://searxng:8080
   depends_on:
    sandbox-api:
      condition: service_healthy

5. Restart everything so the new services pick up the changes:

   sudo docker compose up -d

6. Add your model API key. See Set up n8n Assistant for the full reference, including how to pick a model provider. Web search works out of the box via the bundled SearXNG service above; add a Brave Search key instead if you'd rather use that.

Replace the change-me-... placeholders in .env with your own unique secrets before exposing this Droplet to the internet. sandbox-runner-1 runs privileged Docker-in-Docker. Never publish its ports, and don't route Caddy to it.

Updating

If you run n8n using a Docker Compose file, follow these steps to update n8n:

# Navigate to the directory containing your docker compose file <a href="#navigate-to-the-directory-containing-your-docker-compose-file" id="navigate-to-the-directory-containing-your-docker-compose-file"></a>
cd </path/to/your/compose/file/directory>

# Pull latest version <a href="#pull-latest-version" id="pull-latest-version"></a>
docker compose pull

# Stop and remove older version <a href="#stop-and-remove-older-version" id="stop-and-remove-older-version"></a>
docker compose down

# Start the container <a href="#start-the-container" id="start-the-container"></a>
docker compose up -d

Next steps

• Learn more about configuring and scaling n8n.

• Or explore using n8n: try the Quickstarts.

Related resources

• Use a cloud provider

• DigitalOcean

• Heroku

• AWS

• Azure

• Google Cloud Run

• Google Kubernetes Engine

• OpenShift Local (CRC)

• Use Docker Compose