Deployment guide
Self-host n8n so it survives a restart.
n8n is trivial to start with docker run and awkward to keep. The difference is where its data lives: a real database, and a volume that outlives the container.
The default n8n container keeps its workflows in SQLite inside the container filesystem. That works until the container is replaced — which is what a deployment is — and then the workflows are gone. It is the single most common way a self-hosted n8n loses everything.
The fix is not complicated: point n8n at a managed PostgreSQL database, put the files it still writes on a persistent volume, and set an encryption key that does not change between deploys.
- What it needs
- A container, a PostgreSQL database, a persistent volume, and a fixed encryption key
- Port
- 5678
- Database
- Managed PostgreSQL, with DB_TYPE set to postgresdb
- The critical variable
- N8N_ENCRYPTION_KEY. If it changes, every stored credential becomes unreadable.
- Typical cost
- $15 to $25 a month of metered infrastructure for the container plus a small database
How it goes
- Create the database firstProvision managed PostgreSQL. The credentials are generated and injected, so the service finds them without you copying anything by hand.
- Deploy the n8n imagePoint a new service at the official n8n image and set the container port to 5678.
- Set the database variablesDB_TYPE to postgresdb, plus the host, port, database, user and password of the instance you just created.
- Set the encryption key, onceN8N_ENCRYPTION_KEY to a long random string, stored as a secret. Write it down somewhere safe — changing it later makes every saved credential unreadable.
- Attach a persistent volumeMounted at /home/node/.n8n, for the files n8n still writes outside the database.
- Set the public URLWEBHOOK_URL to the domain you will use, so webhook nodes hand out an address that resolves from outside.
Why the encryption key is the dangerous one
n8n encrypts stored credentials with N8N_ENCRYPTION_KEY. If the variable is unset it generates one and writes it to disk — which means a fresh container generates a different one, and every credential saved under the old key becomes undecryptable.
Set it explicitly, store it as a secret, and treat losing it exactly the way you would treat losing a database password.
Other guides in this section
- Host a Discord BotHost a Discord bot that stays online: deployed from your repository, token stored as a secret, and nothing that sleeps.
- Deploy GhostSelf-host Ghost with managed MySQL, a persistent volume for uploaded images and a custom domain with TLS. What it costs a month.
Read next
- The managed PostgreSQL guideManaged PostgreSQL on Dockup: create a database, connect a service securely, inspect size and logs, back up data, restore safely, and add read-only users.
- Persistent volumes and snapshotsPersistent volumes and snapshots on Dockup: choose mount paths, inspect usage, take and schedule snapshots, restore safely, and protect durable data.
- Environment variables and secretsEnvironment variables and secrets on Dockup: set, import, mask, rotate, and redeploy configuration safely for services and autonomous agents.
Questions this page gets asked
What does self-hosting n8n cost per month?
Roughly $15 to $25 of metered infrastructure: an always-on container plus a small managed PostgreSQL instance. On the Pro plan the first $20 each month is included in the fee.
Do I need PostgreSQL, or is SQLite fine?
SQLite is fine for trying it and dangerous for keeping it. It lives in the container filesystem, so the next deployment replaces it and the workflows go with it. Use a managed database for anything you would be upset to lose.
Why did my credentials stop working after a redeploy?
Almost certainly N8N_ENCRYPTION_KEY. If it was not set explicitly, a new container generated a new one and the old credentials can no longer be decrypted. Set it as a secret and keep it stable.
Can n8n receive webhooks?
Yes. Set WEBHOOK_URL to your public domain so webhook nodes hand out an address that resolves from outside, and attach a custom domain with TLS.
Start on the free plan.
Ten dollars of infrastructure credit is already there, and no card is required.