Self-hosting n8n: production Docker setup with backups and monitoring

volumes:
  db_storage:
  n8n_storage:
  caddy_data:
  caddy_config:

networks:
  frontend:
  backend:

services:
  caddy:
    image: caddy:2.9
    restart: always
    ports:
      - "80:80"
      - "443:443"
    environment:
      N8N_HOST: ${N8N_HOST}
      N8N_PORT: ${N8N_PORT}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - frontend
    depends_on:
      n8n:
        condition: service_started

  postgres:
    image: postgres:18.4-bookworm
    restart: always
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_NON_ROOT_USER: ${POSTGRES_NON_ROOT_USER}
      POSTGRES_NON_ROOT_PASSWORD: ${POSTGRES_NON_ROOT_PASSWORD}
    volumes:
      - db_storage:/var/lib/postgresql
      - ./init-data.sh:/docker-entrypoint-initdb.d/init-data.sh
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h localhost -U ${POSTGRES_NON_ROOT_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 30s
    networks:
      - backend
    deploy:
      resources:
        limits:
          memory: 1g
        reservations:
          memory: 256m

  n8n:
    image: docker.n8n.io/n8nio/n8n:${N8N_VERSION}
    restart: always
    stop_grace_period: 120s
    environment:
      NODE_OPTIONS: --max-old-space-size=1536
      DB_TYPE: ${DB_TYPE}
      DB_POSTGRESDB_HOST: ${DB_POSTGRESDB_HOST}
      DB_POSTGRESDB_PORT: ${DB_POSTGRESDB_PORT}
      DB_POSTGRESDB_DATABASE: ${POSTGRES_DB}
      DB_POSTGRESDB_USER: ${POSTGRES_NON_ROOT_USER}
      DB_POSTGRESDB_PASSWORD: ${POSTGRES_NON_ROOT_PASSWORD}
      N8N_HOST: ${N8N_HOST}
      N8N_PORT: ${N8N_PORT}
      N8N_PROTOCOL: ${N8N_PROTOCOL}
      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
      WEBHOOK_URL: ${N8N_PROTOCOL}://${N8N_HOST}/
      N8N_RUNNERS_ENABLED: ${N8N_RUNNERS_ENABLED}
      N8N_RUNNERS_MODE: ${N8N_RUNNERS_MODE}
      N8N_RUNNERS_AUTH_TOKEN: ${N8N_RUNNERS_AUTH_TOKEN}
      N8N_RUNNERS_BROKER_LISTEN_ADDRESS: ${N8N_RUNNERS_BROKER_LISTEN_ADDRESS}
      N8N_PROXY_HOPS: ${N8N_PROXY_HOPS}
      GENERIC_TIMEZONE: ${GENERIC_TIMEZONE}
      TZ: ${GENERIC_TIMEZONE}
      N8N_LOG_LEVEL: ${N8N_LOG_LEVEL}
      EXECUTIONS_DATA_PRUNE: ${EXECUTIONS_DATA_PRUNE}
      EXECUTIONS_DATA_MAX_AGE: ${EXECUTIONS_DATA_MAX_AGE}
      EXECUTIONS_DATA_PRUNE_MAX_COUNT: ${EXECUTIONS_DATA_PRUNE_MAX_COUNT}
      N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: ${N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS}
      N8N_DIAGNOSTICS_ENABLED: ${N8N_DIAGNOSTICS_ENABLED}
    volumes:
      - n8n_storage:/home/node/.n8n
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:5678/healthz || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 60s
    networks:
      - frontend
      - backend
    depends_on:
      postgres:
        condition: service_healthy
    deploy:
      resources:
        limits:
          memory: 2g
        reservations:
          memory: 512m

  n8n-runner:
    image: docker.n8n.io/n8nio/runners:${N8N_VERSION}
    restart: always
    environment:
      NODE_OPTIONS: --max-old-space-size=768
      N8N_RUNNERS_AUTH_TOKEN: ${N8N_RUNNERS_AUTH_TOKEN}
      N8N_RUNNERS_TASK_BROKER_URI: ${N8N_RUNNERS_TASK_BROKER_URI}
    networks:
      - backend
    depends_on:
      n8n:
        condition: service_healthy
    deploy:
      resources:
        limits:
          memory: 1g
        reservations:
          memory: 256m

{$N8N_HOST} {
    reverse_proxy n8n:{$N8N_PORT}

    encode gzip zstd

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
        Referrer-Policy "strict-origin-when-cross-origin"
    }
}

#!/bin/bash
set -e

if [ -n "${POSTGRES_NON_ROOT_USER:-}" ] && [ -n "${POSTGRES_NON_ROOT_PASSWORD:-}" ]; then
  psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
    CREATE USER ${POSTGRES_NON_ROOT_USER} WITH PASSWORD '${POSTGRES_NON_ROOT_PASSWORD}';
    GRANT CONNECT ON DATABASE ${POSTGRES_DB} TO ${POSTGRES_NON_ROOT_USER};
    GRANT CREATE ON SCHEMA public TO ${POSTGRES_NON_ROOT_USER};
    GRANT USAGE ON SCHEMA public TO ${POSTGRES_NON_ROOT_USER};
EOSQL
fi

[backup]
type = google cloud storage
service_account_file = /opt/n8n/sa-backup.json
bucket_policy_only = true

[backup]
type = s3
provider = AWS
access_key_id = <your-key>
secret_access_key = <your-secret>
region = eu-central-1

#!/bin/bash
set -euo pipefail

cd /opt/n8n
set -a; source .env; set +a

BACKUP_DIR="/opt/n8n/backups"
REMOTE="backup:${BACKUP_BUCKET}"
RETENTION_DAYS=14
DATE=$(date +%Y-%m-%d_%H%M)

mkdir -p "$BACKUP_DIR"

alert_failure() {
  curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
    -d "chat_id=${TELEGRAM_CHAT_ID}" \
    -d "text=n8n backup FAILED: $1 at $DATE"
}

# Database dump (consistent - pg_dump uses MVCC snapshot, no stop needed)
if ! docker compose exec -T postgres \
  pg_dump -U "$POSTGRES_NON_ROOT_USER" -d "$POSTGRES_DB" --clean --if-exists | \
  gzip > "$BACKUP_DIR/n8n_db_$DATE.sql.gz"; then
  alert_failure "pg_dump"
  exit 1
fi

# n8n data directory - stop briefly for consistent snapshot
# trap ensures n8n restarts even if script is killed (Ctrl+C, SIGTERM, error)
trap 'docker compose start n8n 2>/dev/null || true' ERR INT TERM
docker compose stop n8n
docker compose cp n8n:/home/node/.n8n/. - | \
  gzip > "$BACKUP_DIR/n8n_files_$DATE.tar.gz"
docker compose start n8n
trap - ERR INT TERM

# Upload to remote bucket
if ! rclone copy "$BACKUP_DIR" "$REMOTE" --config /opt/n8n/rclone.conf; then
  alert_failure "rclone upload"
  exit 1
fi

# Remote retention - delete old backups from bucket
if ! rclone delete "$REMOTE" --config /opt/n8n/rclone.conf --min-age ${RETENTION_DAYS}d; then
  alert_failure "rclone retention cleanup"
fi

# Local cleanup - keep 3 days for quick restore
find "$BACKUP_DIR" -name "*.gz" -mtime +3 -delete

#!/bin/bash

cd /opt/n8n
set -a; source .env; set +a

ALERT_MARKER="/tmp/n8n_alert_sent"

send_alert() {
  if [ -f "$ALERT_MARKER" ] && [ $(($(date +%s) - $(stat -c %Y "$ALERT_MARKER"))) -lt 3600 ]; then
    return
  fi
  curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
    -d "chat_id=${TELEGRAM_CHAT_ID}" \
    -d "text=$1"
  touch "$ALERT_MARKER"
}

# Disk check on Docker data directory
DISK_USAGE=$(df /var/lib/docker | tail -1 | awk '{print $5}' | tr -d '%')

# Memory check using MemAvailable (kernel's actual estimate of free memory)
MEM_AVAILABLE_KB=$(grep MemAvailable /proc/meminfo | awk '{print $2}')
MEM_TOTAL_KB=$(grep MemTotal /proc/meminfo | awk '{print $2}')
MEM_USED_PCT=$(( (MEM_TOTAL_KB - MEM_AVAILABLE_KB) * 100 / MEM_TOTAL_KB ))

if [ "$DISK_USAGE" -gt 85 ] || [ "$MEM_USED_PCT" -gt 90 ]; then
  send_alert "n8n server: disk=${DISK_USAGE}% mem=${MEM_USED_PCT}%"
fi

# Check main n8n container specifically
if [ -z "$(docker compose ps -q n8n --status running)" ]; then
  docker compose up -d n8n
  send_alert "n8n main container was down, restarted"
fi

# Clear alert marker when conditions normalize
if [ "$DISK_USAGE" -lt 80 ] && [ "$MEM_USED_PCT" -lt 85 ]; then
  rm -f "$ALERT_MARKER"
fi

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

services:
  n8n:
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"