Why Self-Host n8n on AWS EC2
n8n is an open-source workflow automation platform that lets you connect apps and automate tasks without writing endless code. As of 2025, n8n powers over 400 integrations and is used by more than 100,000 self-hosted instances globally. AWS EC2, launched by Amazon in 2006, remains the most widely adopted Infrastructure-as-a-Service platform for deploying open-source tools like n8n. The problem? Many developers overpay for managed n8n Cloud plans or struggle with fragile DIY setups that crash under load. This guide walks you through a production-grade, fully open-source n8n deployment on EC2 — using Docker, Traefik, PostgreSQL, and Let's Encrypt — so you get enterprise reliability at hobbyist cost.
Quick Answer: The best way to host n8n on AWS EC2 using open source tools is to deploy it with Docker Compose behind a Traefik reverse proxy, use a t3.medium or t3.large instance (2-4 vCPUs, 4-8 GB RAM), store workflow data in a PostgreSQL container or Amazon RDS, secure it with Let's Encrypt SSL certificates via Certbot, and back up your ~/.n8n folder daily to Amazon S3. Total monthly cost: $20–$35.
Step 1: Launch and Secure Your EC2 Instance
Your EC2 instance is the foundation. Picking the wrong size or security group causes either overspending or outages. Docker requires at least 2 GB of RAM for n8n to run smoothly with three to five active workflows. Choose the Amazon Linux 2023 AMI — it ships with updated kernel security patches and native EBS optimization.
Instance Type Selection
AWS offers over 500 instance types. For n8n with Docker and PostgreSQL, you need balanced compute and memory. The t3.medium (2 vCPUs, 4 GB RAM) handles up to 10 concurrent workflows. The t3.large (2 vCPUs, 8 GB RAM) supports 20-plus workflows with webhook endpoints. Both use burstable CPU credits — fine for most automation workloads that idle between triggers. Avoid the a1 (ARM) family unless you rebuild all Docker images for arm64. Example: a marketing agency running 8 daily email automation workflows on a t3.large reported zero downtime across six months.
Security Group Hardening
n8n needs three open ports: 22 (SSH from your IP only), 80 (HTTP redirected to HTTPS), and 443 (HTTPS with TLS). Set the SSH source to your static IP or a VPN CIDR block. Never leave port 5678 (n8n's default port) exposed to the internet — Traefik will handle proxying internally. Use AWS Security Groups, not instance-level iptables, for easier auditing. Attach an IAM role with the AmazonS3FullAccess policy so your backup scripts can write to S3 without storing access keys on disk.
Step 2: Install Docker and Docker Compose
Docker, first released as open source in 2013 by Solomon Hykes, virtualizes applications at the OS level using lightweight containers. This eliminates dependency conflicts between n8n, PostgreSQL, and your reverse proxy. Docker Compose declares the entire stack in a single docker-compose.yml file.
Installation Commands
- SSH into your EC2 instance:
ssh -i your-key.pem ec2-user@your-instance-ip - Update packages:
sudo yum update -y - Install Docker:
sudo yum install docker -y - Start and enable Docker:
sudo systemctl enable docker && sudo systemctl start docker - Add your user to the docker group:
sudo usermod -aG docker $USER - Log out and back in, then install Docker Compose plugin:
sudo yum install docker-compose-plugin -y
Verify with docker --version and docker compose version. After this, you can run containers without sudo — a major security and convenience improvement.
Step 3: Deploy n8n With PostgreSQL and Traefik
Running n8n with SQLite works for testing but fails under concurrent writes. PostgreSQL, an ACID-compliant open-source relational database first released in 1996, handles multiple workflow executions without corruption. Traefik, a cloud-native reverse proxy, auto-detects Docker containers and issues Let's Encrypt certificates automatically.
Docker Compose Configuration
Create a directory ~/n8n-docker and add a docker-compose.yml file with three services:
- n8n: Image
n8nio/n8n:latest, expose internal port 5678, mount~/.n8nfor persistent data, set environment variables for PostgreSQL connection, encryption key, and webhook URL. - postgres: Image
postgres:15-alpine, mount a Docker volume for database files, set POSTGRES_USER, POSTGRES_PASSWORD, and POSTGRES_DB. - traefik: Image
traefik:v3.0, mount the Docker socket for container discovery, expose ports 80 and 443, configure the ACME HTTP challenge using your actual domain email.
Set N8N_ENCRYPTION_KEY to a 32-character random string generated via openssl rand -hex 16. If you lose this key, your saved credentials become unrecoverable — back it up in AWS Secrets Manager.
First Launch
Run docker compose up -d. Within 60 seconds, n8n starts on your domain with a valid TLS certificate. Visit https://yourdomain.com — the login screen appears. Create your admin account immediately. Example: a solo developer launched their n8n instance at 10 AM and had a Slack-to-Google Sheets automation running by 11:30 AM using this exact stack.
Comparison: n8n Hosting Options
Choosing between self-hosting on EC2, n8n Cloud, or other platforms depends on your budget, control needs, and scale. The table below compares the five most common approaches across cost, performance, and maintenance dimensions.
| Hosting Method | Monthly Cost | Maintenance Effort | Scalability | Data Control |
|---|---|---|---|---|
| EC2 + Docker (this guide) | $20–$35 | Medium | High (manual scaling) | Full |
| n8n Cloud (official) | $20–$100+ | Low (managed) | Auto-scaling included | Limited |
| Railway / Render | $5–$25 | Low | Medium (container limits) | Medium |
| EC2 + SQLite (no Docker) | $15–$25 | High | Low (single file DB) | Full |
| Kubernetes (EKS) | $80–$200+ | Very High | Very High | Full |
For 90% of teams, the EC2 + Docker path hits the sweet spot between control and operational overhead. Kubernetes only makes sense if you already run a cluster for other services.
Common Mistakes When Hosting n8n on EC2
Mistake 1: Using the Root User
Why It Hurts: The EC2 root user has unlimited privileges. If your n8n instance gets compromised via an unpatched npm dependency, the attacker gains full shell access to your AWS account — including the ability to launch GPU instances for crypto mining. A Reddit user in r/n8n reported a $4,700 AWS bill after leaving port 5678 open with root SSH access.
Fix: Always create a secondary IAM user with EC2-specific permissions. Run n8n containers under the node user (UID 1000) by adding user: "1000:1000" in your Compose file. Disable root password login via /etc/ssh/sshd_config.
Mistake 2: Skipping Automated Backups
Why It Hurts: n8n stores workflow JSON, credentials (encrypted), and execution history in the ~/.n8n directory and the PostgreSQL database. Losing either means recreating every automation from scratch. A scheduler running 14 workflows that fails without backup requires weeks of manual reconfiguration.
Fix: Write a cron job that runs pg_dump against the PostgreSQL container, compresses the output, and uploads it to an S3 bucket with versioning enabled. Add a second cron entry that snapshots the ~/.n8n folder. Run both daily at 3 AM UTC. Test restoration quarterly.
Mistake 3: Exposing n8n Directly on Port 5678
Why It Hurts: n8n's webhook endpoints accept unauthenticated requests by design. If exposed publicly without a reverse proxy, anyone who discovers your IP can trigger workflows, potentially deleting database records or sending spam via your email node.
Fix: Route all external traffic through Traefik or Nginx. Set N8N_PROTOCOL=https and N8N_HOST=yourdomain.com so n8n generates correct webhook URLs. Restrict webhook execution to specific source IPs using Traefik middleware when possible.
Mistake 4: Under-Provisioning Storage
Why It Hurts: The default EBS root volume is 8 GB gp2. n8n logs, Docker images, PostgreSQL WAL files, and workflow execution data fill this in two to three months of active use. Once full, Docker containers crash and SSH becomes inoperable.
Fix: Launch with a 30 GB gp3 volume (baseline 3000 IOPS at no extra cost). Mount an additional 20 GB EBS volume at /var/lib/docker if you run multiple containers beyond n8n. Monitor disk usage with CloudWatch alarms at 80% capacity.
Pro Tips
- Use
N8N_PAYLOAD_SIZE_MAX=16to cap incoming webhook payloads at 16 MB — prevents memory exhaustion from oversized requests. - Add
restart: unless-stoppedto every service in docker-compose.yml so n8n auto-recovers after an EC2 reboot or Docker daemon restart. - Pin n8n to a specific version (e.g.,
n8nio/n8n:1.71.1) instead of using:latestto avoid breaking changes from automatic updates. - Set
N8N_METRICS=trueand ship Prometheus metrics to AWS CloudWatch for Grafana dashboards tracking execution latency and error rates. - Use
docker compose logs --tail=50 -f n8nto debug workflow failures in real time without SSH'ing into the container.
FAQ
What is n8n and how does it differ from Zapier or Make?
n8n is an open-source workflow automation tool released in 2019 under the Sustainable Use License. Unlike Zapier or Make, n8n runs on your own infrastructure so your data never touches third-party servers. It supports 400+ nodes including AI integrations like OpenAI and LangChain, with full access to the underlying Node.js code for custom logic.
Can I host n8n on a free AWS EC2 tier instance?
Yes, but with limitations. The AWS Free Tier includes a t2.micro (1 vCPU, 1 GB RAM) for 12 months. This instance runs n8n with SQLite for testing but fails under any concurrent workflow execution or webhook load. For production, upgrade to at least a t3.small (2 GB RAM) at roughly $15 per month.
How do I update n8n without losing my workflows?
Run docker compose pull n8n then docker compose up -d. Your workflows and credentials persist in the mounted volume and PostgreSQL database because they live outside the container. Always read the release notes on the n8n GitHub repository before updating — some versions introduce breaking changes to node parameters.
What should I do if n8n stops responding after a few days?
This is often caused by memory leaks from long-running workflows or insufficient Docker log rotation. Limit log file size by adding logging: driver: "json-file" options: max-size: "10m" max-file: "3" to each service in docker-compose.yml. If the issue persists, set N8N_EXECUTIONS_DATA_PRUNE=true and N8N_EXECUTIONS_DATA_MAX_AGE=168 to auto-delete execution records older than one week.
Will self-hosting n8n on EC2 remain viable as AI agents evolve?
Absolutely. The trend toward AI agents and LLM-powered automation actually increases n8n's value. The n8n LangChain node lets you build RAG pipelines, connect to OpenAI or Anthropic APIs, and trigger workflows from AI agent outputs — all on your own hardware. EC2 provides the GPU-optional compute these workloads require while keeping API keys and training data private.
Conclusion
Hosting n8n on AWS EC2 with Docker, Traefik, and PostgreSQL gives you the power of a commercial automation platform at a fraction of the cost — roughly $20 to $35 per month for a production-ready stack. The open-source ecosystem around n8n keeps improving: the community now exceeds 50,000 GitHub stars, and the project releases stable updates every two weeks. By following this guide's security practices (no root access, SSL-only, daily S3 backups) and avoiding the four common deployment mistakes, you gain full control over your automation infrastructure. Whether you're connecting Slack to a Google Sheet or building an AI agent pipeline with LangChain, this EC2-based setup scales with your needs without vendor lock-in.
- Choose a t3.large EC2 instance for balanced cost and performance with 5+ concurrent workflows.
- Always use Docker Compose with PostgreSQL and Traefik for reliability, auto-SSL, and easy restores.
- Backup both the .n8n directory and PostgreSQL database daily to an S3 bucket with versioning.
- Pin your n8n container version and limit log sizes to prevent silent crashes from disk or memory exhaustion.
0 comments:
Post a Comment