Why Self-Host n8n on AWS EC2
n8n is a source-available workflow automation platform founded by Jan Oberhauser in Berlin and first released in October 2019. As of December 2025, n8n connects more than 350 applications and services through a visual node-based editor, making it a powerful alternative to hosted tools like Zapier and Make. But relying on a third-party cloud service for sensitive workflow data introduces compliance risk, unpredictable API rate limits, and per-execution billing that scales fast.
Hosting n8n on AWS EC2 gives you full control over your automation infrastructure. You own the data, you choose the security posture, and you pay a flat monthly server cost instead of per-task fees. A t2.micro EC2 instance (free tier eligible) runs n8n comfortably for small to medium workloads. This guide walks you through every step — from launching an EC2 instance to securing it with a free Let's Encrypt SSL certificate and running n8n behind Docker with automatic restarts.
Quick Answer: Launch a free-tier t2.micro EC2 instance with Ubuntu 22.04 LTS, SSH in, install Docker and Docker Compose, clone the official n8n Docker setup, configure a domain with Nginx reverse proxy, and secure it with Let's Encrypt SSL. Total time: 45–60 minutes. Cost: $0–$5/month depending on instance size.
Prerequisites and AWS Account Setup
Before launching anything, you need an AWS account and a registered domain name pointed to Amazon Route 53 or your DNS provider. AWS launched EC2 in limited beta on August 25, 2006, and brought it to full production on October 23, 2008. Since then, EC2 has become the backbone of millions of production workloads worldwide. For n8n, the instance type matters less than the memory — workflows cache data in RAM during execution.
Create an AWS Account and IAM User
- Go to aws.amazon.com and click Create an AWS Account. You need a credit card even for the free tier (for identity verification).
- Once logged in, navigate to IAM (Identity and Access Management) and create a new user with Programmatic Access. Attach the AmazonEC2FullAccess policy.
- Download the access key ID and secret access key — you will use these with the AWS CLI or directly in the console.
- Set up billing alerts so you never exceed the free tier limits accidentally. AWS charges by the second for active EC2 instances.
Choose Your EC2 Instance
Amazon EC2 instance types fall into general purpose (t2, t3, m5), compute optimized (c5, c6g), and memory optimized (r5, x1) families. For n8n, a t2.medium (2 vCPU, 4 GB RAM) is the sweet spot for 10–20 active workflows. Start with t2.micro (1 vCPU, 1 GB RAM) if you are experimenting — it qualifies for the AWS Free Tier (750 hours/month for 12 months).
- t2.micro — Free tier eligible, good for 1–5 simple workflows
- t2.medium — ~$0.0464/hour, handles 15–25 workflows with HTTP nodes
- t3a.medium — ~$0.0376/hour, AMD-based, slightly cheaper than t2
Real example: A solo developer running 8 workflows that poll Google Sheets, send Slack messages, and update Airtable bases uses a t2.micro and reports 40% memory usage at peak. No scaling needed.
Launch EC2 and Configure Security Groups
Security groups act as a virtual firewall for your EC2 instance. By default, all inbound traffic is blocked. You must open port 22 (SSH) for setup and port 80/443 (HTTP/HTTPS) for the n8n web interface.
Launch the Instance
- From the EC2 Dashboard, click Launch Instance. Name it n8n-server.
- Choose Ubuntu Server 22.04 LTS (HVM) as the Amazon Machine Image (AMI). Ubuntu 22.04 LTS is supported until April 2027 and has the best Docker package compatibility.
- Select t2.micro as instance type. Click Create new key pair, download the .pem file, and store it securely — you cannot recover a lost key.
- Under Network Settings, click Edit and create a new security group with these inbound rules:
- SSH — TCP port 22, source: My IP (your public IP only)
- HTTP — TCP port 80, source: 0.0.0.0/0
- HTTPS — TCP port 443, source: 0.0.0.0/0
- Click Launch Instance and wait 2–3 minutes for the status to show 2/2 checks passed.
Assign an Elastic IP
Every EC2 instance gets a public IP by default, but it changes every time you stop and start the instance. An Elastic IP (static public IPv4 address) prevents your domain DNS from breaking.
- In the EC2 Console, navigate to Elastic IPs under Network & Security.
- Click Allocate Elastic IP address, then Allocate.
- Select the new Elastic IP, click Actions → Associate Elastic IP address, choose your n8n instance, and confirm.
- Update your domain's A record to point to this Elastic IP. If using Route 53, create an A record with a 60-second TTL.
Note: Elastic IPs are free as long as they are attached to a running instance. Detached Elastic IPs cost ~$0.005/hour.
Install Docker, Nginx, and Deploy n8n
Containerization isolates n8n and its dependencies from the host OS. Docker containers share the host kernel but bundle their own libraries, making upgrades and rollbacks clean. The n8n official Docker image is published on Docker Hub and maintained by the n8n team.
SSH Into Your Server
Open your terminal and run:
ssh -i /path/to/your-key.pem ubuntu@your-elastic-ip
Replace the path and IP with your key file location and Elastic IP address. Accept the fingerprint prompt on first connection.
Install Docker and Docker Compose
- Update the system:
sudo apt update && sudo apt upgrade -y - Install prerequisites:
sudo apt install -y apt-transport-https ca-certificates curl software-properties-common - Add the Docker GPG key and repository, then install Docker Engine:
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin - Add your user to the docker group so you can run Docker without sudo:
sudo usermod -aG docker $USER - Log out and back in:
exitthen SSH again.
Deploy n8n with Docker Compose
- Create a directory:
mkdir ~/n8n && cd ~/n8n - Create a
docker-compose.ymlfile with the following content:
version: '3.8'
services:
n8n:
image: docker.n8n.io/n8nio/n8n
container_name: n8n
restart: unless-stopped
ports:
- "5678:5678"
environment:
- N8N_HOST=your-domain.com
- N8N_PORT=5678
- N8N_PROTOCOL=https
- WEBHOOK_URL=https://your-domain.com
- N8N_ENCRYPTION_KEY=your-random-32-char-key
- DB_TYPE=sqlite
volumes:
- n8n_data:/home/node/.n8n
volumes:
n8n_data:
- Run:
docker compose up -d— this pulls the latest n8n image and starts the container. - Verify with
docker ps. You should see n8n running and listening on port 5678.
Real example: The N8N_ENCRYPTION_KEY environment variable encrypts your credentials (database passwords, API tokens) at rest. Generate one with openssl rand -hex 20 — it creates a 40-character random string. Without this key, your saved credentials are stored as plaintext in SQLite.
Set Up Nginx Reverse Proxy and Let's Encrypt SSL
Let's Encrypt is a non-profit certificate authority run by the Internet Security Research Group (ISRG). It provides free X.509 TLS certificates valid for 90 days, with automated renewal. As of 2025, Let's Encrypt is used by more than 700 million websites.
- Install Nginx:
sudo apt install -y nginx - Create a new Nginx config file at
/etc/nginx/sites-available/n8n:
server {
listen 80;
server_name your-domain.com;
location / {
proxy_pass http://localhost:5678;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
- Enable the site:
sudo ln -s /etc/nginx/sites-available/n8n /etc/nginx/sites-enabled/thensudo nginx -t && sudo systemctl reload nginx - Install Certbot:
sudo apt install -y certbot python3-certbot-nginx - Run:
sudo certbot --nginx -d your-domain.comand follow the prompts. Certbot modifies your Nginx config automatically to serve HTTPS. - Test auto-renewal:
sudo certbot renew --dry-run
Your n8n instance is now live at https://your-domain.com. Create your first admin account on the login screen.
Comparison: n8n Hosting Options
Choosing where to run n8n depends on your budget, compliance needs, and technical comfort. Below is a direct comparison of the four most common deployment methods.
The table covers cost, control, maintenance, and scalability for each option so you can decide before committing time to setup.
| Hosting Method | Monthly Cost (est.) | Best For |
|---|---|---|
| AWS EC2 t2.micro (self-hosted) | $0 (free tier, 12 months) | Developers wanting full control and zero per-task fees |
| AWS EC2 t3a.medium (self-hosted) | $27–$30 | Teams running 20+ production workflows with SLA requirements |
| n8n Cloud (managed) | $20–$100+ depending on plan | Non-technical users needing one-click setup and support |
| Railway / Render (PaaS) | $5–$20 | Developers who want easy deployment without managing EC2 |
| DigitalOcean Droplet (self-hosted) | $12–$48 | Users who prefer a simpler cloud interface over AWS complexity |
Common Mistakes and How to Avoid Them
Mistake 1: Leaving Port 5678 Open to the Internet
Why It Hurts: n8n's default port 5678 has no authentication layer at the Docker level. Anyone who discovers your IP can access the setup wizard and hijack your instance.
Fix: Never expose port 5678 directly in your security group. Route all traffic through Nginx on port 443 (HTTPS). Your security group should only allow SSH (port 22) and HTTP/HTTPS (ports 80, 443).
Mistake 2: Skipping the Encryption Key
Why It Hurts: Without the N8N_ENCRYPTION_KEY environment variable, n8n stores database passwords, API keys, and OAuth tokens as plaintext in the SQLite database file. A compromised server leaks every credential.
Fix: Set the N8N_ENCRYPTION_KEY before the first run. Changing it later invalidates all stored credentials. Store a backup in a password manager or AWS Secrets Manager.
Mistake 3: Using the Default SQLite Database in Production
Why It Hurts: SQLite cannot handle concurrent writes. If two workflows execute at the same millisecond, the database locks and one workflow fails silently.
Fix: Switch to PostgreSQL by adding DB_TYPE=postgresdb and corresponding DB_POSTGRESDB_* variables to your docker-compose.yml. PostgreSQL handles concurrent workflow execution without locking.
Mistake 4: Not Setting Up Automatic Backups
Why It Hurts: A failed Docker volume, accidental docker compose down -v, or EC2 termination destroys all your workflows and credentials permanently.
Fix: Schedule a daily cron job that backs up the n8n_data Docker volume to S3. Use docker run --rm -v n8n_data:/data -v ~/backups:/backup alpine tar czf /backup/n8n-$(date +%F).tar.gz -C /data .
Pro Tips
- Pin your n8n Docker image to a specific version tag (e.g.,
docker.n8n.io/n8nio/n8n:1.51.0) instead of using:latestto prevent breaking changes from auto-updating mid-week. - Enable n8n logging to a file by mounting a second volume and setting
N8N_LOG_LEVEL=debug— essential for debugging webhook failures. - Use AWS CloudWatch or Netdata to monitor CPU and memory. Set an alarm if memory exceeds 80% for more than 5 minutes.
- Add your n8n instance to an Auto Scaling Group only if you plan to run 50+ concurrent workflows — otherwise, a single t3a.medium covers most needs.
- Set up a swap file (2 GB) on t2.micro instances to prevent out-of-memory kills during heavy workflow execution.
FAQ
What is n8n and how does it work?
n8n is a source-available workflow automation platform built on Node.js and TypeScript, first released in October 2019 by Berlin-based founder Jan Oberhauser. It provides a visual node-based editor where users connect applications, services, and AI models into automated sequences without writing glue code. Workflows execute inside a self-hosted server runtime instead of relying on external cloud APIs for execution logic.
How does self-hosting n8n on EC2 compare to using n8n Cloud?
Self-hosting on EC2 gives you full data ownership, unlimited workflow executions for a flat server cost, and the ability to isolate the instance inside a VPC with strict IAM policies. n8n Cloud charges per execution and per seat, which becomes expensive at scale. However, n8n Cloud requires zero server maintenance, automated backups, and built-in high availability — making it better for non-technical teams.
How do I migrate existing workflows from n8n Cloud to my EC2 instance?
Export each workflow from the n8n Cloud editor using the Download button in the workflow menu, which saves a JSON file. Import these JSON files via the Import button in your self-hosted n8n editor. Credentials (OAuth tokens, API keys) must be re-authenticated on the self-hosted instance since encryption keys differ between environments.
What should I do if my n8n server becomes unresponsive?
SSH into the instance and run docker logs n8n --tail 50 to check the last log entries. Common causes include SQLite database lock errors, out-of-memory kills (check with dmesg | grep -i kill), or an expired SSL certificate. Restart the container with docker compose restart and verify the Nginx service is running with sudo systemctl status nginx.
Will n8n adopt native Kubernetes or serverless deployment in the future?
n8n already supports Kubernetes deployment through Helm charts and has an official Docker image compatible with any orchestration layer. As of December 2025, the n8n team has announced improvements to horizontal scaling and queue-mode execution in the upcoming v2 release. Serverless deployment (AWS Lambda) is not currently supported natively due to the stateful nature of workflow execution.
Conclusion
Hosting n8n on AWS EC2 from scratch gives you the most cost-effective, control-rich deployment option for workflow automation at scale. The process — launch an Ubuntu EC2 instance, install Docker, configure Nginx as a reverse proxy, and secure with Let's Encrypt — takes under an hour and costs as little as $0 on the free tier. By following the security practices outlined here (closing port 5678, setting an encryption key, using PostgreSQL for production, and scheduling automated backups), you eliminate the most common failure points that bring down self-hosted automation servers. Whether you run five workflows or fifty, EC2 combined with Docker and a domain-backed SSL setup keeps n8n stable, secure, and fully under your control.
- Launch a t2.micro or t3a.medium EC2 instance with Ubuntu 22.04 LTS and a security group that only exposes ports 22, 80, and 443.
- Deploy n8n via Docker Compose with a persistent volume, encryption key, and the N8N_HOST variable set to your domain.
- Always use Let's Encrypt SSL through Certbot + Nginx — never expose n8n over plain HTTP or on its default port.
- Back up your n8n_data volume daily to S3 and pin your Docker image to a specific version to avoid unexpected breaking changes.
0 comments:
Post a Comment