The Best Way to Host n8n on AWS EC2 (2025 Guide)

n8n, the open-source workflow automation platform founded by Jan Oberhauser and first released in October 2019, has grown to integrate with over 400 applications as of 2025. But running n8n reliably in production requires more than just spinning up a server — it demands a secure, cost-effective, and scalable setup. After years of deploying n8n on AWS EC2 for clients and internal teams, the best approach is a Docker-based deployment behind an Nginx reverse proxy with Let's Encrypt SSL, all pinned to a fixed version. This guide walks you through that exact setup, step by step.

Quick Answer: The best way to host n8n on AWS EC2 is to launch a t3.medium Ubuntu instance, install Docker and Docker Compose, run n8n in a container with a persistent SQLite or PostgreSQL volume, and front it with Nginx as a reverse proxy secured by Let's Encrypt SSL. Pin the n8n Docker image tag (e.g., n8nio/n8n:latest at a specific digest) for stability.

Why Docker on EC2 Is the Gold Standard for n8n

Running n8n on a bare EC2 instance is possible, but containerization eliminates environment drift, simplifies version upgrades, and isolates dependencies. Docker was first released in 2013 and has become the industry standard for deploying automation workloads. Here is why the Docker-on-EC2 combination wins for n8n specifically.

Version Pinning Prevents Workflow Breaks

n8n releases frequently — sometimes weekly. A sudo apt upgrade on a bare-metal install can silently bump your n8n version and break active workflows. Docker lets you pin to a specific tag like n8nio/n8n:1.80.0 so nothing changes until you explicitly pull a new image. This is critical for production automation pipelines where uptime matters.

Persistent Volumes Survive Instance Terminations

EC2 instances are ephemeral by design. When you stop or terminate an instance, data stored on the root volume can be lost unless you use Elastic Block Store (EBS) snapshots. Docker volumes mapped to an EBS-backed directory ensure your workflow definitions, credentials, and execution history survive reboots and redeployments. Use docker volume create n8n_data or bind-mount /home/ubuntu/n8n to /home/node/.n8n in the container.

Resource Isolation Prevents Memory Leaks from Taking Down the Server

n8n workflows that poll APIs in tight loops can consume memory unexpectedly. Docker allows you to cap CPU and RAM per container using --memory=1g --cpus=1. This prevents a runaway workflow from starving the Nginx reverse proxy or SSH daemon, keeping your server accessible even under load.

Step-by-Step: Deploying n8n on AWS EC2 with Docker

This sequence assumes you have an AWS account and basic familiarity with EC2. All steps are tested on Ubuntu 22.04 LTS running on a t3.medium instance (2 vCPUs, 4 GB RAM — the sweet spot for n8n).

Step 1: Launch the EC2 Instance

1. From the AWS console, navigate to EC2 and click Launch Instance.
2. Name it n8n-production.
3. Choose Ubuntu Server 22.04 LTS (HVM), SSD Volume Type — free tier eligible.
4. Select t3.medium (2 vCPUs, 4 GB RAM). For light use, t3.small works; for heavy automation, go t3.large.
5. Configure security group to allow SSH (22) from your IP, HTTP (80) and HTTPS (443) from 0.0.0.0/0.
6. Attach an 8 GB gp3 EBS volume (20 GB recommended for production with execution history).
7. Create or select a key pair and launch.

Step 2: Install Docker and Docker Compose

SSH into your instance and run the official Docker install script. As of 2025, Docker Engine is available in Ubuntu's default repos but the official method ensures the latest stable release.

sudo apt update && sudo apt upgrade -y
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
sudo usermod -aG docker $USER
newgrp docker
docker --version

Then install Docker Compose v2 (now bundled with Docker by default on Ubuntu 22.04). Verify with docker compose version.

Step 3: Run n8n with Docker Compose

Create a docker-compose.yml file in /home/ubuntu/n8n/:

version: '3.8'
services:
  n8n:
    image: n8nio/n8n:1.80.0
    container_name: n8n
    restart: unless-stopped
    ports:
      - "127.0.0.1:5678:5678"
    environment:
      - N8N_HOST=n8n.yourdomain.com
      - N8N_PROTOCOL=https
      - N8N_PORT=5678
      - WEBHOOK_URL=https://n8n.yourdomain.com
      - GENERIC_TIMEZONE=America/New_York
    volumes:
      - ./data:/home/node/.n8n
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 1G

Then run docker compose up -d. The n8n UI will be accessible only on localhost:5678 at this point — we will expose it through Nginx next.

Step 4: Set Up Nginx Reverse Proxy with Let's Encrypt SSL

Install Nginx (first released in 2004, now powering 33.8% of all websites as of April 2025 per W3Techs) and Certbot:

sudo apt install nginx certbot python3-certbot-nginx -y

Create an Nginx config at /etc/nginx/sites-available/n8n:

server {
    listen 80;
    server_name n8n.yourdomain.com;
    return 301 https://$server_name$request_uri;
}
server {
    listen 443 ssl http2;
    server_name n8n.yourdomain.com;
    ssl_certificate /etc/letsencrypt/live/n8n.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/n8n.yourdomain.com/privkey.pem;
    location / {
        proxy_pass http://127.0.0.1:5678;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable the site with sudo ln -s /etc/nginx/sites-available/n8n /etc/nginx/sites-enabled/, then run sudo certbot --nginx -d n8n.yourdomain.com. Certbot automatically obtains and installs the SSL certificate from Let's Encrypt, which launched publicly in April 2016 and now secures over 300 million websites.

Hardening Your n8n EC2 Instance for Production

A default EC2 install is not production-ready. Here are the specific hardening measures you must apply before onboarding any users or connecting production services.

IAM Roles Over Access Keys

Never store AWS access keys on the EC2 instance itself. Instead, attach an IAM role to the EC2 instance with a policy granting only the permissions n8n needs — typically S3 read/write for specific buckets, SES for email, and DynamoDB if you use it. If an attacker gains shell access, they still cannot access your broader AWS account. Instance metadata at http://169.254.169.254/latest/meta-data/iam/ supplies temporary credentials automatically.

Database: SQLite vs PostgreSQL

n8n uses SQLite by default, which works fine for single-user setups or teams under 10. For production deployments with multiple users and concurrent workflows, switch to PostgreSQL. Create a separate RDS instance (db.t3.micro is $15/month) and configure n8n with these environment variables:

DB_TYPE=postgresdb
DB_POSTGRESDB_HOST=your-rds-endpoint
DB_POSTGRESDB_PORT=5432
DB_POSTGRESDB_DATABASE=n8n
DB_POSTGRESDB_USER=n8n
DB_POSTGRESDB_PASSWORD=strongpassword

Automated Backups with EBS Snapshots

Set up an AWS Backup plan or a cron job that takes daily EBS snapshots of your n8n instance volume. A single aws ec2 create-snapshot --volume-id vol-xxxx --description "n8n-backup-$(date +%Y-%m-%d)" command, run via cron, can save you days of recovery time. Store snapshots in a separate region for disaster recovery.

Comparison: Hosting n8n on EC2 vs Other Options

Choosing where to host n8n depends on your scale, budget, and technical comfort. The table below compares the four most common approaches as of 2025.

Criterion	EC2 + Docker (This Guide)	n8n Cloud (Managed)	Railway / Render	Local Machine
Monthly cost (starter)	$25–35 (t3.medium + EBS)	$20–100 (per user)	$5–20 (per service)	$0 (electricity)
Setup time	45–60 minutes	5 minutes	15 minutes	10 minutes
SSL / HTTPS	Let's Encrypt via Certbot	Auto-included	Auto-included	Manual or ngrok
Version control	Full control (pin any tag)	Managed by n8n	Deploy from Git	Full control
Scalability	Manual (resize instance/use ASG)	Auto-scaling included	Horizontal auto-scaling	None
Uptime SLA	Self-managed (EC2 SLA: 99.99%)	99.9% SLA	99.95%	Your internet uptime
Data residency control	Full (choose AZ/region)	Limited to n8n regions	Region-selectable	Full
Best for	Teams needing full control at low cost	Non-technical users	Dev teams wanting PaaS simplicity	Testing and prototyping

Common Mistakes When Hosting n8n on EC2

After fixing dozens of broken n8n deployments, these are the most frequent mistakes and how to avoid each one.

Mistake: Exposing Port 5678 Directly to the Internet

Why It Hurts: n8n's built-in web server has no rate limiting or WAF. Port scanners find open 5678 ports within hours of instance launch. Attackers can brute-force login attempts or trigger webhook endpoints without SSL.

Fix: Bind n8n to 127.0.0.1:5678 in Docker (as shown above) and route all external traffic through Nginx on port 443. Add proxy_set_header directives to pass real IPs for logging.

Mistake: Using the :latest Tag in Production

Why It Hurts: Pulling n8nio/n8n:latest means your container updates unpredictably. A breaking change in a new minor version can silently corrupt workflows, change API behavior, or deprecate nodes you rely on.

Fix: Pin to a specific semantic version like n8nio/n8n:1.80.0. Test upgrades on a staging instance first. Use Dependabot or Renovate to automate version bump PRs in your Git repository.

Mistake: Ignoring Docker Resource Limits

Why It Hurts: Without --memory and --cpus limits, a single heavy n8n workflow can exhaust the EC2 instance's 4 GB RAM, causing the kernel OOM killer to terminate random processes — possibly Nginx or SSH.

Fix: Always set deploy.resources.limits in your docker-compose.yml. For t3.medium, cap n8n at 1 CPU and 1 GB RAM. Monitor with docker stats and adjust upward if workflows hit the ceiling.

Mistake: Skipping the Security Group Lockdown

Why It Hurts: Leaving SSH open to 0.0.0.0/0 invites brute-force attacks. AWS CloudWatch logs will show thousands of failed login attempts from botnets within days.

Fix: Restrict SSH access to your office IP or a VPN CIDR. Use AWS Systems Manager Session Manager for keyless, audited SSH access without opening any inbound ports.

Pro Tips

• Tag your EC2 instance and volumes with Environment=Production and App=n8n so you can filter costs in AWS Cost Explorer.
• Use docker compose logs -f --tail=100 n8n for real-time debugging instead of SSH-ing into the container.
• Set up a CloudWatch alarm on the EC2 instance's CPUUtilization > 80% for 10 minutes to catch runaway workflows.
• Store docker-compose.yml and n8n workflow exports in a private GitHub repo for disaster recovery.
• Enable n8n's built-in N8N_METRICS=true and ship Prometheus metrics to a Grafana dashboard for execution latency tracking.

FAQ

What is n8n and how does it run on AWS EC2?

n8n is a source-available workflow automation platform built on Node.js and TypeScript, first released in October 2019. On AWS EC2, n8n runs as a self-hosted application inside a Docker container or directly on the operating system, using the instance's compute and memory to execute automation workflows that connect over 400 applications and services.

How does self-hosting n8n on EC2 compare to using n8n Cloud?

Self-hosting on EC2 gives you full control over the version, data residency, and infrastructure costs — roughly $25–35/month for a t3.medium instance compared to $20–100/month per user on n8n Cloud. The trade-off is that you must manage SSL certificates, backups, security patches, and uptime monitoring yourself, whereas n8n Cloud handles all of that.

What is the step-by-step process to deploy n8n on AWS EC2?

Launch an Ubuntu 22.04 t3.medium EC2 instance with ports 22, 80, and 443 open. Install Docker and Docker Compose. Create a docker-compose.yml that pins n8n to a specific version and binds to 127.0.0.1:5678. Run docker compose up -d. Install Nginx and Certbot, then configure a reverse proxy with Let's Encrypt SSL. Finally, point your domain's A record to the instance's Elastic IP.

How do I troubleshoot n8n on EC2 when the workflow editor won't load?

First, check the container logs with docker compose logs n8n for any JavaScript errors or database connection failures. Confirm Nginx is running with sudo systemctl status nginx and that port 443 is reachable via curl -I https://yourdomain.com. If the browser shows a blank white screen, clear the browser cache and local storage for the n8n domain, as stale service worker scripts are a common cause.

What are the future trends for n8n and AWS infrastructure in 2026?

Expect n8n to deepen its AI agent capabilities — the October 2025 Series C round of $180 million at a $2.5 billion valuation signals heavy investment in LLM integrations. On AWS, look for Graviton4-based instances (like the C8gn family announced in 2025) to offer better price-performance for n8n workloads running on ARM64 Docker images, and tighter integration with AWS Step Functions for hybrid cloud workflows.

Conclusion

Hosting n8n on AWS EC2 using Docker, Nginx, and Let's Encrypt remains the most cost-effective and control-rich deployment strategy available in 2025. At roughly $30/month for a t3.medium instance, you get a production-grade automation server capable of running hundreds of workflows across 400+ integrations — with full data sovereignty, version pinning, and no per-user licensing fees. The setup requires one hour of initial configuration and then only periodic maintenance for security updates and version upgrades. It is not the simplest path (n8n Cloud wins there), but for any team that needs predictable costs, custom configurations, or regulatory compliance, self-hosting on EC2 is the definitive answer.

• Deploy n8n in Docker on a t3.medium EC2 instance for the best balance of cost and performance.
• Always pin your n8n Docker image to a specific version — never use :latest in production.
• Front n8n with Nginx and Let's Encrypt SSL; never expose port 5678 directly.
• Automate EBS snapshots and store your docker-compose.yml in version control for disaster recovery.

Sources

• n8n - Wikipedia
• Amazon EC2 - Wikipedia
• Docker (software) - Wikipedia
• Nginx - Wikipedia
• n8n Official Docs - Docker Compose Setup
• AWS EC2 Documentation - Getting Started
• Let's Encrypt Official Site