Canonical page: https://koalavps.com/guides-self-host-n8n-on-a-vps/ Language: English. Source snapshot: 2026-10-21. Generated: 2026-10-21T13:31:28.274Z. [Home](https://koalavps.com/) / [Explore](https://koalavps.com/resources/) / The KoalaVPS field notes The KoalaVPS field notes # Workflows that survive the next restart. A self-hosted automation editor can connect powerful accounts. Treat its database and encryption key as critical infrastructure. [Find your VPS](https://koalavps.com/vps/) ## IN THIS DOCUMENT [Protect the editor](https://koalavps.com/guides-self-host-n8n-on-a-vps/#section-1)[Keep the credential key](https://koalavps.com/guides-self-host-n8n-on-a-vps/#section-2)[Scale the execution path deliberately](https://koalavps.com/guides-self-host-n8n-on-a-vps/#section-3)[Retain only useful execution data](https://koalavps.com/guides-self-host-n8n-on-a-vps/#section-4)[Treat the encryption key as part of the database](https://koalavps.com/guides-self-host-n8n-on-a-vps/#section-5)[Give webhooks their public address](https://koalavps.com/guides-self-host-n8n-on-a-vps/#section-6)[Define the workload and the permitted integrations](https://koalavps.com/guides-self-host-n8n-on-a-vps/#section-7)[Set the public webhook origin for the installed release](https://koalavps.com/guides-self-host-n8n-on-a-vps/#section-8)[Test a harmless workflow before granting write access](https://koalavps.com/guides-self-host-n8n-on-a-vps/#section-9)[Scale only after observing the execution bottleneck](https://koalavps.com/guides-self-host-n8n-on-a-vps/#section-10)[Knowledge base](https://koalavps.com/resources/) ## Protect the editor Place the editor behind HTTPS and supported authentication. Restrict administrative access and avoid public registration when unnecessary. Webhook routes need their own exposure and authentication decisions. ## Keep the credential key Back up the configured encryption key with appropriate protection. Restoring a database without the correct key may leave saved credentials unusable. Keep the key out of screenshots, repositories and unfiltered logs. ## Scale the execution path deliberately For a busy setup, review the supported database, queue and worker model. Redis and separate workers add their own access and persistence requirements. Limit concurrent jobs so a surge cannot exhaust the VPS or an external API budget. ## Retain only useful execution data Workflows can handle tokens, personal records and documents. Set execution-history pruning, redact sensitive values and define retries carefully. A duplicated webhook must not cause an unintended second payment or message. ## Treat the encryption key as part of the database Saved credentials depend on n8n’s encryption key. Preserve the state directory that contains an automatically generated key or set N8N_ENCRYPTION_KEY from a private secret store. All queue workers need the same key as the main process. Test restoration with a disposable credential; a restored database alone may look healthy while its credentials remain unreadable. - Keep the key outside the public directory and repository - Back up the database consistently - Use supported PostgreSQL for the intended production deployment Official documentation: [n8n encryption-key configuration](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/configuration-examples/set-a-custom-encryption-key.md) ## Give webhooks their public address A reverse proxy such as Caddy can terminate HTTPS while n8n listens internally. Current documentation uses N8N_WEBHOOK_URL for the external webhook origin and replaces the older WEBHOOK_URL name from version 2.35.0. Set the trusted proxy-hop count to the real path; a single proxy uses N8N_PROXY_HOPS=1. Preserve forwarded host, protocol and client information. Test a webhook from outside the server and verify its production URL. - Set the workflow timezone deliberately - Prune execution history that contains sensitive inputs - Use queue workers and Redis only with the required private access controls ``` # Example: one HTTPS reverse proxy N8N_WEBHOOK_URL=https://automations.example.com/ N8N_PROXY_HOPS=1 ``` Official documentation: [n8n behind a reverse proxy](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/configuration-examples/configure-webhook-urls-with-reverse-proxy.md) ## Define the workload and the permitted integrations List the triggers, external accounts, expected execution volume and the maximum spend or side effect each workflow can create. Check the n8n licence for the actual use, especially if offering it as a service to others. A small scheduled workflow and a public webhook processor have different resource needs. Start with a supported release, private persistent state, a TLS name and a database appropriate to the deployment; avoid exposing database ports with the editor. - Use separate restricted credentials for each integration. - Set the intended workflow timezone and execution-history retention. - Keep exported workflows free of embedded real secrets. Official documentation: [n8n Docker deployment](https://docs.n8n.io/hosting/installation/docker/) ## Set the public webhook origin for the installed release A reverse proxy such as Caddy reaches n8n internally while external services call its HTTPS webhook origin. Use the webhook URL variable documented for the installed release; current documentation names N8N_WEBHOOK_URL, while older releases used WEBHOOK_URL. Set the real proxy-hop count rather than trusting arbitrary forwarded headers. Keep the editor access policy separate from webhook authentication, and verify that the production callback does not contain an internal host or port. ``` # Example values for a supported current release, behind one proxy: N8N_WEBHOOK_URL=https://automations.example.com/ N8N_PROXY_HOPS=1 ``` Official documentation: [n8n webhook reverse-proxy settings](https://docs.n8n.io/hosting/configuration/configuration-examples/webhook-url/) ## Test a harmless workflow before granting write access Begin with a read-only request or a disposable test record. Test the production webhook from outside the VPS, authentication rejection and a deliberate retry. A repeated request must not accidentally create a second consequential action. Check execution logs for leaked inputs, then apply a retention policy. If a webhook works only in the editor’s test mode, inspect whether the workflow is published/active and whether the production and test routes reach the correct process. - Use a disposable integration credential to test a restore. - Keep an independent encrypted copy of N8N_ENCRYPTION_KEY or the generated key state. - Do not send sample passwords or API tokens into retained debugging output. Official documentation: [n8n encryption key](https://docs.n8n.io/hosting/configuration/configuration-examples/encryption-key/) ## Scale only after observing the execution bottleneck Queue mode adds Redis, workers and a shared database; the main process receives triggers while workers perform executions. Every worker must use the same credential encryption key. Follow current binary-data storage requirements before moving a workflow with files into queue mode. Limit concurrency and upstream API budgets, and monitor queue age and failures. Back up database, state and key together; restarting a container is not a recovery plan for unreadable saved credentials. Official documentation: [n8n queue mode](https://docs.n8n.io/hosting/scaling/queue-mode/) · [Execution pruning settings](https://docs.n8n.io/hosting/configuration/environment-variables/executions/) KEEP EXPLORING ## Continue reading. [Guides ### Automation with a clear stop button. A good automation system has a narrow job, visible state and a predictable response to uncertainty.…](https://koalavps.com/automation-safety/)[Products ### A dependable habitat for your agents. Run schedulers, browser workers, queues and automation processes on infrastructure you control. Keep every agent inside a clear pe…](https://koalavps.com/agentic-vps/)[Guides ### A backup matters when it restores. Design a backup around the data you cannot recreate and the time your service can afford to lose. A successful upload is only the …](https://koalavps.com/backups/) CONFIGURE YOUR INFRASTRUCTURE ## Take control. Deploy on your terms. No identity paperwork. Full administrator access. Crypto-native billing. [Select a configuration](https://koalavps.com/vps/)