Knowledgebase

This guide explains how to install n8n using Docker on Debian 12/13 (Bookworm/Trixie), configure it as a systemd service, and secure it with Nginx and Let’s Encrypt SSL.

Prerequisites

• A Debian 12/13 (Bookworm/Trixie) server with root access

• A registered domain pointing to your server’s IP address

1. Update and Upgrade the System

apt update -y
apt upgrade -y

2. Install Required Dependencies

apt install apt-transport-https ca-certificates curl wget nano gnupg sudo -y

3. Add Docker Repository

Import the Docker GPG key:

curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg

Add Docker repository (for Debian trixie):

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/debian trixie stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

4. Install Docker

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y

Verify installation:

docker --version

5. Run n8n with Docker (Test Run)

docker run -it --rm --name n8n -p 5678:5678 -v n8n_data:/home/node/.n8n docker.n8n.io/n8nio/n8n

Open browser → http://your-server-ip:5678

If it runs successfully, stop it with CTRL + C.

6. Create a systemd Service for n8n

Create the service file:

nano /etc/systemd/system/n8n.service

Paste:

[Unit]
Description=n8n workflow automation (Docker)
Requires=docker.service
After=docker.service

[Service]
Restart=always
ExecStart=/usr/bin/docker run --name n8n \
  -p 5678:5678 \
  -v n8n_data:/home/node/.n8n \
  -e N8N_SECURE_COOKIE=false \
  --restart unless-stopped \
  docker.n8n.io/n8nio/n8n
ExecStop=/usr/bin/docker stop n8n
ExecStopPost=/usr/bin/docker rm n8n

[Install]
WantedBy=multi-user.target

7. Enable and Start n8n Service

systemctl daemon-reload
systemctl enable n8n
systemctl start n8n

8. Check Service Status

systemctl status n8n

If running correctly, you should see Active: active (running).

9. Access n8n

Open browser → http://your-server-ip:5678

The n8n dashboard should load.

Securing n8n with Nginx and Let’s Encrypt

1. Install Nginx & Certbot

apt install nginx certbot python3-certbot-nginx -y

2. Configure Nginx Reverse Proxy

Create a new config file for n8n:

nano /etc/nginx/sites-available/n8n.conf

Paste the following configuration (replace yourdomain.com with your actual domain):

server {
    listen 80;
    server_name yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:5678;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Upload & timeout settings
        client_max_body_size 50M;
        proxy_connect_timeout 600;
        proxy_send_timeout 600;
        proxy_read_timeout 600;
        send_timeout 600;
    }
}

Enable the site and reload Nginx:

ln -s /etc/nginx/sites-available/n8n.conf /etc/nginx/sites-enabled/
nginx -t
systemctl reload nginx

3. Obtain Let’s Encrypt SSL Certificate

certbot --nginx -d yourdomain.com

Follow the prompts. Certbot will:

• Verify your domain

• Install an SSL certificate

• Configure Nginx with HTTPS

4. Auto-Renew SSL

Certbot automatically installs a cron job. Test renewal:

certbot renew --dry-run

5. Final Nginx Config (after SSL)

After Certbot, your /etc/nginx/sites-available/n8n.conf should look like this:

server {
    listen 80;
    server_name yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        proxy_pass http://127.0.0.1:5678;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Upload & timeout settings
        client_max_body_size 50M;
        proxy_connect_timeout 600;
        proxy_send_timeout 600;
        proxy_read_timeout 600;
        send_timeout 600;
    }
}

Reload Nginx:

systemctl reload nginx

Final Check

• Open browser → https://yourdomain.com

• n8n should load securely with SSL

• Certificates will auto-renew every 90 days

Summary

You have successfully installed n8n with Docker, configured it to run as a systemd service, and secured it using Nginx with Let’s Encrypt SSL. This setup ensures n8n starts automatically on boot, restarts if it crashes, and is accessible securely over HTTPS.