Deploy n8n on DigitalOcean: The Complete 2026 Guide

Why DigitalOcean for n8n Self-Hosting

If you're reading this, you've probably already decided to self-host n8n. Good call. Self-hosting cuts costs from ~€24/month on n8n Cloud Starter (verify current pricing at n8n.io/pricing) to under $10/month on a VPS for most workflows. That's a $200+/year delta for a tool most teams use daily.

The next question is where. Three VPS providers dominate the n8n self-hosting conversation in 2026: DigitalOcean, Vultr, and Linode/Akamai. We covered the full comparison in our Best VPS for n8n guide — but if you're already leaning DigitalOcean, here's why it's a reasonable default.

Reason 1 — Predictable flat-rate pricing. Unlike some competitors that bill separately for snapshots and backups, DigitalOcean offers transparent flat-rate droplets with bundled backup retention. No surprise bills when your workflow volume doubles.

Reason 2 — The n8n Marketplace image is real (but skip it). DigitalOcean's Marketplace has a pre-built n8n image. It works — for demos. For production, you want the plain Ubuntu 22.04 droplet path, because the Marketplace image lags behind current n8n versions and locks you out of Docker Compose customization. Everything in this tutorial assumes a plain Ubuntu droplet.

Reason 3 — The ecosystem around it. DigitalOcean's DNS, Spaces (S3-compatible object storage), and Monitoring services all integrate with the same billing dashboard. For a solo operator or small team, one bill beats three.

If DigitalOcean isn't your pick, Linode/Akamai has a comparable tutorial path, and Vultr is slightly cheaper at scale. The rest of this guide is DigitalOcean-specific, but the Docker Compose setup transfers cleanly to any Ubuntu 22.04 VPS.

Prerequisites

What you need before starting:

• A DigitalOcean account (verified email + payment method)
• A domain or subdomain pointed at DigitalOcean's nameservers (e.g., n8n.yourdomain.com) — or Cloudflare DNS if you prefer
• An SSH key pair (or willingness to use password auth — not recommended)
• About 20 minutes of focused time

Recommended droplet size by workflow volume:

*Pricing as of October 2026. Verify current rates at digitalocean.com/pricing/droplets.

Why not the $6 droplet for production? Once you run n8n + PostgreSQL + Redis on the same droplet, RAM is the constraint. The $6 tier handles light testing — 50-100 executions/day. Real production workflows (webhooks, multi-step AI calls, file processing) will trigger OOM kills on 1 GiB. The $12 tier is technically viable for a single-user setup with light workflow volume, but once you start queue mode or handle binary files, the $18 tier (2 GiB / 2 vCPU) is the practical floor.

DNS setup: The easiest path is to point a subdomain (n8n.yourdomain.com) at your droplet's IP via an A record. If you use Cloudflare for DNS, keep the proxy OFF during initial SSL issuance — Cloudflare's proxy interferes with Traefik's ACME challenge. Turn it on after the certificate is live.

Step-by-Step: Deploy the Droplet

Step 1 — Create the Droplet

Log in to DigitalOcean. Click Create → Droplets.

Configuration:

• Region: Choose the one closest to your users (or your AI provider's region — OpenAI US-East, Anthropic US-West)
• Image: Ubuntu 22.04 LTS (NOT the n8n Marketplace image — see §1)
• Size: Per the table above
• Authentication: SSH key (recommended) — paste your public key or upload ~/.ssh/id_rsa.pub
• Hostname: n8n-prod-01 (or your convention)
• Backups: Enable — +20% to droplet cost, worth it
• Monitoring: Enable — free, useful for CPU/RAM alerts

Click Create Droplet. Provisioning takes 30-60 seconds.

Step 2 — SSH In and Harden

Grab the IP from the DO dashboard, then:

ssh root@YOUR_DROPLET_IP

Initial hardening:

# Update packages
apt update && apt upgrade -y

# Create non-root user
adduser n8n
usermod -aG sudo n8n

# Copy SSH key
rsync --archive --chown=n8n:n8n ~/.ssh /home/n8n

# Enable firewall
ufw allow OpenSSH
ufw allow 80
ufw allow 443
ufw enable

# Install fail2ban
apt install fail2ban -y

Log out and back in as n8n. From here on, don't use root.

Step 3 — Install Docker + Compose

# Official Docker install script
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER
newgrp docker

# Verify
docker --version
docker compose version

Verify Docker Compose v2 is available (not the deprecated docker-compose v1 binary). The syntax in this guide assumes v2.

Step 4 — Write docker-compose.yml

Create the working directory:

mkdir -p ~/n8n && cd ~/n8n
nano docker-compose.yml

Paste this (adjust YOUR_DOMAIN and passwords):

version: '3.8'

services:
  traefik:
    image: traefik:v3.7
    restart: unless-stopped
    command:
      - "--api.insecure=false"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=YOUR_EMAIL"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "traefik_data:/letsencrypt"
    networks:
      - n8n_net

  postgres:
    image: postgres:16
    restart: unless-stopped
    environment:
      - POSTGRES_USER=n8n
      - POSTGRES_PASSWORD=CHANGE_ME_STRONG
      - POSTGRES_DB=n8n
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - n8n_net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n8n"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    volumes:
      - redis_data:/data
    networks:
      - n8n_net
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  n8n:
    image: n8nio/n8n:latest
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      - N8N_HOST=YOUR_DOMAIN
      - N8N_PROTOCOL=https
      - N8N_PORT=5678
      - WEBHOOK_URL=https://YOUR_DOMAIN/
      - N8N_EDITOR_BASE_URL=https://YOUR_DOMAIN/
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - DB_POSTGRESDB_PASSWORD=CHANGE_ME_STRONG
      - EXECUTIONS_MODE=queue
      - QUEUE_BULL_REDIS_HOST=redis
      - QUEUE_BULL_REDIS_PORT=6379
      - N8N_ENCRYPTION_KEY=CHANGE_ME_RANDOM_STRING
      - GENERIC_TIMEZONE=UTC
      - N8N_LOG_LEVEL=info
    volumes:
      - n8n_data:/home/node/.n8n
    networks:
      - n8n_net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.n8n.rule=Host(`YOUR_DOMAIN`)"
      - "traefik.http.routers.n8n.entrypoints=websecure"
      - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
      - "traefik.http.services.n8n.loadbalancer.server.port=5678"

volumes:
  traefik_data:
  postgres_data:
  redis_data:
  n8n_data:

networks:
  n8n_net:
    driver: bridge

Generate passwords & keys:

# Strong password
openssl rand -base64 32

# n8n encryption key (32+ chars)
openssl rand -hex 32

Replace CHANGE_ME_STRONG, CHANGE_ME_RANDOM_STRING, YOUR_DOMAIN, and YOUR_EMAIL before saving.

Step 5 — Configure Traefik for Auto-SSL

Traefik reads the ACME config from the docker-compose.yml above. The key parts:

• --certificatesresolvers.letsencrypt.acme.tlschallenge=true — uses TLS challenge, works without a separate HTTP server
• Traefik labels on n8n service — routes YOUR_DOMAIN to port 5678, uses the letsencrypt resolver
• HTTP → HTTPS redirect — configured via the redirections lines

Verify DNS is propagated before bringing up Traefik:

dig +short YOUR_DOMAIN
# Should return your droplet IP

If DNS isn't propagated, Let's Encrypt will fail the ACME challenge and you'll hit the rate limit (5 failures/hour).

Step 6 — Launch and Test

docker compose up -d
docker compose logs -f n8n

Wait for logs to show n8n ready on 0.0.0.0, port 5678. Then open https://YOUR_DOMAIN in your browser.

First launch:

1. Create the owner account (email + password)
2. Verify the browser shows a valid Let's Encrypt certificate (padlock icon)
3. Create a test workflow with a Webhook node
4. Copy the webhook URL and test it from another terminal:

curl -X POST https://YOUR_DOMAIN/webhook-test/test \
  -H "Content-Type: application/json" \
  -d '{"test": "hello"}'

If the webhook receives the payload in the n8n editor — you're live.

Post-Deploy Configuration

Persistent storage — DO Volumes vs R2 external storage.
For most single-droplet setups, the n8n_data Docker volume is enough. If your workflows process large binaries (PDFs, images, videos), configure n8n's external storage to Cloudflare R2 or DO Spaces — it's cheaper than provisioning a DO Volume and keeps binary data out of the Postgres.

Backups — Snapshots vs pg_dump.
DigitalOcean Snapshots cost $0.06/GB/month for Droplets (as of October 2026 — verify at docs.digitalocean.com/products/snapshots/details/pricing). A weekly snapshot is enough for most teams. If you want finer control, add a pg_dump cron:

# /etc/cron.daily/n8n-backup
docker exec postgres pg_dump -U n8n n8n | gzip > /root/backups/n8n-$(date +%Y%m%d).sql.gz

Monitoring — DO Monitoring + Uptime Kuma.
DO Monitoring covers droplet-level CPU/RAM/disk. For workflow-level monitoring (execution failures, queue backlog), add Uptime Kuma as a separate container or use n8n's built-in error workflow → Slack/email alerts.

Auto-updates — Watchtower vs manual pinning.
Watchtower auto-pulls new images nightly. Convenient — risky. For production, pin the n8n image to a specific tag (e.g., n8nio/n8n:2.43.8) and upgrade deliberately. As of October 2026, the current stable release is 2.43.8 — verify the latest at docs.n8n.io/changelog or github.com/n8n-io/n8n/releases.

Cost math — 3 tiers:

*Estimate as of October 2026. Verify current rates at digitalocean.com/pricing/droplets.

Even at the scale tier, this is under n8n Cloud's Pro plan (~€60/month for 10,000 executions — verify current pricing at n8n.io/pricing) — and you get full control over data residency, backups, and worker scaling.

Troubleshooting — 8 Common Errors

Error 1 — Webhook returns 502 Bad Gateway.
Cause: Traefik labels on the n8n service are misaligned, or the internal port is wrong.
Fix: Verify traefik.http.services.n8n.loadbalancer.server.port=5678 and confirm n8n's internal port hasn't been changed via N8N_PORT.

Error 2 — SSL certificate not issuing.
Cause: DNS not propagated, Cloudflare proxy is ON, or ACME rate limit hit.
Fix: dig +short YOUR_DOMAIN should return the droplet IP. Turn Cloudflare proxy OFF. Check docker compose logs traefik for ACME errors. If rate-limited, wait 60 min.

Error 3 — Postgres connection refused.
Cause: Wrong password, service name mismatch, or n8n started before Postgres was healthy.
Fix: The depends_on: postgres: condition: service_healthy in the compose file prevents this. If it still occurs, docker compose logs postgres and verify POSTGRES_PASSWORD matches n8n's DB_POSTGRESDB_PASSWORD.

Error 4 — Out of memory (OOM kill).
Cause: Running n8n + Postgres + Redis on the $6/1 GiB droplet.
Fix: Upgrade to the $18/2 GiB tier. If you can't, add a swapfile (2 GiB) as a stopgap — but this doesn't fix the underlying constraint.

Error 5 — Queue mode: worker not picking jobs.
Cause: In n8n 2.0+, task runners are enabled by default (since n8n 1.69.0). If you're on an older instance and EXECUTIONS_MODE=queue isn't processing jobs, verify the queue configuration.
Fix: Confirm QUEUE_BULL_REDIS_HOST and QUEUE_BULL_REDIS_PORT are set correctly. Note: N8N_RUNNERS_ENABLED was deprecated in n8n 2.0 — task runners are now enabled by default. If you're migrating from an older instance, verify the env var is set correctly — see docs.n8n.io task runners.

Error 6 — Droplet IP banned by email providers.
Cause: Fresh DigitalOcean IP blocks are often flagged by Microsoft/Google mail filters.
Fix: Warm up the IP by sending low-volume test emails first. Or use a transactional email provider (Resend, Postmark) instead of raw SMTP from the droplet.

Error 7 — Large binary workflows bloat the n8n volume.
Cause: n8n's default N8N_DEFAULT_BINARY_DATA_MODE=default stores binary data in memory or on the container filesystem, which can grow the n8n_data volume indefinitely and cause cross-worker inconsistency in queue mode.
Fix: For production queue mode with binary-heavy workflows, set N8N_DEFAULT_BINARY_DATA_MODE=s3 and configure S3-compatible storage (DO Spaces or Cloudflare R2). This keeps binaries out of the container filesystem and consistent across workers. Verify current binary data mode options at docs.n8n.io binary data.

Error 8 — Cron workflow runs at wrong time.
Cause: Droplet timezone is UTC, but the workflow author expected local time.
Fix: Set GENERIC_TIMEZONE=America/New_York (or your zone) in the n8n environment block. n8n uses this for cron scheduling regardless of the OS timezone.

When to Hire vs DIY

DIY if:

• You're comfortable with SSH, Docker, and YAML
• You want to understand your own infrastructure
• You have 2-4 hours for initial setup + ongoing maintenance

Hire if:

• You need production deployment in under 48 hours
• Your workflows handle sensitive data and need audit trails
• Multi-worker queue mode + custom scaling is required

Where to hire:
For a fixed-price deployment walkthrough ($50-$100 typical for standard setups; higher for custom requirements), hire a DigitalOcean deployment specialist on Fiverr Pro — see our vetted specialist directory. For production deployments with queue mode + monitoring + backup automation, hire an n8n infrastructure engineer on Upwork — see our custom AI agent specialists (typically $60-$120/hr, with senior experts up to $150/hr).

Pricing ranges as of October 2026 — verify current rates on platform.

Advanced — Scale to Production

Once your single-droplet setup is stable, the next step is queue mode with dedicated workers. The compose file in §3 already uses EXECUTIONS_MODE=queue — here's how to add workers:

  n8n-worker:
    image: n8nio/n8n:latest
    restart: unless-stopped
    command: worker
    depends_on:
      - n8n
      - redis
    environment:
      # Same env vars as n8n main, minus N8N_EDITOR_BASE_URL
      - EXECUTIONS_MODE=queue
      - QUEUE_BULL_REDIS_HOST=redis
      # ...
    volumes:
      - n8n_data:/home/node/.n8n
    networks:
      - n8n_net
    deploy:
      replicas: 3

External Postgres. DigitalOcean Managed Databases start at $15.15/month (1 GiB RAM / 1 vCPU / 10-30 GiB storage — storage beyond the base is billed separately at $0.215/GiB/month) as of October 2026. Verify at digitalocean.com/pricing/managed-databases. Offloading Postgres frees droplet RAM and gives you automated backups, point-in-time recovery, and failover. Worth it once you cross ~5,000 executions/day.

Redis persistence. The compose file mounts redis_data — but Redis defaults to RDB snapshots every 60 seconds with at least one change. For queue reliability, set --appendonly yes in the Redis command.

External storage. For workflows handling binaries, configure n8n's N8N_DEFAULT_BINARY_DATA_MODE=s3 with Cloudflare R2 or DO Spaces. DO Spaces costs $5/month for 250 GiB storage + 1 TiB (~1,024 GiB) outbound transfer, with additional storage at $0.02/GiB — verify at docs.digitalocean.com/products/spaces/details/pricing.

For the full production-grade walkthrough — including Docker Compose tuning, Traefik routing, and cost breakdowns — see our n8n Production Deployment guide.

Frequently Asked Questions