n8n self-hosten: Hetzner/Contabo Setup mit Docker, HTTPS, Backup & Updates

sudo apt update && sudo apt -y upgrade
sudo apt -y install ca-certificates curl gnupg ufw git

# SSH (22) – optional: nur von deiner IP erlauben
sudo ufw allow 22/tcp

# Web
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

sudo ufw enable
sudo ufw status

# Docker Repo
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update
sudo apt -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# User in docker group (danach neu einloggen)
sudo usermod -aG docker $USER

sudo mkdir -p /opt/n8n
sudo chown -R $USER:$USER /opt/n8n
cd /opt/n8n

# .env erstellen
cat > .env <<'EOF'
# Domain
N8N_HOST=n8n.deinefirma.de
N8N_PORT=5678

# Timezone
TZ=Europe/Berlin

# n8n security
N8N_ENCRYPTION_KEY=BITTE_EINEN_LANGEN_RANDOM_KEY_SETZEN
N8N_BASIC_AUTH_ACTIVE=true
N8N_BASIC_AUTH_USER=admin
N8N_BASIC_AUTH_PASSWORD=BITTE_STARKES_PASSWORT_SETZEN

# Postgres
POSTGRES_DB=n8n
POSTGRES_USER=n8n
POSTGRES_PASSWORD=BITTE_STARKES_DB_PASSWORT_SETZEN

# Traefik / Let's Encrypt
LE_EMAIL=admin@deinefirma.de
EOF

chmod 600 .env

services:
  traefik:
    image: traefik:v3.1
    container_name: traefik
    restart: unless-stopped
    command:
      - "--api.dashboard=false"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LE_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "letsencrypt:/letsencrypt"
    networks:
      - web

  postgres:
    image: postgres:16
    container_name: n8n-postgres
    restart: unless-stopped
    environment:
      - POSTGRES_DB=${POSTGRES_DB}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - TZ=${TZ}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - internal

  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    environment:
      - N8N_HOST=${N8N_HOST}
      - N8N_PORT=${N8N_PORT}
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://${N8N_HOST}/
      - GENERIC_TIMEZONE=${TZ}
      - TZ=${TZ}
      - N8N_BASIC_AUTH_ACTIVE=${N8N_BASIC_AUTH_ACTIVE}
      - N8N_BASIC_AUTH_USER=${N8N_BASIC_AUTH_USER}
      - N8N_BASIC_AUTH_PASSWORD=${N8N_BASIC_AUTH_PASSWORD}
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=${POSTGRES_DB}
      - DB_POSTGRESDB_USER=${POSTGRES_USER}
      - DB_POSTGRESDB_PASSWORD=${POSTGRES_PASSWORD}
      - N8N_LOG_LEVEL=info
    depends_on:
      - postgres
      - traefik
    networks:
      - web
      - internal
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.n8n.rule=Host("${N8N_HOST}")"
      - "traefik.http.routers.n8n.entrypoints=websecure"
      - "traefik.http.routers.n8n.tls=true"
      - "traefik.http.routers.n8n.tls.certresolver=le"
      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
      - "traefik.http.routers.n8n-http.rule=Host("${N8N_HOST}")"
      - "traefik.http.routers.n8n-http.entrypoints=web"
      - "traefik.http.routers.n8n-http.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

volumes:
  postgres_data:
  letsencrypt:

networks:
  web:
  internal:

cd /opt/n8n
docker compose up -d
docker compose ps
docker logs -f traefik
# n8n logs (in separatem Terminal)
docker logs -f n8n

#!/usr/bin/env bash
set -euo pipefail

TS=$(date +"%Y-%m-%d_%H-%M-%S")
BACKUP_DIR="/opt/n8n/backups"
mkdir -p "$BACKUP_DIR"

set -a
source /opt/n8n/.env
set +a

docker exec -t n8n-postgres pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" > "$BACKUP_DIR/postgres_${TS}.sql"
gzip -f "$BACKUP_DIR/postgres_${TS}.sql"
ls -1t "$BACKUP_DIR"/postgres_*.sql.gz | tail -n +15 | xargs -r rm --

echo "Backup done: $BACKUP_DIR/postgres_${TS}.sql.gz"

crontab -e
# hinzufügen:
15 2 * * * /opt/n8n/backup.sh >/dev/null 2>&1

• Backups offsite speichern (S3, Storage Box, anderer Server) – sonst schützt es nicht gegen Serververlust.
• Restore-Test: mindestens 1× pro Quartal in einer Testumgebung.
• Monitoring: Backup-Laufzeit/Erfolg als Health Check.

cd /opt/n8n
docker compose pull
docker compose up -d
docker compose ps