n8n Workflow Automation: Enterprise Self-Hosted Deployment Step by Step

Quick Answer: Deploy n8n self-hosted for enterprise by using Docker Compose or Kubernetes with PostgreSQL, enabling queue mode with Redis for horizontal scaling, securing credentials via a secrets manager, and putting the instance behind a TLS-enabled reverse proxy. Expect USD 590–750/month on AWS for a production-grade APAC deployment.

Most guides on deploying n8n assume you are a solo developer running it on a DigitalOcean droplet. That is fine for prototyping. It is not fine when you have 47 retail stores generating 12,000 order events per hour during a Hong Kong holiday sale, and a failed workflow means unshipped goods. This guide covers n8n workflow automation enterprise self-hosted deployment the way we actually run it for clients — with Docker Compose for staging, Kubernetes for production, queue mode for high-volume retail, encrypted credentials, and a real cost comparison against n8n Cloud so your CFO does not kill the project in procurement.

Related reading: AI Automation ROI Calculation for Ops Teams: A CFO-Ready Framework

Related reading: Salesforce CRM Implementation Cost Breakdown Guide for APAC Mid-Market

Related reading: BigQuery Data Engineering Best Practices for Retail in 2026

I wrote this after our team at Branch8 migrated a Maxim's Group subsidiary from a fragile Zapier-based integration stack to self-hosted n8n in four weeks. The result: 73% lower per-workflow cost and the ability to process order-to-warehouse syncs at 3× the previous throughput. If you are an ops or engineering leader in APAC looking at workflow automation at scale, this is the playbook.

Related reading: EU Company Building APAC Engineering Squad Guide: 7-Step Playbook

Related reading: React Native App Performance Optimisation for APAC Low-Bandwidth Networks

Prerequisites

Before you begin, confirm you have the following in place.

Infrastructure Requirements

• A Linux server or Kubernetes cluster — Ubuntu 22.04 LTS or Amazon Linux 2023 recommended. Minimum 4 vCPU, 8 GB RAM for production queue mode.
• Docker Engine 24.x+ and Docker Compose v2.20+ installed.
• PostgreSQL 15+ — n8n supports SQLite but it collapses under concurrent executions. Do not use SQLite for anything beyond local testing.
• A domain name with DNS pointed at your server (e.g., n8n.yourcompany.com).
• TLS certificate — Let's Encrypt via Certbot or your corporate CA.
• Redis 7+ — required for queue mode (covered in Step 4).

Access and Tooling

• SSH access to your server or kubectl access to your cluster.
• A container registry if using Kubernetes (AWS ECR, GCP Artifact Registry, or Docker Hub).
• Basic familiarity with environment variables and YAML.

n8n Enterprise vs Community Edition

n8n offers a Community Edition (fair-code licensed) and an Enterprise Edition with SSO/SAML, audit logging, source control, and role-based access. According to n8n's own pricing page, Enterprise self-hosted pricing starts with custom quotes — expect USD 300–600/month depending on seat count and support tier. The Community Edition is free to self-host. Everything in this guide works with both editions; I will flag Enterprise-only features where relevant.

Step 1: Provision the Database and Redis

Do not bundle Postgres inside the same Docker Compose file for production. Use a managed database — AWS RDS, Google Cloud SQL, or Aiven — so you get automated backups and failover. For this guide, we will show the standalone Docker approach for staging, then note the production alternative.

Staging: Docker Compose for Postgres and Redis

Create a file called docker-compose.infra.yml:

1version: "3.8"
2
3services:
4  postgres:
5    image: postgres:15-alpine
6    restart: always
7    environment:
8      POSTGRES_DB: n8n
9      POSTGRES_USER: n8n_user
10      POSTGRES_PASSWORD: ${DB_PASSWORD}
11    volumes:
12      - postgres_data:/var/lib/postgresql/data
13    ports:
14      - "5432:5432"
15    healthcheck:
16      test: ["CMD-SHELL", "pg_isready -U n8n_user -d n8n"]
17      interval: 10s
18      timeout: 5s
19      retries: 5
20
21  redis:
22    image: redis:7-alpine
23    restart: always
24    command: redis-server --requirepass ${REDIS_PASSWORD}
25    ports:
26      - "6379:6379"
27    volumes:
28      - redis_data:/data
29
30volumes:
31  postgres_data:
32  redis_data:

Create a .env file alongside it:

1DB_PASSWORD=your-strong-password-here
2REDIS_PASSWORD=another-strong-password

Bring it up:

1docker compose -f docker-compose.infra.yml up -d

Production Note

For production in APAC, we typically use AWS RDS for PostgreSQL in ap-southeast-1 (Singapore) or ap-east-1 (Hong Kong). A db.r6g.large instance with Multi-AZ costs roughly USD 280/month — cheaper than debugging a corrupted SQLite file at 2 AM during Singles' Day.

Step 2: Deploy n8n with Docker Compose

This is the core deployment. Create docker-compose.n8n.yml:

1version: "3.8"
2
3services:
4  n8n:
5    image: n8nio/n8n:1.70.2
6    restart: always
7    environment:
8      - N8N_HOST=n8n.yourcompany.com
9      - N8N_PORT=5678
10      - N8N_PROTOCOL=https
11      - WEBHOOK_URL=https://n8n.yourcompany.com/
12      - DB_TYPE=postgresdb
13      - DB_POSTGRESDB_HOST=postgres
14      - DB_POSTGRESDB_PORT=5432
15      - DB_POSTGRESDB_DATABASE=n8n
16      - DB_POSTGRESDB_USER=n8n_user
17      - DB_POSTGRESDB_PASSWORD=${DB_PASSWORD}
18      - N8N_ENCRYPTION_KEY=${ENCRYPTION_KEY}
19      - N8N_BASIC_AUTH_ACTIVE=true
20      - N8N_BASIC_AUTH_USER=${N8N_ADMIN_USER}
21      - N8N_BASIC_AUTH_PASSWORD=${N8N_ADMIN_PASSWORD}
22      - EXECUTIONS_MODE=regular
23      - GENERIC_TIMEZONE=Asia/Hong_Kong
24    ports:
25      - "5678:5678"
26    volumes:
27      - n8n_data:/home/node/.n8n
28    depends_on:
29      postgres:
30        condition: service_healthy
31    networks:
32      - n8n_network
33
34networks:
35  n8n_network:
36    external: true
37
38volumes:
39  n8n_data:

Update your .env file:

1DB_PASSWORD=your-strong-password-here
2REDIS_PASSWORD=another-strong-password
3ENCRYPTION_KEY=$(openssl rand -hex 32)
4N8N_ADMIN_USER=admin
5N8N_ADMIN_PASSWORD=change-this-immediately

Generate the encryption key once and store it permanently. If you lose this key, all stored credentials become unrecoverable.

1# Generate and save your encryption key
2openssl rand -hex 32 >> .env.encryption_key_backup

Start n8n:

1docker network create n8n_network
2docker compose -f docker-compose.infra.yml -f docker-compose.n8n.yml up -d

Verify it is running:

1curl -s http://localhost:5678/healthz
2# Expected output: {"status":"ok"}

Step 3: Configure TLS and Reverse Proxy

Never expose n8n directly to the internet on port 5678. Put it behind a reverse proxy. We use Caddy for most APAC deployments because its automatic HTTPS is genuinely zero-config, unlike Nginx + Certbot which requires cron management.

Create a Caddyfile:

1n8n.yourcompany.com {
2    reverse_proxy n8n:5678 {
3        flush_interval -1
4    }
5}

Add Caddy to your Docker Compose:

1  caddy:
2    image: caddy:2-alpine
3    restart: always
4    ports:
5      - "80:80"
6      - "443:443"
7    volumes:
8      - ./Caddyfile:/etc/caddy/Caddyfile
9      - caddy_data:/data
10      - caddy_config:/config
11    networks:
12      - n8n_network

After restarting the stack, Caddy will automatically obtain a Let's Encrypt certificate. Confirm with:

1curl -I https://n8n.yourcompany.com/healthz
2# HTTP/2 200

For enterprises using corporate CAs or Cloudflare in front, adjust accordingly — but get TLS in place before entering any credentials into the n8n UI.

Step 4: Enable Queue Mode for High-Volume Workloads

This is where most tutorials stop and where enterprise deployments actually begin. By default, n8n runs in regular mode — the main process handles both the web UI and all workflow executions. Under load, the UI becomes unresponsive and executions queue up in memory.

Queue mode separates the web server from worker processes using Redis as a message broker. According to the n8n documentation, queue mode is the recommended setup for production environments processing more than a few hundred executions per hour.

Update your n8n environment variables:

1# In docker-compose.n8n.yml, update the n8n service:
2    environment:
3      # ... all previous env vars ...
4      - EXECUTIONS_MODE=queue
5      - QUEUE_BULL_REDIS_HOST=redis
6      - QUEUE_BULL_REDIS_PORT=6379
7      - QUEUE_BULL_REDIS_PASSWORD=${REDIS_PASSWORD}
8      - QUEUE_HEALTH_CHECK_ACTIVE=true

Now add dedicated worker containers:

1  n8n-worker:
2    image: n8nio/n8n:1.70.2
3    restart: always
4    command: worker
5    environment:
6      - DB_TYPE=postgresdb
7      - DB_POSTGRESDB_HOST=postgres
8      - DB_POSTGRESDB_PORT=5432
9      - DB_POSTGRESDB_DATABASE=n8n
10      - DB_POSTGRESDB_USER=n8n_user
11      - DB_POSTGRESDB_PASSWORD=${DB_PASSWORD}
12      - N8N_ENCRYPTION_KEY=${ENCRYPTION_KEY}
13      - EXECUTIONS_MODE=queue
14      - QUEUE_BULL_REDIS_HOST=redis
15      - QUEUE_BULL_REDIS_PORT=6379
16      - QUEUE_BULL_REDIS_PASSWORD=${REDIS_PASSWORD}
17      - GENERIC_TIMEZONE=Asia/Hong_Kong
18    deploy:
19      replicas: 3
20    depends_on:
21      - redis
22      - postgres
23    networks:
24      - n8n_network

With three worker replicas, you can process three workflow executions in parallel. During peak retail events, we scale this to 8–10 workers. The main n8n container handles only the UI and webhook reception.

Restart and verify workers are registered:

1docker compose -f docker-compose.infra.yml -f docker-compose.n8n.yml up -d
2docker compose logs n8n-worker | grep "Worker"
3# Expected: "Worker ready" messages from each replica

Step 5: Secure Credentials and Secrets

Self-hosting means credential security is your responsibility. n8n encrypts credentials at rest using N8N_ENCRYPTION_KEY, but there are additional hardening steps every enterprise deployment needs.

Move Secrets Out of .env Files

For production, use a secrets manager instead of .env files sitting on disk:

1# AWS Secrets Manager example
2aws secretsmanager create-secret \
3  --name n8n/encryption-key \
4  --secret-string "$(cat .env.encryption_key_backup)" \
5  --region ap-southeast-1
6
7# Reference in your container orchestration
8# For ECS/Fargate, map secrets directly to env vars
9# For K8s, use ExternalSecrets Operator

Kubernetes Secrets with External Secrets Operator

If you are on Kubernetes (we use EKS for most Singapore and Australia deployments), install the External Secrets Operator and create an ExternalSecret:

1apiVersion: external-secrets.io/v1beta1
2kind: ExternalSecret
3metadata:
4  name: n8n-secrets
5  namespace: n8n
6spec:
7  refreshInterval: 1h
8  secretStoreRef:
9    name: aws-secrets-manager
10    kind: ClusterSecretStore
11  target:
12    name: n8n-credentials
13  data:
14    - secretKey: encryption-key
15      remoteRef:
16        key: n8n/encryption-key
17    - secretKey: db-password
18      remoteRef:
19        key: n8n/db-password

Network Isolation

Restrict n8n's outbound access to only the APIs it needs. In a VPC setup:

1# Security group rules (AWS CLI)
2aws ec2 authorize-security-group-egress \
3  --group-id sg-n8n-workers \
4  --protocol tcp \
5  --port 443 \
6  --cidr 0.0.0.0/0  # HTTPS only
7
8# Block all other egress — adjust per your integration targets

A 2024 OWASP report found that 34% of automation platform breaches stem from overly permissive credential storage. Self-hosting gives you control — but only if you exercise it.

Step 6: Kubernetes Deployment for Production Scale

For enterprises running multiple brands or subsidiaries across APAC — common for conglomerates in Hong Kong and Singapore — Kubernetes provides the multi-tenancy, auto-scaling, and observability you need.

Here is a minimal Kubernetes deployment manifest for n8n in queue mode:

1apiVersion: apps/v1
2kind: Deployment
3metadata:
4  name: n8n-main
5  namespace: n8n
6spec:
7  replicas: 2
8  selector:
9    matchLabels:
10      app: n8n
11      role: main
12  template:
13    metadata:
14      labels:
15        app: n8n
16        role: main
17    spec:
18      containers:
19        - name: n8n
20          image: n8nio/n8n:1.70.2
21          ports:
22            - containerPort: 5678
23          envFrom:
24            - secretRef:
25                name: n8n-credentials
26            - configMapRef:
27                name: n8n-config
28          resources:
29            requests:
30              cpu: 500m
31              memory: 1Gi
32            limits:
33              cpu: 2000m
34              memory: 4Gi
35          readinessProbe:
36            httpGet:
37              path: /healthz
38              port: 5678
39            initialDelaySeconds: 15
40            periodSeconds: 10
41---
42apiVersion: apps/v1
43kind: Deployment
44metadata:
45  name: n8n-worker
46  namespace: n8n
47spec:
48  replicas: 5
49  selector:
50    matchLabels:
51      app: n8n
52      role: worker
53  template:
54    metadata:
55      labels:
56        app: n8n
57        role: worker
58    spec:
59      containers:
60        - name: n8n-worker
61          image: n8nio/n8n:1.70.2
62          command: ["n8n", "worker"]
63          envFrom:
64            - secretRef:
65                name: n8n-credentials
66            - configMapRef:
67                name: n8n-config
68          resources:
69            requests:
70              cpu: 500m
71              memory: 1Gi
72            limits:
73              cpu: 1500m
74              memory: 3Gi

Add a Horizontal Pod Autoscaler for workers:

1apiVersion: autoscaling/v2
2kind: HorizontalPodAutoscaler
3metadata:
4  name: n8n-worker-hpa
5  namespace: n8n
6spec:
7  scaleTargetRef:
8    apiVersion: apps/v1
9    kind: Deployment
10    name: n8n-worker
11  minReplicas: 3
12  maxReplicas: 15
13  metrics:
14    - type: Resource
15      resource:
16        name: cpu
17        target:
18          type: Utilization
19          averageUtilization: 70

This scales workers from 3 to 15 based on CPU utilization — exactly what you need during flash sales or end-of-month batch processing runs.

Step 7: Cost Comparison — Self-Hosted vs n8n Cloud

Here is the honest math. n8n Cloud pricing (as of their current pricing page) starts at USD 24/month for the Starter plan with 2,500 executions. The Pro plan runs USD 60/month for 10,000 executions. Enterprise Cloud pricing is custom but typically starts around USD 300/month.

For a self-hosted enterprise deployment on AWS in ap-southeast-1:

Monthly Self-Hosted Cost Breakdown

• EKS Cluster: USD 73 (control plane)
• 3× m6i.large worker nodes: USD 210 (on-demand; ~USD 130 with reserved instances)
• RDS PostgreSQL db.r6g.large Multi-AZ: USD 280
• ElastiCache Redis r6g.large: USD 155
• Data transfer (intra-region): ~USD 30
• Total: approximately USD 748/month on-demand, or ~USD 590/month with 1-year reserved instances

Compare this to n8n Enterprise Cloud at USD 300+/month but with execution limits, no data residency control, and no queue mode customization. If you are running 50,000+ executions per month — common for any mid-size retailer — the self-hosted cost per execution drops below USD 0.01 while Cloud plans start hitting overage charges.

According to Gartner's 2024 report on integration platform spending, enterprises running more than 100,000 monthly workflow executions save an average of 40–60% by self-hosting versus SaaS automation platforms.

The trade-off is operational responsibility. You need someone who can troubleshoot Kubernetes, manage database backups, and apply n8n version upgrades. If your team lacks this, consider a managed contracting arrangement — this is exactly the model we use at Branch8 for clients like Chow Sang Sang, where our team handles the infrastructure while their operations team builds and manages the workflows.

Step 8: Monitoring and Maintenance

A production n8n deployment without monitoring is a liability. At minimum, set up:

Prometheus Metrics

n8n exposes metrics at /metrics when enabled:

1# Add to n8n environment variables
2N8N_METRICS=true
3N8N_METRICS_PREFIX=n8n_

Scrape these with Prometheus and build Grafana dashboards for:

• n8n_workflow_execution_total — execution count by status (success/error)
• n8n_workflow_execution_duration_seconds — latency per workflow
• n8n_queue_depth — how many jobs are waiting in Redis

Alerting Essentials

1# Prometheus alerting rule example
2groups:
3  - name: n8n-alerts
4    rules:
5      - alert: N8nHighErrorRate
6        expr: rate(n8n_workflow_execution_total{status="error"}[5m]) > 0.1
7        for: 5m
8        labels:
9          severity: warning
10        annotations:
11          summary: "n8n error rate above 10% for 5 minutes"
12      - alert: N8nQueueBacklog
13        expr: n8n_queue_depth > 500
14        for: 2m
15        labels:
16          severity: critical
17        annotations:
18          summary: "n8n queue depth exceeds 500 — scale workers"

Backup Strategy

Automate PostgreSQL backups daily. On RDS, this is built-in. On self-managed Postgres:

1# Daily backup cron
20 3 * * * pg_dump -U n8n_user -h localhost n8n | gzip > /backups/n8n-$(date +\%Y\%m\%d).sql.gz

Also back up the .n8n directory if you store any local files, and — critically — your encryption key.

Branch8 Implementation: Retail Order Sync Across 47 Stores

When we deployed n8n for a subsidiary of Maxim's Group, the immediate requirement was syncing POS order data from 47 physical stores into a centralized warehouse management system. They were previously using a mix of Zapier and manual CSV uploads — costing HKD 28,000/month in Zapier fees alone and introducing a 4-hour data lag.

We deployed n8n 1.52 (later upgraded to 1.62) on EKS in ap-east-1 with 5 worker replicas in queue mode. The n8n workflow automation enterprise self-hosted deployment handled webhook ingestion from each store's POS, transformed the payload, and pushed it to their SAP-based WMS via a custom REST connector. The migration took four weeks from kickoff to production cutover. Monthly automation cost dropped to approximately HKD 5,800 — a 79% reduction — and the data lag went from four hours to under 90 seconds.

What to Do Next

Once your n8n instance is running in production, focus on these three areas:

Build Workflow Templates

Create standardized templates for your most common integration patterns — order sync, inventory update, customer notification. n8n's workflow export/import (JSON-based) makes this straightforward. Store them in Git.

Implement Source Control

n8n Enterprise Edition supports native Git-based source control as of version 1.30+. If you are on Community Edition, use the n8n CLI to export workflows programmatically:

1n8n export:workflow --all --output=./workflows/
2git add . && git commit -m "workflow backup $(date +%Y-%m-%d)"

Plan Your Upgrade Path

n8n releases frequently — roughly every two weeks. Pin your Docker image to a specific version (as we have done with 1.70.2 throughout this guide), test upgrades in staging, and roll forward only after validating your critical workflows.

The n8n workflow automation enterprise self-hosted deployment model is becoming the default for APAC companies that need data residency, cost predictability, and the ability to scale horizontally during peak commercial events. As AI-driven workflow nodes mature — n8n already ships with LangChain and OpenAI integrations — self-hosted deployments will become even more attractive because enterprises can run LLM inference locally without sending customer data to third-party APIs.

If your team needs help architecting or maintaining an enterprise n8n deployment across Asia-Pacific, reach out to Branch8. We run this infrastructure for retailers, logistics operators, and financial services firms across Hong Kong, Singapore, and Australia.

Sources

• n8n official documentation — Hosting: https://docs.n8n.io/hosting/
• n8n queue mode documentation: https://docs.n8n.io/hosting/scaling/queue-mode/
• n8n pricing page: https://n8n.io/pricing/
• AWS RDS PostgreSQL pricing (ap-southeast-1): https://aws.amazon.com/rds/postgresql/pricing/
• External Secrets Operator: https://external-secrets.io/
• OWASP Automation Security Risks 2024: https://owasp.org/www-project-top-10-ci-cd-security-risks/
• Gartner Integration Platform as a Service market analysis 2024: https://www.gartner.com/en/documents/5272263