n8n-impl-deployment

n8n Deployment & Operations

Quick Reference

Aspect	Value
Docker image	docker.n8n.io/n8nio/n8n
Default port	5678
Data volume	/home/node/.n8n
Files volume	/files
Default DB	SQLite (use PostgreSQL for production)
Queue broker	Redis (BullMQ)
Config method	Environment variables (primary)

Default Ports

Service	Port
n8n	5678
Redis	6379
PostgreSQL	5432
Task Runner Broker	5679

---

Decision Trees

Which Database?

Need queue mode or multi-instance?
  YES -> ALWAYS use PostgreSQL (DB_TYPE=postgresdb)
  NO -> Single user / dev environment?
    YES -> SQLite is acceptable (default)
    NO  -> ALWAYS use PostgreSQL for production

Which Deployment Mode?

Expected workflow volume?
  Low (< 50 active workflows, single user)
    -> Single Docker container, regular mode
  Medium (50-200 workflows, team use)
    -> Docker Compose with PostgreSQL, regular mode
  High (200+ workflows, high webhook traffic)
    -> Queue mode: main + workers + Redis + PostgreSQL
  Very High (enterprise, HA required)
    -> Multi-main + workers + Redis + PostgreSQL + load balancer

Which Backup Strategy?

Database type?
  SQLite -> Volume backup (stop container, tar archive)
  PostgreSQL -> pg_dump (ALWAYS preferred for production)
ALWAYS also export workflows/credentials via CLI
ALWAYS back up N8N_ENCRYPTION_KEY separately

---

Critical Rules

• ALWAYS set N8N_ENCRYPTION_KEY explicitly in production and back it up. Losing this key means ALL stored credentials become unrecoverable.
• ALWAYS share the SAME N8N_ENCRYPTION_KEY across ALL instances (main, workers, webhook processors).
• ALWAYS use PostgreSQL for queue mode. SQLite does NOT support queue mode.
• ALWAYS set NODE_ENV=production for production deployments.
• ALWAYS set N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true in Docker.
• ALWAYS set N8N_RUNNERS_ENABLED=true for task runner support.
• ALWAYS configure WEBHOOK_URL when behind a reverse proxy.
• ALWAYS use the same n8n version across ALL instances in queue mode.
• NEVER use SQLite for multi-instance or queue mode deployments.
• NEVER expose n8n directly to the internet without TLS termination.
• NEVER store N8N_ENCRYPTION_KEY in version control.
• NEVER export credentials with --decrypted flag in production environments.