n8n stands out as one of the most powerful open-source low-code AI workflow automation tools available. While cloud-hosted n8n can get expensive quickly, Oracle Cloud's Always Free tier offers an incredible opportunity to run n8n completely free, forever.
In this comprehensive guide, I'll walk you through setting up n8n on Oracle Cloud Infrastructure (OCI) using their generous Always Free tier, which includes compute instances that never expire.
💡Why Oracle Cloud's Always Free Tier?
Oracle Cloud's Always Free tier is genuinely impressive:
2 AMD-based Compute VMs with 1/8 OCPU and 1 GB memory each
Up to 4 Arm-based Ampere A1 cores and 24 GB of memory (can be used as one VM or split)
200 GB total Block Volume storage
10 GB Object Storage
Always Free - no time limits, no credit expiration
The Arm-based instances are particularly powerful for running n8n, offering excellent performance for automation workflows.
For a more detailed overview of the Oracle Free Tier, refer to Oracle Free Tier & Always Free Resources.
✅ Prerequisites
Before we begin, you'll need:
🏗️ Architecture
This setup demonstrates how to run n8n securely inside an OCI Compute VM using Docker and Traefik as the reverse proxy.
1. Traffic Flow
A user accesses n8n.example.com, which resolves via DNS to the VM’s public IP.
Requests on ports 80/443 reach the Traefik container inside the VM.
Traefik forwards HTTPS traffic through the traefik-public network to the n8n container.
2. Security & Certificates
Traefik manages SSL/TLS certificates automatically with Let’s Encrypt CA.
Certificates are issued and renewed using the ACME TLS challenge.
All certificates are stored securely in ./letsencrypt/acme.json.
3. Service Discovery
4. Application Layer
n8n container hosts the workflow automation platform.
Postgres container provides persistent database storage, connected via the n8n-network (port 5432).
5. Infrastructure
All components (Traefik, n8n, Postgres) run as Docker containers inside a single OCI Compute VM.
Networking is logically separated using Docker networks (traefik-public and n8n-network).
Step 1: 📝Create Your Oracle Cloud Account
Visit oracle.com/cloud/free
Sign up for a free account
Complete the verification process (requires credit card for verification, but won't be charged)
Wait for account activation
Step 2: 🖥️✨ Set Up Your Compute Instance
Create a Virtual Cloud Network
- We will take a /16 subnet for the VCN, in this case 10.0.0.0/16
Create a /24 subnet inside the VCN where the VM instance will be connected
Create a Internet gateway for the VCN
Create the VM Instance
SSH Keys:
Click Create and wait for the instance to provision
Configure Network Security
Go to Networking → Virtual Cloud Networks
Click on your VCN
Click on Security Lists → Default Security List
Add ingress rules:
Port 22 (SSH): 0.0.0.0/0
Port 80 (HTTP): 0.0.0.0/0
Port 443 (HTTPS): 0.0.0.0/0
Port 5678 (n8n): 0.0.0.0/0 (temporary, we
Step 3: 🔑 Connect to Your Instance
1. Note your instance's public IP address
2. Connect via SSH:
bash ssh -i /path/to/your/private-key ubuntu@YOUR_PUBLIC_IP
For Windows users with PuTTY, convert the private key to .ppk format first
Step 4: ⚙️ Prepare the Server
Update the System
bash sudo apt update && sudo apt upgrade -y
Install Docker and Docker Compose
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
$(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo usermod -aG docker $USER
Reconnect to your server after logging out.
Step 5: 🐳 Deploy n8n with Docker Compose
Prepare the project directories and files on the VM
~/n8n-oracle-cloud/
├── traefik/
│ └── acme.json
├── prod/
├── .env
└── docker-compose.yaml
🚀 All the code is available on my GitHub Repo!
👉 Clone this repository to your VM to get all the necessary code 🖥️💻
cd ~
git clone https://github.com/sumitsaz23/n8n-docker-traefik-postgres.git n8n-oracle-cloud
cd n8n-oracle-cloud
Secure acme.json for Traefik
Traefik requires acme.json to be present and readable/writable by the Traefik container but with strict permissions (600)
touch traefik/acme.json
chmod 600 traefik/acme.json
Create docker-compose.yml file:
services:
postgres:
image: postgres:16-alpine
container_name: n8n_postgres
restart: unless-stopped
volumes:
- pgdata:/var/lib/postgresql/data
environment:
- POSTGRES_USER=${DB_POSTGRESDB_USER}
- POSTGRES_DB=${DB_POSTGRESDB_DATABASE}
- POSTGRES_PASSWORD=${DB_POSTGRESDB_PASSWORD}
- PGDATA=/var/lib/postgresql/data/pgdata
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${DB_POSTGRESDB_USER} -d ${DB_POSTGRESDB_DATABASE} || exit 1"]
interval: 10s
timeout: 5s
retries: 5
start_period: 15s
networks:
- n8n-network
mem_limit: 2g
cpus: 1.0
n8n:
image: n8nio/n8n:latest
container_name: n8n_main
restart: unless-stopped
depends_on:
- postgres
volumes:
- n8n_data:/home/node/.n8n
environment:
- DB_TYPE=postgresdb
- DB_POSTGRESDB_HOST=postgres
- DB_POSTGRESDB_PORT=${DB_POSTGRESDB_PORT}
- DB_POSTGRESDB_DATABASE=${DB_POSTGRESDB_DATABASE}
- DB_POSTGRESDB_USER=${DB_POSTGRESDB_USER}
- DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD}
- N8N_PORT=5678
- N8N_PROTOCOL=https
- N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
- N8N_REINSTALL_MISSING_PACKAGES=true
- N8N_RUNNERS_ENABLED=true
- WEBHOOK_URL=https://${N8N_HOSTNAME}
- GENERIC_TIMEZONE=${TZ}
- N8N_BASIC_AUTH_ACTIVE=${N8N_BASIC_AUTH_ACTIVE}
- N8N_BASIC_AUTH_USER=${N8N_BASIC_AUTH_USER}
- N8N_BASIC_AUTH_PASSWORD=${N8N_BASIC_AUTH_PASSWORD}
networks:
- n8n-network
- traefik-public
ports:
- 127.0.0.1:5678:5678
labels:
- "traefik.enable=true"
- "traefik.docker.network=n8nstack_traefik-public"
- "traefik.http.routers.n8n.rule=Host(`${N8N_HOSTNAME}`)"
- "traefik.http.routers.n8n.entrypoints=websecure"
- "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
- traefik.http.routers.n8n.tls=true
- traefik.http.middlewares.n8n.headers.SSLRedirect=true
- traefik.http.middlewares.n8n.headers.STSSeconds=315360000
- traefik.http.middlewares.n8n.headers.browserXSSFilter=true
- traefik.http.middlewares.n8n.headers.contentTypeNosniff=true
- traefik.http.middlewares.n8n.headers.forceSTSHeader=true
- traefik.http.middlewares.n8n.headers.SSLHost=${N8N_HOSTNAME}
- traefik.http.middlewares.n8n.headers.STSIncludeSubdomains=true
- traefik.http.middlewares.n8n.headers.STSPreload=true
- traefik.http.routers.n8n.middlewares=n8n@docker
mem_limit: 4g
cpus: 2
traefik:
image: traefik:latest
container_name: traefik
restart: unless-stopped
command:
- --api.dashboard=true
- --api.insecure=false
- --providers.docker=true
- --providers.docker.exposedbydefault=false
- --providers.docker.network=n8nstack_traefik-public
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --certificatesresolvers.letsencrypt.acme.httpchallenge=true
- --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
- --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
- --log.level=INFO
ports:
- "80:80"
- "443:443"
- "8080:8080"
volumes:
- /home/ubuntu/traefik/acme.json:/letsencrypt/acme.json
- /home/ubuntu/traefik/log:/var/log/traefik
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- n8n-network
- traefik-public
mem_limit: 512m
cpus: 0.5
networks:
n8n-network:
driver: bridge
traefik-public:
driver: bridge
volumes:
pgdata:
name: n8n_pgdata
n8n_data:
name: n8n_data
create .env file
COMPOSE_PROJECT_NAME=n8nstack
TZ=Asia/Kolkata
N8N_HOSTNAME=n8n.example.com
LETSENCRYPT_EMAIL=email@example.com
DB_POSTGRESDB_HOST=postgres
DB_POSTGRESDB_PORT=5432
DB_POSTGRESDB_DATABASE=n8n
DB_POSTGRESDB_USER=n8nuser
DB_POSTGRESDB_PASSWORD=dbsupersecret
N8N_BASIC_AUTH_PASSWORD=n8nsupersecret
N8N_BASIC_AUTH_ACTIVE=true
N8N_BASIC_AUTH_USER=admin
N8N_METRICS=true
N8N_METRICS_INCLUDE_QUEUE_METRICS=true
DB_POOL_SIZE=20
Launch the docker compose config
docker-compose up -d
This will create the networks, volumes & the containers
Step 5: 🔍Verify
Verify if n8n has successfully initiated
docker compose logs n8n
docker compose logs -f traefik
Now check the n8n portal using your browser
⚠️ Issues Faced & Fixes 🛠️
Traefik only shows the default self‑signed certificate
Symptom: When you open https://n8n.example.com, your browser shows the Traefik default certificate instead of a valid Let’s Encrypt cert.
Causes & Fixes:
Resolver name mismatch: The resolver name in your labels must match the resolver defined in Traefik’s command args.
Traefik command:
--certificatesresolvers.myresolver.acme.email=you@example.com
--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
--certificatesresolvers.myresolver.acme.tlschallenge=true
Label must match:
- "traefik.http.routers.n8n.tls.certresolver=myresolver"
acme.json permissions: Ensure the file exists and is writable by Traefik:
touch ./traefik/acme.json
chmod 600 ./traefik/acme.json
Firewall/DNS: Ports 80/443 must be open, and n8n.example.com must resolve to your VPS IP.
Traefik fails to obtain ACME certificate when N8N_EDITOR_BASE_URL is set
Symptom: Traefik logs show certificate request failures, and n8n only loads behind the default cert. The issue appears right after setting N8N_EDITOR_BASE_URL=https://n8n.example.com/.
Cause: With TLS‑ALPN challenge, Traefik passes the ACME validation request through to the backend. If n8n enforces HTTPS at this point, the validation breaks.
Fixes:
Option A: Deploy without N8N_EDITOR_BASE_URL until the cert is issued, then set it and restart n8n.
Option B (better): Switch to HTTP‑01 challenge, which bypasses n8n entirely during validation.
--certificatesresolvers.le.acme.httpchallenge.entrypoint=web
Option C: Use DNS‑01 challenge if your DNS provider supports it (best for Cloudflare/Route53).
