VPS chạy n8n 24/7: setup Docker Compose từ A-Z (có HTTPS, backup)

# Từ máy bạnssh root@<IP_VPS> # Update hệ thốngapt update && apt upgrade -y # Tạo user non-root (đừng dùng root cho daily work)adduser n8nadminusermod -aG sudo n8nadmin # Copy SSH key sang user mới (để login không cần password)rsync --archive --chown=n8nadmin:n8nadmin ~/.ssh /home/n8nadmin # Logout, login lại với user mớiexitssh n8nadmin@<IP_VPS>

# Cài Docker officialcurl -fsSL https://get.docker.com -o get-docker.shsudo sh get-docker.sh # Cho user dùng docker không cần sudosudo usermod -aG docker $USER # Logout/login lại để áp dụng groupexitssh n8nadmin@<IP_VPS> # Verifydocker --versiondocker compose version

sudo ufw default deny incomingsudo ufw default allow outgoingsudo ufw allow sshsudo ufw allow 80/tcpsudo ufw allow 443/tcpsudo ufw enablesudo ufw status

Type: AName: n8n  (hoặc subdomain bạn muốn)Value: <IP_VPS>TTL: Auto / 300Proxy status: DNS only (TẮT proxy Cloudflare lúc đầu để Let's Encrypt verify được)

dig n8n.yourdomain.com +short# Phải trả ra IP VPS

mkdir -p ~/n8n-stack/{caddy,n8n,postgres,backups}cd ~/n8n-stack # Tạo file .envcat > .env <<'EOF'# DomainDOMAIN=n8n.yourdomain.com[email protected] # n8nN8N_ENCRYPTION_KEY=<random_32_char_string>N8N_USER_MANAGEMENT_JWT_SECRET=<random_32_char_string> # PostgreSQLPOSTGRES_USER=n8nPOSTGRES_PASSWORD=<strong_random_password>POSTGRES_DB=n8nEOF # Set permission file env (CHỈ owner đọc được)chmod 600 .env

# Trên VPSopenssl rand -hex 32# Copy output, paste vào .env cho N8N_ENCRYPTION_KEY và JWT_SECRET (mỗi cái 1 string riêng) # Generate password Postgresopenssl rand -base64 24

cat > docker-compose.yml <<'EOF'services:  caddy:    image: caddy:2-alpine    container_name: caddy    restart: unless-stopped    ports:      - "80:80"      - "443:443"    volumes:      - ./caddy/Caddyfile:/etc/caddy/Caddyfile      - caddy_data:/data      - caddy_config:/config    networks:      - n8n-net    environment:      - DOMAIN=${DOMAIN}      - ACME_EMAIL=${ACME_EMAIL}   postgres:    image: postgres:16    container_name: n8n-postgres    restart: unless-stopped    environment:      - POSTGRES_USER=${POSTGRES_USER}      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}      - POSTGRES_DB=${POSTGRES_DB}    volumes:      - postgres_data:/var/lib/postgresql/data    networks:      - n8n-net    healthcheck:      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]      interval: 10s      timeout: 5s      retries: 5   n8n:    image: n8nio/n8n:latest    container_name: n8n    restart: unless-stopped    depends_on:      postgres:        condition: service_healthy    environment:      - DB_TYPE=postgresdb      - DB_POSTGRESDB_HOST=postgres      - DB_POSTGRESDB_PORT=5432      - DB_POSTGRESDB_DATABASE=${POSTGRES_DB}      - DB_POSTGRESDB_USER=${POSTGRES_USER}      - DB_POSTGRESDB_PASSWORD=${POSTGRES_PASSWORD}      - N8N_HOST=${DOMAIN}      - N8N_PORT=5678      - N8N_PROTOCOL=https      - WEBHOOK_URL=https://${DOMAIN}/      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}      - N8N_USER_MANAGEMENT_JWT_SECRET=${N8N_USER_MANAGEMENT_JWT_SECRET}      - GENERIC_TIMEZONE=Asia/Ho_Chi_Minh      - TZ=Asia/Ho_Chi_Minh    volumes:      - n8n_data:/home/node/.n8n    networks:      - n8n-net volumes:  caddy_data:  caddy_config:  postgres_data:  n8n_data: networks:  n8n-net:    driver: bridgeEOF

cat > caddy/Caddyfile <<'EOF'{$DOMAIN} {    tls {$ACME_EMAIL}     reverse_proxy n8n:5678 {        flush_interval -1        header_up Host {host}        header_up X-Real-IP {remote_host}        header_up X-Forwarded-For {remote_host}        header_up X-Forwarded-Proto {scheme}    }     encode gzip     header {        Strict-Transport-Security "max-age=31536000;"        X-Content-Type-Options "nosniff"        X-Frame-Options "SAMEORIGIN"        Referrer-Policy "strict-origin-when-cross-origin"    }}EOF

cd ~/n8n-stackdocker compose up -d # Theo dõi logdocker compose logs -f # Stop log: Ctrl+C

cat > ~/n8n-stack/backup.sh <<'EOF'#!/bin/bashset -e BACKUP_DIR=~/n8n-stack/backupsDATE=$(date +%Y%m%d_%H%M%S)KEEP_DAYS=14 cd ~/n8n-stack # Dump databasedocker compose exec -T postgres pg_dump -U n8n n8n | gzip > $BACKUP_DIR/n8n_db_${DATE}.sql.gz # Backup volume n8n_data (chứa credential encryption seed)docker run --rm     -v n8n-stack_n8n_data:/data     -v $BACKUP_DIR:/backup     alpine tar czf /backup/n8n_data_${DATE}.tar.gz -C /data . # Xóa backup cũ hơn KEEP_DAYS ngàyfind $BACKUP_DIR -name "*.gz" -mtime +$KEEP_DAYS -delete echo "Backup completed: $DATE"EOF chmod +x ~/n8n-stack/backup.sh

crontab -e # Thêm dòng:0 3 * * * /home/n8nadmin/n8n-stack/backup.sh >> /home/n8nadmin/n8n-stack/backup.log 2>&1

./backup.shls -lh backups/

# Cài AWS CLIsudo apt install awscli -y # Cấu hình credential cho Cloudflare R2 (rẻ + miễn phí egress)aws configure --profile r2# AWS Access Key ID: <R2_access_key># AWS Secret Access Key: <R2_secret_key># Default region: auto# Default output: json # Sửa backup.sh thêm phần uploadcat >> ~/n8n-stack/backup.sh <<'EOF' # Upload to Cloudflare R2aws s3 cp $BACKUP_DIR/n8n_db_${DATE}.sql.gz     s3://your-bucket/n8n-backups/     --endpoint-url https://<account_id>.r2.cloudflarestorage.com     --profile r2 aws s3 cp $BACKUP_DIR/n8n_data_${DATE}.tar.gz     s3://your-bucket/n8n-backups/     --endpoint-url https://<account_id>.r2.cloudflarestorage.com     --profile r2EOF

cd ~/n8n-stack # Backup TRƯỚC khi update./backup.sh # Pull image mớidocker compose pull # Recreate container (giữ volume data)docker compose up -d # Verifydocker compose logs n8n --tail 50

# Thay vìimage: n8nio/n8n:latest# Pin cụ thể version đang chạy stableimage: n8nio/n8n:1.65.2  # ví dụ

sudo nano /etc/ssh/sshd_config# Sửa: PasswordAuthentication no# Sửa: PermitRootLogin nosudo systemctl restart ssh

sudo apt install fail2ban -ysudo systemctl enable fail2ban

sudo apt install unattended-upgrades -ysudo dpkg-reconfigure -plow unattended-upgrades