n8n Docker 自架完整教學：docker-compose、環境變數、資料庫、備份與升級一次講清楚

version: '3.8'

services:
  postgres:
    image: postgres:16-alpine
    restart: always
    environment:
      POSTGRES_DB: n8n
      POSTGRES_USER: n8n
      POSTGRES_PASSWORD: ${DB_POSTGRESDB_PASSWORD}
      POSTGRES_NON_ROOT_USER: n8n_app
      POSTGRES_NON_ROOT_PASSWORD: ${DB_POSTGRESDB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -h localhost -U n8n -d n8n']
      interval: 5s
      timeout: 5s
      retries: 10

  n8n:
    image: docker.n8n.io/n8nio/n8n:latest
    restart: always
    environment:
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_PORT=5432
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - DB_POSTGRESDB_PASSWORD=${DB_POSTGRESDB_PASSWORD}
      - N8N_HOST=${N8N_HOST}
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://${N8N_HOST}/
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=${N8N_BASIC_AUTH_USER}
      - N8N_BASIC_AUTH_PASSWORD=${N8N_BASIC_AUTH_PASSWORD}
      - GENERIC_TIMEZONE=Asia/Taipei
      - TZ=Asia/Taipei
      - EXECUTIONS_DATA_PRUNE=true
      - EXECUTIONS_DATA_MAX_AGE=720
    ports:
      - 127.0.0.1:5678:5678
    volumes:
      - n8n_data:/home/node/.n8n
    depends_on:
      postgres:
        condition: service_healthy

  caddy:
    image: caddy:2-alpine
    restart: always
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - n8n

volumes:
  postgres_data:
  n8n_data:
  caddy_data:
  caddy_config:

n8n.example.com {
    reverse_proxy n8n:5678 {
        flush_interval -1
    }
}

# .env  (chmod 600, add to .gitignore)
DB_POSTGRESDB_PASSWORD=請用 openssl rand -base64 32 產生
N8N_ENCRYPTION_KEY=請用 openssl rand -base64 32 產生 (這組很重要，掉了救不回來)
N8N_BASIC_AUTH_USER=admin
N8N_BASIC_AUTH_PASSWORD=請用 openssl rand -base64 24 產生
N8N_HOST=n8n.example.com

# 1. 產生三組隨機密鑰
openssl rand -base64 32  # DB_POSTGRESDB_PASSWORD
openssl rand -base64 32  # N8N_ENCRYPTION_KEY (另外抄一份放保險箱)
openssl rand -base64 24  # N8N_BASIC_AUTH_PASSWORD

# 2. 把密鑰填進 .env
nano .env

# 3. 啟動（第一次會抓 image，大概 1-2 分鐘）
docker compose up -d

# 4. 看 n8n 是否起來
docker compose logs -f n8n
# 看到 "Editor is now accessible via" 就成功了

#!/bin/bash
# backup-n8n.sh
set -e

BACKUP_DIR="/opt/n8n-backups"
DATE=$(date +%Y%m%d-%H%M%S)
mkdir -p "$BACKUP_DIR"

# 1. PostgreSQL dump (熱備，不用停服務)
docker compose exec -T postgres pg_dump -U n8n -d n8n --clean --if-exists \
  | gzip > "$BACKUP_DIR/n8n-db-$DATE.sql.gz"

# 2. n8n volume (包起來)
docker run --rm \
  -v $(pwd | sed 's|/|_|g')_n8n_data:/data \
  -v "$BACKUP_DIR":/backup \
  alpine tar -czf "/backup/n8n-volume-$DATE.tar.gz" -C /data .

# 3. .env 檔 (含 encryption key)
# 注意: 這份要加密後再傳到遠端, 直接明文不行
gpg --symmetric --cipher-algo AES256 \
  --output "$BACKUP_DIR/n8n-env-$DATE.env.gpg" .env

# 4. 清掉 30 天前的本地備份
find "$BACKUP_DIR" -mtime +30 -delete

# 5. 推到遠端 (R2 / S3 / Backblaze 都行)
aws s3 sync "$BACKUP_DIR" s3://your-backup-bucket/n8n/

# 6. 回報 (可以接到 n8n 的 webhook, 讓它自己報自己備份狀態)
curl -X POST https://n8n.example.com/webhook/backup-status \
  -H 'Content-Type: application/json' \
  -d "{\"status\":\"ok\",\"date\":\"$DATE\",\"size\":\"$(du -sh $BACKUP_DIR | cut -f1)\"}"

# crontab -e
0 2 * * * /opt/n8n/backup-n8n.sh >> /var/log/n8n-backup.log 2>&1

# ❌ 不要
image: docker.n8n.io/n8nio/n8n:latest

# ✅ 要
image: docker.n8n.io/n8nio/n8n:1.108.0