How can I correctly set up n8n with Portainer and Nginx Proxy Manager for production use?

Below is some guidance based on the Docker Compose setup referenced in the n8n documentation:

---

1. Reverse Proxy Overlap

You’re currently running two reverse proxies on the same host:

• Your Docker Compose setup launches a Traefik container that is set to handle SSL termination and routing.
• You already run Nginx Proxy Manager (NPM) for managing domains and SSL.

Running both can lead to conflicts. In your setup, Traefik is listening on ports 8080/8443 (instead of the standard 80/443 to avoid conflict with NPM), while NPM is also proxying to port 5678. The result is that external traffic might not be reaching n8n the way you expect.

Options:

• Use Only One Reverse Proxy:
  • If you prefer Traefik (as provided by the n8n docs), remove NPM’s reverse proxy for n8n and update your DNS to point to your server’s IP on ports 8080/8443 (or better yet, use the standard ports with a dedicated Traefik setup).
  • If you prefer to keep NPM doing SSL termination and routing, remove the Traefik service from your compose file and let NPM route traffic to the n8n container. In that case, consider binding n8n on a network-accessible interface (or a Docker network) so that NPM can reach it.

---

2. Container Port Binding

Currently, the n8n service’s ports are defined as:

YAMLCopied
ports:
  - "127.0.0.1:5678:5678"

This means n8n is only accessible from the host’s localhost. If you remove Traefik and want NPM (or another reverse proxy) to route traffic to n8n, you have to ensure the container is reachable from outside the host (or at least from the container running NPM). You could:

• Change it to bind on all interfaces:

  YAMLCopied
  ports:
    - "5678:5678"

• Or, better yet, set up a Docker network so that your reverse proxy container can talk to n8n directly without exposing ports publicly.

---

3. Webhook URL & Production Setup

The WEBHOOK_URL you set in the environment:

INICopied
WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/

n8n uses this URL to calculate webhook callback addresses. Make sure that whichever reverse proxy method you choose (Traefik or NPM) the external URL provided here corresponds exactly to the route reaching n8n.

---

4. Recommendations for Your Use-case

Using Nginx Proxy Manager Only

Since you’re already comfortable with NPM, you might consider the following change:

1. Remove the Traefik Service:
   Delete the Traefik part from your docker-compose.
2. Expose n8n Appropriately:
   Adjust the port mapping so that the container is accessible to NPM. For example:

   YAMLCopied
   services:
     n8n:
       image: n8nio/n8n
       restart: always
       ports:
         - "5678:5678"   # or attach to a Docker network used by NPM
       environment:
         - N8N_BASIC_AUTH_ACTIVE=true
         - N8N_BASIC_AUTH_USER=${N8N_BASIC_AUTH_USER}
         - N8N_BASIC_AUTH_PASSWORD=${N8N_BASIC_AUTH_PASSWORD}
         - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
         - N8N_PORT=5678
         - N8N_PROTOCOL=https
         - NODE_ENV=production
         - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/
         - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}
       volumes:
         - ${DATA_FOLDER}/.n8n:/home/node/.n8n

3. Configure NPM’s Proxy:
   In NPM, set up a proxy host for n8n.example.com (or your actual domain), forwarding to the local IP address of the n8n container (or your host IP on port 5678). Ensure SSL is set up in NPM so that external clients reach n8n via HTTPS.
4. DNS and Port Access:
   Ensure your DNS record for n8n points to your server. Since NPM handles SSL (likely on ports 80/443), you no longer need to use non-standard ports like 8080 or 8443 in your docker-compose.

Using Traefik Only

If you’d rather follow the n8n Docker Compose documentation precisely:

1. Remove NPM for n8n:
   Let Traefik handle external routing.
2. Expose Traefik on Ports 80/443:
   Adjust the ports so your server’s entrypoints match standard ports (if possible).
3. Ensure DNS Points to Traefik:
   Update your DNS so that n8n.example.com resolves to your server and traffic goes through Traefik’s ports.
4. Keep WEBHOOK_URL Consistent:
   The URL in the n8n environment must correspond to the address reachable from the outside.

---

5. Testing Webhooks

Once you’ve resolved the reverse proxy and port binding, test an incoming webhook by:

• Verifying the webhook URL (check logs to see if n8n receives a request).
• Using a tool like cURL or Postman to post to the webhook URL and checking n8n’s response.

---

Conclusion

Your configuration isn’t “wrong” in terms of syntax but is running into an architecture conflict: you’re mixing two reverse proxy setups. For a smoother setup as a beginner, stick to one method. Either remove Traefik and use Nginx Proxy Manager to route traffic to a publicly reachable n8n container, or let Traefik handle the SSL and routing (in which case remove NPM’s involvement for n8n).

If you need additional details on configuring n8n with Docker Compose for production, please check the official n8n self-hosting documentation for Docker Compose setups.

---

Feel free to ask for more details if needed!