How can I enable SSL for my Dockerized n8n on a DigitalOcean droplet using Cloudflare?

Below is an approach to get a proper SSL certificate for your self-hosted n8n instance.

Use a Reverse Proxy (Recommended)

The easiest way to get a valid SSL certificate is to run a reverse proxy that automatically manages certificates for you (for example, via Let's Encrypt). Here’s what you can do:

1. Set up a Reverse Proxy (e.g. Traefik or Caddy):
   A reverse proxy like Traefik or Caddy will handle certificate issuance and renewal. It should also route HTTPS traffic to your n8n container.

2. Configure Your DNS Correctly:
   Since you’re already using an A record (unproxied) in Cloudflare, your server will be directly accessible. With the reverse proxy running on the server, the certificate provider (Let’s Encrypt) will be able to perform the TLS-ALPN or HTTP challenge to verify your domain.

3. Set Up Your Docker Compose File:
   An example Docker Compose configuration using Traefik might look like this:

   YAMLCopied
   version: "3.7"
   
   services:
     traefik:
       image: "traefik"
       restart: always
       command:
         - "--api.insecure=true"
         - "--providers.docker=true"
         - "--providers.docker.exposedbydefault=false"
         - "--entrypoints.web.address=:80"
         - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
         - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
         - "--entrypoints.websecure.address=:443"
         - "--certificatesresolvers.mytlschallenge.acme.tlschallenge=true"
         - "--certificatesresolvers.mytlschallenge.acme.email=your_email@example.com"
         - "--certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json"
       ports:
         - "80:80"
         - "443:443"
       volumes:
         - traefik_data:/letsencrypt
         - /var/run/docker.sock:/var/run/docker.sock:ro
   
     n8n:
       image: docker.n8n.io/n8nio/n8n
       restart: always
       labels:
         - traefik.enable=true
         # Replace SUBDOMAIN and DOMAIN_NAME with your actual values.
         - traefik.http.routers.n8n.rule=Host(`SUBDOMAIN.DOMAIN_NAME`)
         - traefik.http.routers.n8n.tls=true
         - traefik.http.routers.n8n.entrypoints=websecure
         - traefik.http.routers.n8n.tls.certresolver=mytlschallenge
       environment:
         - N8N_HOST=SUBDOMAIN.DOMAIN_NAME
         - N8N_PORT=5678
         - N8N_PROTOCOL=https
       volumes:
         - n8n_data:/home/node/.n8n
   
   volumes:
     traefik_data:
       external: true
     n8n_data:
       external: true

   With this setup, Traefik automatically requests and renews a certificate using Let's Encrypt. Make sure to update SUBDOMAIN.DOMAIN_NAME and the email address accordingly.

Directly Passing SSL Certificates to n8n

If you prefer not to use a reverse proxy, you can pass your SSL certificates directly into n8n. To do this:

1. Generate or Obtain a Valid SSL Certificate:
   You can get a certificate from a trusted Certificate Authority or even from Let’s Encrypt manually.

2. Mount the Certificates or Set Environment Variables:
   Set the following environment variables in your n8n Docker environment:

   • N8N_SSL_CERT – Path to your SSL certificate
   • N8N_SSL_KEY – Path to your SSL key

   If using Docker Compose, you might do something like:

   YAMLCopied
   environment:
     - N8N_SSL_CERT=/path/to/fullchain.pem
     - N8N_SSL_KEY=/path/to/privkey.pem
   volumes:
     - ./certs:/path/to # make sure the container’s paths match with the env variables above

3. Keep Your Certificates Renewed:
   Note that when passing certificates directly, you must handle renewals on your own.

Summary

For most users, the best option is to run a reverse proxy (Traefik or Caddy) which will automatically obtain and renew SSL certificates. This approach minimizes manual certificate management and automatically secures your environment as long as your DNS is set up correctly.

By updating your Docker Compose file to include a reverse proxy with a certificate resolver (using Let's Encrypt), you should avoid the “no SSL / Dangerous site” warnings when accessing your n8n subdomain.