What self-hosting actually includes
A VM or container host, reverse proxy with TLS, n8n app, database or embedded storage depending on setup, credential encryption keys, backup jobs, monitoring/alerts, and an upgrade process. “Docker run” is the beginning, not the system.
You also own timezone, disk growth from execution logs, and access control for who can open the editor. Treat the editor like production deploy access — because it is.
If that paragraph already feels heavy, prefer n8n Cloud or partner-managed hosting until you hire ops capacity.
Minimum viable production checklist
TLS on a real domain, automated backups with a tested restore, SSH key-only access, firewall restricted ports, and alerting when n8n or disk fails.
- Named admin users — no shared root password in WhatsApp
- Separate staging if you edit risky workflows
- Documented upgrade window monthly or per release notes
What “managed by a friend” often misses
Friends reboot servers; they rarely test restore or rotate keys after employee exits. Write responsibilities into a contract even if the friend is inexpensive.
Cloud n8n vs India/nearby VPS vs partner-managed
n8n Cloud: least ops burden, vendor handles platform, you govern workflows and credentials. Good default for many SMEs learning the tool.
Self-VPS: maximum control and potentially better unit economics at high volume; you own incidents. Region choice (India vs Singapore/EU) follows policy and latency.
Partner-managed: middle path — partner patches and backs up; you still approve workflow changes. Common for SMEs who want n8n without a Linux hire.
When Cloud wins
No IT owner, first n8n project, or migration already risky enough without infrastructure variables.
When VPS wins
High execution volume, need to colocate near internal databases, or procurement requires infrastructure under your account with audit access.
VPS cost bands and the costs people forget
Entry production VPS sizing depends on concurrent executions and whether you run queue mode / workers. Undersizing shows up as delayed webhooks during campaigns — not as a neat error message.
Forgotten line items: snapshot storage, object storage for backups, domain/DNS, status monitoring SaaS, and two hours a month of admin time. Admin time often dwarfs the VM invoice.
Compare total monthly against Zapier/Make projected spend at your volume — best tools framework. If hosted tools are still cheaper including labour, stay hosted.
Rough planning heuristic
If nobody can name who gets the alert at 11 p.m., your true self-host cost is infinite — because outages will be discovered by customers first.
Backups: the difference between inconvenience and catastrophe
Back up the database/volume and the encryption keys used for credentials. Workflow JSON exports alone are not enough if keys are lost — credentials will not decrypt cleanly.
Store backups off-box. A snapshot on the same dying disk is not a backup strategy. Test restore into a throwaway VM quarterly.
Retention: keep enough history to survive a bad upgrade discovered days later, not only last night’s snapshot.
- Automated daily backups
- Offsite copy
- Documented restore steps
- Quarterly restore drill with timestamp
Execution data vs workflow definitions
Decide how long to keep execution logs for debugging versus privacy. High retention fills disks; zero retention blinds incident response.
SSL, domains, and exposing webhooks safely
Public HTTPS endpoints are required for many SaaS webhooks (Meta, payment providers). Use a reverse proxy with automatic certificate renewal. Expired certs present as mysterious “zap stopped” tickets.
Restrict editor access via VPN or IP allowlists when practical. Webhooks need to be public; the UI does not.
Verify webhook signatures where providers support them. Unsigned public URLs invite junk traffic that can create junk CRM rows if you are careless.
DNS and cutover tips
When moving from Cloud to VPS, lower TTLs ahead of time and keep the old endpoint draining briefly. Same discipline as Zapier→n8n cutover.
TLS monitoring
Alert 14 days before certificate expiry even if auto-renew exists — auto-renew fails silently more often than vendors admit.
Upgrades, breaking changes, and staging
n8n releases move. Pin versions, read release notes, and upgrade on a schedule — not when you are already debugging a CRM outage.
Staging environment that mirrors production credentials shape (with sandbox apps) catches node breaking changes. Skipping staging is how Friday deploys ruin weekends.
Keep a rollback image or previous container tag ready. Hope is not a strategy.
Who approves upgrades
Name a role. Unowned upgrades never happen until something forces an emergency leap across many versions — the riskiest kind.
Security risks unique to self-host
Exposed Docker APIs, weak SSH, shared root passwords, and n8n instances left on default settings are common SME findings. Credential stores are juicy targets — protect the box like it holds CRM API keys, because it does.
Offboarding: remove SSH keys and n8n users the day staff leave. Rotate provider tokens after departures from automation teams.
Logging: avoid shipping full PII to public Slack. Hash or truncate phones in alerts where possible.
Compliance narrative tips
Document region, access list, backup locations, and subprocessors (VPS vendor). Self-host helps the story; documentation completes it.
Operational risks: the outages we actually see
Disk full from execution history. Provider account suspended for unpaid invoice. Memory exhaustion during a campaign spike. Time drift breaking OAuth. DNS change by a well-meaning intern.
Mitigations: disk alerts, billing alerts on the card that pays the VPS, horizontal thinking for workers if volume grows, and change control for DNS.
Customer-facing WhatsApp flows need a documented manual fallback if n8n is down — even a temporary Sheet + human send process.
- Pager or at least Slack alert for downtime
- Runbook for “n8n unreachable”
- Capacity headroom before campaigns
- Finance owns renewal dates
Risk of DIY YouTube installs
Copy-paste install scripts without understanding volumes and keys create un-restorable snowflakes. Prefer documented compose files your team can explain.
When partner-managed or Cloud is the win
If your competitive advantage is not Linux administration, buy that outcome. Many Chennai SMEs correctly choose Cloud or partner-managed and spend attention on sales process quality instead.
Revisit self-host when volume math or enterprise questionnaires demand it — not because a Twitter thread mocked SaaS.
Make and Zapier remain valid alternatives when the workflow is simple — honesty over ideology.
Brevia hosting postures we offer
Workflow-only on your Cloud, harden-your-VPS engagements, or ongoing managed care — scoped after discovery. Start at n8n Automation or consultation.
Decision checklist before you buy a VPS
Can you name the 24/7 owner? Are backups tested? Is TLS automated? Do you have staging? Is migration simultaneous or sequenced? If any answer is no, delay self-host.
If answers are yes, proceed with sizing, monitoring, and a written upgrade policy. Then build workflows — infrastructure first prevents rebuilding on sand.
Next reading and contact
Continue with n8n beginners, Zapier migration, and cost guide. Reach us via contact.
Ready to automate one painful workflow?
Tell us your stack — n8n, Make, Zapier, WhatsApp, or Playwright. Chennai HQ · India delivery · reply within one business day.