n8n Local Hosting with Cloudflare Tunnels - Long Version

Using Cloudflare Tunnels with self-hosted n8n offers a secure and hassle-free way to expose your automation workflows to the internet without opening ports or configuring firewalls. It eliminates the need for a static IP or dynamic DNS by creating an encrypted outbound connection from your server to Cloudflare’s edge network. This not only simplifies deployment but also adds a layer of protection against DDoS attacks and unauthorized access. With built-in TLS and fine-grained access controls, Cloudflare Tunnels make it easy to trigger n8n webhooks and integrations from anywhere while keeping your infrastructure locked down.

What you’ll need:

• A machine to host n8n. This can be a spare PC or even just an inexpensive Raspberry Pi (that’s what I used).
• A free Cloudflare account.
• A web domain that lives on Cloudflare’s nameservers. You can purchase a new one from Cloudflare or move a domain you already own to the Cloudflare nameservers.

The Setup:#

Step 1 - Install Docker:#

Here’s the official documentation on how to install Docker: https://docs.docker.com/engine/install/

I installed this on a Raspberry Pi and followed these instructions: https://pimylifeup.com/raspberry-pi-docker/ Note that n8n requires a 64-bit operating system so you’ll want to check your Raspberry Pi before proceeding using:

uname -m

• aarch64 means 64 bit
• armv7l, armv6l mean 32 bit

Step 2 - Create the Docker Network:#

Create a new Docker bridge network that will be shared by Cloudflared, n8n, and any other container containing a service you want to expose via the Cloudflare Tunnel.

docker network create tunnel

We’ve named the network “tunnel” for clarity, but you can choose any name. If you use a different name, remember to adjust subsequent instructions.

This network provides isolation for your containers from the host and other Docker containers. It also simplifies setup by enabling containers within the network to resolve each other by name, eliminating the need for IP addresses or host port mapping.

Typically, you’d point the tunnel to an IP address like http://192.168.1.128:5678. However, by placing both the cloudflared and n8n containers on the same Docker network, you can refer to n8n by its service name. If your n8n service is named n8n in your Docker Compose file (as shown in Step 6), you can simply use http://n8n:5678 in the Cloudflare Tunnel configuration.

Step 3 - Create the Tunnel in Cloudflare:#

Cloudflare Tunnels are part of Cloudflare’s Zero Trust suite, letting you protect tunnels with access policies such as user login requirements and IP-based exceptions for services. Cloudflare also provides a guided setup wizard that walks you through creating the tunnel, adding the managing application, and configuring those access policies. To access this:

1. Log into your Cloudflare account.
2. Click on Zero Trust in the menu on the left side of the page. You’ll need to set up an organization the first time you do this. Just choose a name and proceed.
3. Click the “Get started” tab at the top of the page.
4. Click on the “Get started” button next to “Securely access private web apps without an agent”.
5. Follow the steps which guides you through the process. When it asks you for a service route use http://n8n:5678

If you want to set this up piece by piece, refer to this post.

If you plan on using webhook triggers, you will need to add an access policy to allow those to hit the n8n service. See this post for how to do that: [[n8n self-hosted + Cloudflare Tunnel + Telegram]] . Note that some triggers like Telegram use webhooks under the covers.

Step 4 - Create the Cloudflared Docker Compose File:#

To simplify the creation, starting, and stopping of your cloudflared container, we’ll use a Docker Compose file instead of direct docker run commands. This eliminates the need to remember complex command-line arguments.

1. Create a directory to hold the compose file:

   mkdir ~/tunnel-compose
   

2. Create the docker compose file:

   nano ~/tunnel-compose/docker-compose.yml
   

3. Paste in the lines below.
4. Enter Ctrl+x , type in “y” to confirm, press enter to accept the file name.

services:
  cloudflared:
    image: cloudflare/cloudflared:latest
    cap_drop:
      - ALL
    read_only: true
    security_opt:
      - no-new-privileges:true
    container_name: cloudflared
    restart: unless-stopped
    command: tunnel run
    environment:
      - TUNNEL_TOKEN=${TUNNEL_TOKEN}
    networks:
      - tunnel
networks:
  tunnel:
    external: true

Here’s a detailed breakdown of each line in your Docker Compose file:

Step 5 - Create the .env file for Cloudflared#

The Docker Compose file retrieves the ${TUNNEL_TOKEN} value from the .env file. You can find this token in the docker run command provided by Cloudflare during tunnel setup. Alternatively, navigate to “Tunnels” under the network section in the Cloudflare Zero Trust dashboard, select your tunnel, click the edit button, and then click the Docker button to reveal the docker run command containing the token.

1. In the terminal, enter:

   nano ~/tunnel-compose/.env
   

2. Paste in the lines below. Set the TUNNEL_TOKEN value equal to the token for your tunnel .
3. Enter Ctrl+x , type in “y” to confirm, press enter to accept the file name.
4. Note that the .env file is a hidden file. To list it in the directory use:

   ls -a
   

.env file contents:

# Tunnel Token
TUNNEL_TOKEN=<YOUR TUNNEL TOKEN>

If you didn’t save the tunnel token when you set it up, you can retrieve it:

1. Log into your Cloudflare account.
2. Click Zero Trust in the side menu.
3. Under Networks, click on Tunnels.
4. Click the name of your tunnel and then the Edit button on the right side of the page.
5. Click the Docker button in the middle of the page to show the “docker run” command. The tunnel token is at the end.

Step 6 - Create the Docker Compose file for n8n:#

1. Create the docker volume for n8n:

   docker volume create n8n_data
   

2. Create a directory to hold the compose file:

   mkdir ~/n8n-compose
   

3. Create a directory for user files. This will allow n8n workflows to read and write files to the host file system.

   mkdir ~/n8n-compose/local-files
   

4. Create the docker compose file:

   nano ~/n8n-compose/docker-compose.yml
   

5. Paste in the lines below.
6. Enter Ctrl+x , type in “y” to confirm, press enter to accept the file name.

services:
  n8n:
    image: docker.n8n.io/n8nio/n8n
    container_name: n8n
    restart: unless-stopped
    environment:
      - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
      - N8N_PORT=5678
      - N8N_SECURE_COOKIE=false
      - N8N_PROXY_HOPS=1
      - N8N_RUNNERS_ENABLED=true
      - NODE_ENV=production
      - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/
      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}
      - TZ=${GENERIC_TIMEZONE}
    volumes:
      - n8n_data:/home/node/.n8n
      - ./local-files:/files
    networks:
      - tunnel
networks:
  tunnel:
    external: true
volumes:
  n8n_data:

Here is a line by line explanation of what we’re setting up.

Step 7 - Create the .env file for n8n#

Values in the docker-compose.yml file defined with “${VARIABLE}” pull values from the .env file.

1. In the terminal, enter:

   nano ~/n8n-compose/.env
   

2. Paste in the lines below, changing the values to match your environment. The domain and subdomain names are those you set up when creating the Cloudflare application / tunnel.
3. Enter Ctrl+x , type in “y” to confirm, press enter to accept the file name.
4. Note that the .env file is a hidden file. To list it in the directory use:

   ls -a
   

.env file contents:

# DOMAIN_NAME and SUBDOMAIN together determine where n8n will be reachable from
# The top level domain to serve from
DOMAIN_NAME=yourdomain.com

# The subdomain to serve from
SUBDOMAIN=n8n

# Optional timezone to set which gets used by Cron and other scheduling nodes
# New York is the default value if not set
GENERIC_TIMEZONE=America/Detroit

Step 8 - Start the n8n container#

1. In the terminal cd to the n8n compose directory:

   cd ~/n8n-compose
   

2. Create and start the n8n container:

   docker compose up -d
   

3. After the container is started, view the logs to look for any errors:

   docker compose logs n8n
   

Step 9 - Start the Cloudflared container#

1. In the terminal cd to the Cloudflared compose directory:

   cd ~/tunnel-compose
   

2. Create and start the Cloudflared container:

   docker compose up -d
   

3. After the container is started, view the logs to look for any errors:

   docker compose logs cloudflared
   

Step 10 - Access the n8n editor#

In your browser, go to https://<subdomain.domain>. For example, if you set the tunnel up with subdomain = n8n and domain = example.com, visit https://n8n.example.com. You’ll land on the Cloudflare login page, and once you sign in, the n8n editor will appear. The first time you access it, you’ll be asked to create a username and password. And that’s it. You now have safe, authenticated access to your self-hosted n8n instance from anywhere on the public internet.