Use local n8n for learning with synthetic data; use n8n Cloud or a properly operated self-hosted deployment for real workflows. Current official docs describe npm, Docker, and server setup options. Do not expose a laptop process or default development configuration to the public internet.

// concept

Local Lab

Create a dedicated directory and a pinned version. Prefer the current official Docker guidance for an isolated lab. Persist the n8n user directory in a named volume, choose a strong unique encryption key through protected environment configuration, and bind only to localhost.

Never commit:

// prompt — copy me5 lines

N8N_ENCRYPTION_KEY
database credentials
OAuth client secrets
API keys/tokens
exported workflows containing credentials or private data

Start the instance, create an owner identity, enable available account security, and verify a synthetic workflow. Record version and stop/remove steps.

// concept

Production Decision

For n8n Cloud, review region, data handling, plan limits, roles, support, and export. For self-hosting, design:

DNS/TLS and reverse proxy;
PostgreSQL where appropriate for production;
encryption-key custody and recovery;
secure database/network boundaries;
backups and restore tests;
execution/binary-data retention;
update staging and rollback;
monitoring, alerts, resource limits, and on-call;
webhook base URL and trusted proxy configuration;
tenant/user/licensing model.

SQLite and a single container can be acceptable for a lab, not evidence of a resilient business service.

// worked_example

Worked Example

A Karachi developer runs a localhost Docker lab with a named volume and sample leads. No inbound port is exposed. After proving the workflow, the client chooses its own managed n8n account rather than turning the developer’s laptop into production.

The handover records owner email, recovery owner, version, workflow export, credential names (not values), backup procedure, and destroy steps. Real WhatsApp and CRM credentials are created only in the client-controlled environment.

// failure_cases

Failure Cases to Diagnose

6 cases to diagnose

Public port opened for convenience
use a controlled tunnel only for temporary authorized tests, then remove it.
Encryption key lost
credentials may become unrecoverable; back it up securely.
Default owner belongs to freelancer
transfer to client control.
Production uses an unbacked laptop volume
deploy a supported operated service.
Environment printed in logs
rotate secrets and redact diagnostics.
“Cloud” assumed maintenance-free
review limits, incidents, export, and access.

// pakistan_angle

Pakistan Angle

Local power and connectivity interruptions make a home PC or office laptop an unsuitable production dependency. Use a region and provider based on measured latency, availability, payment, support, and data obligations—not mere proximity.

Keep client instances and credentials isolated. One agency database containing several clients increases cross-tenant and offboarding risk. If central management is proposed, confirm n8n licensing and contractual authority first.

// hands_on

Hands-On Exercise

5 steps

Build the localhost synthetic lab.
Record version, storage, key custody, and remove steps.
draw the production architecture.
threat-model public ingress and credentials.
perform an export and clean reinstall test.

// completion_rubric

Completion Rubric

6 checks — tick as you verify

0/6

// sources

Sources

3 official sources — check every claim yourself

// check_yourself

Check yourself

4 questions · answers and options are taken word-for-word from this course

0/4

1 / 4 · diagnose
Your work shows this failure mode: “Public port opened for convenience.” What does the lesson tell you to do about it?