Running automation on a raw port (e.g., :5678) is a major security vulnerability. In this lesson, we implement an Nginx Reverse Proxy with SSL to secure your "Automation Factory" behind an encrypted, high-status URL.

🏗️ The Proxy Architecture

Nginx acts as the "Gatekeeper" for your server. It intercepts traffic on port 443 (HTTPS), validates the SSL certificate, and securely passes the request to n8n on port 5678 internally.

Create this file at /etc/nginx/sites-available/n8n:

server {
    listen 80;
    server_name automate.yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name automate.yourdomain.com;

    location / {
        proxy_pass http://localhost:5678;
        proxy_set_header Connection '';
        proxy_http_version 1.1;
        chunked_transfer_encoding off;
        proxy_buffering off;
        proxy_cache off;
    }
}

In 2026, there is zero excuse for unencrypted traffic. Use Certbot (Let's Encrypt) to automate your SSL renewal: sudo certbot --nginx -d automate.yourdomain.com

1. Configure: Setup a basic Nginx site pointing to a local HTML file.
2. Redirect: Implement a port-forward from port 80 to port 8080.
3. Verify: Access the site via your domain and verify the "Green Padlock" is active.

🇵🇰 Pakistan Scenario: Securing Your Client's Automation

You're building an automation for a Lahore e-commerce brand. They process 500 orders/day through Daraz and their own Shopify store. Their data includes customer names, phone numbers, and addresses.

Why SSL matters here: Pakistan's PECA (Prevention of Electronic Crimes Act) requires data protection. If customer data leaks because you ran n8n on an unencrypted port, you're legally liable. The 5-minute Certbot setup protects you AND builds client trust.

Domain tip: Buy a .pk or .com.pk domain from PKNIC for PKR 2,500/year. Point automate.yourbrand.pk to your VPS. Pakistani clients trust local domains more.

Link your n8n Docker container to your Nginx proxy. Ensure that n8n can only be accessed via your HTTPS domain and that the raw port 5678 is blocked by your server's firewall (ufw).

📺 Recommended Videos & Resources

• Nginx Reverse Proxy Setup for n8n — Official n8n reverse proxy documentation
  • Type: Documentation
  • Link description: Visit docs.n8n.io/hosting, search "Nginx"
• Let's Encrypt SSL Certificate in 5 Minutes — YouTube tutorial for Certbot automated SSL setup
  • Type: YouTube
  • Link description: Search YouTube for "Certbot Let's Encrypt tutorial"
• UFW Firewall for Ubuntu VPS — Critical for blocking raw ports and exposing only HTTPS
  • Type: YouTube
  • Link description: Search YouTube for "UFW firewall Ubuntu tutorial"
• PKNIC Domain Registration Guide (.pk Domains) — Register .pk domains for Pakistani trust + SEO
  • Type: Documentation
  • Link description: Visit pknic.net.pk, search "domain registration"
• Pakistani VPS Security Checklist 2026 — Includes SSL, firewall, and Pakistan-specific considerations
  • Type: YouTube
  • Link description: Search YouTube for "VPS security hardening 2026"

🎯 Mini-Challenge

Secure your domain today: Buy or use a free test domain, point it to your VPS IP, run Certbot to generate a free SSL certificate, and verify the green padlock in your browser. (Bonus: Add your n8n instance behind the proxy and share the HTTPS URL with a friend to test.)

🖼️ Visual Reference

📊 Nginx Reverse Proxy Security Layer

┌─────────────────────────────────────────┐
│        Internet Traffic (Port 443)      │
│         automate.yourdomain.com         │
└──────────────────┬──────────────────────┘
                   │ HTTPS (Encrypted)
                   ↓
        ┌──────────────────────┐
        │  Nginx Reverse Proxy │
        │ (Gatekeeper)         │
        │ - SSL Validation     │
        │ - Request Filtering  │
        └──────────────┬───────┘
                       │ HTTP (Local)
                       ↓
            ┌──────────────────────┐
            │  n8n Container      │
            │  (Port 5678)        │
            │  - Isolated         │
            │  - Protected        │
            └──────────────────────┘

Only HTTPS traffic enters. Raw port 5678 is invisible to the world.