Self-host Nod, n8n's personal agent, on a server that stays on

On your computer (pick another name if my-nod is taken):

ssh exe.dev new --name=my-nod --disk=50GB
ssh my-nod.exe.xyz

A new VM has 2 vCPUs and 8 GB of memory, Nod's suggested starting size. The disk needs room for about 18 GB of images and their build. All remaining commands run on the VM, as exedev. Check the disk first:

df -h /

If it shows less than 45 GB, grow it from your computer with ssh exe.dev resize my-nod --disk=50GB, then run sudo resize2fs $(findmnt -no SOURCE /) on the VM.

Build and start Nod#

Turn on Docker so the containers start after a reboot, fetch the pinned source, and let Nod's setup.sh generate .env with the access token, vault key and database password:

sudo systemctl enable --now docker.service
git clone --branch nod-v0.7.5 --depth 1 https://github.com/n8n-io/nod.git ~/nod
cd ~/nod/deployment/self-host
sh setup.sh

Point Nod at the VM's address. Port 8000 is the one https://<vm>.exe.xyz/ reaches; the server stays on loopback, where the exe.dev proxy finds it. Then add the two model connections through the LLM integration:

sed -i -e 's/^PORT=.*/PORT=8000/' \
  -e "s|^NOD_PUBLIC_URL=.*|NOD_PUBLIC_URL=https://$(hostname).exe.xyz|" .env
cat >> .env <<'EOF'
AZURE_OPENAI_ENDPOINT=https://llm.int.exe.xyz/v1
AZURE_OPENAI_API_KEY=exe-llm-integration
AZURE_OPENAI_MODEL=gpt-6.1-sol
OPENAI_COMPATIBLE_BASE_URL=https://llm.int.exe.xyz/v1
LLM_PROVIDER=azure
EOF
grep -E '^(PORT|NOD_BIND_ADDRESS|NOD_PUBLIC_URL)=' .env

Expect PORT=8000, NOD_BIND_ADDRESS=127.0.0.1 and your VM's https:// address. Leave Nod's https profile off: exe.dev's proxy already handles HTTPS.

Build and start the stack. On 2 vCPUs this takes about 12 minutes, most of it compiling the workspace's tools:

docker compose up -d --build --wait
docker compose ps --format '{{.Service}}: {{.Status}}'

Expect six services Up, with server, postgres, browser and workspace-network (healthy). Then check that Nod answers on its address and wants its token:

curl -s -o /dev/null -w '%{http_code}\n' -H "Host: $(hostname).exe.xyz" http://127.0.0.1:8000/api/settings
docker compose logs server | grep 'Nod is ready'

Expect 401 and Nod is ready at https://<vm>.exe.xyz. A 403 means NOD_PUBLIC_URL doesn't match the VM's address.

Check what the agent can reach#

The workspace and browser should be cut off from exe.dev's integrations; the server, which makes the model calls, should not:

P=$(grep ^COMPOSE_PROJECT_NAME= .env | cut -d= -f2)
docker exec nod-workspace-$P curl -sS -m 10 -o /dev/null https://llm.int.exe.xyz/v1/models; echo "workspace: $?"
docker exec nod-workspace-$P curl -sS -m 10 -o /dev/null -w 'internet: %{http_code}\n' https://example.com/
docker exec $P-server-1 node -e 'fetch("https://llm.int.exe.xyz/v1/models").then(r => console.log("server:", r.status))'

Expect Couldn't connect to server and workspace: 7, then internet: 200 and server: 200. The browser's block is inside Nod; ask Nod to open https://reflection.int.exe.xyz/ in its browser, and it reports that the page didn't load.

First backup#

mkdir -p ~/backups && chmod 700 ~/backups
sh backup.sh ~/backups/nod-$(date +%F)
ls -A ~/backups/nod-$(date +%F)

Expect Backup saved, then .env, postgres.dump, four volume archives, source-commit and complete.

Nod's backup.sh stops the server, browser and workspace while it copies the database, the four data volumes, .env and the source commit into a new folder, then starts them again. On the VM:

cd ~/nod/deployment/self-host
sh backup.sh ~/backups/nod-$(date +%F-%H%M)

Restore into a fresh installation, so the original stays as it was until you've checked the copy. Clone the backup's commit into a new folder; on the VM, replacing BACKUP with the backup folder's name:

B=~/backups/BACKUP
git clone https://github.com/n8n-io/nod.git ~/nod-restored
git -C ~/nod-restored checkout "$(cat $B/source-commit)"
cd ~/nod-restored/deployment/self-host
sh restore.sh "$B" nod-restored

Stop the original, so two copies don't run the same schedules or answer the same bot, then start the restored one on the same port:

(cd ~/nod/deployment/self-host && docker compose stop)
docker compose up -d --build --wait

Open Nod with the same token and check your history, files, models and channels. Once you're happy, keep ~/nod-restored as your installation. Nod's operations guide has the details.

Read the releases first, and take a backup. Database migrations run on start, so an older version can't open an upgraded database: roll back by restoring the backup. On the VM, with the tag you chose:

cd ~/nod/deployment/self-host
docker compose stop
git fetch --depth 1 origin tag nod-v0.7.5
git checkout nod-v0.7.5
docker compose up -d --build --wait

After changing only .env, apply it with docker compose up -d --wait; docker compose restart keeps the old values. Keep COMPOSE_PROJECT_NAME as it is: it selects your data volumes.

The build cache grows with each update. docker builder prune -f frees it.

Ask Shelley, or check on the VM:

cd ~/nod/deployment/self-host
docker compose ps
docker compose logs --tail 100 server

• This host is not permitted or This origin is not permitted. NOD_PUBLIC_URL in .env must be exactly https://<vm>.exe.xyz, with no port or slash. Fix it, then docker compose up -d --wait.
• The page doesn't load at all. Check that the server listens with ss -ltn | grep 8000, and that ssh exe.dev share show my-nod says port 8000.
• The build stops with no space left on device. Grow the disk (see Install by hand) and run the build again; it reuses what it finished.
• A model request fails. Check the integration on the VM with curl -s https://llm.int.exe.xyz/v1/models | head -c 300. If that fails, the VM has no LLM integration attached; see the LLM integration docs.
• Containers missing after a reboot. Run sudo systemctl enable --now docker.service; the restart policy brings them back.