Installing the n8n AI Starter Kit with Ollama

The Self-hosted AI Starter Kit is a Docker Compose template from the n8n team for building AI workflows that run entirely on your own server. Prompts and documents are processed by a local language model and are not sent to external AI services.

The kit includes four components:

• n8n, the workflow automation platform with AI nodes;
• Ollama, which runs open language models locally;
• Qdrant, a vector database for storing and searching document embeddings;
• PostgreSQL, the database for n8n.

The official kit is marked by its authors as intended for testing. At the time of writing, run as described in its README, it has several problems on a server with a public IP address: n8n, Ollama and Qdrant are open to the internet, Ollama and Qdrant have no authentication, the secrets in the configuration are the same for every installation, and the demo workflow is not imported. This guide installs the kit as is and fixes all of that with a separate override file, so you can still update the kit from its repository.

This guide is written for Ubuntu 24.04 LTS, n8n 2.47.3, Ollama 0.40.16, Qdrant 1.20.0, Docker 29 and Docker Compose v5.

Before you start

You will need:

• a server running Ubuntu 24.04 LTS with root access over SSH;
• at least 15 GB of free disk space: the Docker images take about 11 GB and the default Llama 3.2 model about 2 GB;
• a domain or subdomain for n8n, for example n8n.example.com, with an A record pointing to the server's IPv4 address.

All commands below are run as root. If you work as a regular user with sudo rights, add sudo before each command.

Install Docker

Install Docker Engine and the Compose plugin from the official Docker repository:

apt update && apt install -y ca-certificates curl git
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

Add the repository:

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list

Install the packages and check the versions:

apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
docker --version
docker compose version

Download the kit

Clone the repository to /opt and create the configuration file from the example:

cd /opt
git clone https://github.com/n8n-io/self-hosted-ai-starter-kit.git
cd self-hosted-ai-starter-kit
cp .env.example .env

Replace the default secrets

The example file contains fixed values, such as password for PostgreSQL and super-secret-key for the n8n encryption key. They are the same in every copy of the kit, so replace them with random ones:

sed -i "s/^POSTGRES_PASSWORD=.*/POSTGRES_PASSWORD=$(openssl rand -hex 24)/" .env
sed -i "s/^N8N_ENCRYPTION_KEY=.*/N8N_ENCRYPTION_KEY=$(openssl rand -hex 32)/" .env
sed -i "s/^N8N_USER_MANAGEMENT_JWT_SECRET=.*/N8N_USER_MANAGEMENT_JWT_SECRET=$(openssl rand -hex 32)/" .env
chmod 600 .env

N8N_ENCRYPTION_KEY encrypts the credentials you save in n8n. N8N_USER_MANAGEMENT_JWT_SECRET signs user sessions.

Close the ports and add HTTPS

In the kit's docker-compose.yml, n8n (port 5678), Ollama (11434) and Qdrant (6333) are published on all network interfaces. Docker adds its own firewall rules for published ports, and they bypass UFW. On a server with a public IP address, this means anyone can open the n8n editor over plain HTTP and use the Ollama and Qdrant APIs, which have no authentication.

Instead of editing docker-compose.yml, create docker-compose.override.yml next to it. Docker Compose reads this file automatically and applies it on top of the main one. The kit's own files stay unchanged, so updating them from the repository does not overwrite your settings.

Create /opt/self-hosted-ai-starter-kit/docker-compose.override.yml and replace n8n.example.com with your domain:

services:
  n8n:
    ports: !override
      - "127.0.0.1:5678:5678"
    environment:
      - N8N_HOST=n8n.example.com
      - N8N_PROTOCOL=https
      - N8N_PROXY_HOPS=1
      - N8N_WEBHOOK_URL=https://n8n.example.com/

  ollama-cpu:
    ports: !reset []

  ollama-gpu:
    ports: !reset []

  qdrant:
    ports: !reset []

  caddy:
    image: caddy:2
    restart: unless-stopped
    networks: ['demo']
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config

volumes:
  caddy_data:
  caddy_config:

Here is what this file changes:

• n8n listens only on 127.0.0.1, and users reach it through Caddy over HTTPS;
• Ollama and Qdrant are not published at all, n8n reaches them over the internal Docker network by the names ollama and qdrant;
• Caddy is added as a reverse proxy that gets and renews a Let's Encrypt certificate, as long as the domain points to the server and ports 80 and 443 are open;
• data volumes for n8n, PostgreSQL, Qdrant and Ollama stay as defined in the kit's docker-compose.yml, the override does not change them.

N8N_WEBHOOK_URL sets the address n8n uses for webhooks, including the chat window in the editor. The domain must resolve to your server from the computer where you open n8n. If it does not, the chat shows only the message "Failed to receive response", without pointing to DNS as the cause.

Create /opt/self-hosted-ai-starter-kit/Caddyfile with your domain:

n8n.example.com {
    reverse_proxy n8n:5678
}

Check the merged configuration:

docker compose --profile cpu config | grep -A4 "ports:"

Only n8n on 127.0.0.1:5678 and Caddy on ports 80 and 443 should be listed.

Configure the firewall

The override file already keeps the kit's internal services off the network. UFW blocks all other incoming traffic to the server, except SSH, HTTP and HTTPS. Allow these and enable UFW:

ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw --force enable

Start the kit

Start the stack in CPU mode:

docker compose --profile cpu up -d

On the first start, Docker downloads about 11 GB of images, and a separate container downloads the Llama 3.2 model. This takes a while, depending on the connection speed. Check that the model is in place:

docker exec ollama ollama list

The list should include llama3.2:latest.

Check that only the expected ports are open on the server:

ss -tlnp

Ports 80 and 443 should be open on all interfaces, port 5678 only on 127.0.0.1. Ports 11434 and 6333 should not be in the list.

Import the demo workflow

The kit includes a demo workflow and two demo credentials. They are supposed to be imported on the first start, but at the time of writing the import check in the kit's docker-compose.yml never passes, so nothing is imported. Run the import manually:

docker compose --profile cpu run --rm n8n-import -c "n8n import:credentials --separate --input=/demo-data/credentials"
docker compose --profile cpu run --rm n8n-import -c "n8n import:workflow --separate --input=/demo-data/workflows"

The -c option is required: the n8n-import service starts a shell, and without -c the command fails with the error "can't open 'n8n'".

Create the owner account

Open https://n8n.example.com in your browser and create the owner account: enter your email, first and last name, and a password of at least 8 characters with at least one number and one capital letter. After the first login, n8n may show a short survey and an offer of a free license key for some Community Edition features. Both are optional.

The overview page lists the imported Demo workflow.

Fix the demo credentials

The demo credentials were encrypted with the default key from .env.example. After you replaced N8N_ENCRYPTION_KEY, n8n cannot decrypt them, so both have to be filled in again. The settings are saved encrypted with your own key.

Open Overview, go to the Credentials tab and open Local Ollama service. The connection fails, and the Base URL field shows http://localhost:11434. Inside the n8n container, localhost is n8n itself, not Ollama.

Set Base URL to http://ollama:11434, leave API Key empty and click Save. n8n tests the connection and shows Connection tested successfully.

Open Local QdrantApi database. Set Qdrant URL to http://qdrant:6333, leave API Key empty and click Save.

Test the demo workflow

Open Demo workflow. It contains three nodes: Chat Trigger receives a message, Basic LLM Chain passes it to the model, and Ollama Chat Model sends it to Llama 3.2 in Ollama.

Click Open chat at the bottom of the canvas and send a short question. The nodes turn green as the workflow runs, and the model's answer appears in the chat. The first answer takes longer, because Ollama loads the model into memory.

If the chat shows "Failed to receive response" and the workflow does not start, check that the domain in N8N_WEBHOOK_URL resolves to your server from your computer.

Use an NVIDIA GPU

If the server has an NVIDIA GPU, the kit can run Ollama on it. Docker needs the NVIDIA Container Toolkit for that. If you have not used the GPU with Docker on this server before, install it first by following the Ollama Docker instructions.

Then start the kit with the gpu-nvidia profile instead of cpu:

docker compose --profile gpu-nvidia up -d

The override file above already closes the Ollama port for this profile. Use the same profile in all other commands. For example, the demo import with the GPU profile:

docker compose --profile gpu-nvidia run --rm n8n-import -c "n8n import:credentials --separate --input=/demo-data/credentials"
docker compose --profile gpu-nvidia run --rm n8n-import -c "n8n import:workflow --separate --input=/demo-data/workflows"

And the update:

cd /opt/self-hosted-ai-starter-kit
git pull
docker compose --profile gpu-nvidia pull
docker compose --profile gpu-nvidia up -d

Update the kit

To update the kit's files and images, run the commands with the profile you use:

cd /opt/self-hosted-ai-starter-kit
git pull
docker compose --profile cpu pull
docker compose --profile cpu up -d

Your docker-compose.override.yml, Caddyfile and .env are not part of the repository, so git pull does not change them.

What's next

The kit is ready for your own AI workflows. From here you can:

• Download other models with docker exec ollama ollama pull followed by the model name, and select them in the Ollama Chat Model node;
• Use Qdrant to search your own documents with the vector store nodes in n8n;
• Connect your services and build workflows that combine them with the local model.

For a general n8n installation without AI components, see the guide Installing n8n with Docker and PostgreSQL. It also explains how to back up and restore an n8n database.