S.M.O
Back to Blog
Self-Hosting n8n on Google Cloud for Free: The Domain and Card You Need Before You Start
Cross-cutting
self-hostingFreen8n

Self-Hosting n8n on Google Cloud for Free: The Domain and Card You Need Before You Start

July 27, 2026

"Can I run n8n for free instead of paying for n8n Cloud?" The answer is yes. Google Cloud's e2-micro instance is genuinely free, forever, as long as you stay inside the limits. But almost every tutorial that answers this question skips the two things that actually stop people from finishing the setup.

You need a domain. And you need a Visa or Mastercard on file with Google, even though you will not be charged for it if you stay within free tier limits. Miss either one and you'll get stuck somewhere between "VM is running" and "n8n is actually reachable."

This post covers both prerequisites honestly, then walks through the full setup, every command, so you end up with a working, HTTPS-secured n8n instance you fully own.

What "free" actually means on Google Cloud

Google's Always Free tier includes one non-preemptible e2-micro VM per month, available only in three US regions: Oregon (us-west1), Iowa (us-central1), and South Carolina (us-east1). You also get 30 GB of standard persistent disk and a small monthly egress allowance. Pick anything outside those regions, or an SSD instead of a standard disk, and you start seeing charges.

The e2-micro is a shared-core machine with limited RAM. It runs n8n fine for a solo founder testing workflows or automating a handful of processes for one business. It is not the machine for a client-facing automation stack running dozens of active workflows with heavy webhook traffic.

Prerequisite 1: You need a domain, not just an IP

n8n needs HTTPS to work properly, especially for OAuth connections (Gmail, Google Sheets, most of the apps SMEs actually automate around). Getting a free SSL certificate through Let's Encrypt requires a real domain pointed at your server. A bare IP address will not get you a certificate, and n8n over plain HTTP will fail silently on half your integrations.

IONOS runs a promotional rate, often $1 for the first year on a .com. The standard first-year price sits closer to $10, and renewal after year one typically jumps to around $20. Budget for the renewal, not just the launch price. If you're setting this up for a client, tell them the real number upfront.

You don't need the root domain. A subdomain like n8n.yourdomain.com works and is what this guide uses.

Prerequisite 2: A card, even though you won't be charged

Google requires a valid Visa or Mastercard to activate any Google Cloud project, free tier included. This is identity verification, not a billing trap, but it's a real barrier for Kenyan SME owners who run their entire business through M-Pesa and don't have a card at all.

A Visa or Mastercard debit card from Equity, KCB, Co-op, or most other Kenyan banks works fine for this step. A virtual card from a fintech app also works in most cases. Apparently my Mpesa virtual card was accepted. Google will not let VM creation complete without it, and no workaround changes that. Flag this with a client before you start the project, not after you hit the wall.

Step 1: Create the VM

Log into the Google Cloud Console, create a new project, and enable the Compute Engine API from the search bar. Then go to Compute Engine > VM Instances > Create Instance and set:

  • Name: n8n-instance
  • Region: us-central1 (or us-west1 / us-east1)
  • Machine type: e2-micro
  • Boot disk: Ubuntu, Standard persistent disk, 30 GB
  • Firewall: allow HTTP and HTTPS traffic

Once it's running, note the external IP address, then go to your domain registrar's DNS settings and create an A record: host n8n, pointing to that IP. Propagation is usually fast, sometimes up to a day.

Step 2: Connect and update the server

Open the SSH button next to your VM in the console to get a browser terminal, then run:

sudo apt-get update
sudo apt-get upgrade -y
sudo apt-get install -y ca-certificates curl nano

Step 3: Install Docker and Docker Compose

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

docker --version
docker compose version

Step 4: Set up the project folder

mkdir n8n-compose
cd n8n-compose
mkdir local-files

The local-files folder is what n8n's "Read/Write Files from Disk" node uses. Create it now so it's ready.

Step 5: Create the .env file

nano .env

Paste this in, replacing the placeholders with your real domain, subdomain, timezone, and email:

DOMAIN_NAME=yourdomain.com
SUBDOMAIN=n8n
GENERIC_TIMEZONE=Africa/Nairobi
SSL_EMAIL=you@yourdomain.com

Save with Ctrl+O, then Enter, then exit with Ctrl+X.

Step 6: Create the docker-compose.yml file

nano docker-compose.yml

Paste this configuration. It runs two containers: n8n itself, and Traefik, which handles routing and automatically issues your HTTPS certificate.

services:
  traefik:
    image: "traefik"
    restart: always
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.mytlschallenge.acme.tlschallenge=true"
      - "--certificatesresolvers.mytlschallenge.acme.email=${SSL_EMAIL}"
      - "--certificatesresolvers.mytlschallenge.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - traefik_data:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock:ro

  n8n:
    image: docker.n8n.io/n8nio/n8n
    restart: always
    ports:
      - "127.0.0.1:5678:5678"
    labels:
      - traefik.enable=true
      - traefik.http.routers.n8n.rule=Host(`${SUBDOMAIN}.${DOMAIN_NAME}`)
      - traefik.http.routers.n8n.tls=true
      - traefik.http.routers.n8n.entrypoints=web,websecure
      - traefik.http.routers.n8n.tls.certresolver=mytlschallenge
    environment:
      - N8N_HOST=${SUBDOMAIN}.${DOMAIN_NAME}
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - NODE_ENV=production
      - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN_NAME}/
      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE}
    volumes:
      - n8n_data:/home/node/.n8n
      - ./local-files:/files

volumes:
  n8n_data:
  traefik_data:

Save and exit the same way as before.

Step 7: Launch it

sudo docker compose up -d

Wait two to three minutes, then visit https://n8n.yourdomain.com. You should land on n8n's setup screen. Fill in your email, name, and password to create the owner account. That's stored permanently, you won't repeat this step.

To stop the stack later:

sudo docker compose stop

Fixing SSL certificate errors

If the page won't load over HTTPS, it's almost always a DNS timing issue. Fix it with:

sudo docker compose down
sudo rm -rf ./letsencrypt/acme.json
sudo docker compose up -d

Updating n8n later

cd n8n-compose
sudo docker compose pull
sudo docker compose down
sudo docker compose up -d

Your workflows, credentials, and data all persist through the update because they live in the n8n_data volume, not inside the container itself. Note that the instance goes offline briefly during this, so don't update mid-way through a critical scheduled workflow.

Where this setup actually breaks down

The e2-micro shares CPU cycles with other workloads on the same physical host. Fine for a handful of workflows checking WhatsApp messages or reconciling M-Pesa statements a few times a day. Not fine for AI agent workflows with large payloads, high-frequency webhooks, or anything memory-hungry.

Set up automated backups before you need them. In the Console, go to Compute Engine > Snapshots > Create Snapshot Schedule, attach it to your VM's disk, and you have a point-in-time restore option if an update or config change breaks something.

What to do with this today

Don't point this setup at a client's production workflows on day one. Buy the cheapest domain you can find, run through every command above, and test it for a week with a low-stakes workflow, something that pings you on WhatsApp when a form gets submitted, for example. Watch how it holds up under real, if light, load before trusting it with anything revenue-critical.

If you'd rather skip the server maintenance and just get workflows that work, this is the exact kind of infrastructure decision CustomCX handles for clients so they never have to think about VM uptime or certificate renewals themselves.