Back openDesk Edu for a sovereign, open-source education — every vote counts.
Vote nowEvery production application needs the same core infrastructure: a database, a cache, object storage, workflow automation, and observability. In 2026, the best tools for each layer are open-source, self-hostable, and proven at scale.
This guide shows how they fit together — not just as isolated services, but as a coherent infrastructure stack that you can deploy on any Linux server. For the skills needed to deploy and manage this stack, see Zero to DevOps in 2026: The Complete Career Path from Linux to AI Infrastructure. For why these skills matter, see Linux, DevOps, and AI: Why Fundamentals Matter More Than Ever in 2026.
flowchart TD
RP["Reverse Proxy<br/>Traefik / Nginx<br/>SSL + WAF (Let's Encrypt + CrowdSec)"]
PG[("PostgreSQL<br/>Relational Database")]
RD[("Redis<br/>Cache + Queue")]
MI[("MinIO<br/>S3-compatible Object Store")]
N8N["n8n<br/>Workflow Automation Engine<br/>(Postgres persistence + Redis queue mode)"]
OBS["Observability Layer<br/>Prometheus + Loki + Grafana<br/>Alloy + cadvisor + node_exporter"]
HOST["Linux Host<br/>(Docker CE)"]
RP --> PG
RP --> RD
RP --> MI
PG --> N8N
RD --> N8N
MI --> N8N
N8N --> OBS
OBS --> HOST
Every arrow represents a network connection. Every service has persistent storage. Every component emits metrics and logs to the observability layer. This is not a theoretical architecture - it's what production deployments look like at startups, mid-size companies, and even some enterprise teams that prefer open-source over vendor lock-in.
Every service behind your infrastructure should be inaccessible except through a single, hardened entry point. This gives you centralized TLS termination, rate limiting, WAF protection, and access control.
| Feature | Nginx + Certbot | Traefik |
|---|---|---|
| Configuration | Files (.conf) | Labels / annotations |
| Auto TLS | Certbot sidecar | Built-in ACME |
| WAF | CrowdSec bouncer | Plugin / middleware |
| Use case | Fixed services, single host | Dynamic routing, containers |
For most self-hosted infrastructure, Nginx + Certbot + CrowdSec is the most battle-tested combination. The SSL Reverse Proxy Stack packages exactly this with production defaults.
A reverse proxy consumes approximately 128MB RAM and negligible CPU. The CrowdSec bouncer adds another 64MB. Total: ~200MB RAM for a fully secured ingress layer.
PostgreSQL is the most advanced open-source relational database in 2026. It handles everything from application state to analytics workloads.
Production configuration matters. The default postgresql.conf from a package install is tuned for a laptop, not a server. Key settings to adjust:
# Memory
shared_buffers = 512MB # 25% of available RAM
effective_cache_size = 1.5GB # 75% of available RAM
work_mem = 16MB # Per-operation sort memory
maintenance_work_mem = 128MB # For VACUUM, CREATE INDEX
# Write-ahead log
wal_level = replica # Required for replication
max_wal_size = 2GB
min_wal_size = 512MB
wal_compression = zstd # Saves ~50% WAL space
# Planner
random_page_cost = 1.1 # For SSD storage
effective_io_concurrency = 200 # For SSD
Backup strategy:
pg_dump with compression (saves ~60% space)The Database Foundation Stack packages PostgreSQL with these exact tuning settings plus automated daily backups and S3 sync.
Redis sits between your application and your database, absorbing read traffic and providing fast in-memory data access.
What to use it for:
Persistence configuration:
# Enable both RDB snapshots and AOF append-only log
save 900 1 # Snapshot after 900s if >=1 key changed
save 300 10 # Snapshot after 300s if >=10 keys changed
save 60 10000 # Snapshot after 60s if >=10000 keys changed
appendonly yes # Append-only log for durability
appendfsync everysec # Good balance of performance vs durability
Production consideration: Redis is single-threaded. A single Redis instance handles ~100K ops/sec. For more throughput, use Redis Cluster or multiple Redis instances sharded by use case (cache vs queue vs sessions).
MinIO provides the same API as AWS S3, Google Cloud Storage, and Azure Blob Storage - but runs on your own hardware with no egress fees.
What to store on MinIO:
Erasure coding protects your data without hardware RAID. A 4-drive MinIO setup with 8 data + 4 parity shards can lose any 4 drives and still serve data.
flowchart TD
D1["/mnt/disk1<br/>Data: 2TB, Parity: 1"]
D2["/mnt/disk2<br/>Data: 2TB, Parity: 2"]
D3["/mnt/disk3<br/>Data: 2TB, Parity: 3"]
D4["/mnt/disk4<br/>Data: 2TB, Parity: 4"]
MINIO["MinIO Cluster<br/>4 Nodes<br/>Erasure Coding 8+4"]
PG[("PostgreSQL<br/>WAL Sync")]
BK["Backups to S3"]
D1 --> MINIO
D2 --> MINIO
D3 --> MINIO
D4 --> MINIO
MINIO -- "S3 API (drop-in replacement)" --> PG
MINIO --> BK
The MinIO S3 Backup Stack includes automated lifecycle policies, versioning, and remote sync - the same configuration used in production object storage deployments.
n8n is the open-source workflow automation engine that connects everything that doesn't have a native integration.
n8n in production requires a two-part backend:
| Component | Purpose | Without It |
|---|---|---|
| PostgreSQL | Workflow state, credentials, execution history | SQLite corrupts under concurrent access; lost workflows on container restart |
| Redis | Webhook + execution queue | Webhooks block the main process; long workflows cause timeout cascades |
In queue mode, n8n separates the webhook receiver from the workflow executor:
flowchart LR
REQ["HTTP Request"]
WH["n8n Webhook<br/>(main node)"]
RQ[("Redis Queue")]
WK["n8n Worker<br/>(executor)"]
PGW[("PostgreSQL<br/>workflows")]
PGE[("PostgreSQL<br/>executions")]
REQ --> WH --> RQ --> WK
RQ --> PGW
WK --> PGE
This architecture means:
Pruning is mandatory in production. Without it, completed executions accumulate and fill your database:
environment:
- EXECUTIONS_DATA_PRUNE=true
- EXECUTIONS_DATA_MAX_AGE=168 # hours (7 days)
- EXECUTIONS_DATA_PRUNE_TIMEOUT=3600000 # 1 hour
The n8n Production Stack ships with all of this pre-configured - queue mode, Postgres persistence, Redis backend, and execution pruning set to sane defaults.
You cannot manage what you cannot measure. The observability layer collects metrics and logs from every service in the stack and presents them in unified dashboards.
flowchart TD
PGM["PostgreSQL<br/>metrics"]
N8N["n8n<br/>metrics"]
NGX["nginx<br/>metrics"]
PROM["Prometheus<br/>(scrape all)"]
GRAF["Grafana<br/>Dashboards"]
PGM --> PROM
N8N --> PROM
NGX --> PROM
PROM --> GRAF
Prometheus scrapes metrics endpoints from every service:
scrape_configs:
- job_name: 'postgresql'
static_configs:
- targets: ['postgres-exporter:9187']
- job_name: 'redis'
static_configs:
- targets: ['redis-exporter:9121']
- job_name: 'n8n'
static_configs:
- targets: ['n8n:5678']
- job_name: 'node'
static_configs:
- targets: ['node-exporter:9100']
- job_name: 'cadvisor'
static_configs:
- targets: ['cadvisor:8080']
Loki aggregates logs from all containers via Alloy (or Promtail):
# docker-compose service for Alloy
alloy:
image: grafana/alloy:v1.6
command:
- run
- /etc/alloy/config.alloy
- --server.http.listen-addr=0.0.0.0:12345
volumes:
- /var/log:/var/log:ro
- /var/lib/docker/containers:/var/lib/docker/containers:ro
ports:
- "12345:12345"
Grafana brings everything together into a single view. The Observability Stack comes with pre-built dashboards for:
| Metric | Good | Warning | Critical | Why |
|---|---|---|---|---|
| CPU usage | <70% | 70-85% | >85% | Throttling, capacity planning |
| Memory usage | <75% | 75-90% | >90% | OOM risk, swap usage |
| Disk usage | <70% | 70-85% | >85% | Backup failures, data loss risk |
| Postgres connections | <50% | 50-80% | >80% | Connection pool exhaustion |
| Redis hit rate | >90% | 80-90% | <80% | Cache inefficiency, increased DB load |
| n8n failure rate | <1% | 1-5% | >5% | Workflow bugs, integration failures |
| SSL expiration | >30 days | 7-30 days | <7 days | Certificate renewal failure |
Once your infrastructure is running, you need to manage it declaratively.
Every service in the stack needs a backup strategy:
| Service | Method | Frequency | Retention | Off-site |
|---|---|---|---|---|
| PostgreSQL | pg_dump / WAL archiving | Daily / continuous | 30 days / 7 days | S3 (MinIO) |
| Redis | RDB snapshot + AOF | Every 60s | 7 days | Optional |
| MinIO | mc mirror to remote | Daily incremental | 90 days | Remote S3 |
| n8n | Workflow export + database | Daily | 30 days | S3 |
| Config files | tar + encryption | Daily | 90 days | S3 |
All configurations should be version-controlled:
infrastructure/
├── docker-compose.yml
├── .env.example
├── nginx/
│ └── conf.d/
├── prometheus/
│ └── prometheus.yml
├── grafana/
│ └── dashboards/
├── postgres/
│ └── init.sql
└── minio/
└── lifecycle.json
This is exactly how the production stacks are structured - each one is a Git-friendly, documented configuration that you can drop into your infrastructure repository.
Here's what this complete stack costs to run:
| Component | RAM | Storage | Monthly Cost (self-hosted) | Monthly Cost (cloud equivalent) |
|---|---|---|---|---|
| Reverse Proxy | 200MB | 1GB | €0* | $20+ (ALB/CLB) |
| PostgreSQL | 2GB | 50GB+ | €0* | $50+ (RDS) |
| Redis | 1GB | 1GB | €0* | $15+ (ElastiCache) |
| MinIO | 1GB | 100GB+ | €0* | $230+ (S3 10TB) |
| n8n | 512MB | 10GB | €0* | $30+ (n8n cloud) |
| Observability | 2GB | 50GB | €0* | $100+ (Grafana Cloud) |
| Total | ~6GB | ~200GB | ~€20/month (hosting) | $445+/month |
*Software is free. Hosting costs depend on your provider - a Hetzner AX102 with 8 cores, 32GB RAM, 2×2TB NVMe costs approximately €35/month and runs the entire stack.
You can deploy this entire stack in an afternoon:
Each stack is a single docker compose up -d. Each one is independently useful. Together, they form a complete production infrastructure that rivals anything a cloud provider offers - without the lock-in and without the bill.
Browse all production stacks →
Deploy production infrastructure like a pro. This 20-point checklist covers security, backups, monitoring, and scaling for each component in the stack.
Download Free Infrastructure Deployment Checklist →
Deploy the components from this article with battle-tested configurations:
| Stack | Components | Use Case | Price |
|---|---|---|---|
| SSL Reverse Proxy Stack | Nginx + Certbot + CrowdSec | Secure entry point | €9.99 |
| Database Foundation Stack | PostgreSQL + Redis | Data layer | €9.99 |
| MinIO S3 Backup Stack | MinIO with lifecycle | Object storage | €9.99 |
| n8n Production Stack | n8n + Postgres + Redis | Workflow automation | €9.99 |
| Observability Stack | Prometheus + Grafana + Loki | Monitoring | €9.99 |
| [🎯 Complete Infrastructure Bundle → Save 25%] | ALL 5 stacks | Full production environment | €37.49 (save €12.46) |
Know someone building production infrastructure? Share this guide:
Share on Twitter Share on LinkedIn
Tobias Weiss creates production-ready Docker Compose configurations that just work. His stacks power infrastructure for startups, agencies, and enterprises worldwide.
Need help with your deployment? Book a Production Stack Consultation →