The Zero-Lockin Dev Stack in 2026: Supabase, n8n, Authentik & Umami on a $7 VPS

When bootstrapping a modern web application or internal tool, developers often default to multi-tenant cloud platforms:

• Auth0 / Clerk for authentication ($25-$100/mo)
• Supabase Cloud / Firebase for database & storage ($25-$250/mo)
• Make / Zapier for background workflows ($29-$199/mo)
• Google Analytics / Mixpanel for traffic analytics ($0 with heavy cookie tracking banners)

Within 6 months, you have four separate dashboards, multiple API keys scattered across services, and recurring bills that scale with users rather than computing cost.

In this guide, we'll configure a complete, sovereign development foundation using Authentik (SSO/Identity), PocketBase / Supabase, n8n (Automation), and Umami (Privacy Analytics) behind Caddy on a single 4GB RAM VPS (€6.90/month on Hetzner or $12/mo on DigitalOcean).

---

The Architecture Blueprint

                     Internet (Port 80 / 443)
                                │
                        ┌───────▼───────┐
                        │ Caddy Reverse │ (Automatic Let's Encrypt SSL)
                        │     Proxy     │
                        └───────┬───────┘
                                │ Docker Network: app-tier
        ┌───────────────┬───────┴───────┬───────────────┐
        ▼               ▼               ▼               ▼
┌───────────────┐┌─────────────┐┌───────────────┐┌───────────────┐
│   Authentik   ││ PocketBase  ││      n8n      ││     Umami     │
│   (Auth/SSO)  ││ (BaaS / DB) ││  (Automation) ││  (Analytics) │
│   :9000       ││ :8090       ││  :5678        ││  :3000       │
└───────────────┘└─────────────┘└───────────────┘└───────────────┘

---

Step 1: Docker Network & Caddy Proxy

Create a dedicated Docker network and the reverse proxy configuration.

Caddyfile

{
    email [e-mail]
}

auth.yourdomain.com {
    reverse_proxy authentik-server:9000
}

api.yourdomain.com {
    reverse_proxy pocketbase:8090
}

flow.yourdomain.com {
    reverse_proxy n8n:5678
}

stats.yourdomain.com {
    reverse_proxy umami:3000
}

---

Step 2: The Complete docker-compose.yml

version: '3.8'

networks:
  app-tier:
    driver: bridge

volumes:
  caddy_data:
  caddy_config:
  pb_data:
  n8n_data:
  umami_db_data:
  authentik_db_data:
  authentik_redis_data:

services:
  # --- Reverse Proxy ---
  caddy:
    image: caddy:2-alpine
    container_name: reverse-proxy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    networks:
      - app-tier

  # --- Database & BaaS (PocketBase) ---
  pocketbase:
    image: ghcr.io/muchobien/pocketbase:latest
    container_name: pocketbase
    restart: unless-stopped
    volumes:
      - pb_data:/pb_data
    networks:
      - app-tier

  # --- Workflow Engine (n8n) ---
  n8n:
    image: docker.n8n.io/n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    environment:
      - N8N_HOST=flow.yourdomain.com
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - NODE_ENV=production
      - WEBHOOK_URL=https://flow.yourdomain.com/
    volumes:
      - n8n_data:/home/node/.n8n
    networks:
      - app-tier

  # --- Privacy Analytics (Umami + Postgres) ---
  umami-db:
    image: postgres:16-alpine
    container_name: umami-db
    restart: unless-stopped
    environment:
      - POSTGRES_DB=umami
      - POSTGRES_USER=umami
      - POSTGRES_PASSWORD=secure_umami_password_here
    volumes:
      - umami_db_data:/var/lib/postgresql/data
    networks:
      - app-tier

  umami:
    image: ghcr.io/umami-software/umami:postgresql-latest
    container_name: umami
    restart: unless-stopped
    environment:
      - DATABASE_URL=postgresql://umami:secure_umami_password_here@umami-db:5432/umami
      - APP_SECRET=replace_with_a_random_32char_secret_key
    depends_on:
      - umami-db
    networks:
      - app-tier

---

Step 3: Deployment & Hardening

1. Firewall: Close all ports except 22 (SSH), 80 (HTTP), and 443 (HTTPS) using ufw:

   sudo ufw default deny incoming
   sudo ufw default allow outgoing
   sudo ufw allow 22/tcp
   sudo ufw allow 80/tcp
   sudo ufw allow 443/tcp
   sudo ufw enable

1. Automated Backups: Run daily backups of /var/lib/docker/volumes using **Restic to Cloudflare R2 or Backblaze B2 (which costs < $0.50/mo for 50GB).
2. Launch:

   docker compose up -d

---

Resource Consumption in Idle / Production

Service	CPU (Idle)	RAM Usage
Caddy Reverse Proxy	< 0.1%	28 MB
PocketBase	< 0.1%	35 MB
n8n Workflow Runner	< 0.5%	320 MB
Umami Analytics + Postgres	< 0.2%	140 MB
Total Footprint	< 1%	~523 MB RAM

You have over 3GB of free RAM on a 4GB VPS to host your actual application frontends, APIs, and background queue workers.

---

Explore More Ready-to-Deploy Stacks

• Compare 90+ proprietary SaaS tools against their best open-source alternatives: SelfHostStack
• Generate custom multi-container YAML templates interactively: Docker Stack Builder
• Sizing benchmarks for cloud VPS providers: VPS Hosting Guide