I use restic to backup my paperless documents to a Hetzner Storage Box. The setup was easy and I am independent of US cloud hosters.
this post was submitted on 16 Aug 2026
28 points (100.0% liked)
Selfhosted
61475 readers
756 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
@lokalhorst As I mentioned in the post, this method can be used to back up to many different providers (incl. hetzner, see https://rclone.org/docs/). I assume w/ restic you're just backing up the folder where paperless stores the docs rather than the export. IMO the latter is nice because leaves you w/ something that's more useful w/o paperless.
I actually use the document_exporter of paperless-ngx. I have a small bash script backup-paperless.sh that runs the paperless-ngx document_exporter and also makes a database dump using pg_dump. It sets up the restic backups logic with daily, weekly and monthly backups. I run that bash script using a systemd service paperless-backup.service. This service is run daily with the timer paperless-backup.timer, randomly at 3 am +-30 minutes.
restic is smart, so it does only backup if there are changes. The incremental backups are great, in case the database corrupts without me noticing. I'll share the scripts in case you are interested in how it works:
backup-paperless.sh
#!/bin/bash
set -euo pipefail
COMPOSE_DIR="/home/user/paperless-ngx/"
DUMP_DIR="$COMPOSE_DIR/sqldump"
EXPORT_DIR="/usr/src/paperless/export"
export RESTIC_REPOSITORY="sftp:abc123@abc123.your-storagebox.de:/backup/restic"
export RESTIC_PASSWORD_FILE="/home/user/.config/restic/password"
mkdir -p "$DUMP_DIR"
cd "$COMPOSE_DIR"
docker compose exec -T webserver document_exporter "$EXPORT_DIR" -p
docker compose exec -T db pg_dump -U paperless paperless > "$DUMP_DIR/dump.sql"
restic backup "$DUMP_DIR" "$COMPOSE_DIR/export"
restic forget \
--keep-daily 7 \
--keep-weekly 4 \
--keep-monthly 6 \
--prune
rm -rf "$COMPOSE_DIR/export"/*
rm -rf "$DUMP_DIR"/*
paperless-backup.service
[Unit]
Description=Paperless-ngx Restic Backup
Wants=network-online.target
After=network-online.target docker.service
[Service]
Type=oneshot
User=user
WorkingDirectory=/home/user/paperless-ngx
ExecStart=/home/user/paperless-ngx/backup-paperless.sh
paperless-backup.timer
[Unit]
Description=Run paperless backup every 24 hours
[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true
RandomizedDelaySec=30min
[Install]
WantedBy=timers.target
If you encrypt at home it doesn't matter where you do offsite. See Cryptomator for an easy platform agnostic approach. Why trust the bastards?
Ah, should have updooted darntootin, oh well. Still, OP, a bit more detail (like I encrypt with rclone, would have been nice.) Cool. Got my own system, but anything that helps...
Restic is a good backup tool with encryption. Cryptomator is awesome but it doesn't do backups, just storage.
Completely correct. It's a useful tool for people protecting their precious memories, not an ongoing protection of an OS state.
@MalReynolds Rclone can encrypt, but I also like to have another avenue to access my documents in case for some reason I can't accessy homelab.
Cryptomator has an android app, haven't used it in anger (It's not a backup until you restore successfully), but it's there.
I wouldn’t trust Dropbox, ever. I backup to Proton, but use Cryptomator to encrypt everything first.
@darntootin I don't see how Proton is all that more trustworthy, but encryption is a good idea, and my method works fine for both since rclone already supports proton (https://rclone.org/protondrive/) and encrypting your data pre-copy (https://rclone.org/crypt/)
This was enough for me to never use them: https://arstechnica.com/information-technology/2023/12/dropbox-spooks-users-by-sending-data-to-openai-for-ai-search-features/
How are you handling versioning and deleted files?
It seems like Restic would be a better option? It only backs up changed files and handles versioning, encryption, deduplication, and some fault recovery allready. You wouldn't need all of the other layers like the export script and float.