Personal cloud
By Pedro Albaladejo · ClearCopies
Updated August 26, 2026 · 7 min read
How to Back Up a Nextcloud VPS with the 3-2-1 Rule
Back up Nextcloud files, database, configuration, and secrets across independent failure domains, then prove restore.
A provider snapshot is convenient but may share the account, region, billing, credentials, or control plane that can disable the production VPS. A file-only copy can also be incomplete because Nextcloud tracks users, shares, apps, and file state in its database and configuration.
Define recovery point and recovery time objectives first. Use an application-consistent backup procedure, transfer encrypted copies to an independent target with restricted credentials, retain multiple generations, and monitor both job completion and expected data volume. A green backup job is evidence of copying, not evidence of restoration.
A practical checklist
- 1Define acceptable data loss, restore time, retention, and independent failure domains.
- 2Back up database, configuration, application state, and user files consistently.
- 3Encrypt copies and restrict backup credentials from the production service.
- 4Monitor completion, size, age, and failed or unexpectedly small backups.
- 5Restore to a clean host and validate accounts, shares, and sampled file checksums.
Understand the situation
Self-hosting exchanges a subscription workflow for operational responsibility. You control the server and storage, but you also own patching, TLS, authentication, monitoring, capacity, backups, restore testing, and incident response.
Use a controlled workflow
Build for recovery before convenience: keep application, database, and file data in persistent storage; place the service behind HTTPS; restrict exposed ports; automate security updates carefully; and maintain an independent, encrypted backup that you have actually restored in a test.
Make the final decision
Keep the design only if a clean host can restore the service within the stated objective and users can open sampled files, shares, and accounts. Record which secrets and DNS changes are required during a provider outage without storing the only instructions on that provider.
ClearCopies currently scans supported OneDrive, Google Drive, and Dropbox accounts, not arbitrary Nextcloud or VPS storage. These guides are adjacent educational resources for readers planning storage responsibly, without implying a self-hosted connector that does not exist.
Limits and risks to check
- — Snapshots in the same provider account are not fully independent.
- — Mounted writable backups can be altered by a compromised server.
- — Files and database captured at different points may be inconsistent.
- — An untested encrypted backup can be useless if keys or instructions are missing.
Official references
Frequently asked questions
Does 3-2-1 require tape?
No. The goal is multiple copies and independent failure domains. Object storage, another provider, offline disks, or other media can qualify when access, durability, and restore are designed properly.
Is a VPS snapshot enough?
It is useful for fast rollback, but add an independent copy outside the VPS account or provider control plane for important data.
How often should I test restore?
Choose a schedule from data value and change rate, and test after material architecture or upgrade changes. The interval should be shorter than the time you can tolerate an undiscovered failure.
Using a managed drive as well?
ClearCopies does not currently connect to Nextcloud, WebDAV, or a generic VPS. If you also use OneDrive, Google Drive, or Dropbox, it can scan that supported account for exact copies without downloading original file bodies.