---
title: "How to Back Up and Restore Nextcloud All-in-One (AIO)"
description: "Back up and restore Nextcloud All-in-One (AIO) with its built-in Borg backup: what is covered, what is excluded, encryption keys and testing a restore."
url: "https://docs.noiz.ie/nextcloud/how-to-back-up-and-restore-nextcloud-all-in-one/"
section: "Nextcloud"
categories:
  - "Applications > Nextcloud"
tags:
  - "nextcloud"
  - "backup"
  - "restore"
  - "borg"
  - "encryption"
last_reviewed: "13 October 2026, against the current Nextcloud All-in-One release"
---

# How to Back Up and Restore Nextcloud All-in-One (AIO)

Nextcloud All-in-One (AIO) includes a backup tool based on BorgBackup, an open-source deduplicating backup program, which you manage from the AIO interface. It backs up the database, your files and AIO's configuration, but not external storage. This guide is for administrators of an AIO instance on a Linux Docker host. It explains how to set up the backup, what you must protect separately (such as encryption keys), and how to test and restore.

**Last reviewed:** 13 October 2026, against the current Nextcloud All-in-One release. This guide is written for Noiz hosting and is kept current against Nextcloud AIO. It complements, and does not replace, the official Nextcloud AIO, Nextcloud and Borg documentation linked below.

### Official Documentation Reference

- [Nextcloud AIO: backup and restore](https://github.com/nextcloud/all-in-one#backup)
- [Nextcloud AIO: moving AIO to another server](https://github.com/nextcloud/all-in-one#how-to-migrate-from-aio-to-aio)
- [Nextcloud AIO: Borg retention policy](https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy)
- [Nextcloud backup](https://docs.nextcloud.com/server/latest/admin_manual/maintenance/backup.html) and [restoring a backup](https://docs.nextcloud.com/server/latest/admin_manual/maintenance/restore.html)
- [Nextcloud server-side encryption](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html)
- [Borg integrity checks](https://borgbackup.readthedocs.io/en/stable/usage/check.html) and [retention (prune)](https://borgbackup.readthedocs.io/en/stable/usage/prune.html)

## Prerequisites

- Nextcloud AIO installed and running. See [How to Install and Configure Nextcloud AIO on Ubuntu 24.04 LTS](/nextcloud/how-to-install-and-configure-nextcloud-aio-on-ubuntu-2404-lts/).
- Access to the AIO interface and its passphrase.
- A backup destination: a separate disk mounted on the host (for example at `/mnt/backup`), or a remote Borg repository reachable over SSH.
- Root or sudo SSH access to the Docker host, for the checks below.

## Decide What You Need to Recover

Before setting anything up, decide two things: how much recent work you can afford to lose (your recovery point objective, or RPO) and how quickly service must return (your recovery time objective, or RTO). Then list what the instance depends on: the data location, enabled apps, external storage and any external sign-in service.

| What you have | What it protects against |
|---|---|
| A matching set of database, files, configuration and encryption keys | Everything needed to restore the Nextcloud application. |
| The database or configuration on its own | Not enough: neither recreates your files. |
| A backup on the same server or disk array | Mistakes and failed updates, but not the loss of that server. |
| A backup on another server or service | Loss of the original server, provided you can still reach the copy and its password. |
| RAID | A single disk failure. It keeps the server running but holds no history, so it is not a backup. |

AIO's backup is not a full operating-system image. Keep your own notes for rebuilding the host itself.

## Step 1: Set Up AIO's Backup

1. Open the AIO interface and find the backup section.
2. Enter a backup location: a local path on a separately mounted disk, for example `/mnt/backup`, or the URL of a remote Borg repository (leave the local path blank).
3. Select **Create Backup**. For a remote repository the first attempt fails and shows a public SSH key: add that key to the remote's authorised keys, then select **Create Backup** again.
4. Save the backup encryption password that AIO shows you somewhere off the server, such as a password manager. You cannot restore without it. It is different from the AIO interface passphrase and from Nextcloud's file-encryption keys.
5. After the first backup succeeds, enable daily backups.

Before each backup run, check that the backup disk is actually mounted (for example with `findmnt /mnt/backup`), not just that the folder exists.

Borg only stores changes after the first backup, so later backups are quicker and smaller. The first one copies everything and can take a long time on large or many-file instances, so check the destination has room for the full data size first.

## Step 2: Check What Is Not Covered

- **External storage:** files connected through Nextcloud's external storage app are not backed up. Back them up separately, or add their host paths or Docker volumes to AIO's backup once the first backup has succeeded. Plan how you would restore them too.
- **Excluded data:** AIO lets you exclude the data directory or the preview folder by placing a `.noaiobackup` file in it. The AIO documentation warns that the database and files can then get out of sync on restore, and recommends external storage instead. Only exclude the data directory if you back it up another way. See [excluding data from AIO backups](https://github.com/nextcloud/all-in-one#how-to-exclude-nextclouds-data-directory-or-the-preview-folder-from-backup).
- **Outside services:** an external sign-in service, storage credentials or a custom encryption-key location each need their own backup.

If you use your own backup system instead of AIO's, follow [AIO's guidance for external backups](https://github.com/nextcloud/all-in-one#how-to-enable-automatic-updates-without-creating-a-backup-beforehand): stop the containers properly first, then back up all AIO Docker volumes and the data directory if it is not in a Docker volume. Copying a live database volume, or only turning on Nextcloud's maintenance mode, does not give a consistent backup.

## Step 3: Set Retention and Keep a Copy Elsewhere

By default AIO keeps every backup from the last 7 days, plus 4 weekly and 6 monthly backups. To change this, set `BORG_RETENTION_POLICY` on the mastercontainer as the [AIO documentation describes](https://github.com/nextcloud/all-in-one#how-to-adjust-borgs-retention-policy). Pruning deletes older backups, so check what a new policy will remove before applying it.

A backup on the same server does not survive the loss of that server. Either back up directly to a remote Borg repository, or copy the local repository to another location:

- A **remote Borg repository** can use an append-only SSH key, so that the source server cannot delete old backups. See [remote Borg backups](https://github.com/nextcloud/all-in-one#are-remote-borg-backups-supported).
- To **copy a local repository** elsewhere, use AIO's [sync script](https://github.com/nextcloud/all-in-one#sync-local-backups-regularly-to-another-drive), which respects AIO's lock file (`aio-lockfile`) so that it never copies a backup that is still being written. If the copy mirrors deletions, it also loses old backups when they are pruned at the source.

Watch for failed backup runs and check the age of the newest good backup regularly.

## Step 4: Protect Encryption Keys

If Nextcloud server-side encryption is enabled, a readable Borg backup can still contain files that need Nextcloud's keys to decrypt. Keep the instance configuration (including its secret) and all encryption keys with the matching data, and check any custom key-storage location.

The two server-side encryption modes behave differently:

- **Master key mode** (the default): one server-held key encrypts all files. Recovery keys are not available in this mode, so the master key and configuration must be in the backup.
- **Per-user key mode**: each user's key is protected by their password. A recovery key, if set up, lets an administrator recover files after a lost password; without one, those files are lost.

End-to-end encrypted folders also need each user's own client recovery material. Follow the [encryption manual](https://docs.nextcloud.com/server/latest/admin_manual/configuration_files/encryption_configuration.html) for the mode you use.

## Step 5: Check the Backup and Test a Restore

Check three separate things:

1. **Completion:** the backup, and any copy to another location, finished without errors.
2. **Integrity:** run the backup check from the AIO interface, or with the script helper below, and read the result in the logs of the `nextcloud-aio-borgbackup` container. The helper does not return meaningful exit codes, so always read the log.

   ```bash
   sudo docker exec --env DAILY_BACKUP=0 --env CHECK_BACKUP=1 --env STOP_CONTAINERS=0 nextcloud-aio-mastercontainer /daily-backup.sh
   sudo docker logs --tail 50 nextcloud-aio-borgbackup
   ```

3. **Restore:** a separate test instance restored from the backup starts, and you can sign in and open real files.

Keep a test restore away from production: no shared external storage, notifications or scheduled integrations. Test sign-in, file contents, shares, encrypted files and the apps you rely on, and note how long the restore took and anything that was missing.

If an integrity check fails, keep a copy of the repository before trying any repair. Do not experiment with Borg repair options on your only backup.

To run backups from a script, `DAILY_BACKUP=1` stops the containers and takes a backup but leaves them stopped; add `START_CONTAINERS=1` to start them again afterwards, without updating the containers. When the Nextcloud container starts, AIO can still update the apps it manages. See the [script helper options](https://github.com/nextcloud/all-in-one#how-to-stopstartupdate-containers-or-trigger-the-daily-backup-from-a-script-externally).

## Step 6: Restore

### One File or Folder

AIO keeps deleted files and old versions for 30 days by default, so check Nextcloud's [deleted files](https://docs.nextcloud.com/server/latest/user_manual/en/files/deleted_file_management.html) and [versions](https://docs.nextcloud.com/server/latest/user_manual/en/files/version_control.html) first. Otherwise, extract the file from a backup to a separate location. Encrypted files may need a test-instance restore with the original keys before you can read them. A full restore would also roll back everyone else's work.

### The Whole Instance on the Same Server

1. Stop users making changes, and save any files changed since the backup you plan to use.
2. In the AIO interface, choose the backup and select **Restore selected backup**.
3. Wait for the restore to finish, then start the containers.

For local backups the restore copies back changed files and deletes files that were not in the backup, so anything added after that backup is lost.

### The Whole Instance on a New Server

Follow [moving AIO to another server](https://github.com/nextcloud/all-in-one#how-to-migrate-from-aio-to-aio). In outline:

1. On the old server, update AIO and all containers, stop the containers, then take a final backup, so that the new install can restore it.
2. Copy the Borg repository to the new server.
3. Prepare AIO on the new server, but do not run the mastercontainer yet.
4. Point DNS at the new server and configure any reverse proxy.
5. Start the mastercontainer, open the new AIO interface, save its new passphrase, then select **Restore former AIO instance from backup**, and enter the backup location and encryption password.
6. Choose the latest backup, select **Restore selected backup**, then start the containers.

Restore excluded data and external storage separately.

### After Any Restore

Keep desktop and mobile sync clients paused until you have checked the restored data and decided how to handle newer files on users' devices. The [Nextcloud restore guidance](https://docs.nextcloud.com/server/latest/admin_manual/maintenance/restore.html#synchronising-with-clients-after-data-recovery) explains the sync risks. Then run the [service checks from the update guide](/nextcloud/how-to-update-nextcloud-all-in-one-and-its-apps/#step-4-check-the-service) before letting users back in.

## Support

If Noiz manages your Nextcloud service, [open a support ticket](/client-area/how-to-open-a-support-ticket/) via the client area at [www.noiz.co.za](https://www.noiz.co.za) to confirm your backup scope, retention, destination and most recent restore test. Never include backup passwords, keys or user files in a ticket.

---
Source: https://docs.noiz.ie/nextcloud/how-to-back-up-and-restore-nextcloud-all-in-one/