How to Self-Host Paperless-ngx
Paperless-ngx is a document management system that stores scans and PDFs, runs OCR, and makes the archive searchable, tagged, and organized. The notes below were checked against the project site and source repository.
When Paperless-ngx is a good fit
Choose Paperless-ngx when you want incoming scans and office files turned into a searchable archive on disk you control. OCR and classification use CPU, and the originals need real storage. You own the consume workflow, the database, the file archive, and the upgrades. Read the current setup guide before selecting a version, because the compose layout changes between releases.
Deployment notes
Docker Compose is the documented easy path. The compose files in the repository pull the image from the GitHub container registry and expect Redis plus a database. The project also publishes an install script that writes a compose environment for you; read it before you run it. Give the host enough CPU for OCR and a volume large enough for the original documents, not just the database.
Put the UI behind HTTPS. Change the admin password created at first start, and do not expose the consume folder as a world-readable share.
Data and recovery
Back up the original documents and the database together. The database is the index, tags, and correspondents. The media directory is the files. Redis is the task broker and can be recreated. Export a document dump as well, using the documented exporter, so you are not stuck if you need to move versions.
Write down the restore sequence, required secrets, exposed ports, and the mail or scanner path that feeds the consume folder. A scheduled backup is not complete until a clean host can restore it and pass a functional check.
Important limitation
OCR of a large backlog can pin a CPU for hours. Size the host for the ingest rate you actually have, and keep a copy of the originals outside this stack.
Production checklist
- Pin and record the deployed version.
- Persist every documented data and configuration path.
- Terminate TLS at a maintained reverse proxy or trusted tunnel.
- Restrict administrative interfaces and rotate default credentials.
- Monitor uptime, disk space, certificate expiry, and failed jobs.
- Test an off-host backup with a real restore.
