Your Nextcloud can survive a dead disk easily. It cannot survive a backup nobody tested and an admin nobody can replace. This page fixes both risks with routines a small office can actually keep.
Every self-hosted office eventually faces two tests. The first is mechanical: a disk dies, an update goes wrong, someone deletes the wrong folder. The second is human: the one person who runs the system goes on leave, falls ill, or leaves the company. Offices prepare obsessively for the first and forget the second. They are the same risk, and both are fixed with boring routines written down.
Backups protect you from broken disks. The runbook and the second person protect you from everything else.
A Nextcloud backup is not a copy of the files folder. A working restore needs three parts together: the data directory (the files), the database (users, permissions, shares, calendars — the map that makes the files meaningful), and the configuration. Back up only the files and your restore day becomes a week of rebuilding accounts and permissions by hand while staff watch. Any backup routine or tool you use must be checked against all three, by name.
Schedule one honest test every quarter: restore the backup onto a spare machine or a virtual machine, log in, and open a handful of files, including one document in OnlyOffice. Takes an hour. This test catches the classic tragedies — the backup that was empty, the database that was never included, the password nobody wrote down — while they are still embarrassments instead of disasters. Write the test date on the backup checklist; an untested backup should be treated, emotionally, as no backup.
"Bus factor" is the grim industry joke: how many people must be hit by a bus before the system dies. In most small offices it is one. The fix is not expensive: a runbook — a short document covering where the server is, how backups run, how to add a user, how to restore, and where the master passwords live (in a password manager or sealed envelope with the owner). Then train a second person by having them actually do an update and a test restore once, supervised. An hour of cross-training converts a fragile setup into a resilient one.
Then buy the safety instead. Options that honestly exist: a local IT provider on a small monthly retainer who holds the runbook, or moving the same Nextcloud to a managed Nextcloud host where the provider runs updates and backups for a fee. You give up some savings and some control, and you gain a system that survives your admin’s resignation letter. For some offices that trade is obviously right, and there is no shame in it — the goal is working collaboration, not proving a point.
Watch the running system in the video above — then write your runbook while everything is calm. Calm is exactly when runbooks get written.
Watch Full VideoNightly is the standard for an office that creates documents all day — it caps your worst loss at one day of work. Busy offices add a midday snapshot of the database. Whatever you choose, decide the acceptable loss in a meeting, in advance, not during the disaster.
Anywhere that is not the same building: a rotated external disk at the owner’s home, a second office or branch, or an encrypted copy in cloud storage. The backup is encrypted and access-controlled either way — off site must never mean exposed.
Before anything else: sit with them and produce the runbook, transfer every password into the company’s password manager, change shared credentials after they leave, and have the replacement do one supervised update and restore. Do this in week one of the notice period, not the last day.