Proxy hosts, certificates, access lists, your admin account — all of it is two folders. That is wonderful news for backup, right up until the disk holding them dies unbacked-up.
NPM feels like a control panel, but underneath it is admirably simple: a small SQLite database and a folder of certificate files. Backing it up is not a project — it is copying two folders somewhere safer than the same disk. This page shows exactly what to copy, the one timing subtlety the database adds, and the restore test that separates a backup from a hope. Do it today, while it still feels unnecessary.
Everything you have built sits in the folder that holds your docker-compose.yml. The data folder contains the SQLite database file (your hosts, users, access lists and settings), the generated nginx configs, and logs. The letsencrypt folder contains every certificate and its keys. The compose file itself completes the set — it records the image and the exact port and volume layout. Copy all three, together, and a replacement server can be rebuilt to the identical state. This is the great structural advantage of the Docker-Compose style install: no settings are hiding anywhere else on the machine.
A database that is being written while you copy it can arrive at the destination mid-sentence. SQLite is robust and a live copy usually survives — but 'usually' is a poor foundation for the folder your whole network's doors hang from. The clean pattern takes one extra minute: stop the container with docker compose stop, copy the two folders, then docker compose start. Your sites pause for the length of a file copy, and the backup is perfectly consistent. Schedule it for a quiet hour, script it if you like, but keep the stop in the sequence.
A backup on the same disk protects against exactly one accident: you deleting something yourself. It does nothing for a dead disk, a dead machine, theft or ransomware that reaches the server. Send the copy to different hardware — a NAS, another computer, an external drive that goes back in a drawer, or an encrypted cloud folder. Keep dated versions, not one overwritten copy: if a bad change or quiet corruption happened last week, last week's backup is the one you will beg for. Three to five dated copies cost almost nothing; these files are small.
A backup you have never restored is a rumour. Once, on a spare machine or a VM, do the whole drill: install Docker, drop in the compose file and your two folders, run docker compose up -d, and open the panel. Your hosts, certificates and admin login should all simply be there. Time it — most people finish in under fifteen minutes, and knowing that number turns a future disk death from a catastrophe into an errand. Certificates restore with the files, so no re-issuing storm is needed as long as DNS still points at the new home.
Make the backup a habit with a calendar or a tiny scheduled script: stop, copy with the date in the folder name, start, done. Revisit it whenever you add several new hosts — a backup from before your last five services existed is a partial backup wearing a full backup's name. And store one copy of the folder somewhere that survives the building, because the disasters that take the server and its desk-drawer drive together are exactly the ones insurance forms ask about.
The video builds the setup; this page makes it survivable. Fifteen minutes with the video plus ten minutes here and a dead disk becomes a non-event.
▶️ Watch Full VideoYes, if DNS points at the restored server. The certificate files and their keys live in the letsencrypt folder and move with it, and renewals continue from the restored data folder.
Small — typically a few tens of megabytes, mostly logs inside data. You can trim old logs before copying, but at this size, keeping dated copies costs almost nothing.
The letsencrypt folder part is identical, but the database now lives in the database server, not in data. Back that up with a proper database dump as well — the folder alone no longer holds your whole setup.