Nextcloud AIO native backup

Extracted from the master document on 2026-09-04. §N numbering preserved so as not to break cross-references.

41. Nextcloud AIO — native backup integrated into Layer 2

AIO comes with its own backup system, which also uses Borg underneath. Three options were evaluated:

Option	Verdict
Copy the AIO volumes by hand with Borg	❌ does not guarantee consistency between DB, Redis, files and mastercontainer
Use AIO’s “Remote borg repo” feature	❌ it would create a second off-site pipeline with its own credentials and another place to look when something failed
Native backup writing locally + that folder as a Borg source	✅ chosen

Why the third: AIO knows how to coordinate consistency between its containers; a generic borg create over live volumes does not. But by writing locally and letting Layer 2 carry it away, there is a single repository, a single retention policy, a single mirror to R2 and a single place to look.

environment:
  NEXTCLOUD_BACKUPDIR: /mnt/storage/nextcloud-aio-backup
volumes:
  - /mnt/storage/nextcloud-aio-backup:/mnt/storage/nextcloud-aio-backup

AIO ── own borg ──► /mnt/storage/nextcloud-aio-backup/borg
                                   │
                                   └──► source for borg-backup.sh (§39.3)
                                              └──► VM 101 ──► R2

⚠️ That backup has its own passphrase, different from the Layer 2 repo’s, generated by AIO when configuring the location and stored in Vaultwarden. Without that specific passphrase, that backup is unrecoverable even though the data is still on disk.

Verification of 2026-08-30 (archive 20260829_103951-nextcloud-aio): 43.258 files, 139,65 GB original / 78,21 GB deduplicated — consistent with the ~129 GB actually in /mnt/storage/nextcloud/data. That is: the backup is real and complete, not an empty shell.