Configure storage destinations
Dockstash stores backups on a machine you control: a storage VPS reached over SSH, holding encrypted restic repositories. No third-party cloud sits between your data and you — the setup is one SSH identity plus one encryption password, and both stay in your hands.
How to do it
Prepare a storage box
Any Linux VPS or home server reachable over SSH works — it needs disk space and an SSH user, nothing else installed. Use a different machine (ideally a different provider or location) than the one running your projects: a backup on the same box dies with the box.
Add the SSH connection
In the setup wizard (or Settings → Storage later) enter host, user, port, and an SSH private key. The key is write-only — after saving it is never displayed again. Dockstash pushes restic snapshots over SFTP with that identity.
Save the encryption password — it is shown once
The wizard generates a strong repository encryption password and shows it exactly once. Copy it to a password manager before clicking Done. This is not recoverable: losing it means the repositories cannot be decrypted, by anyone, ever.
Verify with a first backup
Run Backup Now on any project. A green run proves the storage VPS is reachable, the SSH identity works, and the repository initialized and encrypted correctly. The project card then shows the repo size growing on the storage box.
Plan for total-loss recovery
Keep three things in separate places: the storage VPS (your repos), your master encryption key, and your configuration export envelope. With all three, a destroyed production server is a rebuild, not a data loss — the bootstrap recovery runbook walks through it.
Do it in one click with Dockstash
Dockstash runs the exact dump above, restics it off-site, and drill-tests the restore automatically — no script to maintain.
Last updated: July 2026
Related guides
Set a retention policy
Keep N daily, weekly, and monthly snapshots and let the scheduled prune map your policy straight onto restic forget --prune.
Restore a backup
Pick a snapshot, type the project name to confirm, restore to a new location by default, and validate before overwriting anything.
MinIO
Back up MinIO in Docker
PostgreSQL
Back up PostgreSQL in Docker
Frequently asked questions
Can I use any provider as the storage destination?
Anything you can SSH into: a cheap storage VPS, a Hetzner storage box, a NAS at another site. If it speaks SSH/SFTP and has disk, restic can keep repositories on it.
Who can read my backups on the storage box?
Nobody without your encryption password. Repositories are AES-encrypted by restic before leaving your server; the storage box only ever sees ciphertext.
What if I lose the encryption password?
The repositories are unrecoverable — that is the point of real encryption. Store the password in a password manager the moment the wizard shows it, and keep the master key and export envelope backed up separately.
Can I rotate the encryption password or the SSH key?
Yes. Settings → Encryption password rotates the repo password (with an explicit "I have saved it" confirmation), and Settings → Storage accepts a new SSH key any time.