self-host Paperless-ngx: turn paper into a searchable, private archive

that drawer of paper is a liability, not an archive

you know the drawer. tax returns from 2019, your kid's birth certificate, a warranty card for a toaster you don't own anymore. it's not organized, it's not searchable, and if your house floods or burns, it's gone. the fix isn't "scan everything into a folder called Documents" because that folder becomes its own version of the drawer, just digital. the fix is paperless-ngx, a self hosted app that ocr's, tags, dates, and indexes every scan so you can search for a word and actually find the thing. and it runs on hardware you already own, for free.

the one command that starts it all

paperless-ngx ships as a set of docker containers (the app, a database, redis for task queueing, and optionally a tool called tika for parsing office docs). you don't build this by hand. you grab the official docker-compose file and bring it up with:

docker compose up -d

breaking that down: docker compose reads the compose file in your current folder and spins up every service it defines. up means start everything. -d means detached, so it runs in the background instead of locking up your terminal. that's it. one command, several containers, all talking to each other on an internal network docker creates for you.

the consume folder is where the magic happens

paperless-ngx watches a folder, usually mapped as ./consume on your host machine, for new files. drop a scanned pdf or a photo of a document in there and the app picks it up automatically: it runs ocr to extract the text, guesses a date from the content, and lets you assign tags, correspondents, and document types either manually or through rules you set up. once it's processed, the original gets archived and the text becomes fully searchable. type "progressive" and every insurance doc with that word shows up, regardless of file name or folder structure. that's the whole point: you stop organizing by folder and start organizing by content.

keep this off the public internet

this is the part people skip, and it's the part that actually matters for defense. paperless-ngx is now holding your most sensitive documents in one searchable place: tax returns, social security numbers, passports, medical records. that's a goldmine if it's exposed. don't port forward it to the internet so you can check it from a coffee shop. instead:

run it on your lan only, meaning it's reachable from devices on your home network but not from the outside world. if you want remote access, put it behind a vpn like wireguard or tailscale so you're tunneling into your home network first, then hitting the app, rather than exposing the app directly. check your router's port forwarding rules right now and make sure nothing points to paperless-ngx's port. if you're not sure, log into your router admin panel and look for forwarded ports, if you see one pointing at your docker host, kill it.

backups matter more than the app itself

self hosting means you own the data, which also means you own the responsibility for not losing it. paperless-ngx stores two things that matter: the database (your tags, metadata, search index) and the actual document files. back up both. a common approach is a scheduled job that dumps the database and syncs the document directory to an encrypted offsite location, something like restic or borgbackup pushing to a cheap cloud bucket, encrypted before it ever leaves your network. test the restore occasionally too. a backup you've never restored is a guess, not a backup.

the takeaway

paperless-ngx turns a chaotic pile of paper into something searchable and actually useful, and it costs nothing but a little setup time. but the second you digitize your tax returns and ids, you've created a single target worth protecting. run it on your lan, gate remote access behind a vpn, encrypt your backups, and store them somewhere other than the same room as the server. the goal isn't just convenience, it's making sure the only person who can search your documents is you.