Why self-host Paperless-ngx on a VPS
Invoices, contracts, payslips, administrative correspondence: document management involves confidential data that few companies want to entrust to a third-party cloud. Paperless-ngx ingests each PDF or scan, applies OCR (text recognition) to make it searchable, then automatically classifies it by correspondent, type and tags thanks to a matching engine. On a VPS, you get an archive accessible from anywhere, fed by simply dropping files into a watched folder or by email. The stack relies on PostgreSQL for the index, Redis for the task queue, and a processing service that runs Tesseract for OCR. You control legal retention, backup encryption and access, with no dependence on a vendor.
The benefits of a self-hosted Paperless-ngx
- Automatic OCR via Tesseract: each scan or PDF becomes full-text searchable.
- Automatic classification by correspondent, document type and tags according to your rules.
- Watched folder and email ingestion: drop a file, and it is processed and indexed on its own.
- Instant search across all textual content, not just file names.
- Preservation of the originals intact alongside the OCR'd versions, for evidentiary value.
- Controlled backups of a legally sensitive archive, without a third-party cloud.
Hardware and software requirements
Paperless-ngx is reasonable at idle but OCR is demanding in bursts: 2 vCPUs and 3 to 4 GB of RAM offer good comfort, since OCR of a multipage document temporarily taxes the CPU. For a large initial ingestion of several thousand documents, additional cores speed up processing considerably. Plan for storage covering the originals plus the OCR'd archive files, roughly double the raw volume. On the software side: Docker and docker compose v2, PostgreSQL, Redis, and the Tesseract languages you need (fra, eng, ara). A domain (docs.yourcompany.com) and, optionally, a dedicated IMAP account for the automatic ingestion of email attachments.
Deploy Paperless-ngx step by step
Prepare the VPS and volumes
Install Docker, then create the persistent folders: consume (watched drop point), media (OCR'd archive), data and export. The consume folder will be your document inbox.
Retrieve the official compose file
The project provides an interactive installation script, but in production start from the official docker-compose.yml declaring webserver, broker (Redis), db (PostgreSQL) and the worker. Adapt the volume paths to the folders you created.
Configure the OCR languages and secrets
In the environment file, set PAPERLESS_OCR_LANGUAGE=fra+eng+ara, PAPERLESS_SECRET_KEY generated with openssl rand -base64 48, and the public URL PAPERLESS_URL=https://docs.yourcompany.com.
Create the superuser and start
Run docker compose up -d, then create the administrator with docker compose run --rm webserver createsuperuser. Then log in to the interface to check that the workers are properly processing the task queue.
Add a reverse proxy and SSL
Place Caddy in front of the web service for docs.yourcompany.com, with an automatic Let's Encrypt certificate. Increase the proxy's maximum upload size to accept large scanned PDFs without a 413 error.
Connect email ingestion
In Administration, configure a dedicated IMAP account: Paperless-ngx will retrieve the attachments of incoming emails, OCR them and classify them automatically according to your matching rules.
Define correspondents and document types with automatic matching rules (by keyword or regular expression) from the start. Paperless-ngx also learns through classification: after manually tagging about fifty documents, enable the automatic classifier so it suggests the tags for new files on its own. Combined with the watched consume folder, you get a fully automatic chain from scan to indexed archive.
