On taking the backup, the thing that separates a backup from a false sense of security: databases must not be copied while running.
Copying the files under a live database gives you a snapshot taken across a period of time, with writes happening during it. It may restore. It may restore into a corrupt state that looks fine until it does not. This is the most common way people discover their backups are worthless.
So, per type:
Databases: use the database's own dump tool, from inside the container, on a schedule. That produces a consistent file you can restore anywhere. Alternatively stop the container, copy the volume, start it again, if a few minutes of downtime is acceptable.
Everything else: files, uploads, configuration: can generally be copied while running, though stopping is still cleaner.
Configuration and compose files, already in git, which is the right answer.
The practical shape for a small box: a script that dumps each database, copies each volume, and hands the result to a backup tool that does encrypted incremental backups off the machine. Run it nightly from a timer.
Off the machine is the part that matters. A backup on the same VPS protects you from a mistake and not from losing the VPS, which was your stated concern.