# Actual Budget - Personal finance
# Port: 5006
# URL: https://actual.vish.gg
# Local-first personal budgeting app
# SSO: Authentik OIDC (sso.vish.gg/application/o/actual-budget/)
version: "3.8"

services:
  actual_server:
    image: actualbudget/actual-server:latest
    container_name: Actual
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: timeout 10s bash -c ':> /dev/tcp/127.0.0.1/5006' || exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
    ports:
      - "8304:5006"
    volumes:
      - /volume1/docker/actual:/data:rw
    environment:
      # Authentik OIDC SSO — login method not set so password login remains as fallback
      ACTUAL_OPENID_DISCOVERY_URL: https://sso.vish.gg/application/o/actual-budget/.well-known/openid-configuration
      ACTUAL_OPENID_CLIENT_ID: actual-budget
      ACTUAL_OPENID_CLIENT_SECRET: "REDACTED_CLIENT_SECRET" # pragma: allowlist secret
      ACTUAL_OPENID_SERVER_HOSTNAME: https://actual.vish.gg
      ACTUAL_USER_CREATION_MODE: login
    restart: on-failure:5