apps/actual-budget/manifest.yaml
Rama main · réplica de lectura del repositorio original.
schema_version: 6
publication_status: published
slug: actual-budget
name: Actual Budget
tagline: Envelope budgeting that syncs between your own devices
summary: >-
Actual Budget assigns every rouble or dollar to a category for the month ahead, imports transactions from files or bank integrations, and keeps a full local copy of the budget in each browser and desktop client. The server in this recipe is the sync endpoint that merges those copies and stores the file in SQLite.
status: active
editorial_status: experimental
links:
website: https://actualbudget.org/
source: https://github.com/actualbudget/actual
documentation: https://actualbudget.org/docs/
issues: https://github.com/actualbudget/actual/issues
classification:
categories:
- Personal finance
tags:
- budget
- finance
- envelope-budgeting
- local-first
- sync
implementation_languages:
- TypeScript
alternatives_to:
- YNAB
- Quicken
- Monarch Money
license:
spdx: MIT
kind: open_source
restrictions: []
notes: null
localization:
ui_languages:
- en
- ru
docs_languages:
- en
clients:
web: true
android: false
ios: false
desktop: true
auth:
oidc: native
saml: none
two_factor: none
proxy_header: true
requirements:
architectures:
- amd64
- arm64
min_cpu_cores: 1
min_ram_mb: 512
recommended_ram_mb: 1024
min_disk_gb: 2
gpu:
required: false
supported: false
database: sqlite
dependencies: []
operations:
install_difficulty: 1
installation_levels:
home: partial
vps: partial
reliable: partial
maintenance_difficulty: 2
backup_supported: true
restore_tested: true
healthcheck: true
reverse_proxy_required: true
update_complexity: in_place
recipe:
id: actual-budget-compose
version: 3
compose_file: compose.yaml
env_example: .env.example
installation: installation.md
troubleshooting: troubleshooting.md
supported_docker_compose: ">=2.24.0"
application_version: 26.10.0
images:
- name: actualbudget/actual-server
tag_source: pinned
tested_at: "2026-10-09"
tested_architectures:
amd64: passed
arm64: not_tested
smoke_test: full
check_history:
- tested_at: "2026-10-09"
application_version: 26.10.0
recipe_version: 3
tested_architectures:
amd64: passed
arm64: not_tested
smoke_test: full
restore_tested: true
- tested_at: "2026-09-11"
application_version: 26.9.0
recipe_version: 2
tested_architectures:
amd64: passed
arm64: passed
smoke_test: full
restore_tested: true
- tested_at: "2026-09-03"
application_version: 26.9.0
recipe_version: 1
tested_architectures:
amd64: passed
arm64: passed
smoke_test: full
restore_tested: true
- tested_at: "2026-09-02"
application_version: 26.9.0
recipe_version: 1
tested_architectures:
amd64: passed
arm64: not_tested
smoke_test: partial
restore_tested: false
license: MIT
smoke_test_limitations:
- The application smoke test, including backup and restore, passed on amd64 on 2026-10-09. arm64 were not tested in this run.
- "The restore is checked against a volume that was actually removed: the server password and the budget files come back and the password logs in again."
- Budget synchronisation between clients, end-to-end encryption, and bank integrations are not exercised by the smoke test.
security:
public_exposure: supported
default_bind: localhost
privileged: false
host_network: false
docker_socket: false
known_risks:
- Until the server password is set in the browser, anyone who reaches the address can claim the instance; bootstrap it immediately after the first start.
- Budget files are stored unencrypted unless end-to-end encryption is enabled per budget inside the application, and they land unencrypted in every backup.
- ACTUAL_ALLOWED_LOGIN_METHODS is narrowed to password on purpose; allowing the header method behind a proxy that does not strip the header would let a request authenticate itself.
- The whole budget is a handful of SQLite files in one volume, so anyone with access to the volume or an archive reads every transaction.
assessment:
status: not_assessed
assessed_at: null
upstream:
release_source: github
repository: actualbudget/actual
last_release_at: "2026-09-01"
last_checked_at: "2026-09-02T19:40:00Z"
stars: 28528
stars_checked_at: "2026-09-02T19:40:00Z"
releases_last_year: 17
releases_checked_at: "2026-09-02T19:40:00Z"
update_tracking:
releases:
status: current
checked_at: "2026-10-09T13:58:07.217Z"
latest_version: 26.10.0
critical_vulnerabilities:
status: findings
checked_at: "2026-10-09T13:58:51Z"
critical_count: 5
scanner: trivy
ids:
- CVE-2023-45853
- CVE-2026-13221
- CVE-2026-42496
- CVE-2026-8376
- CVE-2026-90711
breaking_updates:
status: unknown
checked_at: null
compose_changes:
status: not_tracked
checked_at: null
outdated_images:
status: current
checked_at: "2026-10-09T13:58:51Z"
images: []
update_policy:
images:
- image: actualbudget/actual-server
provider: docker_hub
repository: actualbudget/actual-server
compose: null
content:
description: description.md
logo: assets/logo.svg
screenshots:
- file: assets/budget.webp
alt: The budget for September with every category assigned and nothing left to budget
- file: assets/accounts.webp
alt: The combined transaction list of all accounts with payees, categories, and cleared marks
- file: assets/reports.webp
alt: The reports dashboard with income, expenses, net worth, and cash flow widgets in dark theme
- file: assets/cashflow.webp
alt: The cash flow report for the month with income and expense bars over the running balance in dark theme
- file: assets/settings.webp
alt: Settings with the client and server versions, themes, number and date formats, and the interface language
updated_at: "2026-10-09"