Breaking: Actual Budget Script (HTTPS / DB Migration / New Structure)

[MickLesk]

ActualBudget Update & Migration Guide

📌 Important: Backup Your Data First

Before updating, export your Actual Budget data to avoid data loss. Follow these steps:

1. Login to your budget and go to More > Settings.
2. Scroll down to Export and click Export Data.
3. Save the file to your computer.

For detailed instructions, see the Backup & Restore Guide.

---

🚀 Key Changes in the New Version

1️⃣ Database Changes

• New database structure, including a password column in auth.
• Migrations are now stored in /opt/actualbudget-data/migrate/.

2️⃣ File Structure Overhaul

• Data moved to /opt/actualbudget-data/.
• Key directories:
  • /opt/actualbudget-data/server-files/
  • /opt/actualbudget-data/user-files/
  • /opt/actualbudget-data/migrations/
  • /opt/actualbudget-data/migrate/
  • /opt/actualbudget-data/config/
• .env is now stored in /opt/actualbudget-data/.

3️⃣ New HTTPS Support

• Supports self-signed certificates.
• Certificates must be renewed manually.

4️⃣ If Issues Persist, Reinstall in a New LXC

• open your Proxmox Main Node and enter:

bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/ct/actualbudget.sh)"

---

🔐 Enabling HTTPS

Generate a Self-Signed Certificate

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /opt/actualbudget/selfhost.key -out /opt/actualbudget/selfhost.crt

Configure HTTPS

Update .env:

ACTUAL_HTTPS_KEY=/opt/actualbudget/selfhost.key
ACTUAL_HTTPS_CERT=/opt/actualbudget/selfhost.crt

Restart service:

systemctl restart actualbudget

Renew Certificate Manually

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /opt/actualbudget/selfhost.key -out /opt/actualbudget/selfhost.crt
systemctl restart actualbudget

---

🎯 Summary

✅ Backup before updating (see Backup Guide)
✅ HTTPS supported but needs manual renewal
✅ If update fails, migrate manually or reinstall LXC

[knario]

Muchísimas gracias por el esfuerzo y por todo el trabajo.

[aperezva]

Hi, how we can update to 25.3.1 version?. It seems update command it´s not working

[MickLesk]

"Due to major changes in the Actual Budget repository, we are currently unable to provide updates. Please check back later"

[aperezva]

see this link: https://actualbudget.org/blog/release-25.3.0

It seems they have cahnged something.

This messages is appearing since two weeks ago

[MickLesk]

Since 5 days. We have Commit Out the Update function, until we have fix it. So be Patient & Look into current issue for state

[aperezva]

ahh ok, it s your message ,apoligies for me misunderstanding

[danluckner]

I have been able to install a new instance of Actual Budget with the latest version with no problems and I can access it with https://<lxc_ip>:5006.
But I have a Caddy instance running as a reverse proxy. When I try access through it, I keep getting HTTP ERROR 502.

I've tried changing the .env file in /opt/actualbudget-data/ to include the IP range or the exclusive Caddy instance IP in the ACTUAL_TRUSTED_PROXIES variable, but to no avail.

Anyone knows how to make it work?
I appreciate any support.

This is how my .env is looking:

ACTUAL_UPLOAD_DIR=/opt/actualbudget-data/upload
ACTUAL_DATA_DIR=/opt/actualbudget-data
ACTUAL_SERVER_FILES_DIR=/opt/actualbudget-data/server-files
ACTUAL_USER_FILES=/opt/actualbudget-data/user-files
PORT=5006
ACTUAL_TRUSTED_PROXIES="<network_ip_range>/24,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.1/32,::1/128,fc00::/7"
ACTUAL_HTTPS_KEY=/opt/actualbudget/selfhost.key
ACTUAL_HTTPS_CERT=/opt/actualbudget/selfhost.crt

[MickLesk]

do you have already an Certificate? Then its an Thing of your config

Have you try another Browser? Chrome for example caused many cors Issues.

Or maybe you ask in the Repo of actual

[danluckner]

I only tried in Chromium based browsers.

I will ask in their repo.

One thing to note is that the previous Actual Budget version was working properly with my Caddy configuration, without any issues.
All I did different was the update.

[danluckner]

I was able to make it work for now by adding the tls_insecure_skip_verify.
This is not exactly recommended, but I'm running both Caddy and Actual budget on the same Proxmox instance.

actualbudget.mydomain.com {
  reverse_proxy https://<acutalbudget_lxc_ip>:5006 {
    transport http {
      tls_insecure_skip_verify
    }
  }
}

If you don't want to use tls_insecure_skid_verify instruction, you need to get the certificate files referred in the Actual Budget .env file, add them to the Caddy LXC in a known directory and use another instruction:

actualbudget.mydomain.com {
  reverse_proxy https://<acutalbudget_lxc_ip>:5006 {
    transport http {
      tls_trusted_ca_certs /path/to/selfhost.crt
    }
  }
}

I did not test the tls_trusted_ca_certs yet, but this is what Caddy documentation and forum suggest.

[githubaff0]

I did not test the tls_trusted_ca_certs yet, but this is what Caddy documentation and forum suggest.

I just got tls_trusted_ca_certs working but had to regenerate my Actual server self-signed cert. Note update below that tls_trusted_ca_certs is now deprecated in favor up tls_trust_pool.

On the Caddy box, I captured the Actual server cert:

# openssl s_client -connect 192.168.0.203:5006 </dev/null 2>/dev/null | sed -n -e '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' | tee /etc/caddy/actual-server-selfsigned.pem
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

And then updated my Caddyfile to use it.

*.example.com {
	@hostactual host actual.example.com
	reverse_proxy @hostactual https://192.168.0.203:5006 {
	transport http {
		tls_trusted_ca_certs /etc/caddy/actual-server-selfsigned.pem
	}
}

but I got

# systemctl restart caddy.service

# curl -vvv https://actual.example.com/
...
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 502

# systemctl -l --no-pager status caddy
...
Mar 16 09:20:28 caddy caddy[9439]: {"level":"error","ts":1742131228.7798386,"logger":"http.log.error","msg":"tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead","request": ...

So on the Actual server, I regenerated my Actual budget self-signed cert with a SubjectAlternativeName entry (and extended the expiration):

# cd /opt/actualbudget

# openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -addext "subjectAltName = DNS:localhost" -keyout selfhost.key -out selfhost.crt <<EOF
US
California
San Francisco
My Organization
My Unit
localhost
[email protected]
EOF
...

# systemctl restart actualbudget.service

Then on back on the Caddy server, I confirmed I saw the SAN entry set in the Actual server cert and recaptured the new cert:

# openssl s_client -connect 192.168.0.203:5006 </dev/null 2>/dev/null | openssl x509 -noout -text  | grep -A1 'Subject Alternative Name'
            X509v3 Subject Alternative Name: 
                DNS:localhost

# openssl s_client -connect 192.168.0.203:5006 </dev/null 2>/dev/null | sed -n -e '/BEGIN CERTIFICATE/,/END CERTIFICATE/p' | tee /etc/caddy/actual-server-selfsigned.pem
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

And I updated the Caddyfile to use the server name to match the new cert

*.example.com {
	@hostactual host actual.example.com
	reverse_proxy @hostactual https://192.168.0.203:5006 {
	transport http {
		tls_trusted_ca_certs /etc/caddy/actual-server-selfsigned.pem
		tls_server_name localhost
	}
}

Update

I see that tls_trusted_ca_certs is deprecated

# journalctl -l --no-pager -u caddy | grep 'tls_trusted'
...
Mar 16 17:02:50 caddy caddy[11647]: {"level":"warn","ts":1742158970.381777,"msg":"The 'tls_trusted_ca_certs' field is deprecated. Use the 'tls_trust_pool' field instead."}

Updated config:

*.example.com {
	@hostactual host actual.example.com
	reverse_proxy @hostactual https://192.168.0.203:5006 {
	transport http {
		tls_trust_pool file /etc/caddy/actual-server-selfsigned.pem
		tls_server_name localhost
	}
}