Actual Budget - Post Install

[MickLesk]

[githubaff0]

Update: The latest version of the Proxmox Helper script (as of release 2025-02-20) enables HTTPS via a self-signed cert by default, so new installs should not run into the SharedArrayBuffer issue.

--- Original

I just installed Actual Budget recently. I wanted use HTTPS instead of using fallback mode, so I can share some of my notes/findings about setting up an HTTPS reverse proxy for Actual Budget.

1. I wanted to use HTTPS instead of fallback mode because of this thread: https://www.reddit.com/r/actualbudgeting/comments/1d6ldvo/how_important_is_httpssharedarraybuffer_to_not/
2. The SharedArrayBuffer issue seems to be due to different browser behavior when the browser is accessing http to localhost (no problem) vs http to non-localhost (problem) vs https to non-localhost (no problem) - [Bug]: Using full URL vs localhost results in merged budget Files actualbudget/actual#436 (comment)
3. So this means you can resolve the issue with a reverse proxy terminating the HTTPS connection as an alternative to enabling HTTPS directly on your Actual Budget server.
4. The Actual software doesn't support mapping the server to a subdir path in a proxy. See [Feature] Allow changing the base URL actualbudget/actual#672 (comment)
5. If you happen to use DuckDNS for your homelab domain/cert, note that DuckDNS will resolve subdomains of your DuckDNS domain, i.e. if you register foobar.duckdns.org, then actual.foorbar.duckdns.org will resolve as well. See https://www.reddit.com/r/homelab/comments/89li2u/comment/dwsk7qo/
6. You may run into problems if you try to register multiple DuckDNS domains (normal and subdomain or wildcard) on single cert via certbot using DNS challenge. See problem and possible solutions here: https://superuser.com/q/1839628 - I just registered a separate cert for my actual subdomain

[nickdaria]

FWIW, I simply put it behind NGINX proxy manager with SSL enabled and that made it work

[githubaff0]

I simply put it behind NGINX proxy manager with SSL enabled and that made it work

Yes, that's basically the TL;DR for my post and that's what I did:

• Set up an NPM proxy using a subdomain (e.g. actual.x.duckdns.org)
• Created a new wildcard cert (e.g. *.x.duckdns.org) separate from my root cert (x.duckdns.org) instead of trying to create an 'uber' cert that covers both my root domain and wildcard subdomain.

I was trying to cite/capture all the references I found while researching the topic and going down some rabbit holes. I should have made my original the post simpler to understand or given it a TL;DR.

[nickdaria]

I simply put it behind NGINX proxy manager with SSL enabled and that made it work

Yes, that's basically the TL;DR for my post and that's what I did:

* Set up an NPM proxy using a subdomain (e.g. actual.x.duckdns.org)

* Created a new wildcard cert (e.g. *.x.duckdns.org) separate from my root cert (x.duckdns.org) instead of trying to create an 'uber' cert that covers both my root domain and wildcard subdomain.

I was trying to cite/capture all the references I found while researching the topic and going down some rabbit holes. I should have made my original the post simpler to understand or given it a TL;DR.

Oh it was very informative, I was just trying to throw a TLDR out there for people who run NGINX/NGINX PM and wanted a quick solution