blob: b07251868227bce59b335ce1ef43d1b93f6a0764 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
{ ... }:
# Actual Budget - local-first personal finance application.
#
# Native NixOS module (services.actual, available since this flake's pinned
# nixpkgs release). Listens on 127.0.0.1:5006; Caddy handles public HTTPS
# termination.
#
# On first visit to https://budget.karanj.com the app prompts you to set a
# server password in the browser - no pre-configuration needed.
#
# All budget data is persisted in /var/lib/actual on the host (the module's
# own StateDirectory).
#
# Uses a static user rather than the module's default DynamicUser: this
# server previously ran Actual via a hand-rolled Podman container (root
# inside the container = host root), so /var/lib/actual's existing budget
# data is owned by root:root. A DynamicUser gets a fresh ephemeral UID each
# start and can't read pre-existing root-owned files, so the service would
# fail to see the existing budget on switch-over. The tmpfiles rule below
# reclaims ownership for the static user once, recursively.
{
services.actual = {
enable = true;
user = "actual";
group = "actual";
settings = {
hostname = "127.0.0.1";
port = 5006;
};
};
users.users.actual = {
isSystemUser = true;
group = "actual";
};
users.groups.actual = { };
systemd.tmpfiles.rules = [
"Z /var/lib/actual 0700 actual actual - -"
];
}
|
