The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The reliable way to self-host Actual Budget is to run the official actualbudget/actual-server Docker image on a Linux VPS, persist its /data directory on the host, and put the service behind a reverse proxy with HTTPS. Keep the application port private, back up the mounted data independently, and test a restore before trusting the server with your primary budget.
This guide covers the complete path: provisioning and hardening a VPS, launching Actual with Docker Compose, configuring a domain and TLS, syncing devices, backing up and restoring data, updating safely, and diagnosing the failures that matter.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
What self-hosting Actual Budget on a VPS actually involves
Actual Budget has two sides: the application running in your browser or mobile-capable client, and a server that stores and synchronizes the selected budget. A VPS supplies the always-on Linux host. Docker runs the official Actual server in an isolated container. A bind mount preserves the server’s files outside that container, and a reverse proxy handles public HTTPS traffic.
The resulting path is:
Device browser or app → HTTPS reverse proxy → Actual server container on port 5006 → persistent host directory mounted at /data
#1 Best Overall
Deleting and recreating a container is normally safe only when that host directory remains intact. Deleting the directory, or starting a replacement container without mounting it, removes the server-side copy of your budgets. Container status alone is not proof that synchronization or recovery works.
What you need before installing
A Linux VPS
Choose a VPS distribution supported by Docker Engine and Docker Compose. The provider’s smallest plan may be adequate for a single household, but the practical limits are memory, CPU, disk space, and backup capacity rather than a special Actual license. Keep enough disk for the live data, temporary backup archives, logs, and future growth.
Free tools Windows power users keep installed
One-click scans. No signup required.
A domain or subdomain
Use a dedicated hostname such as budget.example.org. Create a DNS record pointing that hostname to the VPS’s public IP address. Certificate issuance will fail if the name does not resolve correctly or if the VPS cannot receive the required HTTP and HTTPS traffic.
Administrative access and a backup destination
Create a non-root administrative account and use it for routine work. Keep a separate destination for backups, such as another server or an external USB hard drive or SSD. A second disk attached to the same VPS is not an adequate disaster-recovery plan if the VPS itself is lost.
Provision and harden the VPS first
- Create a non-root administrator. Log in with the provider’s initial account, create an administrative user, grant the required administrative privileges, and switch to that account for Docker and maintenance work.
- Update the operating system. Apply the distribution’s current security updates before exposing any service to the internet. Reboot if the package manager requests it.
- Restrict the provider firewall. Allow SSH only from trusted source addresses when practical. Allow TCP ports 80 and 443 for the reverse proxy. Do not expose TCP port 5006 publicly when the proxy runs on the VPS.
- Harden SSH. Prefer key-based authentication, disable password login only after confirming that key access works, and avoid permitting direct root login. Keep a recovery method provided by the VPS operator.
- Record the server details. Save the VPS address, SSH user, DNS name, and the filesystem path you will use for the stack. Do not put passwords or private keys in shell history or a public repository.
Public exposure creates ongoing operator duties. You must continue applying operating-system and Docker updates, review disk usage, protect SSH, and investigate unexpected login or container activity. Actual’s documentation does not substitute for a complete VPS-hardening standard.
Install Docker and create the Actual directory
Install Docker Engine and the Compose plugin using the VPS distribution’s supported method. Avoid an unrelated third-party installer when the operating system provides a maintained package path.
Then create a dedicated directory and persistent data directory:
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
sudo mkdir -p /opt/actual/actual-data
sudo chown -R "$USER":"$USER" /opt/actual
cd /opt/actualThe actual-data directory is the host-side location that will be mounted into the container as /data. Back up this directory, not just the container image or a browser profile.
Create a Docker Compose stack
Create /opt/actual/compose.yaml with the official image and a persistent bind mount:
services:
actual_server:
image: actualbudget/actual-server:latest
ports:
- "127.0.0.1:5006:5006"
volumes:
- ./actual-data:/data
restart: unless-stoppedThis host binding keeps port 5006 reachable only from the VPS itself, which is appropriate when Caddy or another host-installed proxy forwards requests locally. The official example maps port 5006, mounts ./actual-data:/data, uses restart: unless-stopped, and defines a Node-based healthcheck. If you use that official Compose file, retain its healthcheck stanza unchanged rather than removing it.
If your reverse proxy runs in another container, do not point it at 127.0.0.1; containers have separate network namespaces. Put both services on the same Docker network and proxy to the service name actual_server:5006, or run the proxy on the host as in the example above.
Start the container and verify it locally
- From
/opt/actual, start the stack:docker compose up -d - Check that Compose sees the service:
docker compose ps - Review startup output if the service is not healthy:
docker compose logs --tail=100 actual_server - If the Compose file includes the official healthcheck, inspect its result:
docker inspect --format='{{.State.Health.Status}}' actual_server
A running container proves only that the process started. Before moving on, confirm that the health state is healthy and that the service responds through the VPS’s local path. Do not import your authoritative budget until the HTTPS path and a backup have both been tested.
Put Actual behind HTTPS with a reverse proxy
Actual recommends hiding an internet-exposed instance behind a reverse proxy with SSL enabled. The proxy listens on ports 80 and 443, obtains and renews the certificate, and forwards traffic to the private Actual service.
Host-installed Caddy
Install Caddy using the Linux distribution or Caddy’s supported package instructions, then create a site entry similar to:
budget.example.org {
reverse_proxy 127.0.0.1:5006
}Reload Caddy using the service manager after validating its configuration. With DNS already pointing at the VPS and ports 80 and 443 allowed, Caddy can request a publicly trusted certificate automatically.
Containerized proxies and Traefik
Traefik and containerized Caddy can perform the same role. In that design, attach the proxy and actual_server to a shared Docker network and route to actual_server:5006. Keep the Actual container’s host port unpublished unless you have a specific reason to expose it; the proxy should be the only public listener.
Self-signed certificates
A self-signed certificate encrypts traffic but is not trusted automatically by browsers and many clients. Every device must be configured to trust the certificate, and the healthcheck may also need trust configuration. Expect browser warnings until that trust is installed. For ordinary public access, a certificate issued by a trusted authority is less error-prone.
Open https://budget.example.org in a browser and verify that the certificate is valid, the login page loads, and no request is being sent to an unencrypted HTTP endpoint. Do not treat a successful certificate issuance as proof that the application can read its data directory.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Complete the first Actual setup and connect devices
- Open the HTTPS hostname and create the first administrator password when prompted.
- Create a small test budget rather than importing your entire financial history immediately.
- Sign in from a second device using the same server address and verify that the test budget appears.
- Make a small, identifiable change on one device, wait for synchronization, and confirm it arrives on the other device.
- Only after that test succeeds, import or open the budget you consider authoritative.
Actual’s synchronization model keeps data on local devices and on the server you select; it does not send your budget to arbitrary external servers. Optional end-to-end encryption can protect budget contents from the host, including the VPS operator, but it does not remove the need to protect account credentials or maintain backups. Record any encryption passphrase in a secure password manager. Losing it can make encrypted data unrecoverable.
Back up the persistent data and prove that restoration works
Actual explicitly warns that browser-only data can be lost if browser memory is cleared, so a backup is crucial. Synchronization is not a substitute for an independently restorable backup, and the sync server is not described as a complete database backup in Actual’s FAQ.
A simple cold backup
Stopping the service before archiving gives you a consistent copy:
Recommended Free Tools
Rank #4
cd /opt/actual
docker compose stop actual_server
mkdir -p /opt/actual-backups
tar -C actual-data -czf "/opt/actual-backups/actual-data-$(date +%F).tar.gz" .
docker compose start actual_serverCopy the resulting archive to a separate destination. Keep at least one copy away from the VPS. Nightly backups are a reasonable operational choice, but they are not an Actual requirement; choose an interval that matches how much recent work you could afford to recreate.
Test a restore before disaster strikes
- Use a temporary directory or separate test VPS rather than overwriting the only live copy.
- Stop the test container.
- Extract the archive into a fresh directory that will be mounted as
/data. - Start the official image against that directory and check the health state.
- Log in through HTTPS and open several budgets, including recent transactions.
- Document the exact commands and file locations that worked.
A backup that has never been opened is only an assumption. Test after changing the image version, moving providers, or changing the proxy, because each change can expose a different failure.
Update Actual without losing the data directory
The stable Docker tag is latest. The nightly tag is updated from commits and should be treated as pre-release software. Keep a restorable backup before trying it.
For a normal update:
cd /opt/actual
docker compose pull
docker compose up -dCompose downloads the newer image and recreates the container while reusing the bind-mounted actual-data directory. Afterward, check docker compose ps, inspect the health state, sign in through the browser, and perform a two-device sync test. If the new container fails, inspect logs first; do not delete actual-data as a troubleshooting shortcut.
Security and maintenance checklist
- Network exposure: publish only the reverse proxy’s 80/443 listeners. Keep 5006 private.
- Certificates: renew and monitor the trusted certificate. If self-signed, install trust on every client and in healthcheck contexts.
- Secrets: keep credentials out of shell history and source control. Actual supports configuration through
config.json, environment variables, and secret files; use the mechanism appropriate to your deployment. - SSH: restrict source addresses where possible, use keys, and apply operating-system updates.
- Docker: update Docker Engine and Compose through the supported package channel, and review image changes before production updates.
- Storage: monitor free disk space for the live data, logs, and backup archives.
- Backups: maintain a separate, off-VPS copy and periodically perform a full restore test.
- Monitoring: check certificate expiry, container health, disk usage, and successful backup jobs instead of relying on a single “container is running” signal.
Troubleshooting common failures
The domain shows a timeout
Confirm the DNS record resolves to the VPS address, ports 80 and 443 are allowed in both the provider firewall and the operating-system firewall, and the proxy service is running. If the VPS is behind another gateway, verify that gateway forwards both ports.
The proxy returns a bad gateway
Check whether Caddy is forwarding to the correct target. A host-installed proxy should use 127.0.0.1:5006 when the Compose file binds that address. A proxy container should use the shared-network service name actual_server:5006, not the proxy container’s own localhost.
The browser warns about the certificate
Verify that the hostname in the address bar exactly matches the certificate name and that the certificate is from a trusted authority. With a self-signed certificate, install the certificate authority or server certificate on each client and configure health checks to trust it.
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Actual starts with an empty budget
Inspect the volume declaration and current working directory. A relative mount such as ./actual-data:/data is relative to the directory from which Compose resolves the project. Starting the file from a different directory, changing the path, or omitting the mount creates a new empty data location. Stop the service, identify the original directory, and restore from a known-good archive if necessary.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe container is running but synchronization fails
Test the HTTPS URL from a second device, check browser developer errors, inspect proxy logs, and verify the Actual health state. Confirm that both devices use the same server address and that the VPS clock, certificate, and DNS name are correct. A green container status does not validate the complete sync path.
An update fails
Read docker compose logs --tail=100 actual_server, confirm that the host directory is readable and has free space, and verify that the image pull completed. If the failure began after an update, stop the service and restore the previously tested data copy and image version rather than experimenting on the only production data.
VPS self-hosting versus managed hosting
A VPS gives you control over the operating system, Docker image, region, network rules, and backup destination. It also makes you responsible for every layer below Actual. Managed or community-hosted options reduce administration but limit infrastructure choices and require you to evaluate the operator’s backup and migration policies.
| Decision factor | Self-managed VPS | Managed or community hosting |
|---|---|---|
| Monthly cost | VPS, storage, domain, and optional backup charges; the actual amount varies by provider and plan. | Service fee or community terms; pricing and limits vary by operator. |
| Administrative workload | You maintain Linux, Docker, the proxy, certificates, updates, monitoring, and restores. | The operator handles most infrastructure maintenance. |
| Control | Full control of region, filesystem, image tag, firewall, and encryption configuration. | Dependent on the operator’s supported versions, policies, and features. |
| Backups | You choose the schedule, destination, retention, and restore tests. | Confirm whether backups exist, how often they run, and whether you can download and restore them. |
| TLS setup | You configure DNS, the reverse proxy, and certificate renewal. | Usually included, but verify the hostname and certificate behavior. |
| Geographic location | You select a VPS region and can move it later. | Limited to the operator’s available regions. |
| Storage and CPU limits | Set by your VPS plan and upgrade path. | Set by the service plan and provider policy. |
| Support | Provider support generally covers the VPS, not your Docker or Actual configuration. | The operator may support the application, subject to its service terms. |
| Migration difficulty | Moving the stack means copying actual-data, recreating the proxy, and updating DNS. |
Depends on whether the operator provides a complete export and documented restore process. |
Choose the VPS route when you are comfortable owning updates and recovery. Choose managed hosting when reducing operational work matters more than controlling the underlying host, but ask for a downloadable backup and a documented exit path before importing irreplaceable records.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11When the setup is ready for real financial data
Consider the deployment production-ready only after all of these checks pass:
- The domain resolves to the VPS and loads over a trusted HTTPS certificate.
- Port 5006 is not publicly reachable.
- The official container reports a healthy state.
- A test budget syncs between two devices.
- A complete
/dataarchive exists outside the VPS. - You have restored that archive in a test environment and opened the data successfully.
- You know how to update the image and how to roll back using the tested copy.
- SSH, operating-system updates, disk monitoring, and certificate renewal have an owner and a routine.
With those controls in place, self-hosting Actual Budget on a VPS is a straightforward Docker deployment rather than an exposed application port. The important work is preserving the mounted data, securing the public entry point, and proving that recovery works before you need it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
