Running Actual Budget from a Synology NAS

This post walks through how to set up Actual Budget on a Synology NAS using Docker containers, and also includes upgrade instructions for when Actual release a new version. Additionally, I describe how to get it working with HTTPS using both tailscale cert and your own root certificate if you want to use a custom domain.

What is Actual Budget

Actual Budget is an open-source, self-hosted budgeting app that uses the envelope budgeting method, loosely inspired by YNAB4 (which was a standalone desktop/mobile budgeting app that synced via Dropbox). I am a big fan of Actual, because it allows you to own your own data, vital for sensitive personal financial information, and it fills the much-needed void left since YNAB moved to a hosted subscription model. Even better, it's open source, so you can inspect the code, and contribute back to the project.

Setup Tailscale

This is optional, but using Tailscale gives us a VPN that allows our NAS, and thus our budget, to be accessed from all of our devices wherever we are, without exposing it to the public internet. Tailscale provides a package that can be installed via the Synology Package Center.

I won't go into the details of setting up a Tailscale network in this guide, but I will cover some options for getting HTTPS working with Let's Encyrpt when using Tailscale.

Getting Actual Budget running on the NAS

These instructions are valid as of DSM 7.2.2-72806 Update 3 (confirmed working with 7.3.2-86009 Update 1).

1. Install Container Manager

Via the Package Center, install Container Manger.

This is the application that allows us to run docker containers on our NAS.

2. Create a folder to store docker data

We need to create a destination on our NAS for our docker containers to store data, so that the data is accessible when the container is stopped, and persists even when the container is deleted or replaced when we upgrade it.

In Control Panel, select Shared Folder, and click Create. Give it a name - I chose docker. We don't need the recycle bin, so deselect it.

On the next page, we can skip encryption. Under user permissions, we need to grant permission for Container Manager to read/write to the folder.

• Under the drop-down, select System internal user, and next to ContainerManager, check Read/Write.

We should now have a folder for storing persistant data from our docker containers, and can close the Control Panel.

3. Add the actual-server Docker Image

The latest docker tag is linked from the Actual release notes. At the time of writing, the latest docker tag is 25.5.0, so I'll use that in this guide.

Update 2026-08-03: Confirmed working for 26.8.0.

Open Container Manager (from Package Center), under Image, choose Action → Import → Add from URL.

For the Repository URL, enter actualbudget/actual-server, and click Import.

Container Manager will fetch the tags from Docker Hub, and we can choose the latest one, at the time of writing, 25.5.0. You can also choose latest, but this makes updates more difficult later, so I suggest going with the version tag.

After clicking Import, nothing will appear to happen - but container manager is downloading the image in the background. You will get a system notification when it's completed, after which if you press the refresh button in the bottom right of the Images window, the image should show up.

(The status dot is blue in the screenshot, because I have already started a container, but the first time it will be white.)

Now we have downloaded the docker image, we can start it as a container.

4. Start the Container

Under Container, select Create.

Choose the image we downloaded, and give the container a name (or leave the default, something like actualbudget-actual-server-1).

We do not need to set up Web Station, so leave that unchecked.

In Advanced settings, referring to Actual's Docker docs, we need to add a couple of settings:

Expose port 5006 locally, so we can access it from our other machines. Type 5006 into the first box.

In Volume Settings, we will add a volume so that our budget data will persist to the shared folder on our NAS we set up in step 2, and not only exist within the running container.

• Click Add Folder. You should be able to see the docker shared folder we created earlier, select it.
• Click Create Folder, and create a folder called actual inside docker.
• Manually enter /data as the destination to mount the folder (this is where the folder appears inside the container)

• Click Next, verify that we have mapped container port 5006 to local port 5006, and docker/actual to /data
• Click Done.

Container manager should then start our container, and it should show up with a green status dot.

Assuming your network settings allow it, it should now be possible to access the running Actual budget application by accessing port 5006 on your NAS from your web browser (I'm using 5007 in the screenshot because I'm starting a new instance for this blog post and don't want to break my old one that's running on 5006). You may get a warning about unsupported features due to not using HTTPS. We'll set up HTTPS in the next section.

Setting up HTTPS

For HTTPS, we need to do two things:

• Get a certificate
• Configure our NAS to use the certificate for Actual Budget

5. Get a TLS Certificate

Personally, I use my own root certificate, and don't want to issue public TLS certificates for my devices that are not accessible from the public internet. But being your own root certificate authority is both a burden and a risk, so most people may prefer to get a certificate from a public certificate authority.

If using Tailscale's Magic DNS, you will need to access Actual via your NAS's fully-qualified tailnet name ending in ts.net, such as nas.tails-scales.ts.net. Tailscale can generate a Let's Encrypt certificate for your NAS using the tailscale cert --cert-file=actual_cert.pem --key-file=actual_key.pem nas.tails-scales.ts.net command. I have not used this myself.

If you have a custom domain, the NAS also provides an option to get a Let's Encrypt certificate for it, mentioned in the next step.

At this stage (unless using Let's Encrypt with a custom domain), we should have a TLS certificate and corresponding private key to upload to the NAS.

6. Add the certificate to the NAS

Open Control Panel, and under Security, Certificate, select Add. Add a description such as Let's Encrypt, then choose Import Certificate.

Note that the NAS also has an option to generate a Let's Encrypt certificate - we won't use that, because we already generated a certificate in step 5 above. If this sounds like it might be a better option for you, here's the Synology docs, although I have not tried it myself.

Select your generated certificate and private key, leaving the Intermediate certificate blank.

We should now have our imported certificate. The name in bold is the Common Name embedded in the certificate. The grey text below is the description we added.

7. Set up a reverse proxy

This configures the NAS to send HTTPS requests it receives to the container running Actual.

In Control Panel, Login Portal, Advanced, select Reverse Proxy. Click Create, then configure the proxy:

• Reverse Proxy Name: Actual
• Source protocol: HTTPS
• Hostname: This is your NAS's tailnet name like nas.tails-scales.ts.net, or if using a custom hostname, whatever you chose. In my case, it's actual.adamu.jp. If using a custom domain, don't forget to set up a DNS record that resolves to your NAS's IP.
• Source port: 443 (If you later want to add other HTTPS services to the NAS using the same hostname, you can use a custom port here, and the service will then run on that port. 443 is the default for HTTPS).
• Enable HSTS (this denies non-HTTPS traffic)
• Leave Access control profile as Not configured
• Destination protocol: HTTP
• Destination hostname: localhost
• Destination port: 5006

The NAS should now be forwarding HTTPS requests to actual. But the browser should complain, because we have not told the NAS to use the uploaded TLS certificate yet:

8. Serve the TLS certificate from the reverse proxy

Back in Control Panel → Security → Certificate from step 6, click Settings.

Open the drop down for our reverse proxy, and set it to use our TLS certificate, and click OK.

9. Done!

We should now be able to access the running Actual server via HTTPS from the browser 🎉

Upgrades

When a new version of Actual is released, we can upgrade it by stopping the container, downloading the new image, and starting a new container bound to the same port and data directory as the old one.

From Container Manager:

1. Stop, then Delete the existing container (the data remains in the folder we created at step 2).
2. Add the latest image and start a new container, following steps 3-4 of the guide above. This is why using the versioned tag is better - when using latest it's hard to confirm that you've actually downloaded the latest latest.
3. Delete the now unused image of the previous version.

You may also need to force-refresh any browsers, so they download the latest version of the client code from the server.

Backups

Actual Budget is local-first software. It uses CRDTs to store the data locally in the browser on each device, and uses the server to synchronise the data between them.

Check out the Actual docs for information about how to backup your data from within the app. You may also want to back up the /docker/actual shared folder we created in step 2 above.

Feedback

If you use this guide and identify any errors or inaccuracies, please get in touch on the Fediverse or via email.