Add Actual Budget to the sensitive tier #142

Beyond ADR-0008's nine. Cross-references #102 but does not block on the placement decision — this is a small service that fits the tier the ADR already defined.

What and why

Actual MIT Nodejs/Docker — awesome-selfhosted README.md:1525.

Local-first zero-sum budgeting. The server is a sync target rather than the application itself, so it is small, it keeps working when the server is down, and there is no database server to run or back up separately.

Firefly III (:1536, AGPL-3.0, PHP/Docker) is the alternative if double-entry accounting and a rule engine are wanted instead — heavier, Postgres-backed, and a different philosophy rather than a bigger version of the same one. Pick one; running both is how neither gets used.

Placement

Sensitive tier, VLAN 99. Household financial records sit squarely in ADR-0008's "data whose loss or exposure genuinely hurts" — the same category as the password vault and the document archive, and nowhere near the media tier.

What it needs

• The mini PC from ADR-0008: the sensitive-tier services and two new firewall rules are untracked #102 and Caddy (Sensitive tier: Caddy as the reverse proxy and the only published port #129).
• Server password in secrets/*.sops.yaml.
• Backups. The local-first design means every client holds a copy, which is a real mitigation but not a backup strategy — it survives server loss, not a bad sync.
• Bank sync is optional and involves a third party; default to off and import files instead, which keeps the estate's no-external-dependency property intact.

Which VLAN this touches

🔴 99 — Winterfell (management)

Security review

• Does not weaken the default-deny posture between VLANs — reached from Hicks under the existing 50→99; no new rule
• Any new credential goes in secrets/*.sops.yaml
• Any new device is added to docs/network.md with an OUI-truncated MAC — n/a

Depends on

#102 (the mini PC), #129 (Caddy).

Corrected 2026-09-19

"Depends on #102 (the mini PC)" — #102 closed 2026-09-04 and the box is in hand; the host is #404. Not authored, and correctly so: this is beyond ADR-0008's nine and needs its own decision first. Moved to the Tier extras milestone today so that trinity measures the tier ADR-0008 decided.