[Gerrrt]

What changed

This adds Actual, the household's budget, to stacks/sensitive on trinity, behind Caddy at actual.matrix.elysium, and records the decision as ADR-0062. The service is authored and validated here; deploying it on trinity comes afterwards and is listed at the end.

Actual has no password setting: a new server is claimed by whoever sets the first password. The new scripts/seed-actual-password.sh claims it from SOPS (ACTUAL_SERVER_PASSWORD), inside the pinned image and with no network, before the service's first start. make up runs it every time, and once the server is claimed it only checks that the SOPS password still logs in.

Also in this PR:

• The Caddy site block and alias.
• actual-data joins the nightly backup set and the restore uid table.
• The restore runbook gains Actual checks.
• A link-only Homepage tile.
• A CI job that boots Actual under its hardening.
• Pointer notes on ADR-0022 (no second factor) and ADR-0023 (class Durable).
• Runbooks, roadmap and changelog.

Why

Closes out the decision half of #142. Miniflux (#147, ADR-0057), Memos (#145, ADR-0059), Mealie (#146, ADR-0060) and linkding (#144, ADR-0061) landed first, and HomeBox's decline took ADR-0058, so Actual is the fifth tier extra and its record is ADR-0062. The issue sits under Tier extras, and the roadmap requires each of those to have its own decision before any of it is written. ADR-0062 is that decision:

• Actual rather than Firefly III.
• Password login only.
• No bank sync.
• The server is claimed before it can answer anyone.

Blast radius

This affects trinity (VLAN 99) only, and adds one container, one volume and one name. Nothing is deployed by merging.

• No change to network segmentation or firewall rules. Hicks reaches it through Caddy's 443 under the existing 50→99 rule.
• No new port published to a VLAN that could not already reach the service. It uses expose: 5006 only.
• No credential added outside secrets/*.sops.yaml. ACTUAL_SERVER_PASSWORD is read from SOPS by the seed script; it is never in the container's environment or in .env.

Known limit (ADR-0062): in password mode every device shares one login session, and changing the password does not sign anyone out. The stack README has a tested command that does.

Verification

Measured on actualbudget/actual-server:26.9.0-alpine, pinned by digest, on trinity:

• It runs as uid 1001, read-only, with no capabilities, and docker diff is empty.
• It boots and answers /health with --network none.
• account.sqlite is in rollback-journal mode.
• Memory: 279 MiB idle, 329 MiB peak.
• A sixth failed login within 15 minutes gets 429.
• A header login is refused.

The seed script was tested on throwaway volumes in four cases, and each gave the expected result:

• new volume → claimed
• already claimed → left alone
• live check → ok
• wrong password → warning, and --check exits 1

Session revocation was tested: after deleting sessions, the old token gets 401.

Actual also booted from the real compose.yaml on an internal network with a spare subnet (the live stack holds the fixed one): healthy, read-only, CapDrop=[ALL], user 1001:1001. CI's hardened-boot job runs it on the real subnet.

• make validate passes. shellcheck was run separately in Docker, because it isn't installed on trinity.

• Deployed to the lab and confirmed working. Not yet; the steps are:

  1. Put ACTUAL_SERVER_PASSWORD in SOPS on trinity, and a copy in the password manager.
  2. Add the actual host override on morpheus.
  3. Run make up STACK=sensitive.

  No real budget goes in before Build the sensitive-tier host on the ProDesk (ADR-0034) #404 step 10.

• Docs updated (docs/, service README, or docs/roadmap.md)

Refs #142

🤖 Generated with Claude Code