1.5.0 Release actual budget

config/services/containers/app/actual-budget/actual-budget.container.j2

@@ -0,0 +1,29 @@
+[Quadlet]
+DefaultDependencies=false
+
+[Unit]
+Description=Actual Budget
+
+[Container]
+Image=ghcr.io/actualbudget/actual-server:{{ version['containers']['actualbudget'] }}
+ContainerName=actual-budget
+HostName=actual-budget
+
+PublishPort=5006:5006
+
+Volume=%h/data/containers/actual-budget:/data:rw
+
+Environment="TZ=Asia/Seoul"
+Environment="ACTUAL_OPENID_DISCOVERY_URL=https://authelia.ilnmors.com/.well-known/openid-configuration"
+Environment="ACTUAL_OPENID_CLIENT_ID=actual-budget"
+Environment="ACTUAL_OPENID_SERVER_HOSTNAME=https://budget.ilnmors.com"
+Environment="ACTUAL_OPENID_AUTH_METHOD=oauth2"
+Secret=ACTUAL_OPENID_CLIENT_SECRET,type=env
+
+[Service]
+Restart=always
+RestartSec=10s
+TimeoutStopSec=120
+
+[Install]
+WantedBy=default.target

config/services/containers/auth/authelia/config/authelia.yaml.j2

@@ -175,3 +175,25 @@ identity_providers:
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_post'
+      # https://www.authelia.com/integration/openid-connect/clients/actual-budget/
+      - client_id: 'actual-budget'
+        client_name: 'Actual Budget'
+        client_secret: '{{ hostvars['console']['actualbudget']['oidc']['hash'] }}'
+        public: false
+        authorization_policy: 'one_factor'
+        require_pkce: false
+        pkce_challenge_method: ''
+        redirect_uris:
+          - 'https://budget.ilnmors.com/openid/callback'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'groups'
+          - 'email'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+        access_token_signed_response_alg: 'none'
+        userinfo_signed_response_alg: 'none'
+        token_endpoint_auth_method: 'client_secret_basic'

config/services/containers/common/caddy/etc/app/Caddyfile.j2

@@ -47,3 +47,10 @@ immich.app.ilnmors.internal {
                 header_up Host {http.request.header.X-Forwarded-Host}
         }
 }
+
+budget.app.ilnmors.internal {
+        import private_tls
+        reverse_proxy host.containers.internal:5006 {
+                header_up Host {http.request.header.X-Forwarded-Host}
+        }
+}

config/services/containers/common/caddy/etc/auth/Caddyfile.j2

@@ -91,6 +91,15 @@ immich.ilnmors.com {
                 }
         }
 }
+budget.ilnmors.com {
+        import crowdsec_log
+        route {
+                crowdsec
+                reverse_proxy https://budget.app.ilnmors.internal {
+                        header_up Host {http.reverse_proxy.upstream.host}
+                }
+        }
+}
 
 # Internal domain
 auth.ilnmors.internal {