github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-11-12 03:42:19 -06:00
Code Issues 3.0k Packages Projects Releases 58 Wiki Activity

[Bug]: Docker health-check script fails when using self signed certificates #1870

New Issue
Closed
opened 2026-02-28 19:56:50 -06:00 by GiteaMirror · 5 comments
GiteaMirror commented 2026-02-28 19:56:50 -06:00
Owner
Copy Link
Copy Source

Originally created by @matthijssn on GitHub (Feb 17, 2025).

Verified issue does not already exist?

  • I have searched and found no existing issue

What happened?

When using self signed certificated, the fetch used in the health-check node script returns an error, what results in an unhealthy status in Docker.

FetchError: request to https://localhost:8003/health failed, reason: self-signed certificate at ClientRequest

How can we reproduce the issue?

Generate own self signed certificates and use them the actual docker compose setup. Enable health check in the docker compose, pointed to the health-check.js script in the src/scripts folder.

Where are you hosting Actual?

Docker

What browsers are you seeing the problem on?

Microsoft Edge

Operating System

Linux

Originally created by @matthijssn on GitHub (Feb 17, 2025). ### Verified issue does not already exist? - [x] I have searched and found no existing issue ### What happened? When using self signed certificated, the fetch used in the health-check node script returns an error, what results in an unhealthy status in Docker. FetchError: request to https://localhost:8003/health failed, reason: self-signed certificate at ClientRequest ### How can we reproduce the issue? Generate own self signed certificates and use them the actual docker compose setup. Enable health check in the docker compose, pointed to the health-check.js script in the src/scripts folder. ### Where are you hosting Actual? Docker ### What browsers are you seeing the problem on? Microsoft Edge ### Operating System Linux
GiteaMirror added the bug label 2026-02-28 19:56:50 -06:00
GiteaMirror commented 2026-02-28 19:56:50 -06:00
Author
Owner
Copy Link
Copy Source

@MikesGlitch commented on GitHub (Feb 17, 2025):

I don't know if you're on discord but here's a solution: https://discord.com/channels/937901803608096828/1340016243415056494/1340035073113723003

If you're not on discord here's the highlights:

Image

Basically, you need to tell node to use the self signed certificate by setting the environment variable NODE_EXTRA_CA_CERTS:

NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/ca.crt node src/scripts/health-check.js'

You'll want to make sure your self signed certificate has localhost in the subject list.

@MikesGlitch commented on GitHub (Feb 17, 2025): I don't know if you're on discord but here's a solution: https://discord.com/channels/937901803608096828/1340016243415056494/1340035073113723003 If you're not on discord here's the highlights: ![Image](https://github.com/user-attachments/assets/4d9b10e3-c1e9-41dd-8545-0b2452b0c250) Basically, you need to tell node to use the self signed certificate by setting the environment variable ``` NODE_EXTRA_CA_CERTS ```: ``` NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/ca.crt node src/scripts/health-check.js' ```` You'll want to make sure your self signed certificate has localhost in the subject list.
GiteaMirror commented 2026-02-28 19:56:51 -06:00
Author
Owner
Copy Link
Copy Source

@matthijssn commented on GitHub (Feb 18, 2025):

Thanks, ill try it out! probably a good idea when this is part of the docs (https://actualbudget.org/docs/config/https) as well.

@matthijssn commented on GitHub (Feb 18, 2025): Thanks, ill try it out! probably a good idea when this is part of the docs (https://actualbudget.org/docs/config/https) as well.
GiteaMirror commented 2026-02-28 19:56:51 -06:00
Author
Owner
Copy Link
Copy Source

@khobbits commented on GitHub (Jun 20, 2025):

Dropping this in here, as this is the issue that came up when googling.

When using an actual valid non-self signed certificate, the health check will also fail validation.

If you try and set the 'ACTUAL_HOSTNAME' env variable on the application, this can cause it to fail to bind, if the hostname doesn't resolve to something the app/container can listen on, such as when using various types of docker networking.

You can however set it, before the healthcheck, to make sure it checks the right url.

EG in docker compose:

      # Enable health check for the instance
      test:
        - CMD-SHELL
        - ACTUAL_HOSTNAME=valid.url.com node src/scripts/health-check.js
@khobbits commented on GitHub (Jun 20, 2025): Dropping this in here, as this is the issue that came up when googling. When using an actual valid non-self signed certificate, the health check will also fail validation. If you try and set the 'ACTUAL_HOSTNAME' env variable on the application, this can cause it to fail to bind, if the hostname doesn't resolve to something the app/container can listen on, such as when using various types of docker networking. You can however set it, before the healthcheck, to make sure it checks the right url. EG in docker compose: ``` healthcheck: # Enable health check for the instance test: - CMD-SHELL - ACTUAL_HOSTNAME=valid.url.com node src/scripts/health-check.js
GiteaMirror commented 2026-02-28 19:56:51 -06:00
Author
Owner
Copy Link
Copy Source

@jayscovill commented on GitHub (Oct 25, 2025):

Not sure if this is going to get any views about being closed but I'm confused about how to do this.

Is /usr/local/share/ca-certificates on the Docker host or the container because that path doesn't exist in the container and I'm assuming it's not persistent across restarts if I create it.

I tried putting my CA pem/crt in the /data volume mount and referencing it with 'NODE_EXTRA_CA_CERTS=/data/ca.crt node src/scripts/health-check.js' but that still results in an unhealthy status.

@jayscovill commented on GitHub (Oct 25, 2025): Not sure if this is going to get any views about being closed but I'm confused about how to do this. Is /usr/local/share/ca-certificates on the Docker host or the container because that path doesn't exist in the container and I'm assuming it's not persistent across restarts if I create it. I tried putting my CA pem/crt in the /data volume mount and referencing it with 'NODE_EXTRA_CA_CERTS=/data/ca.crt node src/scripts/health-check.js' but that still results in an unhealthy status.
GiteaMirror commented 2026-02-28 19:56:52 -06:00
Author
Owner
Copy Link
Copy Source

@OberstVonGatow commented on GitHub (Feb 19, 2026):

Same Problem here. Is there any easy update stable method to get this working?
Should be explained in https://actualbudget.org/docs/config/https/
Tought that would be pretty the default way for a smalls self hosting setup in docker to use self signed certificates.

@OberstVonGatow commented on GitHub (Feb 19, 2026): Same Problem here. Is there any easy update stable method to get this working? Should be explained in https://actualbudget.org/docs/config/https/ Tought that would be pretty the default way for a smalls self hosting setup in docker to use self signed certificates.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
tech-support
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#1870