Building a Self-Hosted Family Financial Hub: Wealthfolio, Actual Budget, and Authentik Behind a Unified Services Portal

Modern family life comes with fragmented financial tools: checking accounts across different institutions, investment portfolios, retirement funds, kids’ allowances, and subscription trackers. Handing all this data to commercial SaaS platforms often means accepting recurring subscription costs, privacy compromises, and third-party tracking. I was looking also for a way to have a global look on all the investments, funds and debt that often time is split between multiple brokers, banks and financial institutions.

This post details our deployed private, self-hosted family financial platform. The architecture unifies:

• Actual Budget: A local-first, zero-based budgeting system for cash flow and envelope budgeting.
• Wealthfolio: An investment and net-worth tracking platform for multi-asset monitoring (stocks, ETFs, crypto, real estate, domestic and international brokers).
• Authentik: An open-source Identity Provider (IdP) for Single Sign-On (SSO), multi-factor authentication, and user access management.
• Unified Multi-Site Infrastructure & Services Portal: A single, clean access dashboard (via Homepage / Authentik Application Hub) providing one-click access across all family financial services.

1. High-Level Architecture

Here is how the family financial hub fits together across the family access, unified services portal, identity & authentication, and core application layers:

Why This Combination?

1. Actual Budget excels at tactical, day-to-day cash flow planning, envelope budgeting, and bank reconciliation.
2. Wealthfolio handles strategic wealth tracking, asset allocations, performance metrics, dividend forecasting, and multi-asset net worth aggregation (Real Estate, Crypto, XTB, TradeVille, and Cash).
3. Authentik provides centralized identity management: parents can manage master accounts, kids can have restricted or personal budgets, and everyone logs in with a single password or Passkey.
4. Unified Services Portal bridges multiple sites and services across local homelabs and remote nodes into one polished interface.

2. Core Service Configurations & Deployment

The financial services platform is composed of dedicated containerized services with persistent storage volumes:

version: "3.8"

volumes:
  actual_data:
  wealthfolio_data:
  authentik_db:
  authentik_redis:
  authentik_media:
  authentik_templates:

services:
  # =========================================================================
  # 1. Actual Budget Server
  # =========================================================================
  actual-server:
    image: actualbudget/actual-server:latest
    container_name: actual_budget
    restart: unless-stopped
    ports:
      - "5006:5006"
    environment:
      - PORT=5006
    volumes:
      - actual_data:/data

  # =========================================================================
  # 2. Wealthfolio (Net Worth & Asset Tracker)
  # =========================================================================
  wealthfolio:
    image: wealthfolio/wealthfolio:latest
    container_name: wealthfolio
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      - PORT=8080
      - NODE_ENV=production
    volumes:
      - wealthfolio_data:/app/data

  # =========================================================================
  # 3. Authentik (PostgreSQL + Redis + Server + Worker)
  # =========================================================================
  authentik-db:
    image: postgres:15-alpine
    container_name: authentik_db
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: ${AUTHENTIK_DB_PASS:?error}
      POSTGRES_USER: authentik
      POSTGRES_DB: authentik
    volumes:
      - authentik_db:/var/lib/postgresql/data

  authentik-redis:
    image: redis:alpine
    container_name: authentik_redis
    restart: unless-stopped
    volumes:
      - authentik_redis:/data

  authentik-server:
    image: ghcr.io/goauthentik/server:latest
    container_name: authentik_server
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?error}
      AUTHENTIK_REDIS__HOST: authentik-redis
      AUTHENTIK_POSTGRESQL__HOST: authentik-db
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASS}
    volumes:
      - authentik_media:/media
      - authentik_templates:/templates
    ports:
      - "9000:9000"
      - "9443:9443"

  authentik-worker:
    image: ghcr.io/goauthentik/server:latest
    container_name: authentik_worker
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?error}
      AUTHENTIK_REDIS__HOST: authentik-redis
      AUTHENTIK_POSTGRESQL__HOST: authentik-db
      AUTHENTIK_POSTGRESQL__USER: authentik
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_POSTGRESQL__PASSWORD: ${AUTHENTIK_DB_PASS}
    volumes:
      - authentik_media:/media
      - authentik_templates:/templates

3. Wealthfolio Portfolio Structure & Multi-Asset Account Management

Wealthfolio acts as the central balance sheet and net worth cockpit. Unlike simple stock trackers, our setup models the entire family portfolio across diverse asset classes, geographic regions, and custodians.

                                  ┌─────────────────────────────────────────┐
                                  │      Family Net Worth (Wealthfolio)     │
                                  └────────────────────┬────────────────────┘
                                                       │
         ┌───────────────────┬─────────────────────────┼─────────────────────────┬───────────────────┐
         │                   │                         │                         │                   │
┌────────┴─────────┐ ┌───────┴─────────┐      ┌────────┴────────┐       ┌────────┴────────┐ ┌────────┴─────────┐
│   Real Estate    │ │   Crypto Assets │      │  XTB Brokerage  │       │   TradeVille    │ │   Cash & Banking │
├──────────────────┤ ├─────────────────┤      ├─────────────────┤       ├─────────────────┤ ├──────────────────┤
│ • Primary Home   │ │ • Ledger (Cold) │      │ • Global ETFs   │       │ • BVB Equities  │ │ • Wise EUR/USD   │
│ • Land / Rentals │ │ • On-Chain / EVM│      │   (VWCE, VUAA)  │       │   (TLV, SNP,    │ │ • Emergency Fund │
│ • Linked Mortgage│ │ • Live CoinGecko│      │ • US Stocks     │       │    H2O, SNG)    │ │ • Multi-Currency │
│   Liabilities    │ │   Price Sync    │      │ • CSV Import    │       │ • Fidelis Bonds │ │   FX Tracking    │
└──────────────────┘ └─────────────────┘      └─────────────────┘       └─────────────────┘ └──────────────────┘

Below is the exact breakdown of what accounts are configured in Wealthfolio and how each is added and maintained:

3.1 Real Estate & Physical Property (Houses, Land, Mortgages)

Real estate represents the illiquid foundation of household wealth. Tracking it requires balancing realistic valuation updates with mortgage liability deductions.

• Account Type: Real Estate / Custom Asset.
• Configured Properties:
  • Primary Residence: Capital value based on initial purchase cost plus major capital improvements.
  • Secondary Properties / Land: Appraised land value or rental unit equity.
• How It Is Added:
  1. Navigate to Accounts -> Add Account -> Select Real Estate / Custom Asset.
  2. Set the Account Name (e.g., Primary Residence, Suburban House), Base Currency (EUR or RON), and Initial Value / Purchase Price.
  3. Valuation Method: Rather than using volatile automated scrapers, manual valuation checkpoints are logged semi-annually or annually based on conservative comparative market appraisals or notary benchmark grids. Wealthfolio records these as Value Adjustments rather than trading gains, preserving clean financial analytics. I found that using carefully constructed AI prompts I was able to perform valuations that were very close to the real market value.
  4. Mortgage & Liability Pairing: A paired liability account (e.g., Mortgage Loan - Primary Home) is created under Liabilities. As regular monthly mortgage payments amortize the principal, the liability decreases, accurately reflecting the increasing Net Home Equity (Net Equity = Market Value - Remaining Loan Principal).

3.2 Cryptocurrency & Digital Assets (Cold Storage, Hot Wallets, Staking)

Cryptocurrency holdings are managed across security tiers to separate long-term cold storage from operational on-chain assets.

• Account Type: Crypto Account.
• Account Segmentation:
  • Crypto - Cold Storage (Ledger Nano): High-conviction long-term reserves (Bitcoin BTC, Ethereum ETH, Solana SOL).
  • Crypto - On-Chain / Hot Wallets: Active Web3 assets and staking positions.
• How It Is Added:
  1. Go to Accounts -> Add Account -> Select Crypto.
  2. Enter the account name (e.g., Ledger Cold Storage).
  3. Asset & Ticker Mapping: Add positions by selecting standard cryptocurrency symbols (BTC, ETH, SOL, ADA, DOT, USDC).
  4. Automated Live Pricing: Wealthfolio automatically hooks into public price feeds (CoinGecko / Yahoo Finance) to fetch live spot prices and historical OHLCV data. Every asset is continuously converted into the family’s primary reporting currency (EUR/RON/USD).
  5. Transaction Tracking: Purchases, transfers, and staking rewards are recorded with execution timestamp, quantity, and transaction/gas fees to preserve strict FIFO (First-In, First-Out) cost-basis calculations.

3.3 International Equities & ETFs: XTB (X-Trade Brokers)

XTB serves as our primary broker for global diversification, accumulating index ETFs, and international equities.

• Account Type: Brokerage Account (Base Currency: EUR / USD).
• Tracked Assets:
  • Broad-Market UCITS ETFs: Vanguard FTSE All-World (VWCE.DE), Vanguard S&P 500 (VUAA.DE), iShares Core MSCI World (EUNL.DE).
  • Individual Global Equities: US/European tech and value stocks, including fractional share allocations.
• How It Is Added & Maintained:
  1. Account Creation: Create a Brokerage account named XTB Global Investment.
  2. Automated Statement Ingestion (CSV / Excel):
     • In the XTB xStation 5 platform (desktop or web), navigate to History -> Cash Operations / Closed Positions.
     • Select the reporting period and click Export to CSV.
     • In Wealthfolio, open Import Transactions and upload the statement. Wealthfolio maps the columns into its unified schema:Date,Type,Symbol,Name,Shares,Price,Currency,Commission 2025-01-15,BUY,VWCE.DE,Vanguard FTSE All-World UCITS ETF,15,124.50,EUR,0.00 2025-02-15,BUY,VUAA.DE,Vanguard S&P 500 UCITS ETF,20,98.20,EUR,0.00 2025-03-15,BUY,AAPL,Apple Inc.,5,225.40,USD,0.00
  3. Live Price Feeds & Ticker Matching: Wealthfolio matches European XETRA tickers (.DE), Euronext (.PA), and US tickers directly with market data APIs for automatic daily P&L and unrealized capital gain computations.
  4. Dividend Tracking: Accumulating ETFs (Acc) automatically reflect NAV growth, while distributing dividends from single stocks are logged into the account’s cash balance.

3.4 Domestic & Regional Equities: TradeVille (Bucharest Stock Exchange – BVB)

TradeVille is our dedicated brokerage for Romanian capital market investments, high-dividend domestic blue chips, and sovereign bonds.

• Account Type: Brokerage Account - Domestic BVB (Base Currency: RON).
• Tracked Assets:
  • BET Index Blue Chips: Banca Transilvania (TLV), OMV Petrom (SNP), Hidroelectrica (H2O), Romgaz (SNG), Nuclearelectrica (SNN), BRD Groupe Société Générale (BRD), MedLife (M), Electrica (EL).
  • Domestic Index Trackers: ETF BET Patria-Tradeville (TVBETETF).
  • Government & Corporate Bonds: Romanian State Treasury Bonds (Fidelis series in RON and EUR listed on the BVB).
• How It Is Added & Maintained:
  1. Account Creation: Add a Brokerage account named TradeVille BVB with base currency set to RON.
  2. Statement & Transaction Ingestion:
     • In the TradeVille StartTrade 2.0 / TradeVille Web Portal, go to Rapoarte (Reports) -> Tranzacții executate (Executed Trades) / Fișă Portofoliu.
     • Export the transaction log to CSV/Excel.
     • Import the transactions into Wealthfolio using the mapped Romanian tickers:Date,Type,Symbol,Name,Shares,Price,Currency,Commission 2025-01-20,BUY,TLV.RO,Banca Transilvania SA,500,28.40,RON,7.10 2025-02-10,BUY,H2O.RO,SPEEH Hidroelectrica SA,80,122.50,RON,4.90 2025-03-05,BUY,SNP.RO,OMV Petrom SA,2500,0.735,RON,9.18 2025-04-12,BUY,TVBETETF.RO,ETF BET Patria-Tradeville,100,24.80,RON,2.48
  3. Multi-Currency Real-Time Conversion: Wealthfolio tracks BVB assets in RON while automatically fetching daily foreign exchange rates (RON/EUR and RON/USD) to integrate domestic investments seamlessly into the global family net worth dashboard.
  4. Dividend Withholding Tax Tracking: Romanian dividends feature local withholding tax (impozit reținut la sursă). Wealthfolio logs both the gross dividend and the net credited amount to track true net cash yield and dividend growth trajectories.

3.5 Cash Reserves, Wise & Emergency Funds

• Account Type: Cash / Banking Account.
• Integration Model:
  • Multi-currency liquidity pools (EUR, USD, RON, GBP) held in Wise and local bank accounts.
  • While Actual Budget handles every granular coffee purchase and grocery receipt, Wealthfolio tracks the macro liquid reserve balances (e.g., 6-month family emergency fund, short-term treasury bills, and pending investment cash).

3.6 Target Allocation & Portfolio Analytics

By consolidating all these accounts into Wealthfolio, the platform generates automated visual analytics across three key dimensions:

4. Securing the Financial Stack with Authentik SSO

Financial data requires strict zero-trust perimeter security. Authentik secures the deployed environment via two mechanisms:

1. OpenID Connect (OIDC) / OAuth2: For applications supporting native SSO identity delegation.
2. Forward Auth / Proxy Outposts: For applications without built-in multi-user SSO, Authentik Proxy Outposts intercept requests and enforce authentication before traffic reaches backend containers.

User Directory & Family Groups

• Family-Admins: Full access to all accounts, investment portfolios, and backend infrastructure.
• Family-Members: Scoped access restricted to personal budget views and expense tracking.
• Authentication Flows: WebAuthn / Passkeys and MFA (TOTP) enforced in the Default Authentication Flow for hardware-level biometric protection.

Forward Auth / Proxy Outpost Configuration

Because applications like Actual Budget utilize internal sync keys and token headers, placing them behind an Authentik Proxy Provider ensures unauthenticated external traffic never touches the backend container:

1. Proxy Provider Definition:
   • Type: Proxy Provider
   • Name: Actual Budget Proxy
   • Authorization Flow: default-provider-authorization-explicit
   • External Host: https://budget.yourfamily.com
   • Mode: Forward auth (single application)
2. Application Binding:
   • Name: Actual Budget
   • Slug: actual-budget
   • Provider: Actual Budget Proxy
   • Launch URL: https://budget.yourfamily.com
3. The same pattern is mirrored for Wealthfolio (https://wealth.yourfamily.com).

5. Unified Multi-Site Services Portal Integration

A unified portal provides a single entry point across local homelab servers and remote nodes, keeping the experience seamless for all family members.

Services are exposed and monitored via Homepage and Authentik’s built-in User Hub:

# services.yaml (Homepage Dashboard configuration)
- Family Finances:
    - Actual Budget:
        icon: actual-budget.png
        href: https://budget.yourfamily.com
        description: "Zero-based monthly budgeting & envelope tracking"
        siteMonitor: https://budget.yourfamily.com
        widget:
          type: custom
          url: https://budget.yourfamily.com

    - Wealthfolio:
        icon: wealthfolio.png
        href: https://wealth.yourfamily.com
        description: "Net worth, investment portfolios & asset allocation"
        siteMonitor: https://wealth.yourfamily.com

- Identity & Security:
    - Authentik Identity Portal:
        icon: authentik.png
        href: https://auth.yourfamily.com
        description: "Family Single Sign-On, Passkeys & Account Management"

6. Family Onboarding & Operational Workflows

1. Day-to-Day Budgeting (Actual Budget)

• Family members access the Actual Budget PWA on mobile devices or via the unified portal.
• Bank transactions are synchronized automatically or imported via CSV.
• Family members categorize expenses in real time against monthly envelope allocations.

2. Strategic Net Worth Tracking (Wealthfolio)

• Monthly Broker Sync: Import monthly CSV statements from XTB (global ETFs/stocks) and TradeVille (BVB shares/bonds).
• Crypto Valuation: Real-time balance updates and price syncing for cold storage (Ledger) and on-chain assets.
• Periodic Real Estate Review: Semi-annual valuation checks and mortgage amortization updates.
• Consolidated Net Worth View: Visualizing asset distribution, currency balance, and dividend performance across all holdings.

3. Centralized Access Management & Revocation

• A single biometric Passkey or master password per family member across all financial services.
• In the event a device is lost or compromised, access is revoked centrally from the Authentik admin console without needing to rotate application-level secrets.

7. Data Safety, Privacy & Backup Strategy

Given the sensitive nature of family financial records:

• Automated Encrypted Backups: Scheduled backup jobs target persistent data volumes (actual_data, wealthfolio_data, and authentik_db) to an off-site, client-side encrypted repository.
• Local-First Resiliency: Actual Budget operates on a local-first SQLite model, allowing offline caching on client devices with automatic bidirectional sync once connectivity is restored.
• Full Data Ownership: No reliance on third-party SaaS financial aggregators; sensitive transaction records, balances, and asset identifiers remain 100% inside your private homelab.

Summary

Deploying Wealthfolio, Actual Budget, and Authentik behind a Unified Services Portal provides:

• Multi-Asset Mastery: Seamless consolidated tracking across real estate, hardware-secured crypto, international ETFs (XTB), and domestic Romanian equities (TradeVille).
• 100% Data Sovereignty: Complete elimination of recurring SaaS subscription fees and third-party data tracking.
• Enterprise-Grade Security: Passkeys, MFA, and centralized identity management tailored for family homelab infrastructure.
• Single Access Cockpit: A clean, unified dashboard connecting all household budgeting and investment tracking.