Proxmox VE

There are three sensible ways to run Wealthfolio on Proxmox. Pick based on how you already run other services.

If you’re already a community-scripts user, stick with the LXC path. If you already run a Docker host VM on Proxmox, just deploy the container there like any other service. See Docker Compose.

1. LXC via community-scripts (recommended)

The community-scripts project maintains an installer that creates a Debian 13 LXC, installs all dependencies, builds Wealthfolio from source, and registers a systemd service.

Install

Open a shell on the Proxmox host (not inside an existing container) and run:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/wealthfolio.sh)"

The script prompts for resources. The defaults are sensible:

When the script finishes:

• WebUI: http://<lxc-ip>:8080
• Login credentials: /root/wealthfolio.creds inside the container (pct enter <vmid> then cat ~/wealthfolio.creds)
• WF_SECRET_KEY is generated for you and persisted in /etc/systemd/system/wealthfolio.service. Back this file up along with /opt/wealthfolio_data/.

Layout inside the LXC

Updating

Re-run the installer one-liner. The script’s update path pulls the latest release tag, rebuilds, and restarts the service.

OIDC with a private CA

For a native LXC using an IdP behind a private CA, place the PEM CA bundle inside the LXC, for example /etc/wealthfolio/internal-ca.pem. Inspect systemctl cat wealthfolio.service to find the service’s EnvironmentFile, and add the following to that file. If the unit defines its environment inline instead, add the variable to the service’s environment configuration.

WF_OIDC_CA_FILE=/etc/wealthfolio/internal-ca.pem

The bundle must be readable by the service’s configured User and protected against changes by untrusted users. Restart wealthfolio.service after changing the setting or replacing the bundle. If you edited the unit or a drop-in, run systemctl daemon-reload before restarting. Leave the setting unset when no private CA is needed.

See WF_OIDC_CA_FILE for supported server builds, startup failures, and browser trust requirements. Installing the CA only in the system trust store does not configure the OIDC client. For the Docker paths below, use the read-only Compose mount and a container path instead.

2. Docker inside an LXC

If you already run a Docker-host LXC for other services, just add Wealthfolio to it. Otherwise, create a small unprivileged Debian/Ubuntu LXC first.

LXC requirements for Docker

In the LXC’s config (/etc/pve/lxc/<vmid>.conf on the Proxmox host):

features: nesting=1,keyctl=1

Unprivileged containers running storage-driver overlay2 may also need:

lxc.apparmor.profile: unconfined
lxc.cap.drop:

(Drop these only if you understand the security tradeoff. Privileged LXCs sidestep most of this but lose isolation.)

Install Wealthfolio

Inside the LXC, install Docker + Compose, then follow the Docker Compose guide. Quick version:

mkdir -p /opt/wealthfolio && cd /opt/wealthfolio

# Generate secrets
WF_SECRET_KEY=$(openssl rand -base64 32)
apt install -y argon2
WF_AUTH_PASSWORD_HASH=$(printf 'changeme' | argon2 yoursalt16chars! -id -e)

cat > .env <<EOF
WF_SECRET_KEY='${WF_SECRET_KEY}'
WF_AUTH_PASSWORD_HASH='${WF_AUTH_PASSWORD_HASH}'
WF_CORS_ALLOW_ORIGINS=http://$(hostname -I | awk '{print $1}'):8088
EOF
chmod 600 .env

curl -fsSL https://raw.githubusercontent.com/wealthfolio/wealthfolio/main/compose.yml -o compose.yml
docker compose --env-file .env up -d

WebUI: http://<lxc-ip>:8088. Data lives in the wealthfolio-data Docker volume.

# Compose prefixes the volume with the project name (the directory you ran
# `docker compose` from). Run `docker volume ls` to confirm – the name is
# usually `wealthfolio_wealthfolio-data`. Substitute it below if different.
docker compose down
docker run --rm -v wealthfolio_wealthfolio-data:/data alpine chown -R 1000:1000 /data
docker compose up -d

3. Docker inside a VM

Same flow as a normal Docker host. Nothing Proxmox-specific. Spin up a Debian/Ubuntu VM, install Docker, and follow Docker or Docker Compose.

This is the right choice if you don’t want to fiddle with LXC nesting or if you’re already running a “docker VM” pattern.

Reverse proxy

For HTTPS and a real domain, see Reverse proxy setup.

Troubleshooting

Reference

• LXC installer source: community-scripts/ProxmoxVE → ct/wealthfolio.sh
• Build/install steps: community-scripts/ProxmoxVE → install/wealthfolio-install.sh
• Prebuilt-binary tracking issue: #563