Unraid

Wealthfolio runs as a standard Docker container on Unraid, configured through Unraid’s Docker tab. The Community Apps (CA) template covers ports, volumes, and required env vars. You just fill in the secrets.

Prerequisites

• Unraid 6.10 or newer
• The Community Applications plugin
• A directory under /mnt/user/appdata/ for persistent data (template defaults to /mnt/user/appdata/wealthfolio)

Install from Community Apps

1. Open the Apps tab in the Unraid web UI.
2. Search for Wealthfolio.
3. Click Install, fill in the required values below, click Apply.

That’s it. The container starts, and the WebUI is reachable at http://<unraid-ip>:8088.

Manual sideload (power users)

If you want to test a newer template before CA picks it up, or run a template Squid hasn’t approved yet, sideload it directly from the project repo. SSH into Unraid (or use the WebTerminal):

mkdir -p /boot/config/plugins/dockerMan/templates-user
curl -fsSL \
  https://raw.githubusercontent.com/wealthfolio/wealthfolio-unraid/main/templates/wealthfolio.xml \
  -o /boot/config/plugins/dockerMan/templates-user/my-wealthfolio.xml

Then in Unraid: Docker → Add Container → Template dropdown → User templates → wealthfolio.

Required values

Generating the password hash

On any machine with argon2 installed (brew install argon2, apt install argon2, or argon2.online):

printf 'your-password' | argon2 yoursalt16chars! -id -e

Copy the entire output (starts with $argon2id$v=19$...) into the WF_AUTH_PASSWORD_HASH field.

OIDC with a private CA

For an IdP using a private CA, see WF_OIDC_CA_FILE for supported server builds and trust behavior. Leave this optional setting empty for ordinary installations.

In Docker → wealthfolio → Edit:

1. Add a Path mapping from an existing host PEM CA bundle to /certs/internal-ca.pem, with access mode Read Only.
2. Set the advanced variable WF_OIDC_CA_FILE to /certs/internal-ca.pem. If an older installed template does not show it, add it as a Variable.
3. Make the bundle readable by the actual container user (99:100 with the standard template). Keep it and its parent directory protected against unauthorized changes, then click Apply to recreate the container.

The variable uses the container path, not the Unraid host path. Restart the container after replacing the bundle. A missing, unreadable, or invalid bundle prevents startup when OIDC is enabled. Browser trust for the IdP is configured separately.

Permissions

The image runs as a non-root user (UID 1000) by default. The Unraid template overrides this with --user=99:100 in <ExtraParams> so the container matches Unraid’s standard nobody:users appdata ownership. Fresh installs work without any host-side chown.

chown -R 99:100 /mnt/user/appdata/wealthfolio

Reverse proxy (SWAG, NPM, Traefik)

If you front Wealthfolio with a proxy:

• Set WF_CORS_ALLOW_ORIGINS to the public HTTPS URL.
• Forward to the container’s host port (default 8088).
• Standard websocket / Host header proxying. No special config needed.
• If your proxy authenticates, set WF_AUTH_REQUIRED to false (advanced view) and clear WF_AUTH_PASSWORD_HASH.

See Reverse proxy setup for full examples.

Backups

Everything lives in the appdata volume:

• wealthfolio.db: your portfolio data
• secrets.json: encrypted with WF_SECRET_KEY

Back up the volume and the secret key together. Either alone is useless. Tools like CA Backup / Restore Appdata work fine.

Updating

In the Docker tab, click the container → Force Update. The template tracks wealthfolio/wealthfolio:latest; switch the Repository field to a specific tag (e.g. wealthfolio/wealthfolio:3.3.0) for production stability.

Troubleshooting

Configuration reference

Every variable the container reads is documented in Configuration.