Firefly-III¶
Personal finance manager.
| Runtime | Container (Docker Swarm), 2 containers: app, db |
| Tier | Apps (Important) |
| Node | swarm-core |
| Image | fireflyiii/core:version-6.6.6; postgres:16-alpine |
| URL | https://firefly.lab.riversfamily.uk |
| Auth | Forward-auth (authentik@swarm) — mandatory, see Gotchas |
| Source | ansible/stacks/apps/firefly-iii/ |
Configuration¶
TRUSTED_PROXIES set to traefik_trusted_proxies. AUTHENTICATION_GUARD=remote_user_guard
with AUTHENTICATION_GUARD_HEADER=HTTP_X_AUTHENTIK_EMAIL — Firefly-III's own
login is disabled; it trusts the Authentik forward-auth header instead.
Volumes¶
| Volume | Path | Backing | Contents |
|---|---|---|---|
upload |
/var/www/html/storage/upload |
Local | Uploaded attachments |
database |
/var/lib/postgresql/data |
Local | Postgres data — never NFS |
Networking¶
app joins both the shared traefik network (for its Traefik route) and
this stack's private internal network. db joins internal only — it is
unreachable from every other stack.
Secrets¶
| Vault variable | Delivered as | Purpose |
|---|---|---|
vault_firefly_postgres_password |
Swarm secret on db; app reads the same value inline as DB_PASSWORD |
Postgres password |
vault_firefly_app_key |
Plain env var (APP_KEY), must be exactly 32 characters |
Laravel app key |
Gotchas¶
- Forward-auth is not optional here. Firefly-III has no native login of
its own once
remote_user_guardis set — it trustsHTTP_X_AUTHENTIK_EMAILcompletely. Theauthentik@swarmmiddleware is what stops a client from spoofing that header and impersonating another user; removing the middleware from this route without also re-enabling Firefly's own login would be a real security hole, not just a config regression.