Error: Authentication failed: network-failure

[clowgg]

I have configured the .env file and it is loading (can see the various environment variables listed in Portainer).
However, I get this error in the container log at start up:

Error: Error: Authentication failed: network-failure
    at Object.init (/app/node_modules/@actual-app/api/dist/app/bundle.api.js:136954:23)
    at async Object.init (/app/node_modules/@actual-app/api/dist/index.js:61:5)
    at async ActualService.initialize (/app/dist/services/actual-service.js:51:9)
    at async main (/app/dist/index.js:22:9)

.env file:

# Akahu API Credentials
AKAHU_APP_TOKEN=app_token_XXXXX
AKAHU_USER_TOKEN=user_token_XXXXX

# Account Mappings
# Format: {"akahu_account_id": "actual_account_id"}
# - Akahu IDs: Found in URL when viewing account on my.akahu.nz (format: acc_xxx...)
# - Actual IDs: Found in URL when viewing account in Actual Budget (GUID format)
ACCOUNT_MAPPINGS={"acc_XXXXX":"XXXXX-XXXX-XXXX-XXXX-XXXXX"}

# Actual Budget Configuration
ACTUAL_SERVER_URL=http://192.168.201.94:5006 # URL of your Actual server
ACTUAL_PASSWORD=XXXXX           # Your Actual master password
ACTUAL_SYNC_ID=XXXXX  # Found in Settings -> Advanced Settings

# Optional Settings
DAYS_TO_FETCH=7  # Number of days of transaction history to fetch (default: 7)
ACTUAL_E2E_ENCRYPTION_PASSWORD=password # Actual E2E encryption password, if enabled (default: undefined)
RECONCILE_ACCOUNT_IDS=["acc_XXXXX"] # JSON array of Akahu account IDs to reconcile after import (default: [])

docker-compose.yaml:

    actual_server:
        image: docker.io/actualbudget/actual-server:latest
        ports:
        # This line makes Actual available at port 5006 of the device you run the server on,
        # i.e. http://localhost:5006. You can change the first number to change the port, if you want.
          - '5006:5006'
        environment:
          - ACTUAL_HTTPS_KEY=/data/selfhost.key
          - ACTUAL_HTTPS_CERT=/data/selfhost.crt
          # - ACTUAL_PORT=5006
          # - ACTUAL_UPLOAD_FILE_SYNC_SIZE_LIMIT_MB=20
          # - ACTUAL_UPLOAD_SYNC_ENCRYPTED_FILE_SYNC_SIZE_LIMIT_MB=50
          # - ACTUAL_UPLOAD_FILE_SIZE_LIMIT_MB=20
        volumes:
          - '/home/cyril/docker/actual:/data'
        healthcheck:
          # Enable health check for the instance
          # test: ['CMD-SHELL', 'node src/scripts/health-check.js']
          # health check using self signed certs
          # test: ['CMD-SHELL', 'NODE_EXTRA_CA_CERTS=/data/selfhost.crt node src/scripts/health-check.js']
          interval: 60s
          timeout: 10s
          retries: 3
          start_period: 20s
        restart: unless-stopped
        
    akahu-actual:
        container_name: akahu-actual
        image: ghcr.io/scottmckendry/akahu-actual
        env_file:
            - '/home/cyril/docker/akahu-actual/.env'
        depends_on:
            actual_server:
               condition: service_healthy

I wonder if the self-signed certificate for the Actual server isn't working properly, as that container stays in [starting] status for a couple of minutes and then goes to [unhealthy] if I have the healthcheck enabled. However, the error stopped happening when I created and configured those two cert files... so I assumed that meant it was working - at least for the browser.

Having said that, the .env ACTUAL_SERVER_URL setting uses http:// so I don't know...

If I do have the 2nd healthcheck enabled, this is the error that appears in the 'Last output':

Health check failed: TypeError: fetch failed at node:internal/deps/undici/undici:14976:13 at process.processTicksAndRejections (node:internal/process/task_queues:103:5) 
{ [cause]: Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: Host: localhost. is not cert's CN: actual.clow.nz at Object.checkServerIdentity (node:tls:456:12) at TLSSocket.onConnectSecure (node:internal/tls/wrap:1711:27) at TLSSocket.emit 
(node:events:519:28) at TLSSocket._finishInit (node:internal/tls/wrap:1099:8) at ssl.onhandshakedone (node:internal/tls/wrap:885:12) { code: 'ERR_TLS_CERT_ALTNAME_INVALID', reason: "Host: localhost. is not cert's CN: actual.clow.nz", host: 'localhost', cert: <ref *1> 
{ subject: [Object: null prototype], issuer: [Object: null prototype], ca: true, modulus: '97AE63FAEC06E6C42FDB314CE848F7C6DBF82DEDA1D1C601E7ABC8128B4D103FA464371291B8CF0ECA86152C8D7D1EAF092DF1132782CCF600E2EC3FE39BA71893EE4E3DBF9F4558571DC5BF0987BEB2888D0E7EA77483420BD36C2EDC2CCDF36A7651EBF021F84B4DAA85AA0C45146B15438DE125B3677878519E024438E08526A99DE84705090CA1FB12B8AC6B29F2C79411996B979EC16C9D71BD90B11215351C612656C7AB570454A5214119AA312A564FB9526D055C303F4D269E1A8BF051094E222ECF8F5669B19D987C403FAF197B9382990B4F49EB3759A32969212F77D7EF4FDEFE396C795FCDCBCC7409DC7E518CCBBDEF09F9DE75C1B5EB0B9CAD', 
bits: 2048, exponent: '0x10001', pubkey: <Buffer 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 97 ae 63 fa ec 06 e6 c4 2f db 31 4c e8 48 f7 c6 db ... 244 more bytes>, 
valid_from: 'Apr 14 11:19:30 2026 GMT', valid_to: 'Apr 14 11:19:30 2027 GMT', fingerprint: 'AB:C6:7B:CB:9D:B6:08:D6:D8:0C:98:23:2B:B1:8D:2C:77:82:5B:DD', fingerprint256: 'B5:1B:EC:88:DF:B3:D1:6B:21:E8:51:04:4C:9F:D5:8B:26:FE:AE:1E:0D:D1:C2:70:1D:8E:F4:FC:0A:78:E7:C6', fingerprint512: '30:1E:72:40:3C:72:61:86:2B:31:56:95:F6:5D:9A:6D:F8:9B:95:61:D8:1B:7F:85:1D:54:BD:92:61:57:AE:C1:8D:A2:95:C1:65:35:F8:A3:2C:18:F2:DE:29:76:7A:FE:1C:6B:4C:8E:EE:7D:BD:07:C5:5C:DC:80:5A:CB:EE:3C', 
serialNumber: '3282D3F4664A2FE7052468F90F0B1EFA5629FE82', raw: <Buffer 30 82 03 b7 30 82 02 9f a0 03 02 01 02 02 14 32 82 d3 f4 66 4a 2f e7 05 24 68 f9 0f 0b 1e fa 56 29 fe 82 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 ... 905 more bytes>, issuerCertificate: [Circular *1] } } }

[scottmckendry]

I think you should be using the internal docker hostname of the actual container in your config.

[scottmckendry]

something like http://actual_server:5006 or something like that. You should be able to work out what the real host name is.

[clowgg]

I found that if I remove the references to the digital cert, and set the ACTUAL_SERVER_URL to the IP address of the host server, and ignore the Https error when I open the Actual web UI, then I can get a healthy Actual container status.

Now your akahu-actual container is connecting to Actual server OK.
But it is coming up with the attached errors.

akahu-actual_logs.txt

[scottmckendry]

ah, what version of actual are you running? I've not updated to the latest here yet.

once #121 is merged and released, I think we should be up-to-date.

For now I think we only support 26.3.*

[scottmckendry]

I'll try and get a release out today to see if it fixes your issue.

[clowgg]

Thanks Scott. I take it that log was useful to understand there is an issue?

[clowgg]

I'm running 26.4.0 - my first install of Actual - done on Sunday.

[scottmckendry]

okay, seems we've got a perfect storm here - there are issues with the API in 26.4.0:

actualbudget/actual#7410

We'll need to wait for 26.4.1 until we can release a compatible version of akahu-actual. I'll try and get this out as soon as the new version comes through. Until then, hold tight :)

[clowgg]

All good - thanks for following up so quickly!!
holding...

[clowgg]

PS: I forced pulling the 26.3.0 Actual image, and your container worked perfectly - this weeks transactions imported fine.

[clowgg]

Since the initial load of 70 days of transactions for all my accounts via akahu-actual, I am only getting 'Auto-reconcile from Akahu balance' transactions in Actual.
I have reset DAYS_TO_FETCH=7 in my env file.
Is there something else I need to get the transactions to transfer, and not just get the account balances updated?

[scottmckendry]

That's odd, can't say i've run into that before. If you're getting the reconciliation transactions it means akahu must be working. I'm not sure why transactions would be missing.

The only thing i can think of is some banks may be slower to update than others.

[scottmckendry]

26.5.0 is out! I've merged the API dep and released under 0.14.1.

This release also introduces a check to make sure akahu-actual only targets supported versions of actual.

It should give a much clearer error than the original cryptic ones reported here.