Tally

A self-hosted personal finance web application for households. Track accounts, transactions, budgets, savings goals, and debt — all in one place, on your own infrastructure.

⚠️ Security: single-tenant only

Tally is designed for a single household you fully trust. Authentication gates access to the app, but the data layer is not user-scoped: any authenticated user (owner or viewer) can read all accounts, transactions, budgets, debts, and savings in the instance. Roles limit actions, not data visibility.

Do not expose Tally as a shared multi-user service to people who should not see each other's finances, and do not put it on the public internet. Run it on your LAN or behind a private tunnel/VPN. Per-user data isolation is tracked as a future enhancement.

Cross-origin browser access is additionally restricted to an explicit allow-list (ALLOWED_ORIGINS), and the login and password-recovery endpoints are rate-limited per IP. See Configuration.

Features

• Multi-user with configurable roles (Owner / Viewer by default)
• Transaction tracking — verified/unverified status, sortable columns, inline category editing, bulk category update
• Transfers — record money moving between accounts; excluded from budget calculations
• Budgets by category and period (transfers and debt payments excluded)
• Savings goals — allocate income across goals in one step; link withdrawals back to the goal
• Debt tracking — interest rate, minimum payment, paydown strategy badges; link expense transactions directly to a debt
• Closed account lifecycle — mark accounts as closed rather than deleting them
• CSV/PDF import — upload your bank statement files directly through the import wizard
• AI chat interface — ask questions about your finances in plain language; powered by Anthropic, OpenAI, or any OpenAI-compatible endpoint (e.g. Ollama); persona system controls data access and write permissions
• Backup & export — automatic verified snapshot before every upgrade; one-click database backup, full JSON export, and transactions CSV from Settings → Data
• Mobile navigation — slide-in drawer on small screens
• Dracula-inspired UI with custom logo and favicon
• Single Docker container — easy self-hosting

Installation

Option 1 — Docker run (quick start)

Warning: Tally runs as a non-root user inside the container. The host directory you mount at /data must be writable by that user, or Tally will fail to create its database on first start. On Unraid, /mnt/user/appdata/... is writable by default. On a plain Linux host, make the data directory writable by the container's user first (see Getting Started).

# Generate a secret key
SECRET_KEY=$(openssl rand -hex 32)

docker run -d \
  --name tally \
  --restart unless-stopped \
  -p 8092:8091 \
  -v /path/to/your/data:/data \
  -e SECRET_KEY=$SECRET_KEY \
  -e FIRST_RUN_OWNER_USERNAME=admin \
  -e FIRST_RUN_OWNER_PASSWORD=changeme \
  jaydenroberts/tally:latest

Open http://localhost:8092 — your owner account will be created automatically on first run.

Option 2 — Docker Compose

Create a docker-compose.yml:

services:
  tally:
    image: jaydenroberts/tally:latest
    container_name: tally
    restart: unless-stopped
    ports:
      - "8092:8091"
    volumes:
      - ./data:/data
    environment:
      - SECRET_KEY=${SECRET_KEY}
      - ACCESS_TOKEN_EXPIRE_DAYS=30
      - FIRST_RUN_OWNER_USERNAME=${FIRST_RUN_OWNER_USERNAME}
      - FIRST_RUN_OWNER_PASSWORD=${FIRST_RUN_OWNER_PASSWORD}

Create a .env file alongside it:

SECRET_KEY=         # generate with: openssl rand -hex 32
FIRST_RUN_OWNER_USERNAME=admin
FIRST_RUN_OWNER_PASSWORD=changeme

Then start:

docker compose up -d

Option 3 — Unraid Community Applications

1. Open your Unraid web UI and go to the Apps tab.
2. Search for Tally.
3. Click Install and fill in the required fields (SECRET_KEY is mandatory — generate one with openssl rand -hex 32).
4. Click Apply and wait for the container to start.
5. Open http://[your-unraid-ip]:8092.

Manual install via Docker tab (without CA):

1. Go to the Docker tab in Unraid and click Add Container.
2. Set the repository to jaydenroberts/tally:latest.
3. Add a path: Container path /data → Host path /mnt/user/appdata/tally/data (Read/Write).
4. Add a variable: SECRET_KEY = your generated key.
5. Set port: Host 8092 → Container 8091.
6. Click Apply.

Configuration

All configuration is via environment variables:

First-Run Setup

On first start, Tally checks whether any users exist. If none do, it enters setup mode.

Automatic setup (via env vars): If FIRST_RUN_OWNER_USERNAME and FIRST_RUN_OWNER_PASSWORD are set, the owner account is created silently at startup. No setup page is shown.

Manual setup (via browser): If those vars are not set, navigate to http://[host]:8092 — you will be redirected to a setup page where you can create the first owner account. This endpoint is disabled once any user exists.

After setup, log in with your owner credentials. You can add viewer accounts, configure roles, and invite household members from the Settings page.

Role System

Tally ships with two roles:

Display names are editable by any owner via the UI without affecting permissions logic.

Documentation

Full documentation is available in the docs/ directory:

Development

Prerequisites

• Python 3.14 — the version the runtime image and CI use; older versions are untested
• Node.js 26 — the version the image build and CI use; older versions are untested

Backend

cd backend
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
uvicorn app.main:app --reload --port 8091

Frontend

cd frontend
npm install
npm run dev   # proxies /api to port 8091

Build & Run (Docker)

docker build -t tally .
docker run -p 8092:8091 -v $(pwd)/data:/data tally

Financial File Import

Tally imports transactions from bank statement files you upload directly through the import wizard. Uploads are parsed locally and never leave your machine.

Supported formats: CSV (auto-detected column mapping), PDF bank statements (text extraction).

Privacy

Tally is fully self-hosted. Tally's application code collects no data, contains no telemetry or analytics, and makes no network requests on your behalf. All your financial data stays in your own SQLite database, on your own hardware. Uploaded financial statement files are only parsed locally for import (see Financial File Import).

The AI chat feature (see AI Coach) is optional, but it is not disabled by default: the provider defaults to anthropic, and the feature will make requests whenever an API key is available — from AI_API_KEY, or falling back to an ANTHROPIC_API_KEY present in the container environment. If you want the feature off, ensure neither variable is set; with no key available, no request is ever made and no data leaves your machine. When a key is configured, your chat messages and the financial context your persona settings permit are sent only to the AI provider you configure with your own API key — Anthropic, OpenAI, or a local OpenAI-compatible endpoint such as Ollama — under that provider's terms. Running a local model via Ollama keeps even that traffic on your own network.

These statements describe what Tally's own code does. They do not cover the Docker base image, your operating system, or third-party services you choose to connect — those are outside Tally's control.

Note: Tally is a budgeting and tracking tool, not financial advice. The software is provided as-is under the MIT license.

License

MIT — see LICENSE.