diff --git a/hosts/stratus/containers/docker/actualbudget/default.nix b/hosts/stratus/containers/docker/actualbudget/default.nix
new file mode 100644
index 0000000..05dea91
--- /dev/null
+++ b/hosts/stratus/containers/docker/actualbudget/default.nix
@@ -0,0 +1,42 @@
+{ config, pkgs, ... }:
+{
+  sops.secrets."container/actualbudget/tailscale-auth-key" = { };
+
+  virtualisation.oci-containers.containers = {
+    actualbudget = {
+      image = "ghcr.io/actualbudget/actual-server:latest";
+      volumes = [ "/data/actualbudget:/data" ];
+    };
+
+    tailscale-actualbudget =
+      let
+        configPath = pkgs.writeTextFile {
+          name = "config";
+          destination = "/tailscale-serve.json";
+          text = builtins.toJSON {
+            TCP."443".HTTPS = true;
+            Web."actualbudget.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:5006";
+          };
+        };
+      in
+      {
+        image = "ghcr.io/tailscale/tailscale:latest";
+        environment = {
+          TS_HOSTNAME = "actualbudget";
+          TS_STATE_DIR = "/var/lib/tailscale";
+          TS_SERVE_CONFIG = "/config/tailscale-serve.json";
+          TS_USERSPACE = "true"; # https://github.com/tailscale/tailscale/issues/11372
+        };
+        environmentFiles = [
+          # Contains "TS_AUTHKEY=<token>"
+          config.sops.secrets."container/actualbudget/tailscale-auth-key".path
+        ];
+        volumes = [
+          "/var/lib/tailscale-actualbudget:/var/lib/tailscale"
+          "${configPath}:/config"
+        ];
+        extraOptions = [ "--network=container:actualbudget" ];
+        dependsOn = [ "actualbudget" ];
+      };
+  };
+}
diff --git a/hosts/stratus/containers/docker/default.nix b/hosts/stratus/containers/docker/default.nix
new file mode 100644
index 0000000..6194c35
--- /dev/null
+++ b/hosts/stratus/containers/docker/default.nix
@@ -0,0 +1,8 @@
+{ lib, ... }:
+{
+  imports = lib.mapAttrsToList (name: _: ./${name}) (
+    lib.filterAttrs (_: value: value == "directory") (builtins.readDir ./.)
+  );
+
+  virtualisation.oci-containers.backend = "docker";
+}
diff --git a/hosts/stratus/default.nix b/hosts/stratus/default.nix
index 2331f47..9150039 100644
--- a/hosts/stratus/default.nix
+++ b/hosts/stratus/default.nix
@@ -4,6 +4,7 @@
     ./hardware.nix
     ./disko.nix
 
+    ./containers/docker
     ./containers/nspawn
   ];
 
diff --git a/hosts/stratus/secrets.yaml b/hosts/stratus/secrets.yaml
index 899d180..ac12aad 100644
--- a/hosts/stratus/secrets.yaml
+++ b/hosts/stratus/secrets.yaml
@@ -1,6 +1,8 @@
 seb-password: ENC[AES256_GCM,data:N3w7niUZsyFmF2gF+gMhlDb6XfoYZ8yNrZvv2J0Cb3zDhstW7LsgYZVcM3+MXPbTDE9xJ00VGBayOT7fW+5IYYWdGgbRWvOH0w==,iv:rLCKJ9wUL+3sjIaqwV89pYJtt/ERuoR4AAgbt9H4oHg=,tag:nuh9rT0W500w8+y76MqC1Q==,type:str]
 tailscale-auth-key: ENC[AES256_GCM,data:vwFTBVQr7T8/Wrc3jOCF3TeQhuEpFyJ0M9yES2g+hSmoc4kraq+QfXmpbz9ciw5dk3mZoZycZFPKU2HJig==,iv:1Ca6tOhQNRw3jxnl3+IoKSJpRuy4jHy9HC/Dj2xOsmQ=,tag:ZqZPqBOF5GZoRLLO1Iq2Iw==,type:str]
 container:
+  actualbudget:
+    tailscale-auth-key: ENC[AES256_GCM,data:n6sxwHbhKyvk1gubSIg6qXyDONob2LJOWOUCvLwmZDe3tCVxkq62vwfgiqAA5is2HEaLi72JdgdYMFQNoggwEnZ5X1YcS8WC,iv:0rJJiL+T9y45nZqRqpMobP1XmVYHeLfZei7jQoofMLE=,tag:RKPj2JwBlhNMvYH27lGsaQ==,type:str]
   forgejo:
     ssh-key: ENC[AES256_GCM,data:PbPRioKPPE/sv8jceAzuV5NFSVSBNOZAejCfUJUYmhLblLSuDsZ7fdgk5+TFjf7baVPhWasUGAo588z7fqzMlTgHfT/RtwDJ4QUMaPXts68CxdZemdjVa8LbV96i9UNlCJP8Sz/7Wvc8axnmyIApAhcLBA7d9KTQn/7lXgaGs9QtDDpSSmJluQHDe1t4QG2UqV73ZZ4I1MY9nVYO9lmaKBej43247cnw8FrkeCQLx4nXuArCp88rBug0CpgY8z15eK4RWXonBjBe5TDoCOWpENyD/6uVFeQIow5TSJgKlkh1w+dj9IiCBfYBllH5xQxjsjlVpDba4A+hfoBhah+EWhK3J765UGn4ufslVMNTQeL9yD87WMa1EkYwGSCVgCTD+/BfgP4HjzgGbM0OuU2Z5t2WV/R9Dm69w+wISbcjTmqqk+q6hle0RR5SkY9bOax2AKsOkcp/k6BS9QmNnajD7qnIVgGTLEwqgWjbQJGFLEE5mSNmZU5oV2gatrbPnN609LbaH6d6Zj28l7Hwr6jH,iv:fgUklpj946AqYe5hh3gwII4CUoUXsrrk3cW2TVugm0c=,tag:ypVvK3K/lSunq2g/LFIWRA==,type:str]
   nextcloud:
@@ -33,8 +35,8 @@ sops:
         aW00MUpGdXpYam5LYVFUenh2VndzcE0KT6Hfx1CYJFseFaEZxwi4Fds4v1HEFzBo
         FdSC6pzpZkfXso8EtSftq0lPx10GfJ6GZXYb+bCB2S9ROvUMPYDH3A==
         -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2024-09-14T10:07:39Z"
-  mac: ENC[AES256_GCM,data:5GHWZjCOBq6ksmGuJXh+OTyHmeN/nLplV8Y9bz2hhbufOORg87nsPpGt6ymX6Oc13Y9oFsqGytRFvJGvmgkouWz/aSmqycXCUXgSjSxYciQciUGc7AhLlKNDFh16iouIXn/Ldw2x5VFb7IhqHeAhifoXxUy358n4Z932yoJXE34=,iv:Svb++YaZJW2Mo1QITdowZhXJXWf9sD/8RYLK8R+rNV4=,tag:yqnEBoQsPRi8BERaL8FkSQ==,type:str]
+  lastmodified: "2024-09-17T19:24:26Z"
+  mac: ENC[AES256_GCM,data:J8Yb58+LhtuLck/T0dDyVxJUkn/C0NjQX2BcqwZXcBFKDrFzCOEDIlcAh0xipm5GD1vOtG+aTGTim0ukd7Nyixqihi6Idz36aGXcvV1honkrWh6lJK74ptJfAwt5tCeg8EPUAaDDeWXjkzG75nZo+gyFCiD70KwlM6hbJzWHvy8=,iv:QG37NsN6yGLnv2AWnAeMm/3r+xxbSGlLjnY35IGV6B4=,tag:LWynqPIJoYePUP35DfyY4A==,type:str]
   pgp: []
   unencrypted_suffix: _unencrypted
   version: 3.9.0