hledger on Ubuntu 24.04 LTS

hledger is a mature open source plain text accounting system. Instead of a database, your entire ledger lives in a single human readable text file that you own, can read without any special software, can diff and can keep in version control. hledger reads that journal and produces real double entry accounting reports: balance sheets, income statements, account registers, budgets and forecasts. It suits personal finance, freelance and small business bookkeeping, and any situation where auditable, portable, vendor neutral financial records matter more than a proprietary format.

Three interfaces over one journal

• The hledger command line tool for reports and scripted workflows.
• hledger-ui, a terminal interface for browsing accounts and transactions.
• hledger-web, a browser interface for reviewing the journal and recording new transactions.

All three read and write the same plain text file, so there is no database to keep in step and no import or export step between them.

Secure by default, which matters more here than for most applications

The hledger-web browser interface ships with no authentication of any kind, and by default it allows anyone who can reach it to add transactions to your journal. This image never exposes it that way. It is bound to the loopback interface only and placed behind an nginx reverse proxy that enforces HTTP basic authentication on every request, and a unique administrator credential is generated on each virtual machine's first boot. Only a one way hash of the password is written to the server, while the plain password is placed in a root only file for the administrator to read. There are no shared or default credentials and nothing usable is baked into the image, so no two deployments are ever the same.

The browser interface is configured deliberately in append only mode: new transactions can be recorded, but existing history cannot be altered, deleted, uploaded over or downloaded. The deployment guide explains how to switch to a strictly read only viewer or a fully editable journal if you prefer. Your journal file is readable only by the service account and the administrator, because it is financial data.

Hardened and ready on first boot

• Served over HTTPS on port 443 by nginx, which terminates TLS with a self signed certificate regenerated per VM on first boot. Port 80 redirects to HTTPS.
• An unauthenticated health endpoint is provided for load balancer probes; every other path, including the add transaction endpoint, requires the per instance credential.
• The service runs as an unprivileged system user under systemd for automatic restarts and clean logging.
• A documented starter journal is included so reports return real data the moment you sign in.
• A built in self test proves the accounting engine, the authentication gate and the browser interface end to end.

Why cloudimg

cloudimg delivers hledger installed and fully patched on a hardened Ubuntu 24.04 LTS base, serving on first boot, with no shared credentials and nothing to compile yourself. Every image passes an automated verification gate and is backed by 24/7 support with a guaranteed 24 hour response SLA.

Licensing

hledger is open source software distributed under the GNU General Public License version 3 or later, and is free. The licence text and a pointer to the corresponding source are included on the image. The cloudimg charge covers packaging, hardening, security patching, image maintenance and 24/7 support. A step by step deployment guide is provided.