diff --git a/machines/bomba/services/actual.nix b/machines/bomba/services/actual.nix
new file mode 100644
index 0000000..7cd4416
--- /dev/null
+++ b/machines/bomba/services/actual.nix
@@ -0,0 +1,9 @@
+{ ... }:
+{
+  services.actual = {
+    enable = true;
+    settings = {
+      port = 8015;
+    };
+  };
+}
diff --git a/machines/bomba/services/caddy.nix b/machines/bomba/services/caddy.nix
index d0427e6..def43c6 100644
--- a/machines/bomba/services/caddy.nix
+++ b/machines/bomba/services/caddy.nix
@@ -8,7 +8,7 @@
   services.caddy =
     let
       basicAuth = ''
-        basicauth {
+        basic_auth {
           ${currentSystemUser} $2a$14$L6SBwu.0FhGBYwH2LWa6uOrBSeRHo8Lo95Vkle/g5uB7kZl7nmJPO
         }
       '';
@@ -77,6 +77,9 @@
         "yamtrack.patrickcanal.it".extraConfig = ''
           reverse_proxy :8014
         '';
+        "actual.patrickcanal.it".extraConfig = ''
+          reverse_proxy :${toString config.services.actual.settings.port}
+        '';
       };
     };
 
diff --git a/machines/bomba/services/default.nix b/machines/bomba/services/default.nix
index 041c2fc..f6ee16c 100644
--- a/machines/bomba/services/default.nix
+++ b/machines/bomba/services/default.nix
@@ -12,6 +12,7 @@
     ./vaultwarden.nix
     ./vikunja.nix
     ./yamtrack.nix
+  ./actual.nix
   ];
 
   services.openssh.enable = true;
diff --git a/machines/bomba/services/fail2ban.nix b/machines/bomba/services/fail2ban.nix
index 9e41433..d84b25c 100644
--- a/machines/bomba/services/fail2ban.nix
+++ b/machines/bomba/services/fail2ban.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ ... }:
 {
   services.fail2ban = {
     enable = true;
@@ -9,26 +9,5 @@
       multipliers = "1 2 4 8 16 32 64";
       overalljails = true;
     };
-    jails = {
-      caddy-filter.settings = {
-        enabled = true;
-        port = "http,https";
-	action = "iptables-multiport";
-        filter = "caddy-filter";
-        logpath = "/var/log/caddy/*.log";
-        maxretry = 8;
-	backend = "auto";
-      };
-    };
-  };
-
-  environment.etc = {
-    "fail2ban/filter.d/caddy-filter.local".text = lib.mkDefault (
-      lib.mkAfter ''
-        [Definition]
-        failregex = ^\{"level":"info","ts":\d+\.\d+,"logger":"http\.log\.access\.log\d*","msg":"handled request".*"remote_ip":"<HOST>".*"status":4\d{2}.*
-        ignoreregex =
-      ''
-    );
   };
 }