diff --git a/flake.nix b/flake.nix
index 01e0316..307b4a6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -124,6 +124,7 @@
           // (vm_test "deluge" ./test/services/deluge.nix)
           // (vm_test "forgejo" ./test/services/forgejo.nix)
           // (vm_test "grocy" ./test/services/grocy.nix)
+          // (vm_test "hledger" ./test/services/hledger.nix)
           // (vm_test "homeassistant" ./test/services/home-assistant.nix)
           // (vm_test "jellyfin" ./test/services/jellyfin.nix)
           // (vm_test "monitoring" ./test/services/monitoring.nix)
diff --git a/modules/services/hledger.nix b/modules/services/hledger.nix
index 99bbd03..efdd801 100644
--- a/modules/services/hledger.nix
+++ b/modules/services/hledger.nix
@@ -49,15 +49,17 @@ in
     };
 
     authEndpoint = lib.mkOption {
-      type = lib.types.str;
+      type = lib.types.nullOr lib.types.str;
       description = "OIDC endpoint for SSO";
       example = "https://authelia.example.com";
+      default = null;
     };
 
     backup = lib.mkOption {
       description = ''
         Backup configuration.
       '';
+      default = {};
       type = lib.types.submodule {
         options = contracts.backup.mkRequester {
           user = "hledger";
diff --git a/test/services/hledger.nix b/test/services/hledger.nix
new file mode 100644
index 0000000..dfae061
--- /dev/null
+++ b/test/services/hledger.nix
@@ -0,0 +1,114 @@
+{ pkgs, ... }:
+let
+  pkgs' = pkgs;
+
+  testLib = pkgs.callPackage ../common.nix {};
+
+  subdomain = "h";
+  domain = "example.com";
+
+  adminPassword = "AdminPassword";
+
+  commonTestScript = testLib.mkScripts {
+    inherit subdomain domain;
+    hasSSL = { node, ... }: !(isNull node.config.shb.hledger.ssl);
+    waitForServices = { ... }: [
+      "hledger-web.service"
+      "nginx.service"
+    ];
+  };
+
+  base = testLib.base pkgs' [
+    ../../modules/services/hledger.nix
+  ];
+
+  basic = { config, ... }: {
+    shb.hledger = {
+      enable = true;
+      inherit domain subdomain;
+    };
+  };
+
+  https = { config, ... }: {
+    shb.hledger = {
+      ssl = config.shb.certs.certs.selfsigned.n;
+    };
+  };
+
+  sso = { config, ... }: {
+    shb.hledger = {
+      authEndpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";
+    };
+  };
+in
+{
+  basic = pkgs.testers.runNixOSTest {
+    name = "hledger_basic";
+
+    nodes.server = {
+      imports = [
+        base
+        basic
+      ];
+    };
+
+    nodes.client = {};
+
+    testScript = commonTestScript.access;
+  };
+
+  backup = pkgs.testers.runNixOSTest {
+    name = "hledger_backup";
+
+    nodes.server = { config, ... }: {
+      imports = [
+        base
+        basic
+        (testLib.backup config.shb.hledger.backup)
+      ];
+    };
+
+    nodes.client = {};
+
+    testScript = commonTestScript.backup;
+  };
+
+  https = pkgs.testers.runNixOSTest {
+    name = "hledger_https";
+
+    nodes.server = {
+      imports = [
+        base
+        (testLib.certs domain)
+        basic
+        https
+      ];
+    };
+
+    nodes.client = {};
+
+    testScript = commonTestScript.access;
+  };
+
+  sso = pkgs.testers.runNixOSTest {
+    name = "hledger_sso";
+
+    nodes.server = { config, pkgs, ... }: {
+      imports = [
+        base
+        (testLib.certs domain)
+        basic
+        https
+        (testLib.ldap domain pkgs')
+        (testLib.sso domain pkgs' config.shb.certs.certs.selfsigned.n)
+        sso
+      ];
+    };
+
+    nodes.client = {};
+
+    testScript = commonTestScript.access.override {
+      redirectSSO = true;
+    };
+  };
+}