From da7eae35588e1367513b13b177b17fffd7ef3a23 Mon Sep 17 00:00:00 2001
From: Matthew Jackson <matthew@pq.io>
Date: Fri, 22 May 2026 16:07:06 -0700
Subject: [PATCH] basement: rename image basement-ui -> basement; chown appdata
 for distroless

- template Repository now ghcr.io/mattjackson/basement:latest
- Registry URL and all "basement-ui" descriptive text updated
- install.sh chowns /mnt/user/appdata/basement to 65532:65532 so the
  nonroot distroless image can create its data subpaths
---
 README.md                      |  2 +-
 unraid-1/basement.template.xml | 14 +++++++-------
 unraid-1/install.sh            |  4 ++++
 3 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 6db64d8..0ed9fd5 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ unraid-1/
   install.sh                     # bootstrap entrypoint
   garage.toml                    # garage S3 config (single-node, lmdb, rf=1)
   garage.template.xml            # unraid CA template — garage container
-  basement.template.xml          # unraid CA template — basement-ui (garage admin UI)
+  basement.template.xml          # unraid CA template — basement (garage admin UI)
   watchtower.template.xml        # unraid CA template — image auto-updater
   host-agent.template.xml        # unraid CA template — per-host metrics + fan ctrl
 ```
diff --git a/unraid-1/basement.template.xml b/unraid-1/basement.template.xml
index 59251e5..1f830e7 100644
--- a/unraid-1/basement.template.xml
+++ b/unraid-1/basement.template.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <!--
-  Unraid Community Apps template for basement-ui (Garage admin UI).
+  Unraid Community Apps template for basement (Garage admin UI).
   Source of truth: pq/scripts on Gitea (https://git.docker.pq.io/pq/scripts).
   Served via gitea raw URL: https://git.docker.pq.io/pq/scripts/raw/branch/main/unraid-1/basement.template.xml
 
@@ -12,7 +12,7 @@
   BASEMENT_ADMIN_USER and BASEMENT_ADMIN_PASSWORD_HASH must be set by hand
   in the Unraid UI before Apply — install.sh leaves them blank.
   Generate a bcrypt hash with: `htpasswd -bnBC 12 "" yourpassword | tr -d ':\n'`
-  (or use any bcrypt tool; basement-ui expects the standard $2a$/$2b$ format).
+  (or use any bcrypt tool; basement expects the standard $2a$/$2b$ format).
 
   Caddy on classe reverse-proxies https://basement.pq.io to this container's
   port 8080. DNS for basement.pq.io and the Caddy vhost are managed on classe,
@@ -20,15 +20,15 @@
 -->
 <Container version="2">
   <Name>basement</Name>
-  <Repository>ghcr.io/mattjackson/basement-ui:latest</Repository>
-  <Registry>https://github.com/mattjackson/basement-ui</Registry>
+  <Repository>ghcr.io/mattjackson/basement:latest</Repository>
+  <Registry>https://github.com/mattjackson/basement</Registry>
   <Network>bridge</Network>
   <MyIP/>
   <Shell>sh</Shell>
   <Privileged>false</Privileged>
   <Support/>
   <Project/>
-  <Overview>basement-ui: admin UI for the local garage S3 container. Caddy on classe terminates TLS for basement.pq.io and reverse-proxies to this container's port 8080.</Overview>
+  <Overview>basement: admin UI for the local garage S3 container. Caddy on classe terminates TLS for basement.pq.io and reverse-proxies to this container's port 8080.</Overview>
   <Category>Network:Web Cloud:</Category>
   <WebUI>http://[IP]:[PORT:8080]/</WebUI>
   <TemplateURL/>
@@ -49,9 +49,9 @@ Publicly served at https://basement.pq.io via Caddy on classe (reverse proxy →
 
   <Config Name="WebUI" Target="8080" Default="8080" Mode="tcp" Description="HTTP port. Caddy on classe proxies basement.pq.io here." Type="Port" Display="always" Required="true" Mask="false">8080</Config>
 
-  <Config Name="Data dir" Target="/var/lib/basement-ui" Default="/mnt/user/appdata/basement" Mode="rw" Description="Persistent state (audit log, sessions). basement-ui's default BASEMENT_DATA_DIR; container can't mkdir under / so this mount is required." Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/basement</Config>
+  <Config Name="Data dir" Target="/var/lib/basement" Default="/mnt/user/appdata/basement" Mode="rw" Description="Persistent state (audit log, sessions). basement's default BASEMENT_DATA_DIR; container can't mkdir under / so this mount is required." Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/basement</Config>
 
-  <Config Name="BASEMENT_DRIVER_GARAGE_ADMIN_URL" Target="BASEMENT_DRIVER_GARAGE_ADMIN_URL" Default="http://host.docker.internal:3903" Mode="" Description="Garage admin API base URL (reaches the sibling garage container via the host-gateway alias). basement-ui namespaces driver-specific config as BASEMENT_DRIVER_GARAGE_*." Type="Variable" Display="always" Required="true" Mask="false">http://host.docker.internal:3903</Config>
+  <Config Name="BASEMENT_DRIVER_GARAGE_ADMIN_URL" Target="BASEMENT_DRIVER_GARAGE_ADMIN_URL" Default="http://host.docker.internal:3903" Mode="" Description="Garage admin API base URL (reaches the sibling garage container via the host-gateway alias). basement namespaces driver-specific config as BASEMENT_DRIVER_GARAGE_*." Type="Variable" Display="always" Required="true" Mask="false">http://host.docker.internal:3903</Config>
   <Config Name="BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN" Target="BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN" Default="" Mode="" Description="Bearer token for Garage admin API. Pre-filled by install.sh (same value as the garage container's GARAGE_ADMIN_TOKEN)." Type="Variable" Display="always" Required="true" Mask="true">__GARAGE_ADMIN_TOKEN__</Config>
 
   <Config Name="BASEMENT_DRIVER" Target="BASEMENT_DRIVER" Default="garage" Mode="" Description="Storage backend driver. 'garage' for this deployment." Type="Variable" Display="always" Required="true" Mask="false">garage</Config>
diff --git a/unraid-1/install.sh b/unraid-1/install.sh
index 6189170..8d21b1b 100755
--- a/unraid-1/install.sh
+++ b/unraid-1/install.sh
@@ -39,6 +39,10 @@ die() { printf "install.sh: %s\n" "$*" >&2; exit 1; }
 [ -d /mnt/user/s3 ]                    || die "share /mnt/user/s3 missing. Create it in unraid UI first (Shares → Add Share → 's3', cache:yes recommended), then re-run."
 
 mkdir -p "$APPDATA/meta" "$DATADIR" "$TEMPLATE_DIR" /mnt/user/appdata/basement /mnt/user/appdata/host-agent
+# basement image is distroless and runs as nonroot UID 65532 — it can't mkdir
+# subpaths under a root-owned bind mount target. host-agent runs as root, so
+# only the basement dir needs this.
+chown 65532:65532 /mnt/user/appdata/basement
 
 # ── garage.toml ──
 if [ -f "$TOML_DEST" ] && [ "${FORCE:-}" != "1" ]; then