- template Repository now ghcr.io/mattjackson/basement:latest
- Registry URL and all "basement-ui" descriptive text updated
- install.sh chowns /mnt/user/appdata/basement to 65532:65532 so the
nonroot distroless image can create its data subpaths
Re-running install.sh was wiping BASEMENT_ADMIN_USER and _PASSWORD_HASH
back to empty in my-basement.xml — the user then had to re-enter them
in the Unraid UI every time. Annoying.
Template now declares those two fields as __PLACEHOLDER__ tokens.
install.sh, before fetching the new template, sed-extracts whatever's
currently in the existing my-basement.xml and feeds those values back
into the substitution. First-time installs sub to empty (user fills
via UI); subsequent runs preserve what's there.
Bcrypt's $-heavy chars survive sed because `|` is the delimiter and
sed only interprets $ in regex/match, not replacement.
Last config blocker — basement-ui's store.Open() calls MkdirAll on
BASEMENT_DATA_DIR (default /var/lib/basement-ui), which fails inside
the container because / is read-only-ish for the unprivileged user.
Mount /mnt/user/appdata/basement to /var/lib/basement-ui via a Path
Config; install.sh pre-creates the directory (and host-agent's
appdata while we're at it, since we never explicitly created that
either — it had been working by luck).
Source-checked the basement-ui repo for any other "is required" env
vars; ADMIN_USER / ADMIN_PASSWORD_HASH / JWT_SECRET / DRIVER (+ the
two DRIVER_GARAGE_* when DRIVER=garage) are the complete set. After
this, container should reach Up.
basement-ui's config loader namespaces driver-specific settings under
BASEMENT_DRIVER_<DRIVER>_*. With DRIVER=garage, it looks for:
BASEMENT_DRIVER_GARAGE_ADMIN_URL
BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN
not the bare GARAGE_ADMIN_URL / GARAGE_ADMIN_TOKEN we had.
Value still the same (same admin URL, same admin token from secrets.env);
just the Target env var name changes. install.sh's sed substitution of
__GARAGE_ADMIN_TOKEN__ still applies — it's a value placeholder, not the
env var name.
`docker start host-agent` failed on unraid-1 with:
Error response from daemon: path / is mounted on / but it is not a
shared or slave mount
Unraid's root filesystem mount has "private" propagation by default and
rejects rslave from a container's volume spec. The static view of host
mounts (without rslave) is fine for an unraid box where the array is
mounted before host-agent starts — we lose the ability to see *future*
host mounts inside the container, which we never use anyway.
Container stays in Created state until this is fixed: user runs
install.sh + re-Applies my-host-agent template in Unraid UI.
basement-ui as of latest now requires BASEMENT_DRIVER /
BASEMENT_ADMIN_USER / BASEMENT_ADMIN_PASSWORD_HASH / BASEMENT_JWT_SECRET
and refuses to start without them — container was crash-looping.
Template now declares all four:
- DRIVER: defaults to "garage" (this deployment's storage backend).
- JWT_SECRET: install.sh generates a hex string into secrets.env
next to the garage secrets, sed-substitutes into the template.
Backfills existing secrets.env that predates this key.
- ADMIN_USER / ADMIN_PASSWORD_HASH: left blank; user fills via
Unraid UI. bcrypt hash recipe is in both the file header and the
PASSWORD_HASH config description.
basement-ui's placeholder image exits immediately, so the container sits
in a Restarting (0) loop. Watchtower's default filter only checks Up
containers, so basement was being silently skipped every cycle —
`scanned=1` in the running watchtower log was actually garage (pinned,
no update available), not basement.
INCLUDE_STOPPED=true makes watchtower check restart-looping / exited
containers too. REVIVE_STOPPED=true starts them after the update so the
new image actually runs. Once a working basement-ui image is pushed,
this combo will pick it up and the container will stop restart-looping.
matthew