- template Repository now ghcr.io/mattjackson/basement:latest
- Registry URL and all "basement-ui" descriptive text updated
- install.sh chowns /mnt/user/appdata/basement to 65532:65532 so the
nonroot distroless image can create its data subpaths
Re-running install.sh was wiping BASEMENT_ADMIN_USER and _PASSWORD_HASH
back to empty in my-basement.xml — the user then had to re-enter them
in the Unraid UI every time. Annoying.
Template now declares those two fields as __PLACEHOLDER__ tokens.
install.sh, before fetching the new template, sed-extracts whatever's
currently in the existing my-basement.xml and feeds those values back
into the substitution. First-time installs sub to empty (user fills
via UI); subsequent runs preserve what's there.
Bcrypt's $-heavy chars survive sed because `|` is the delimiter and
sed only interprets $ in regex/match, not replacement.
Last config blocker — basement-ui's store.Open() calls MkdirAll on
BASEMENT_DATA_DIR (default /var/lib/basement-ui), which fails inside
the container because / is read-only-ish for the unprivileged user.
Mount /mnt/user/appdata/basement to /var/lib/basement-ui via a Path
Config; install.sh pre-creates the directory (and host-agent's
appdata while we're at it, since we never explicitly created that
either — it had been working by luck).
Source-checked the basement-ui repo for any other "is required" env
vars; ADMIN_USER / ADMIN_PASSWORD_HASH / JWT_SECRET / DRIVER (+ the
two DRIVER_GARAGE_* when DRIVER=garage) are the complete set. After
this, container should reach Up.
basement-ui as of latest now requires BASEMENT_DRIVER /
BASEMENT_ADMIN_USER / BASEMENT_ADMIN_PASSWORD_HASH / BASEMENT_JWT_SECRET
and refuses to start without them — container was crash-looping.
Template now declares all four:
- DRIVER: defaults to "garage" (this deployment's storage backend).
- JWT_SECRET: install.sh generates a hex string into secrets.env
next to the garage secrets, sed-substitutes into the template.
Backfills existing secrets.env that predates this key.
- ADMIN_USER / ADMIN_PASSWORD_HASH: left blank; user fills via
Unraid UI. bcrypt hash recipe is in both the file header and the
PASSWORD_HASH config description.
matthew