Last config blocker — basement-ui's store.Open() calls MkdirAll on
BASEMENT_DATA_DIR (default /var/lib/basement-ui), which fails inside
the container because / is read-only-ish for the unprivileged user.
Mount /mnt/user/appdata/basement to /var/lib/basement-ui via a Path
Config; install.sh pre-creates the directory (and host-agent's
appdata while we're at it, since we never explicitly created that
either — it had been working by luck).
Source-checked the basement-ui repo for any other "is required" env
vars; ADMIN_USER / ADMIN_PASSWORD_HASH / JWT_SECRET / DRIVER (+ the
two DRIVER_GARAGE_* when DRIVER=garage) are the complete set. After
this, container should reach Up.
basement-ui's config loader namespaces driver-specific settings under
BASEMENT_DRIVER_<DRIVER>_*. With DRIVER=garage, it looks for:
BASEMENT_DRIVER_GARAGE_ADMIN_URL
BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN
not the bare GARAGE_ADMIN_URL / GARAGE_ADMIN_TOKEN we had.
Value still the same (same admin URL, same admin token from secrets.env);
just the Target env var name changes. install.sh's sed substitution of
__GARAGE_ADMIN_TOKEN__ still applies — it's a value placeholder, not the
env var name.
basement-ui as of latest now requires BASEMENT_DRIVER /
BASEMENT_ADMIN_USER / BASEMENT_ADMIN_PASSWORD_HASH / BASEMENT_JWT_SECRET
and refuses to start without them — container was crash-looping.
Template now declares all four:
- DRIVER: defaults to "garage" (this deployment's storage backend).
- JWT_SECRET: install.sh generates a hex string into secrets.env
next to the garage secrets, sed-substitutes into the template.
Backfills existing secrets.env that predates this key.
- ADMIN_USER / ADMIN_PASSWORD_HASH: left blank; user fills via
Unraid UI. bcrypt hash recipe is in both the file header and the
PASSWORD_HASH config description.
matthew