matthew
da7eae3558
- template Repository now ghcr.io/mattjackson/basement:latest - Registry URL and all "basement-ui" descriptive text updated - install.sh chowns /mnt/user/appdata/basement to 65532:65532 so the nonroot distroless image can create its data subpaths
62 lines
4.9 KiB
XML
62 lines
4.9 KiB
XML
<?xml version="1.0"?>
|
|
<!--
|
|
Unraid Community Apps template for basement (Garage admin UI).
|
|
Source of truth: pq/scripts on Gitea (https://git.docker.pq.io/pq/scripts).
|
|
Served via gitea raw URL: https://git.docker.pq.io/pq/scripts/raw/branch/main/unraid-1/basement.template.xml
|
|
|
|
This file is NOT installed directly. install.sh fetches it, substitutes
|
|
__GARAGE_ADMIN_TOKEN__ (shared with the garage container) and
|
|
__BASEMENT_JWT_SECRET__ (generated alongside the garage secrets), and
|
|
writes the result to /boot/config/plugins/dockerMan/templates-user/my-basement.xml.
|
|
|
|
BASEMENT_ADMIN_USER and BASEMENT_ADMIN_PASSWORD_HASH must be set by hand
|
|
in the Unraid UI before Apply — install.sh leaves them blank.
|
|
Generate a bcrypt hash with: `htpasswd -bnBC 12 "" yourpassword | tr -d ':\n'`
|
|
(or use any bcrypt tool; basement expects the standard $2a$/$2b$ format).
|
|
|
|
Caddy on classe reverse-proxies https://basement.pq.io to this container's
|
|
port 8080. DNS for basement.pq.io and the Caddy vhost are managed on classe,
|
|
not here.
|
|
-->
|
|
<Container version="2">
|
|
<Name>basement</Name>
|
|
<Repository>ghcr.io/mattjackson/basement:latest</Repository>
|
|
<Registry>https://github.com/mattjackson/basement</Registry>
|
|
<Network>bridge</Network>
|
|
<MyIP/>
|
|
<Shell>sh</Shell>
|
|
<Privileged>false</Privileged>
|
|
<Support/>
|
|
<Project/>
|
|
<Overview>basement: admin UI for the local garage S3 container. Caddy on classe terminates TLS for basement.pq.io and reverse-proxies to this container's port 8080.</Overview>
|
|
<Category>Network:Web Cloud:</Category>
|
|
<WebUI>http://[IP]:[PORT:8080]/</WebUI>
|
|
<TemplateURL/>
|
|
<Icon>https://garagehq.deuxfleurs.fr/img/logo.svg</Icon>
|
|
<ExtraParams>--restart=unless-stopped --add-host=host.docker.internal:host-gateway --label com.centurylinklabs.watchtower.enable=true</ExtraParams>
|
|
<PostArgs/>
|
|
<CPUset/>
|
|
<DateInstalled/>
|
|
<DonateText/>
|
|
<DonateLink/>
|
|
<Description>
|
|
Admin UI for the garage container running on this host.
|
|
|
|
Reaches garage's admin API at http://host.docker.internal:3903 (the host-gateway alias resolves to unraid-1's docker bridge IP, where the garage container publishes port 3903). The admin token below is shared with the garage container — install.sh pre-fills both.
|
|
|
|
Publicly served at https://basement.pq.io via Caddy on classe (reverse proxy → unraid-1:8080).
|
|
</Description>
|
|
|
|
<Config Name="WebUI" Target="8080" Default="8080" Mode="tcp" Description="HTTP port. Caddy on classe proxies basement.pq.io here." Type="Port" Display="always" Required="true" Mask="false">8080</Config>
|
|
|
|
<Config Name="Data dir" Target="/var/lib/basement" Default="/mnt/user/appdata/basement" Mode="rw" Description="Persistent state (audit log, sessions). basement's default BASEMENT_DATA_DIR; container can't mkdir under / so this mount is required." Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/basement</Config>
|
|
|
|
<Config Name="BASEMENT_DRIVER_GARAGE_ADMIN_URL" Target="BASEMENT_DRIVER_GARAGE_ADMIN_URL" Default="http://host.docker.internal:3903" Mode="" Description="Garage admin API base URL (reaches the sibling garage container via the host-gateway alias). basement namespaces driver-specific config as BASEMENT_DRIVER_GARAGE_*." Type="Variable" Display="always" Required="true" Mask="false">http://host.docker.internal:3903</Config>
|
|
<Config Name="BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN" Target="BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN" Default="" Mode="" Description="Bearer token for Garage admin API. Pre-filled by install.sh (same value as the garage container's GARAGE_ADMIN_TOKEN)." Type="Variable" Display="always" Required="true" Mask="true">__GARAGE_ADMIN_TOKEN__</Config>
|
|
|
|
<Config Name="BASEMENT_DRIVER" Target="BASEMENT_DRIVER" Default="garage" Mode="" Description="Storage backend driver. 'garage' for this deployment." Type="Variable" Display="always" Required="true" Mask="false">garage</Config>
|
|
<Config Name="BASEMENT_ADMIN_USER" Target="BASEMENT_ADMIN_USER" Default="" Mode="" Description="Login username for the basement UI. Pick something; you'll log in with this + the password whose hash goes below. install.sh preserves whatever you set here across re-runs." Type="Variable" Display="always" Required="true" Mask="false">__BASEMENT_ADMIN_USER__</Config>
|
|
<Config Name="BASEMENT_ADMIN_PASSWORD_HASH" Target="BASEMENT_ADMIN_PASSWORD_HASH" Default="" Mode="" Description="Bcrypt hash of the admin password ($2a$/$2b$ format). Generate with: docker run --rm caddy:alpine caddy hash-password --plaintext 'yourpassword'. install.sh preserves whatever you set here across re-runs." Type="Variable" Display="always" Required="true" Mask="true">__BASEMENT_ADMIN_PASSWORD_HASH__</Config>
|
|
<Config Name="BASEMENT_JWT_SECRET" Target="BASEMENT_JWT_SECRET" Default="" Mode="" Description="HMAC secret for signing UI session JWTs. Pre-filled by install.sh from secrets.env (auto-generated, persisted across re-runs)." Type="Variable" Display="always" Required="true" Mask="true">__BASEMENT_JWT_SECRET__</Config>
|
|
</Container>
|