matthew
2f3b324518
basement-ui as of latest now requires BASEMENT_DRIVER /
BASEMENT_ADMIN_USER / BASEMENT_ADMIN_PASSWORD_HASH / BASEMENT_JWT_SECRET
and refuses to start without them — container was crash-looping.
Template now declares all four:
- DRIVER: defaults to "garage" (this deployment's storage backend).
- JWT_SECRET: install.sh generates a hex string into secrets.env
next to the garage secrets, sed-substitutes into the template.
Backfills existing secrets.env that predates this key.
- ADMIN_USER / ADMIN_PASSWORD_HASH: left blank; user fills via
Unraid UI. bcrypt hash recipe is in both the file header and the
PASSWORD_HASH config description.
pq/scripts
Public bootstrap scripts. Only public repo on git.docker.pq.io — everything
else is private. This one is public so machines on the internal network
can curl raw URLs anonymously, without embedding tokens.
Distribution is over the LAN (gitea is not internet-reachable); "public" here just means anonymous access from the internal network.
Layout
unraid-1/
install.sh # bootstrap entrypoint
garage.toml # garage S3 config (single-node, lmdb, rf=1)
garage.template.xml # unraid CA template — garage container
basement.template.xml # unraid CA template — basement-ui (garage admin UI)
watchtower.template.xml # unraid CA template — image auto-updater
host-agent.template.xml # unraid CA template — per-host metrics + fan ctrl
Usage
On the unraid-1 console:
bash <(curl -sL https://git.docker.pq.io/pq/scripts/raw/branch/main/unraid-1/install.sh)
The installer is idempotent. Re-run any time to re-fetch templates or pick
up new ones. FORCE=1 rotates garage's secrets.
After install: Unraid UI → Docker → Add Container → Template dropdown →
Apply each of my-garage, my-basement, my-watchtower, my-host-agent.